TW200534653A - Communication system using TCP/IP protocols - Google Patents

Communication system using TCP/IP protocols Download PDF

Info

Publication number
TW200534653A
TW200534653A TW094101663A TW94101663A TW200534653A TW 200534653 A TW200534653 A TW 200534653A TW 094101663 A TW094101663 A TW 094101663A TW 94101663 A TW94101663 A TW 94101663A TW 200534653 A TW200534653 A TW 200534653A
Authority
TW
Taiwan
Prior art keywords
request
communication
server
common key
information
Prior art date
Application number
TW094101663A
Other languages
Chinese (zh)
Inventor
Junji Yoshida
Shinji Hamai
Chiyoko Matsumi
Original Assignee
Matsushita Electric Ind Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Matsushita Electric Ind Co Ltd filed Critical Matsushita Electric Ind Co Ltd
Publication of TW200534653A publication Critical patent/TW200534653A/en

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/09—Mapping addresses
    • H04L61/25—Mapping addresses of the same type
    • H04L61/2503—Translation of Internet protocol [IP] addresses
    • H04L61/2514—Translation of Internet protocol [IP] addresses between local and global IP addresses
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/09—Mapping addresses
    • H04L61/25—Mapping addresses of the same type
    • H04L61/2503—Translation of Internet protocol [IP] addresses
    • H04L61/2521—Translation architectures other than single NAT servers
    • H04L61/2528—Translation at a proxy
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0823—Network architectures or network communication protocols for network security for authentication of entities using certificates
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/083—Network architectures or network communication protocols for network security for authentication of entities using passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/14—Session management
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/2866—Architectures; Arrangements
    • H04L67/30—Profiles
    • H04L67/303—Terminal profiles
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
    • H04L69/30—Definitions, standards or architectural aspects of layered protocol stacks
    • H04L69/32—Architecture of open systems interconnection [OSI] 7-layer type protocol stacks, e.g. the interfaces between the data link level and the physical level
    • H04L69/322—Intralayer communication protocols among peer entities or protocol data unit [PDU] definitions
    • H04L69/329—Intralayer communication protocols among peer entities or protocol data unit [PDU] definitions in the application layer [OSI layer 7]

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Small-Scale Networks (AREA)

Abstract

A server apparatus receives a TCP connection start signal transmitted from a request issuance equipment to establish a TCP connection with the request issuance equipment, receives a connection request signal including an equipment ID of a request acceptance equipment, and an IP address and a port number thereof, searches the equipment ID thereof included in the received connection request signal from an equipment information list, identifies the equipment related to a set of pieces of equipment information including the equipment ID coincident with the equipment ID thereof included in the connection request signal, as the request acceptance equipment, identifies the IP address and the port number included in a set of pieces of equipment information on the identified request acceptance equipment, and transmits a connection request signal including the IP address and the port number included in the received connection request signal.

Description

200534653 九、發明說明： 發明領域 本發明係關於使用傳輪控制協定厂網際網路協定 5 (TCP/IP)之通訊系統。本發明同時也關於（a)—伺服器裝 置，其供使用於連接到一網路，例如，網際網路或其類似 者，之設備間的點對點連接之通訊；（b)—要求發出設備， 其發出連接要求信號；（c)一要求接受設備，其接受連接要 求信號；（d) —伺服器裝置；（e)—通訊系統，其包含該要求 10發出設備和該要求接受設備；以及(f)一通訊方法。本發明 進一步地關於包含該通訊方法中之步驟的程式。 I：先前技術3 發明背景 近年來，因為供用於xDSL、光纖電纜、或其類似者之 15 寬頻環境已被構成，網際網路不僅逐漸地延伸於公司中， 而同時也延伸至一般家庭中。此外，不僅是（a)個人電腦 (PC)，同時(b)AV裝置(例如，電視接收器或DVD記錄器）， (c)空調設備，以及(d)家用電氣裝置（例如，冰箱），也可被 連接到網際網路。於本發明之說明中，被連接到網路（例 20 如，網際網路以及利用其他設備的通訊）之裝置將被稱為 “通訊設備”或“設備”。 為了在住宅或公司中連接區域網路（此後被稱為LAN) 至網際網路，具有網路位址轉化（此後被稱為NAT)功能和網 路位址接埠轉化（此後被稱為NAPT)功能之徑由器裝置一般 5 200534653 被採用。 當通訊在連接到網際網路之設備之間被執行時，唯一 地被配置至各設備之廣域IP位址被使用。但是，廣域IP位 址數目漸減少，因為連接到網際網路之設備數量急速的增 5 加。這導致依據RFC 1918僅唯一地被指定於LAN中之私用 IP位址時常被使用於LAN中而不直接地連接到網際網路。 應注意到，私用IP位址不是唯一地在網際網路上並且不允 許被使用於網際網路上。這導致具有私用IP位址之設備， 如無任何設備支援的話，則不能與連接到網際網路的其他 10 設備通訊。 NAT功能或NAPT功能解決這問題。該NAT或NAPT功 能執行在私用IP位址和廣域IP位址之間的轉化，因而私用IP 位址被配置且被連接到LAN之設備可與連接到網際網路的 其他設備通訊。 15 NAPT功能機構將參考第10至12圖而被說明。 第10圖是展示先前技術通訊系統之網路組態範例的方 塊圖。參看第10圖，具有NAPT功能之要求接受設備13和徑 由器裝置104構成LAN 106，並且在徑由器裝置104之WAN 端接埠，LAN 106被連接至網際網路(WAN)105。伺服器裝 20 置11和要求發出設備12同時也被連接到網際網路 (WAN)105。 為了辨認所謂之網際網路與LAN，此處將以WAN(廣域 網路)代表網際網路。 第11圖展示使用NAPT功能通訊之範例的通訊序列 6 200534653 圖。參看至第11圖，封包21從要求接受設備13被發送至徑 由器裝置104。藉由允許徑由器裝置1〇4在步驟22執行封包 21上之前向路線轉換處理，封包23從徑由器裝置104被發送 至伺服器裝置11。進一步地，封包25從伺服器裝置11被發 5 送至徑由器裝置104。藉由允許徑由器裝置104在步驟S26 執行封包25上之反向路線轉換處理，封包27從徑由器裝置 104被發送至要求接受設備13。 更進一步地，第12圖是一列表，其展示徑由器裝置1〇4 之NAPT列表的範例。這NAPT列表之内容被儲存於包含在 10 徑由器裝置104之列表記憶體中（不被展示）。 如第10圖所展示，假設，廣域IP位址“130.74.23.6，，被配 置在伺服器裝置11，廣域IP位址“202.204· 16.13,，被配置在徑 由器裝置104之WAN端，並且私用IP位址“192.168.1.3”被配 置在要求接受設備13。 15 供使用於網際網路上之通訊的IP封包包含指定來源之 一來源IP位址欄（此後被稱為SA)，以及一指定目的地之目 的地IP位址欄（此後被稱為DA)。此外，當TCP(傳輸控制協 定）或UDP(使用者資料包協定)被使用作為通訊協定時，ιρ 封包同時也包含作為來源接埠號碼之一來源接埠號碼欄 20 (此後被稱為SP)，以及作為目的地接埠號碼之目的地接埠 號碼攔（此後被稱為DP)。 當要求接受設備13執行與伺服器裝置11之TCP通訊 時，要求接受設備13發送封包21，如第11圖之展示，例如， 至徑由器裝置104。封包21包含指定來源之SA位址 7 200534653 “192.168.1.3”且SP為“2_”，並且指定目的地之da為 “130.743.23.6”以及DP為“1200”。 徑由器裝置104在步驟S22執行被接收封包21之前向路 線轉換處理，並且發送該被處理之封包23至封包目的地之 5伺服器裝置11。在步驟S22之前向路線轉換處理時，徑由器 裝置104以徑由器裝置104之WAN端之廣域Ip位址 “202.204.16.13”取代私用 ip位址之sa“192.168_1.3，，，此外， 徑由器裝置104以徑由器裝置14iWAN端的接埠號碼 “3400”取代SP之“2000”。此時，徑由器裝置1〇4儲存一組吓 10 位址“192.168.1.3，，和 “2〇2·204·16·13，，以及接埠號碼 “2〇〇〇” 和“3400”於ΝΑΡΤ表中，如第12圖之展示。 當接收封包23時，伺服器裝置η在步驟S24執行一預定 反應處理，並且隨後，發送封包25至徑由器裝置1〇4當作至 封包23之反應。封包25包含指定來源之SA“130.743.23.6，，和 15 SP“1200”，以及指定目的地之 da“202.204.16.13，，和 DP“3400”。 當接收封包25時，徑由器裝置104查詢ΝΑΡΤ表，在步 驟S26執行封包25之反向路線轉換處理。並且發送被處理之 封包27至要求接受設備13。在步驟S26之反向通道轉換處理 20時’徑由器裝置104首先查詢ΝΑΡΤ列表中da之 “202·204·16·13”和DP“3400”組對。因為這組對出現在其 中’徑由器裝置1〇4以DA‘‘192.168.1.3，，取代DA封包25之 “202.204.16.13”，並且接著，以DP之“2000”取代封包25之 DP的 “3400”。 8 200534653 在通訊時，被儲存於NAPT列表中之資料被保留，並且 在通机結束之後被丢棄。 經由這操作，於LAN上具有私用IP位址之設備可與連 接到網際網路的其他設備通訊。但是，相反地，連接到網 5 際網路之設備不能與於L A N上具有私用IP位址之設備開始 通訊。 為了解決這問題，被稱為“靜態NAPT”之功能被提供。 換言之’靜態NAPT列表預先地被設定於徑由器裝置1〇4 上。靜態NAPT列表内容是相等於第丨2圖展示的那些NAPT 10列表。但是，於這情況中，在設定時，一未被使用的接埠 號碼應該被指定為一 WA N端接埠號碼。靜態N A P T功能之使 用具有下面之有利的影響。例如，當網際網路端之設備發 送一封包至具有一被設定之廣域IP位址和設定之接埠號碼 的徑由器裝置104時，徑由器裝置1〇4以相似於第丨丨圖展示 15 之操作的方式而轉化該IP位址和接埠號碼。接著，封包抵 達具有私用IP位址且被連接到LAN之要求接受設備13。結 果，連接到網際網路之設備可與於LAN上具有私用ip位址 之設備通訊。 順便地，徑由器裝置104之廣域IP位址常不固定。例 20如，當徑由器裝置1〇4使用PPP(點對點協定)被連接到網際 網路服務提供者或IP位址依據DHCP(動態主機組態協定）而 動態地被配置在徑由器裝置104時，每當徑由器裝置1〇4被 連接到網際網路時，則廣域IP位址通常改變。這使得不易 抓牢將被連接設備之廣域IP位址。此外，如果靜態NAPT被 9 200534653 使用，則該設備可存取LAN上之其他設備，即使當於其間 沒有通訊被執行時亦然，並且這導致其安全性不利地被減 低。 為了解決這些問題，一種通訊系統被建議於國際公告 5 WG)-2’__314-A1案中，其是曰本專利序號3445986案之 家族。相同於國際公告所推薦之通訊系統將參考第1〇至13 圖而被說明。 第13圖是第1〇圖展示之通訊系統的通訊序列範例之順 序圖。如第ίο圖所展示，假設一廣域IP位址“8117121〇9，， 10被配置在要求發出設備12。其同時也假設，要求接受設備 13儲存唯一地被配置至設備13之一組設備ID於内部記憶體 中（不被展示）。 要求接受設備13週期性地使用UDP而發送一包含有效 裝載中之設備ID的設備註冊封包31至伺服器裝置u。要求 15接受設備13之私用IP位址“192_168·1·3”的UDP封包被寫入 設備註冊封包31之SA中。當設備註冊封包31通過徑由器裝 置104時，設備註冊封包31之一SA和一仆利用如上所述之 NAPT功能被轉化，並且該被轉化之封包31被發送至伺服器 裝置11。伺服器裝置1丨查詢被接收之設備註冊封包31，並 20且在步驟幻2儲存要求接受設備13之一組設備ID、一廣域IP 位址、以及一接埠號碼。 要求接受設備13週期性地發送設備註冊封包3丨至伺服 菇裝置11。因此，即使徑由器裝置1〇4之廣域IP位址或WAN 端之接埠號碼被改變，被儲存於伺服器裝置丨丨中之要求接 200534653 受設備13的設備ID、一組廣域ip位址、以及接埠號碼仍將 藉由執行步驟S32，相似於步驟S32之步驟S32A，或其類似 者而自動地被更新。 另一方面，當要求發出設備12希望與要求接受設備π 5通訊時，要求發出設備12首先發送一TCP連接開始封包33 至祠服器裝置11，因而與伺服器裝置11建立一TCP連接，並 且發送一具有要求接受設備13(其是連接配對）之設備11}的 連接要求封包34至伺服器裝置η。當接收該連接要求封包 34時，在步驟S35，伺服器裝置11查詢被儲存於内部記憶體 10 (不被展示）中之設備ID列表。如果相同於被包含在連接要求 封包34中設備ID之設備ID的資訊被呈現，則伺服器裝置11 使用UDP發送一連接要求通知封包36至被指示之設備，該 設備是利用相關於這設備ID之IP位址以及接埠號碼被指 示。連接要求通知封包36被發送至徑由器裝置1〇4,而反應 15於設備註冊封包31。因此，IP位址和接埠號碼利用徑由器 裝置104被轉化，因而連接要求通知封包％可抵達要求接受 5又備13。當接收该連接要求通知封包3 6時，要求接受設備 13發送一 TCP連接開始封包37至伺服器裝置u，接著建立 與伺服器裝置11之一 TCP連接。 20 隨後，當要求發出設備12使用開始於TCP連接開始封 包33之TCP連接而發送一命令信號38至伺服器裝置丨1時， 伺服器裝置11可使用開始於TCP連接開始封包37iTcp連 接而轉移命令信號38至要求接受設備13。進一步地，當要 求接受設備13使用開始於TCP連接開始封包372TCp連接 11 200534653 而發送封包至伺服器裝置11時，伺服器裝置u可使用開始 於TCP連接開始封包33之TCP連接而轉移這封包至要求發 出設備12。 以此方式，伺服器裝置U之中繼器可執行在具有廣域 5仆位址且被連接到網際網路之設備的要求發出設備12以及 具有私用IP位址且被連接到L A N之設備的要求接受設備J 3 之間通訊。即使要求發出設備12被呈現在其他的LAN中且 經由徑由器裝置被連接到網際網路，要求發出設備12仍可 利用相同操作而與要求接受設備13通訊。 10 15200534653 IX. Description of the invention: Field of the invention The present invention relates to a communication system using the Internet Protocol 5 (TCP / IP) of the round control protocol plant. The present invention also relates to (a) a server device for use in point-to-point communication between devices connected to a network, such as the Internet or the like; (b)-a request to issue a device, It sends a connection request signal; (c) a request acceptance device that accepts the connection request signal; (d)-a server device; (e)-a communication system including the request 10 issuing device and the request acceptance device; and ( f) a communication method. The invention further relates to a program comprising steps in the communication method. I: Prior Art 3 Background of the Invention In recent years, as a 15-broadband environment for xDSL, fiber-optic cable, or the like has been constructed, the Internet has not only gradually extended to companies, but also to ordinary homes. In addition, not only (a) a personal computer (PC), but also (b) an AV device (for example, a television receiver or a DVD recorder), (c) an air conditioner, and (d) a household electrical device (for example, a refrigerator), Can also be connected to the Internet. In the description of the present invention, a device connected to a network (for example, the Internet and communication using other devices) will be referred to as a "communication device" or "device". In order to connect a local area network (hereinafter referred to as LAN) to the Internet in a house or company, it has a network address translation (hereinafter referred to as NAT) function and a network address port conversion (hereinafter referred to as NAPT ) The function of the diameter of the device is generally 5 200534653. When communication is performed between devices connected to the Internet, a wide-area IP address uniquely assigned to each device is used. However, the number of wide-area IP addresses has gradually decreased, as the number of devices connected to the Internet has increased rapidly. This results in that private IP addresses that are only uniquely assigned to the LAN in accordance with RFC 1918 are often used in the LAN without being directly connected to the Internet. It should be noted that private IP addresses are not unique on the Internet and are not allowed to be used on the Internet. As a result, devices with private IP addresses cannot communicate with other 10 devices connected to the Internet without any device support. The NAT function or NAPT function solves this problem. The NAT or NAPT function performs the conversion between the private IP address and the wide area IP address, so the device with the private IP address configured and connected to the LAN can communicate with other devices connected to the Internet. 15 The NAPT function mechanism will be explained with reference to Figures 10 to 12. Figure 10 is a block diagram showing a network configuration example of a prior art communication system. Referring to FIG. 10, the request receiving device 13 having the NAPT function and the router device 104 constitute a LAN 106, and the LAN 106 is connected to the Internet (WAN) 105 at the WAN terminal port of the router device 104. The server device 11 and the request issuing device 12 are also connected to the Internet (WAN) 105. In order to identify the so-called Internet and LAN, the Internet will be represented by a WAN (Wide Area Network). Figure 11 shows the communication sequence of an example of communication using NAPT function. Referring to Fig. 11, the packet 21 is transmitted from the request receiving device 13 to the router device 104. By allowing the router device 104 to perform route conversion processing before executing the packet 21 on step 22, the packet 23 is transmitted from the router device 104 to the server device 11. Further, the packet 25 is sent from the server device 11 to the router device 104. By allowing the router device 104 to perform the reverse route conversion processing on the packet 25 in step S26, the packet 27 is transmitted from the router device 104 to the request acceptance device 13. Furthermore, FIG. 12 is a list showing an example of the NAPT list of the router device 104. The contents of this NAPT list are stored in the list memory contained in the 10-router device 104 (not shown). As shown in FIG. 10, it is assumed that the wide-area IP address “130.74.23.6” is configured on the server device 11 and the wide-area IP address “202.204 · 16.13” is configured on the WAN side of the router device 104. And the private IP address "192.168.1.3" is configured on the request acceptance device 13. 15 An IP packet for communication on the Internet includes a source IP address field (hereinafter referred to as SA) of a specified source and a destination IP address field (hereinafter referred to as DA) of a specified destination. In addition, when TCP (Transmission Control Protocol) or UDP (User Datagram Protocol) is used as the communication protocol, the ιρ packet also contains a source port number field 20 (hereinafter referred to as SP) as one of the source port numbers. , And the destination port number block (hereafter called DP) as the destination port number. When the receiving device 13 is required to perform TCP communication with the server device 11, the receiving device 13 is required to send a packet 21, as shown in FIG. 11, for example, to the router device 104. Packet 21 contains the SA address of the specified source 7 200534653 "192.168.1.3" and SP is "2_", da of the specified destination is "130.743.23.6" and DP is "1200". The router device 104 performs route conversion processing before the received packet 21 in step S22, and sends the processed packet 23 to the server device 11 of the packet destination. In the route conversion processing before step S22, the router device 104 replaces the private IP address sa "192.168_1.3" with the wide area IP address "202.204.16.13" on the WAN side of the router device 104, In addition, the router device 104 replaces the "2000" of the SP with the port number "3400" of the 14iWAN end of the router device. At this time, the router device 104 stores a set of 10 addresses "192.168.1.3, And "2202 · 204 · 16 · 13", and the port numbers "2OO" and "3400" are shown in the NAPT table, as shown in Fig. 12. When receiving the packet 23, the server device η A predetermined response process is performed in step S24, and then, a packet 25 is sent to the router device 104 as a response to the packet 23. The packet 25 contains SA "130.743.23.6," and 15 SP "1200" of the specified source. , And the designated destination da "202.204.16.13," and DP "3400". When receiving the packet 25, the router device 104 queries the NAPT table, and performs the reverse route conversion processing of the packet 25 in step S26. The processed packet 27 goes to the request receiving device 13. The reverse path is transferred in step S26 When processing 20, the router device 104 first queries the "202 · 204 · 16 · 13" and DP "3400" pairs of da in the NAPT list. Because this pair appears in the router device 104 through DA "192.168.1.3" replaces "202.204.16.13" of DA packet 25, and then replaces "3400" of DP of packet 25 with "2000" of DP. 8 200534653 During communication, it is stored in the NAPT list. The data is retained and discarded after the end of the connection. With this operation, a device with a private IP address on the LAN can communicate with other devices connected to the Internet. However, instead, it is connected to the network 5 Internet devices cannot start communication with devices with private IP addresses on the LAN. In order to solve this problem, a function called "static NAPT" is provided. In other words, the "static NAPT list is set in advance by path" Device 104. The contents of the static NAPT list are equivalent to those of the NAPT 10 list shown in Figure 2. However, in this case, when setting, an unused port number should be designated as a WA N port number. Static NA The use of the PT function has the following beneficial effects. For example, when a device on the Internet side sends a packet to a router device 104 having a set wide-area IP address and a set port number, the routing The device device 104 converts the IP address and port number in a manner similar to the operation shown in FIG. 15. Then, the packet arrives at the request acceptance device 13 having a private IP address and connected to the LAN. As a result, devices connected to the Internet can communicate with devices with private IP addresses on the LAN. By the way, the wide area IP address of the router device 104 is often not fixed. For example, when the router device 104 is connected to an Internet service provider using PPP (point-to-point protocol) or the IP address is dynamically configured on the router device according to DHCP (Dynamic Host Configuration Protocol) At 104 o'clock, whenever the router device 104 is connected to the Internet, the wide-area IP address usually changes. This makes it difficult to grasp the wide-area IP address of the device to be connected. In addition, if static NAPT is used by 9 200534653, the device can access other devices on the LAN, even when no communication is performed in the meantime, and this causes its security to be disadvantageously reduced. In order to solve these problems, a communication system is proposed in International Publication 5 WG) -2 '__ 314-A1, which is a family of Japanese Patent No. 3445986. The same communication system as recommended in the International Announcement will be explained with reference to Figures 10 to 13. Fig. 13 is a sequence diagram of a communication sequence example of the communication system shown in Fig. 10. As shown in the figure, suppose a wide-area IP address "8117121009, 10" is configured in the requesting device 12. It is also assumed that the requesting device 13 stores a group of devices that are uniquely configured to the device 13. The ID is in the internal memory (not shown). The receiving device 13 is required to periodically use UDP to send a device registration packet 31 containing the device ID in the payload to the server device u. Requesting 15 to accept the private use of the device 13 The UDP packet with the IP address "192_168 · 1 · 3" is written into the SA of the device registration packet 31. When the device registration packet 31 passes the router device 104, one of the device registration packet 31 SA and a servant use as above The described NAPT function is transformed, and the transformed packet 31 is sent to the server device 11. The server device 1 inquires the received device registration packet 31, and 20 and stores one of the requested devices 13 in step 2 Group device ID, a wide-area IP address, and a port number. The receiving device 13 is required to periodically send a device registration packet 3 to the servo device 11. Therefore, even the wide-area IP of the router device 104 Address or WAN The port number of the device is changed, and the request for accessing the 200534653 device 13 stored in the server device. The device ID, a set of wide area IP addresses, and the port number will still be executed by step S32, similar to Step S32A of step S32 or the like is automatically updated. On the other hand, when the request issuing device 12 wishes to communicate with the request receiving device π 5, the request issuing device 12 first sends a TCP connection start packet 33 to the temple server. The server device 11 therefore establishes a TCP connection with the server device 11 and sends a connection request packet 34 with the device 11} requesting the receiving device 13 (which is the connection pairing) to the server device n. When receiving the connection request packet At 34 o'clock, in step S35, the server device 11 queries the device ID list stored in the internal memory 10 (not shown). If the same information as the device ID contained in the device ID in the connection request packet 34 is presented, , The server device 11 sends a connection request notification packet 36 to the instructed device using UDP, and the device is instructed by using the IP address and the port number related to the device ID. The connection request notification packet 36 is sent to the router device 104, and the response 15 is the device registration packet 31. Therefore, the IP address and the port number are converted by the router device 104, so the connection request notification packet is% The reachable request accepts 5 and prepares 13. When receiving the connection request notification packet 36, the requesting receiving device 13 sends a TCP connection start packet 37 to the server device u, and then establishes a TCP connection with the server device 11. 20 Subsequently, when the requesting device 12 is requested to send a command signal 38 to the server device using the TCP connection starting with the TCP connection start packet 33, the server device 11 may transfer the command signal using the TCP connection starting packet 37iTcp connection 38 to request to accept equipment 13. Further, when the receiving device 13 is required to send a packet to the server device 11 using the TCP connection start packet 372TCp connection 11 200534653, the server device u may transfer the packet to the server device 11 using the TCP connection starting with the TCP connection start packet 33 Ask for equipment 12. In this way, the repeater of the server device U can execute a request issuing device 12 on a device having a wide area 5 slave address and connected to the Internet, and a device having a private IP address and connected to the LAN The request accepts communication between devices J 3. Even if the request issuing device 12 is presented in another LAN and connected to the Internet via a router device, the request issuing device 12 can still communicate with the request receiving device 13 by the same operation. 10 15

20 更進步地，曰本專利申請公開序號2〇〇3_2〇3〇23案揭 示-資訊處理线，用以在連㈣崎轉之未知設備之 間直接地發送廣域IP位址，其是用以進行輯點之發送。 各具有廣卿位址之客戶_人«_輯點連接而彼 此被連接’因而其他的客戶經由伺服器_客戶肩服器連 接而彼此㈣接。輯點連触雜他㈣得之減廣 域1P位址而被建立。利用部份地改變客戶對伺服器連接: 點對點連接，舰器上之局部的交通集聚可被防止。 、彳一疋，破揭示於國際公告WO-2004-030314_Al案中之 通訊系統具有下面的問題。被揭示於㈣之國際公告案中 的通訊系統總纽由他器裝置u而執行通訊。由:這原 因’當較大容量之資料(如移動影像資料)在該等設備之 =送時’則較大的負載被施加至該器裝置。尤其:， :多數個通訊在相同時間被執行時，該等通訊有時；:被 处理’即使藉由使用多數_服器裝置被分佈處理亦然。 12 200534653 更進纟地，被揭示於日本專利申請公開序號 2003-203023案中之資訊處理系統，僅在具有廣域巧位址的 該等設備之間並且不在具有私用㈣址且被連接到lan的 該等設備之間進行點對點發送。 5 【發明内容】 發明概要 本發明之-目的是提供一伺服器裝置、一要求發出設 備、-要求接受設備、-通訊系統以及一通訊方法，其能 夠解決上述先前技術之問題，而實現在各具有私胺位址 10但是被置放在禁止任何非法存取之不同LAN上的設備之間 的點對點通訊。 本發明另-目的是提供包含通訊方法之步驟的程式。 依據本發明第-論點，揭示一種提供於一通訊系統中 之伺服為裝置。於該通訊系統中，包含一要求發出設備和 15要求接讀之伺服n裝置和多數個設備各被連接到網 路，並且该祠服器裝置可操作以自該要求發出設備轉移該 連接要求信號至要求接受設備。伺服器裝置包含一設備資 成儲存裝置，其可操作以儲存包含供用於該等多數個設備 之各個之一組設備資訊之一設備資訊列表，該組設備資訊 20包含相關於該等多數個設備之各個之一 IP位址和一接埠號 碼，以及該等多數個設備之各個之設備1〇。 忒伺服器裝置可操作以接收一設備註冊信號，後者包 各供用於要求接受設備之一組設備資訊，且其週期性地自 要求接受設備被發送，並且可操作以儲存供用於該要求接 13 200534653 受設備的一組設備資訊，後者包含在該設備資訊儲存裝置 之被接收設備註冊信號中。該伺服器裝置可操作以接收從 該要求發出設備被發送之第一 τ c P連接開始信號而供建立 與該要求發出設備之第一TCP連接。該伺服器裝置可操作 5 以接收第一連接要求信號，後者包含該要求接受設備之設 備ID，以及相關於該要求發出設備之IP位址和接埠號碼， 並且其是使用第一TCP連接自該要求發出設備至該要求接 受設備的要求。該伺服器裝置可操作以自該設備資訊列表 搜尋被包含於被接收之第一連接要求信號中之該要求接受 10 設備的設備ID，辨識關於一組設備資訊，其包含符合於被 包含在第一連接要求信號中之要求接受設備的設備ID之設 備ID，的設備作為該要求接受設備，並且辨識包含於被辨 識要求接受設備之一組設備資訊中之IP位址和接埠號碼作 為該設備資訊列表上相關於該要求接受設備之IP位址和接 15埠號碼。該伺服器裝置可操作以發送包含被包括於該被接 收之第一連接要求信號中且相關於該要求發出設備之正位 址和接埠號碼的第二連接要求信號至該被辨識之要求接受 設備，作為對於該設備註冊信號之反應信號，而以該被辨 識的IP位址和該被辨識的接埠位址被設定作為目的地。 20 於上述之伺服器裝置中，在辨識包含於被辨識要求接 受設備之一組設備資訊中之IP位址和接埠號碼作為相關於 該要求接受設備之IP位址和接埠號碼之後，且在發送第二 連接要求信號至該被辨識之要求接受設備之前，該伺服器 裝置發送第二連接要求信號至該要求接受設備，並且自該 14 200534653 連接要：P連接開始信號作為對於該第三 _=成之反應信號，以建立與該要求接受設備之第 砂、表Ϊ ^輯置獨如制職建立之第二 520 More progressively, the Japanese Patent Application Publication No. 20003_200323 discloses-an information processing line for directly sending a wide-area IP address between unknown devices transferred from Lianyizaki. To send edit points. Each of the customers with Guangqing address is connected to each other ’, so the other customers are connected to each other via the server_customer server. The edit points were created in conjunction with the reduced-area 1P address he won. By partially changing the client-to-server connection: point-to-point connection, local traffic concentration on the ship can be prevented. At first, the communication system disclosed in the international publication WO-2004-030314_Al has the following problems. The communication system master disclosed in the International Proclamation of Yu is used to perform communication by an external device u. Reason: This is because 'when a larger capacity of data (such as moving image data) is sent to these devices', a larger load is applied to the device. In particular :,: When most communications are performed at the same time, such communications are sometimes;: processed 'even if distributed processing is performed by using a majority server device. 12 200534653 Further, the information processing system disclosed in Japanese Patent Application Publication No. 2003-203023 is only between these devices with a wide area smart address and is not a private address and is connected to Point-to-point transmission is performed between these devices of LAN. [Summary of the Invention] SUMMARY OF THE INVENTION The object of the present invention is to provide a server device, a request issuing device, a request receiving device, a communication system, and a communication method, which can solve the above-mentioned problems of the prior art and achieve Point-to-point communication between devices with private amine address 10 but placed on a different LAN that prohibits any illegal access. Another object of the present invention is to provide a program including steps of a communication method. According to the first aspect of the present invention, a servo device provided in a communication system is disclosed. The communication system includes a request-issuing device and 15 request-reading servo devices and a plurality of devices are each connected to the network, and the temple server device is operable to transfer the connection request signal from the request-issuing device. To request acceptance of equipment. The server device includes a device asset storage device operable to store a device information list containing a set of device information for each of the plurality of devices, the set of device information 20 containing information related to the plurality of devices One of each of the IP address and a port number, and each of the plurality of devices 10.忒 The server device is operable to receive a device registration signal, each of which contains a set of device information for requesting the receiving device, and it is sent periodically from the requesting receiving device, and is operable to store the requesting device 13 200534653 A set of device information of the receiving device, which is included in the received device registration signal of the device information storage device. The server device is operable to receive a first τ c P connection start signal sent from the request issuing device for establishing a first TCP connection with the request issuing device. The server device is operable to receive a first connection request signal, which includes the device ID of the request accepting device, and the IP address and port number of the request issuing device, and it uses the first TCP connection from The request sends the device to the request receiving device. The server device is operable to search the device information list for the device ID of the request accepting 10 device included in the received first connection request signal, and to identify a group of device information, including A device ID of the device ID of the request-receiving device in the connection request signal, the device serving as the request-receiving device, and identifying the IP address and port number included in the device information of the identified request-receiving device as the device The information list is related to the IP address and port number of the receiving device. The server device is operable to send a second connection request signal included in the received first connection request signal and related to the positive address and port number of the request issuing device to the identified request acceptance The device, as a response signal to the device registration signal, sets the identified IP address and the identified port address as the destination. 20 In the above server device, after identifying the IP address and port number included in the device information of a group of identified request accepting devices as the IP address and port number related to the request accepting device, and Before sending the second connection request signal to the identified request accepting device, the server device sends a second connection request signal to the request accepting device, and since the 14 200534653 connection request: the P connection start signal is used for the third _ = Successful response signal to establish the second and fifth table with the requirements to accept the equipment

而發运第二連接要求錢至該要求接受設備。 上述之他職置中，該第—連接要求信號進一步 ^供用於該要求接受設備之密碼資訊。該舰器裝置 ^作以增加被包含於第__連接要求信號中之該密碼資訊 連接要求信號，並且發送包含該密碼資訊之第二連 接要求信號。And shipping a second connection requires money to the request accepting device. In the other positions mentioned above, the first connection request signal is further provided for the password information of the request acceptance device. The warship device works to increase the password information connection request signal included in the __ connection request signal, and sends a second connection request signal including the password information.

上述之伺服II裝置進-步地包含第一加密碼通訊裝 以及證明資訊儲存裝置。第_加密碼通訊裝置可操 作以產生供用於通訊之第一共同密鑰以及供用於通訊之第 Π岔鑰，使用供通汛用之該第一共同密鑰以解密碼該 被接收之信號，並且使用供通訊用之該第二共同密鑰而加 岔碼於該被發送之信號。證明資訊儲存裝置可操作以儲存 用以證實該伺服器裝置之有效性的伺服器證明資訊。 該伺服器裝置可操作以在接收第一連接要求信號之前 發送該伺服器證明資訊至該要求發出設備。該伺服器裝置 可操作以使用該第一TCP連接自該要求發出設備而接收因 20反應於該伺服器證明資訊被產生之第一共同密鑰產生資 訊，反應於該第一共同密鑰產生資訊而導致該第一加密碼 通訊裝置產生第二共同密鑰產生資訊，導致該第一加密碼 通訊裝置依據第一共同密鑰產生資訊和第二共同密鑰產生 資訊而產生供用於通訊之第一共同密鑰，使用第一TCP連 15 200534653 接以發送該第二共同密鑰產生資訊至該要求發出設備，並 且導致該要求發出設備依據該第一共同密鑰產生資訊和第 二共同密鑰產生資訊而產生與供通訊用之第一共同密鑰相 同的通訊用之共同密鑰，以與該要求發出設備共用通訊用 5 之第一共同密鑰。該伺服器裝置可操作以使用第一 TCP連 接自該要求發出設備而接收使用供通訊用的第一共同密鍮 被加密碼之第一連接要求信號，並且導致該第一加密碼通 訊裝置使用供通訊用之第一共同密鑰而解密碼該被接收之 第一連接要求信號。在發送第二連接要求信號之前，該伺 10 服器裝置發送該伺服器證明資訊至該要求接受設備。該祠 服器裝置可操作以使用該第二TCP連接自該要求接受設備 而接收因反應於該伺服器證明資訊被產生之第三共同密鍮 產生> ，導致5亥第一加岔碼通訊裝置反應於該第三共同 密鑰產生資訊而產生第四共同密鑰產生資訊，導致該第一 15加密碼通訊裝置依據該第三共同密鑰產生資訊和第四共同 密鑰產生資訊而產生供通訊用之第二共同密鑰，使用第二 TCP連接而發送該第四共同密瑜產生資訊至該要求接受設 備，並且導致該要求接受設備依據該第三共同密输產生資 訊和第四共同密鑰產生資訊而產生與供通訊用之第二共同 20密鍮相同的通訊用之共同密鑰以與該要求接受設備共用通 訊用之第二共同密鍮。在接收第—連接要求信號之後且在 發送第二連接要求信號之前，該伺服器農置導致該第—加 密碼通訊裝置使用供通訊用之第二共同密输而加密碼於第 一連接要求信號。 16 200534653 依據本發明第二論點，揭示一種提供於一通訊系統中 之要求發出設備。於該要求發出設備中，一伺服器裝置以 及包含該要求發出設備和一要求接受設備之多數個設備被 各連接到一網路，並且該要求發出設備可操作以與伺服器 5裝置和要求接受設備通訊。該要求發出設備可操作以發送 弟一 TCP連接開始信號至該伺服器裝置以供建立與該伺服 器裝置之第一 TCP連接。該要求發出設備可操作以使用第 一TCP連接而發送第一連接要求信號至該伺服器裝置，該 第一連接要求信號包含該要求接受設備之一設備ID以及相 10關於該要求發出設備之一 IP位址和一接埠號碼，且該第一 連接要求信號是至該要求接受設備之一要求。在從該要求 接受設備接收供用於要求在該要求發出設備和該要求接受 設備之間的通訊之一通訊要求信號之後，該要求發出設備 反應於該通訊要求信號而接受在該要求發出設備和該要求 15接受設備之間的通訊，並且開始與該要求接受設備之通訊。 於上述之要求發出設備中，該第一連接要求信號進一 步地包含供用於該要求接受設備之密碼資訊。 上述之要求發出設備進一步地包含第二加密碼通訊裝 置，以及第一組證明資訊認證裝置。第二加密碼通訊裝置 20可操作以產生供通訊用之第一共同密鍮，且使用供通訊用 之第一共同密鑰而加密碼於被發送之信號。第一證明資訊 認證裝置可操作以認證用以證實該伺服器裝置之有效性的 伺服器證明資訊。該要求發出設備可操作以在發送第一連 接要求信號之前自該伺服器裝置接收該伺服器證明資訊。 17 200534653 該要求發出設備可操作以藉由該第一證明資訊認證裝置以 認證被接收之伺服器證明資訊並且確認該被接收之伺服器 證明資訊是否有效。當確認該被接收之伺服器證明資訊為 有效時，該要求發出設備導致該第二加密碼通訊裝置產生 5 第一共同密鑰產生資訊，使用第一TCP連接以發送該被產 生之第一共同密鑰產生資訊至該伺服器裝置，使用第一 TCP連接以自該伺服器裝置接收因反應於第一共同密鑰產 生資訊所產生之第二共同密鑰產生資訊，導致該第二加密 碼通訊裝置依據第一共同密鑰產生資訊和第二共同密鎗產 10 生資訊而產生供通訊用之第一共同密鑰，並且導致該伺服 器裝置依據第一共同密输產生資訊和第二共同密鑰產生資 訊而產生與通訊用之第一共同密鑰相同的供通訊用之共同 密錄以與該伺服器裝置共用通訊用之第一共同密鑰。在發 送第一連接要求信號之前，該要求發出設備導致該第二加 15密碼通訊裝置使用通訊用之第一共同密鑰而加密碼於第一 連接要求信號。該要求發出設備可操作以使用第一TCP連 接而發送該被加密碼之第一連接要求信號至該伺服器裝 置。 依據本發明第三論點，揭示一種提供於一通訊系統中 20之要求接受設備。於該通訊系統中，伺服器裝置以及包含 一要求發出設備和該要求接受設備之多數個設備各被連接 到一網路，該要求接受設備可操作以與伺服器裝置和要求 發出設備通訊。該要求接受設備包含一組設備ID儲存裝 置，其可操作以儲存該要求接受設備之設備ID。該要求接 18 200534653 受設備可操作以週期性地發送包含該要求接受設備之設備 ID之設備註冊信號至該伺服器裝置。該要求接受設備可操 作以自該伺服器裝置接收包含相關於該要求發出設備之一 IP位址和一接埠號碼之第二連接要求信號作為對於該設備 5註冊信號的反應信號。該要求接受設備可操作以發送用以 要求在該要求接受設備和該要求發出設備之間的通訊之一 通訊要求信號至利用被包含於該被接收之第二連接要求信 號中的該IP位址和該接埠號碼所代表之該要求發出設備。 在該要求發出設備反應於該通訊要求信號而接受在該要求 10接受設備和該要求發出設備之間的通訊之後，該要求接受 設備開始與該要求發出設備的通訊。 於上述之要求接受設備中，在發送該設備註冊信號至 該伺服器裝置之後且在接收第二連接要求信號之前，該要 求接受設備自該伺服器裝置接收第三連接要求信號作為對 15於該設備註冊信號之反應信號，並且發送第二TCP連接開 始信號至該伺服器裝置作為對於該第三連接要求信號之反 應信號以建立與該伺服器裝置之第二TCP連接。該要求接 受設備可操作以使用該被建立之第二TCP連接而自該伺服 器裝置接收第二連接要求信號。 20 上述之要求接受設備進一步地包含一密碼資訊儲存裝 置’其可操作以儲存供用於該要求接受設備之密碼資訊。 該要求接受設備可操作以使用第二Tcp連接而自該伺服器 裝置接收進一步地包含密碼資訊之第二連接要求信號。該 要求接受設備可操作，而僅當被包含於第二連接要求信號 200534653 中之該密碼資訊與供用於被儲存於該密碼資訊儲存裝置中 之該要求接受設備的該密碼資訊相符時，則發送通訊要求 信號至該要求發出設備。 上述之要求接受設備進一步地包含第三加密碼通訊裝 5置，以及第二證明資訊認證裝置。該第三加密碼通訊裝置 可操作以產生供通訊用之第二共同密鑰，並且使用該通訊 用之第二共同密鑰以解密碼該被接收之信號。第二證明資 訊認證裝置可操作以認證用以證實該伺服器裝置之有效性 的伺服器證明資訊。在接收第二連接要求信號之前，該要 10求接受設備自該伺服器裝置接收該伺服器證明資訊。該要 求接受設備可操作以導致該第二證明資訊認證裝置認證該 被接收之伺服器證明資訊是否為有效以確認該被接收之伺 服器證明資訊是否為有效。當確認該被接收之伺服器證明 資訊為有效時，該要求接受設備導致該第三加密碼通訊裝 15置產生第三共同密鑰產生資訊，使用第二TCP連接以發送 該被產生之第三共同密鑰產生資訊至伺服器裝置，使用第 二TCP連接而自該伺服器裝置接收因反應於該第三共同密 鑰產生資訊被產生之第四共同密鑰產生資訊，導致該第三 加密碼通訊裝置依據第二共同密鑰產生資訊和第四共同密 20 鑰產生資訊而產生通訊用之第二共同密鑰，並且導致該伺 服器裝置依據該第三共同密鍮產生資訊和該第四共同密鍮 產生資訊而產生與通訊用之第二共同密鑰相同的通訊用之 共同密鑰以與該伺服器裝置共用供通訊用之第二共同密 鑰。該要求接受設備可操作以使用該第二TCP連接自該伺 20 200534653 服器裝置接收使用供通訊用之弟~共同密輪而被加密碼之 第二連接要求信號，並且導致該第三加密碼通訊裝置使用 通訊用之第二共同密鑰而解密碼該被接收之第二連接要求 信號。 5 依據本發明第四論點，提供一通訊系統，該系統包含 該祠服器裝置、包含要求發出設備和要求接受設備之多數 個设備。於遠通訊糸統中，該專多數個設備以及該伺服器 裝置各被連接到一網路。 依據本發明第五論點，提供一通訊方法，該方法包含 10多數個步驟，該等步驟利用該伺服器裝置、該要求發出設 備以及該要求接受設備而被執行。 依據本發明第六論點，提供用以導致一電腦進行該通 訊方法之程式。 因此，依據本發明，可實現在該要求發出設備和該要 15求接又5又備之間的點對點通訊，其中該要求發出設備和該 • I求接受設備各具有—㈣1P他，而被置放於具有禁止 任何非法存取之不同的LAN上。進—步地，依據本發明， t含j訊方法之步驟的程式可被提供，而當該程式利用電 ―或:備被β取日夺，允許連接到網際網路之電腦或設備執 20行通訊方法之步驟。 圖式簡單說明 第1圖是依據本發明較佳實施例之通訊系統的 網路組 怨方塊圖； &岐之通訊线中被執行之通訊 21 200534653 序列範例的順序圖； 斤第圖疋展不在第2圖所示之步驟§2〇3中被詳細地處理 之第一連接要求順序的順序圖； 第4圖是風-丄 展不在弟2圖所示之步驟S206中被詳細處理之 5第二連接要求順序的順序圖； 第5圖是證日倾職置51之方塊圖，其龍用於第1圖 展不之要求發出設備102和要求接受設備1〇3的伺服器裝置 101是否為有效； 第6圖是展示被儲存於第1圖所示之徑由器裝置⑺如的 10 内部列表記憶體104am中之NAPT列表範例的列表； 第7A圖是展示第2圖所示之LAN端設備註冊封包2〇1組 態的分解圖； 第7B圖是展示第2圖所示之WAN端設備註冊封包2〇1 組態的分解圖； 15 第7C圖是展不第3圖所不之LAN端連接要求封包217組 ^ 態的分解圖； 第7D圖是展示第3圖所示之WAN端連接要求封包217 組態的分解圖； 第8A圖是展示第2圖所示之LAN端連接要求通知封包 20 205組態的分解圖； 第8B圖是展示第2圖所示之WAN端連接要求通知封包 205組態的分解圖； 第8C圖是展示第4圖所示之LAN端連接要求封包226組 態的分解圖； 22 200534653 第8D圖是展示筮 - 弟4圖所不之WAN端連接要求封包226 組態的分解圖； 第9圖是展示姑#姑 被錯存於苐1圖所示之伺服器裝置101的 列表記憶體10lm中之設備資訊列表範例的列表； 5 第 圖是展 、尤則技術通訊系統之網路組態範例的方 塊圖； 第U圖疋展不使用徑由器裝置之NAPT功能而用於通 訊之通訊序列範例的順序圖； 第12圖疋展不徑由器裝置104之NAPT列表範例的列 10 表；並且 第13圖是展示第1〇圖所示之通訊系統的通訊序列範例 之順序圖。 【實施方式】 執行本發明最佳模式 15 此後將參考第1至9圖而說明本發明較佳實施例。 第1圖疋展示依據本發明較佳實施例之通訊系統網路 組態範例的方塊圖。具有NAPT功能之要求發出設備1〇2和 徑由器裝置104a構成要求·發出-端LAN 106a。要求-發出-端LAN 106a在徑由器裝置l〇4a之WAN端接埠被連接到網 20 際網路(WAN)105。進一步地，具有NAPT功能之要求接受 設備103和徑由器裝置104b構成一要求-接受-端LAN 106b。要求-接受-端LAN 106b在徑由器裝置104b之WAN端 接埠被連接到網際網路(WAN)105。此外，伺服器裝置101 被連接到網際網路(WAN)105 ° 23 200534653 依據本發明較佳實施例之通訊系統包含多數個設備， 例如，要求發出設備102和要求接受設備103，各被連接到 網際網路(WAN)105，並且伺服器裝置101被連接到網際網 路(WAN)105。於該通訊系統中，在該要求-發出-端LAN 5 l〇6a上之要求發出設備102經由伺服器裝置101而轉移一連 接要求信號至要求-接受-端LAN 106b上之要求接受設備 103，並且在要求發出設備1〇2和要求接受設備1〇3之間的通 訊被執行。於這通訊系統中，伺服器裝置101包含儲存設備 資訊列表之設備資訊儲存裝置或設備的列表記憶體1 〇lm， 10 如第9圖之展示，包含在由相關於各設備之一組IP位址和接 埠號碼以及設備之設備ID構成的各設備上之一組設備資 訊。要求接受設備103週期性地發送一包含要求接受設備 103上之一組設備資訊的設備註冊封包2〇1至伺服器裝置 101。於第2圖所展示步驟S202和S202A，伺服器裝置101接 15收該設備註冊封包201，並且儲存被包含於此被接收設備註 冊封包201中要求接受設備丨〇3上之一組設備資訊於該列表 記憶體101m中。當與要求接受設備1〇3通訊時，要求發出設 備102首先執行步驟S203之第一組連接要求序列。在步驟 S203，要求發出設備1〇2發送一TCp連接開始封包211至伺 20 服器裝置1〇1，因而建立與伺服器裝置101之第一組TCP連 接，並且接著，使用第一TCP連接而發送一連接要求封包 217(其包含要求接受設備1〇3之設備ID，以及相關於將被發 送至要求接受設備103之要求發出設備102的IP位址和接埠 號碼）至伺服器裝置101。伺服器裝置101接收連接要求封包 24 200534653 217。在步驟S204，伺服器裝置1〇1從設備資訊列表搜尋被 包含於所接收之連接要求封包217中之要求接受設備1〇3的 a又備ID，辨識關於包含符合於被包含在連接要求封包a? 中之要求接受設備103的設備之一設備仍的一組設備資訊 5之設備作為於設備資訊列表上之要求接受設備103，並且辨 識被包含於相關於被辨識之要求接受設備1〇3的一組設備 資訊中之IP位址和接埠號碼作為相關於該設備資訊列表上 之要求接又设備103的IP位址和接埠號碼。在步驟S2〇5，伺 服器裝置ιοί發送一連接要求封包226至該被辨識之要求接 10文没備103，該連接要求封包226包含相關於要求發出設備 102之IP位址和接埠號碼且被包含於該被接收之連接要求 封包217中，作為對於設備註冊封包2〇1之反應信號而以被 辨識之IP位址和接埠號碼作為目的地。要求接受設備1〇3接 收連接要求封包226。此外，要求接受設備1〇3發送一Tcp 15連接要求封包208至利用被包含於被接收之連接要求封包 226中的IP位址和接埠號碼被表示之要求發出設備1〇2，作 為要求在要求發出設備1〇2和要求接受設備1〇3之間通訊的 通訊要求信號。當要求發出設備102反應於Tcp連接要求封 包208而接受在要求發出設備102和要求接受設備1〇3之間 20的通訊時，用於在要求發出設備102和要求接受設備1〇3之 間的資料通訊之資料通訊序列於步驟S2〇9開始。 於本發明較佳實施例中，伺服器裝置1〇1、要求發出設 備102、以及要求接受設備103可以被構成為藉由用以執行 多數個步驟之電腦可讀程式而操作用於通訊之設備或一般 25 200534653 目的之電腦，其稍後將被說明。 於本發明較佳實施例中，如下所示地被假設，如第i 圖所展示之“130·74·23·6”被配置於伺服器裝置101中作為廣 域1Ρ位址’該伺服器裝置101包含用以儲存其廣域IP位址和 5設備資訊列表之列表記憶體l〇lm。“192.168.1.11”被配置於 要求發出設備102中作為私用IP位址。“ 192·ΐ68·1·3，，被配置 於要求接受設備103中作為私用IP位址。要求發出設備1〇2 包含一列表記憶體l〇2m，其儲存其私用ip位址和接埠號 碼。要求接受設備103包含一列表記憶體i〇3m，其儲存其私 10用IP位址和接埠號碼。“4.17.168.2，，被配置於徑由器裝置 104a中作為廣域IP位址，並且“202.204.16.13”被配置於徑由 器裝置104b中作為廣域ip位址。以相似於第12圖展示之方 式’徑由器裝置104a儲存第6圖之NAPT列表内容（包含其 WAN端之接埠號碼和廣域IP位址、以及要求發出設備丨〇2 15 之私用IP位址和接埠號碼）於其内部列表記憶體104am中。 進一步地，徑由器裝置l〇4b儲存NAPT列表内容（包含其 WAN端之接埠號碼及廣域ip位址，以及要求接受設備1〇3 之私用IP位址和接埠號碼），於内部列表記憶體l〇4bm中。 同時也如下所示地假設。要求發出設備1〇2儲存唯一地 2〇 被配置至設備1〇2之一組設備ID“1051”於其内部列表記憶 體102m中，並且要求接受設備1〇3儲存唯一地被配置至設備 103之一組設備ID“2133”於其内部列表記憶體l〇3m中。該設 備ID是唯一地被指定至本發明較佳實施例執行點對點通訊 之各設備的辨識資訊。例如，被設備製造商配置之一組辨 26 200534653 識數字或MAC位址可被使用作為設備ID。但是，該設備ID 是不只受限於它們。 進一步地假設，要求接受設備103儲存作為秘密資訊之 一組密碼於其内部列表記憶體103m中。如稍後將說明，執 5 行與要求接受設備103之點對點通訊的要求發出設備102需 要預先地取得一密碼和要求接受設備102之設備ID，以及徑 由器裝置104a之廣域IP位址和WAN端之接埠號碼，並且儲 存它們於其内部列表記憶體102m中。 第2至4圖是展示通訊序列範例之順序圖，其被執行於 10 第1圖展示之通訊系統中。第7A至7D圖以及第8A至8D圖展 示供使用於第2至4圖展示之通訊序列中的多數個封包範 例0 要求接受設備103週期性地或在預定週期區間使用 UDP而發送具有被包含於有效裝載中之設備π)的設備註冊 15 封包2〇1至伺服器裝置101。如第7A圖之展示，於要求·接受 -端-LAN 106b上，“192.168.1.3”被寫入至設備註冊封包201 之SA中，並且“2000，，被寫入至設備註冊封包2〇1之SP中。設 備註冊封包201經由徑由器裝置i〇4b被發送至伺服器裝置 101。當設備註冊封包201通過徑由器裝置l〇4b時，徑由器 20裝置104b利用NAPT功能轉化設備註冊封包2〇1上之SA為 202.204.16· 13” ’並且同時也轉化設備註冊封包2〇1上之sp 為“3400”。利用NAPT功能被轉化之設備註冊封包2〇1，如 第7B圖之展示，經由該網際網路(WAN)1〇5被發送至伺服器 裝置101。 27 200534653 饲服器裳置101包含儲存設備資訊列表之列表記憶體 101m’而該列表包含被連接到網際網路(WAN)1〇5之分別的 设備上的一組設備資訊以及構成相關於各設備之ιρ位址和 接埠號碼與各設備之設備ID。伺服器裝置101查詢SA、SP、 5以及被接收之設備註冊封包201的有效裝載，並且接著，在 步驟S202，伺服器裝置1〇1儲存要求接受設備1〇3之一組設 備1D、徑由器裝置104b之廣域IP位址、以及徑由器裝置i〇4b 之WAN端的接埠號碼於被包含在伺服器裝置1〇1之列表記 憶體101m中，作為對應至要求接受設備1〇3的一組設備資訊 10 (亦即，設備資訊列表之項目）。於本發明較佳實施例中，伺 服器裝置101查詢廣域IP位址和徑由器裝置1〇扑之WAN端 的接埠號碼，作為相關於要求接受設備丨⑽之吓位址和接埠 號碼。換言之，當伺服器裝置101發送一封包至要求接受設 備103時，伺服器裝置101查詢包含作為目的地之要求接受 15設備103的要求-接受-端LAN106b之廣域IP位址和WAN端 接埠號碼（因而，徑由器裝置l〇4b之廣域IP位址和WAN端接 埠號碼）。第9圖展示被儲存於包含在伺服器裝置1〇1之列表 記憶體l〇lm中的設備資訊列表範例。 要求接受設備103週期性地發送設備註冊封包2〇1至伺 20服器裝置丨〇丨。由於這，即使徑由器裝置104b之廣域IP位址 或WAN端接埠號碼被改變，伺服器裝置丨〇丨上之設備資訊列 表亦藉由執行步驟S202以及相似於步驟S202之步驟S202A 而自動地被更新。 另一方面，當要求發出設備102希望執行與要求接受設 28 200534653 備103之資料通訊時，在步驟S203於要求發出設備i〇2和伺 服器裝置101之間的第一連接要求序列、利用伺服器裝置 101之步驟S204、封包之發送步驟S205、以及在步驟S206 於伺服器裝置101和要求接受設備103之間的第二連接要求 5序列被執行作為一系列之處理程序，以便從要求發出設備 102發送一連接要求訊息至要求接受設備103，該連接要求 汛息用以通知要求發出設備1〇2希望執行與要求接受設備 103之資料通訊。接著，來自要求發出設備1〇2之連接要求 5孔息利用伺服器裝置被中繼並且從該要求發出設備1〇2 10被轉移至要求接受設備103。要求發出設備102首先執行在 步驟S203於要求發出設備1〇2和伺服器裝置1〇1之間的第一 組連接要求序列，以便發送連接要求訊息至要求接受設備 103 〇 在步驟S203之第一連接要求序列，需要發送秘密資 15訊，例如，要求接受設備1〇3之密碼、要求接受設備103之 設備ID、以及相關於要求發出設備1〇2iIp位址和接埠號 碼。由於這原因，SSL(安全承口層（Secure Socket Layer)) 被使用以加秘密資訊之密碼於本發明較佳實施例中。通常 被使用以加密碼於連接要求封包217之發送的SSL通訊（其 20稍後將被說明），首先參考第3和5圖而被說明。 第5圖是證明授權裝置51之方塊圖，其認證伺服器裝置 101對於要求發出設備1〇2和要求接受設備1〇3是否有效。尤 其疋，第5圖展示用以證實伺服器裝置1〇1之有效性的分配 伺服器證明資料65之方法以及認證方法。於第5圖中，徑由 29 200534653 器裝置104a和104b不被展示，因為它們於認證說明方面不 是必要的。參看第5圖，證明授權裝置51(其中證明授權於 此後被稱為CA)儲存一對内在的CA共用密鑰52和CA密鑰 53於證明授權裝置51之列表記憶體51m中。伺服器裝置101 5 儲存一對内在的伺服器密鑰61和伺服器共用密鑰62以及利 用證明授權裝置51發出之伺服器證明資料65於伺服器裝置 101之列表記憶體l〇lm中。伺服器證明資料65是由證明授權 裝置51產生之伺服器共用密鑰62和簽名64所構成。 為了執行在步驟S203之第一連接要求序列和步驟S206 10 之第二連接要求序列的處理程序，伺服器裝置101首先需要 依據下面說明之處理序列而預先地使證明授權裝置51發出 伺服器證明資料65。 證明授權裝置51包含列表記憶體51m，其預先地儲存 CA共用密鑰52和CA密鍮53組對。伺服器裝置101產生伺服 15器共用密鑰62和伺服器密鑰61組對。伺服器裝置101發送伺 服器裝置101上之伺服器共用密鑰62和資訊至證明授權裝 置51作為伺服器證明資料要求封包63，並且要求該證明授 權裝置51發出伺服器證明資料65。當接收該伺服器證明資 料要求封包63時，證明授權裝置51依據從伺服器裝置1〇1被 20接收之資訊以及其他必須的資訊而使用CA密鑰53以產生 簽名64。接著，證明授權裝置51發出藉由組合從伺服器裝 置101被接收之資訊、其他必須的資訊、以及簽名64而產生 之貝料至伺服器裝置1 〇 1作為伺服器證明資料6 5。因此被發 出之伺服器證明資料65從證明授權裝置5丨被發送至伺服器 3〇 200534653 裝置10H乍為伺服器證明資料發出封包54。伺服器裝置1〇1 儲存該被接收之伺服器證明資料6 5於伺服器震置丨〇丨内部 列表記憶體101m中。 被視為客戶設備之要求發出設備102和要求接受設備 5 103，自證明授權裝置51預先取得CA共用密鑰52，並且儲 存被取得之CA公用密鑰52於它們分別的内部記憶體1〇2m 和103m中。一般，CA公用密鑰52以與證明授權裝置51上之 資訊以及其類似者被組合的CA證明資料封包55形式而被 分配至客戶設備（亦即，與伺服器裝置1〇1通訊的其他設 ίο備）。當從伺服器裝置101經由伺服器證明資料封包214而接 收伺服器證明資料65時，各要求發出設備1〇2和要求接受設 備103允a午被k供於分別的設備1 〇2和1 〇3中之各證明資訊 認證處理部份102c和103c，使用被儲存於各内部列表記憶 體102m和103m中之CA公用密鑰52而認證被包含於伺服器 15證明資料65中之簽名64是否有效。這導致各要求發出設備 102和要求接受設備1〇3可確認在伺服器證明資料65内之伺 服器公用密鑰62是否有效。 具體地’於步驟S203，在要求發出設備1〇2和伺服器裝 置101之間供用於秘密通訊的第一連接要求序列如下所示 20 地被執行。 第3圖是展示在步驟S203之第一連接要求序列的處理 細節之順序圖。第3圖展示使用SSL通訊以發送連接要求封 包217之流程圖。第3圖中，參考符號73指示被使用於秘密 通訊之供用於通訊的共同密鍮。 31 200534653 假設，伺服器裝置101進一步地包含一組加密碼通訊處 理部份l〇le。則該加密碼通訊處理部份i〇ie產生用以加密 碼且解密碼將被發送且被接收信號之供用於通訊的共同密 鍮73和83，使用被產生之通訊用的共同密鑰73而加密碼且 5 解密碼至/自要求發出設備102之被發送和被接收的信號， 並且使用通訊用之共同密鑰83而加密碼且解密碼被發送且 被接收至/自要求接受設備103之信號。同時假設，要求發 0 出設備102進一步地包含加密碼通訊處理部份i〇2e和證明 資訊認證處理部份102c。設備102之加密碼通訊處理部份 10 i〇2e產生通訊用之共同密鑰73以供加密碼且解密碼將被發 送且被接收之信號，並且使用被產生之通訊用的共同密鑰 73以執行將被發送且被接收至/自該伺服器裝置1〇1之信號 的加密碼和解密碼。證明資訊認證處理部份l〇2c認證伺服 器證明資料65是否有效。 15 於SSL通訊中，客戶端之要求發出設備102首先經由徑 φ 由器裝置l〇4a而發送TCP連接開始封包211至伺服器裝置 101，並且這導致要求利用TCP連接與伺服器裝置101之通 訊被開始。第6圖展示被儲存於徑由器裝置104a内部列表記 憶體104am中之NAPT列表的範例。當TCP連接開始封包211 20 通過徑由器裝置l〇4a時，徑由器裝置104a使TCP連接開始封 包211 上之SA從“192.168.1.1Γ，轉化為“4_17.168·2，，，並且同 時也依據ΝΑΡΤ表使用ΝΑΡΤ功能而使TCP連接開始封包 211上之SP從“1500”轉化為“7000”。進一步地，當接收被定 址至要求發出設備102之封包時，徑由器裝置104a執行相對 32 200534653 於上述轉化之轉化至封包上之da以及一不同轉化至封包 上之DP ’並且發送該產生的封包至要求發出設備1〇2。於本The above-mentioned servo II device further includes a first encrypted communication device and a certification information storage device. The first encrypted communication device is operable to generate a first common key for communication and a second key for communication, and uses the first common key for communication to decrypt the received signal, And use the second common key for communication to add a code to the transmitted signal. The certification information storage device is operable to store server certification information for verifying the validity of the server device. The server device is operable to send the server certification information to the request issuing device before receiving the first connection request signal. The server device is operable to use the first TCP connection to receive the first common key generation information generated from the request issuing device in response to the server certification information, in response to the first common key generation information As a result, the first encrypted communication device generates second common key generation information, which causes the first encrypted communication device to generate a first for communication based on the first common key generation information and the second common key generation information. Common key, using the first TCP connection 15 200534653 to send the second common key generation information to the request issuing device, and cause the request issuing device to generate the second common key generation information and the second common key generation information according to the first common key The information generates the same common key for communication as the first common key for communication to share the first common key for communication 5 with the request issuing device. The server device is operable to use the first TCP connection to receive a first connection request signal encrypted from the request issuing device using a first common password for communication, and cause the first encrypted communication device to use the The first common key for communication is used to decrypt the received first connection request signal. Before sending the second connection request signal, the server device sends the server certification information to the request accepting device. The temple server device is operable to use the second TCP connection to receive from the request accepting device a third common key generated due to the server's certification information being generated, resulting in a 5H first fork code communication The device generates fourth common key generation information in response to the third common key generation information, which causes the first 15 plus cryptographic communication device to generate a certificate based on the third common key generation information and the fourth common key generation information. The second common key for communication uses the second TCP connection to send the fourth common secret-generating information to the request receiving device, and causes the request accepting device to generate the information and the fourth common secret according to the third common secret transmission. The key generation information generates the same common key for communication as the second common 20 key for communication to share the second common key for communication with the request receiving device. After receiving the first connection request signal and before sending the second connection request signal, the server farm causes the first encrypted communication device to use a second common secret for communication and add a password to the first connection request signal. . 16 200534653 According to the second aspect of the present invention, a request issuing device provided in a communication system is disclosed. In the request issuing device, a server device and a plurality of devices including the request issuing device and a request receiving device are each connected to a network, and the request issuing device is operable to communicate with the server 5 device and request acceptance Device communication. The request issuing device is operable to send a TCP connection start signal to the server device for establishing a first TCP connection with the server device. The request issuing device is operable to send a first connection request signal to the server device using a first TCP connection, the first connection request signal including a device ID of one of the request accepting devices and one of the phase 10 requesting devices. An IP address and a port number, and the first connection request signal is a request to the request accepting device. After receiving a communication request signal from the request receiving device for requesting one of the communications between the request issuing device and the request receiving device, the request issuing device accepts the request issuing device and the response in response to the communication request signal. Requirement 15 accepts communication between devices and begins communicating with the request-receiving device. In the above-mentioned request issuing device, the first connection request signal further includes password information for use in the request receiving device. The above-mentioned request issuing device further includes a second encrypted communication device and a first group of certification information authentication devices. The second encrypted communication device 20 is operable to generate a first common key for communication, and uses the first common key for communication to encrypt the transmitted signal. First certification information The authentication device is operable to authenticate server certification information used to verify the validity of the server device. The request issuing device is operable to receive the server certification information from the server device before sending the first connection request signal. 17 200534653 The request issuing device is operable to authenticate the received server certification information by the first certification information authentication device and confirm whether the received server certification information is valid. When confirming that the received server certification information is valid, the request issuing device causes the second encrypted communication device to generate 5 first common key generation information, and uses the first TCP connection to send the generated first common The key generation information is sent to the server device, and the first TCP connection is used to receive the second common key generation information generated from the server device in response to the first common key generation information, resulting in the second encrypted communication The device generates the first common key for communication according to the first common key generation information and the second common secret key generation information, and causes the server device to generate the information and the second common secret according to the first common secret input. The key generation information generates the same common secret for communication as the first common key for communication to share the first common key for communication with the server device. Before sending the first connection request signal, the request issuing device causes the second encrypted communication device to use the first common key for communication to add a password to the first connection request signal. The request issuing device is operable to send the encrypted first connection request signal to the server device using the first TCP connection. According to a third aspect of the present invention, a request acceptance device provided in a communication system is disclosed. In the communication system, a server device and a plurality of devices including a request issuing device and the request receiving device are each connected to a network, and the request receiving device is operable to communicate with the server device and the request issuing device. The request acceptance device includes a set of device ID storage means operable to store the device ID of the request acceptance device. The request receiving device is operable to periodically send a device registration signal including the device ID of the request receiving device to the server device. The request accepting device is operable to receive a second connection request signal including an IP address and a port number related to the request issuing device from the server device as a response signal to the device 5 registration signal. The request receiving device is operable to send a communication request signal to request communication between the request receiving device and the request issuing device to use the IP address included in the received second connection request signal. And the request issuing device represented by the port number. After the request issuing device accepts communication between the request receiving device and the request issuing device in response to the communication request signal, the request receiving device starts communication with the request issuing device. In the above request accepting device, after sending the device registration signal to the server device and before receiving the second connection request signal, the request accepting device receives a third connection request signal from the server device as a pair of 15 to the The device registers a response signal of the signal and sends a second TCP connection start signal to the server device as a response signal to the third connection request signal to establish a second TCP connection with the server device. The request acceptance device is operable to receive a second connection request signal from the server device using the established second TCP connection. 20 The above-mentioned request accepting device further includes a password information storage device 'which is operable to store password information for use in the request accepting device. The request accepting device is operable to receive a second connection request signal from the server device further comprising password information using the second Tcp connection. The request accepting device is operable, and is sent only when the password information contained in the second connection request signal 200534653 matches the password information provided for the request accepting device stored in the password information storage device. A communication request signal is sent to the request issuing device. The above-mentioned request acceptance device further includes a third encrypted communication device and a second certification information authentication device. The third encrypted communication device is operable to generate a second common key for communication, and uses the second common key for communication to decrypt the received signal. The second certification information authentication device is operable to authenticate server certification information used to verify the validity of the server device. Before receiving the second connection request signal, the request accepting device receives the server certification information from the server device. The request acceptance device is operable to cause the second certification information authentication device to authenticate whether the received server certification information is valid to confirm whether the received server certification information is valid. When confirming that the received server certification information is valid, the request acceptance device causes the third encrypted communication device to generate third common key generation information, and uses a second TCP connection to send the generated third The common key generation information is sent to the server device, and the second TCP connection is used to receive the fourth common key generation information generated from the server device in response to the third common key generation information, resulting in the third encryption code. The communication device generates the second common key for communication according to the second common key generation information and the fourth common key 20 generation information, and causes the server device to generate the information and the fourth common key according to the third common key. The secret generates information to generate the same common key for communication as the second common key for communication to share the second common key for communication with the server device. The request accepting device is operable to use the second TCP connection to receive a second connection request signal encrypted from the server device by using the second TCP connection. The communication device uses the second common key for communication to decrypt the received second connection request signal. 5 According to the fourth aspect of the present invention, there is provided a communication system including the temple server device, a plurality of devices including a request issuing device and a request receiving device. In the remote communication system, each of the equipment and the server device is connected to a network. According to a fifth aspect of the present invention, a communication method is provided, which includes 10 or more steps, which are performed using the server device, the request issuing device, and the request accepting device. According to a sixth aspect of the present invention, a program for causing a computer to perform the communication method is provided. Therefore, according to the present invention, a point-to-point communication between the request issuing device and the request 15 request and 5 request can be realized, wherein the request issuing device and the request receiving device each have—㈣1P him and are set. Put on a different LAN with any illegal access prohibited. Further, according to the present invention, a program containing the steps of the j-signal method can be provided, and when the program uses electricity-or: it is captured by beta, allowing a computer or device connected to the Internet to execute The steps of the communication method. Brief Description of the Drawings Figure 1 is a block diagram of a network group of a communication system in accordance with a preferred embodiment of the present invention; & Sequence diagram of a communication example executed in the communication line 21 200534653; The sequence diagram of the first connection request sequence that is not processed in detail in step §2 03 shown in Figure 2; Figure 4 is the fifth of the wind-margin not processed in detail in step S206 shown in Figure 2 Sequence diagram of the second connection request sequence; Figure 5 is a block diagram of the Zeniji position 51, which is used for the server device 101 of the request issuing device 102 and the request receiving device 103 in the first picture. Is valid; FIG. 6 is a list showing an example of the NAPT list stored in the 10 internal list memory 104am of the router device shown in FIG. 1; FIG. 7A is a view showing the LAN shown in FIG. 2 Figure 7B is an exploded view of the configuration of the device registration packet 201; Figure 7B is an exploded view showing the configuration of the WAN end device registration packet 201 shown in Figure 2; 15 Figure 7C is not shown in Figure 3 The LAN side connection requires an exploded view of the 217 groups of packets; Figure 7D is shown in Figure 3 An exploded view of the WAN connection request packet 217 configuration; Figure 8A is an exploded view showing the LAN terminal connection request notification packet 20 205 configuration shown in Figure 2; Figure 8B is a WAN end shown in Figure 2 An exploded view of the configuration of the connection request notification packet 205; Figure 8C is an exploded view showing the configuration of the LAN-side connection request packet 226 shown in Figure 4; 22 200534653 Figure 8D is a WAN shown in Figure 4 Exploded view of the configuration of the connection request packet 226; FIG. 9 is a list showing an example of the device information list in the list memory 10lm of the server device 101 shown in FIG. 1; 5 FIG. It is a block diagram of a network configuration example of a communication system, especially a technical communication system; Figure U shows a sequence diagram of a communication sequence example for communication without using the NAPT function of a router device; Figure 12 shows 10 is an example of a NAPT list of the router device 104; and FIG. 13 is a sequence diagram showing an example of a communication sequence of the communication system shown in FIG. [Embodiment] The best mode for carrying out the present invention 15 Hereinafter, a preferred embodiment of the present invention will be described with reference to FIGS. 1 to 9. Fig. 1 is a block diagram showing an example of a network configuration of a communication system according to a preferred embodiment of the present invention. The request issuing device 102 having a NAPT function and the router device 104a constitute a request-emitting LAN 106a. The request-originating-end LAN 106a is connected to the Internet 20 (WAN) 105 at the WAN end port of the router device 104a. Further, the request acceptance device 103 having a NAPT function and the router device 104b constitute a request-receiving-end LAN 106b. The request-accept-side LAN 106b is connected to the Internet (WAN) 105 at the WAN terminal port of the router device 104b. In addition, the server device 101 is connected to the Internet (WAN) 105 ° 23 200534653. The communication system according to the preferred embodiment of the present invention includes a plurality of devices, for example, a request issuing device 102 and a request receiving device 103, each connected to The Internet (WAN) 105, and the server device 101 is connected to the Internet (WAN) 105. In the communication system, the request issuing device 102 on the request-issuing-end LAN 5106a transfers a connection request signal to the request receiving device 103 on the request-receiving-side LAN 106b via the server device 101, And the communication between the request issuing device 102 and the request receiving device 103 is performed. In this communication system, the server device 101 contains a device information storage device or a device list memory 10lm, which stores a device information list. As shown in FIG. 9, it is included in a group of IP bits associated with each device. A set of device information on each device consisting of the address and port number and the device ID of the device. The request accepting device 103 periodically sends a device registration packet 201 containing a set of device information on the request accepting device 103 to the server device 101. In steps S202 and S202A shown in FIG. 2, the server device 101 receives and receives the device registration packet 201, and stores a set of device information contained in the requested device registration packet 201 included in the received device registration packet 201 in the The list memory is 101m. When communicating with the request accepting device 103, the request issuing device 102 first executes the first set of connection request sequences of step S203. In step S203, the issuing device 102 is required to send a TCp connection start packet 211 to the server device 101, so a first TCP connection with the server device 101 is established, and then, using the first TCP connection, A connection request packet 217 (containing the device ID of the request receiving device 103 and the IP address and port number of the request issuing device 102 to be sent to the request receiving device 103) is sent to the server device 101. The server device 101 receives a connection request packet 24 200534653 217. In step S204, the server device 101 searches the device information list for a request ID of the request accepting device 1 03 included in the received connection request packet 217, and identifies whether it contains a packet that meets the request included in the connection request. a? One of the devices in the request acceptance device 103 is still a group of device information 5. The device in the device information list is the request acceptance device 103, and the identification is included in the related request acceptance device 103. The IP address and port number in a group of device information are used as the IP address and port number of the requested device 103 on the device information list. At step S205, the server device ιοί sends a connection request packet 226 to the identified request to receive 10 texts 103, the connection request packet 226 contains the IP address and port number of the request issuing device 102 and It is included in the received connection request packet 217 as a response signal to the device registration packet 201 and the identified IP address and port number as the destination. The request receiving device 103 receives the connection request packet 226. In addition, the request receiving device 10 sends a TCP 15 connection request packet 208 to the request issuing device 10 using the IP address and port number contained in the received connection request packet 226 as a request in A communication request signal is required to be transmitted between the device 102 and the receiving device 103. When the requesting device 102 responds to the Tcp connection request packet 208 and accepts the communication between the requesting device 102 and the requesting device 103, it is used for the communication between the requesting device 102 and the requesting device 103. The data communication sequence of the data communication starts at step S209. In a preferred embodiment of the present invention, the server device 101, the request issuing device 102, and the request receiving device 103 may be configured to operate a device for communication by a computer-readable program for executing a plurality of steps. Or general 25 200534653 purpose computer, which will be explained later. In the preferred embodiment of the present invention, it is assumed as follows, as shown in FIG. I, "130 · 74 · 23 · 6" is configured in the server device 101 as a wide-area IP address' the server The device 101 includes a list memory 10lm for storing its wide area IP address and a list of 5 device information. "192.168.1.11" is configured in the request issuing device 102 as a private IP address. "192 · ΐ68 · 1 · 3, is configured in the request accepting device 103 as a private IP address. The request issuing device 102 contains a list memory 102m, which stores its private IP address and access Port number. The receiving device 103 is required to include a list memory 103m, which stores its private IP address and port number. "4.17.168.2" is configured in the router device 104a as a wide area IP bit. Address, and "202.204.16.13" is configured in the router device 104b as the wide area IP address. In a manner similar to that shown in Figure 12, the router device 104a stores the contents of the NAPT list in Figure 6 (including its WAN port number and wide-area IP address, and the private use of the requesting device) 0215. IP address and port number) in its internal list memory 104am. Further, the router device 104b stores the contents of the NAPT list (including the port number and wide area IP address of its WAN end, and the private IP address and port number of the receiving device 103), and Internal list memory 104bm. It is also assumed as shown below. The requesting device 102 is stored uniquely, and a group of device ID "1051" is allocated to the device 102 in its internal list memory 102m. The receiving device 103 is uniquely allocated to the device 103. One set of device ID "2133" is in its internal list memory 103m. The device ID is identification information uniquely assigned to each device that performs point-to-point communication in the preferred embodiment of the present invention. For example, a group of IDs configured by the device manufacturer can be used as the device ID. However, the device ID is not limited to them. It is further assumed that the receiving device 103 is required to store a set of passwords as secret information in its internal list memory 103m. As will be explained later, the request-issuing device 102 that performs peer-to-peer communication with the request-receiving device 103 needs to obtain a password and the device ID of the request-receiving device 102 in advance, and the wide-area IP address of the router 104a and Port numbers on the WAN side and store them in its internal list memory 102m. Figures 2 to 4 are sequence diagrams showing examples of communication sequences, which are implemented in the communication system shown in Figure 1 to Figure 10. Figures 7A to 7D and Figures 8A to 8D show examples of most packets used in the communication sequence shown in Figures 2 to 4. 0 The receiving device 103 is required to send UDP periodically or at a predetermined period. Register 15 packets 201 to the server device 101 at the device in the payload π). As shown in FIG. 7A, on the request-receiving-end-LAN 106b, "192.168.1.3" is written into the SA of the device registration packet 201, and "2000" is written into the device registration packet 201 In the SP. The device registration packet 201 is transmitted to the server device 101 via the router device 104b. When the device registration packet 201 passes through the router device 104b, the router 20 device 104b uses the NAPT function to convert the device The SA on the registered packet 201 is 202.204.16 · 13 "and the sp on the device registered packet 201 is also converted to" 3400 ". The device registration packet 201 converted using the NAPT function is transmitted to the server device 101 via the Internet (WAN) 105 as shown in FIG. 7B. 27 200534653 The feeder 101 contains a list of memory 101m 'that stores a list of device information and the list contains a set of device information on the respective devices connected to the Internet (WAN) 105 and its composition is related to The ιρ address and port number of each device and the device ID of each device. The server device 101 inquires the payload of SA, SP, 5 and the received device registration packet 201, and then, in step S202, the server device 101 stores a group of devices 1D, which are required to receive the device 103. The wide-area IP address of the server device 104b and the port number of the WAN end of the router device 104b are included in the list memory 101m of the server device 101, which corresponds to the request acceptance device 103. A set of device information 10 (i.e., items of the device information list). In the preferred embodiment of the present invention, the server device 101 inquires the wide area IP address and the port number of the WAN end of the router device 10, as the scarce address and the port number related to the request receiving device. . In other words, when the server device 101 sends a packet to the request-receiving device 103, the server device 101 queries the wide-area IP address and the WAN end port of the request-receiving 15 device 103 including the request-receiving device 103 as the destination. Number (thus, the wide area IP address and WAN end port number of the router device 104b). FIG. 9 shows an example of the device information list stored in the list memory 10lm included in the server device 101. The receiving device 103 is required to periodically send a device registration packet 201 to the server device 丨 〇 丨. Because of this, even if the wide area IP address or WAN end port number of the router device 104b is changed, the device information list on the server device 丨 〇 丨 is performed by executing step S202 and step S202A similar to step S202. Updated automatically. On the other hand, when the request issuing device 102 wishes to perform data communication with the request receiving device 28 200534653 device 103, in step S203, the first connection request sequence between the request issuing device 102 and the server device 101, using the servo Step S204 of the server device 101, step S205 of sending the packet, and the second connection request 5 sequence between the server device 101 and the request receiving device 103 in step S206 is performed as a series of processing procedures to issue the device from the request 102 sends a connection request message to the request accepting device 103, and the connection request flood information is used to notify the request issuing device 102 that it wishes to perform data communication with the request accepting device 103. Next, the connection request 5 from the request issuing device 102 is relayed by the server device and transferred from the request issuing device 102 to the request receiving device 103. The request issuing device 102 first executes the first set of connection request sequences between the request issuing device 102 and the server device 101 at step S203, so as to send a connection request message to the request receiving device 103. At the first step of step S203, The connection request sequence requires the sending of secret information, such as the password of the receiving device 103, the device ID of the receiving device 103, and the 102iIP address and port number of the requesting device. For this reason, SSL (Secure Socket Layer) is used to add secret information to the cipher in the preferred embodiment of the present invention. The SSL communication (20 which will be described later) which is usually used to encrypt the connection request packet 217 is explained first with reference to FIGS. 3 and 5. Fig. 5 is a block diagram of the certification authority 51. The authentication server 101 is valid for the request issuing device 102 and the request receiving device 103. In particular, FIG. 5 shows a method of allocating server certification data 65 and a method of authentication for verifying the validity of the server device 101. In Figure 5, the actuators 104a and 104b are not shown because they are not necessary for certification purposes. Referring to Fig. 5, the certificate authority 51 (where the certificate authority is hereinafter referred to as a CA) stores a pair of an internal CA common key 52 and a CA key 53 in a list memory 51m of the certificate authority 51. The server device 101 5 stores a pair of the internal server key 61 and the server shared key 62 and the server certification data 65 issued by the certificate authorization device 51 in the list memory 10lm of the server device 101. The server certification data 65 is composed of a server common key 62 and a signature 64 generated by the certification authority 51. In order to execute the processing procedures of the first connection request sequence in step S203 and the second connection request sequence in step S206 10, the server device 101 first needs to cause the certificate authorization device 51 to issue server certification data in advance according to the processing sequence described below. 65. The certificate authority 51 includes a list memory 51m, which stores a pair of the CA common key 52 and the CA secret 53 in advance. The server device 101 generates a pair of a server common key 62 and a server key 61. The server device 101 sends the server common key 62 and information on the server device 101 to the certification authority device 51 as a server certification data request packet 63, and requests the certification authority device 51 to issue the server certification data 65. When receiving the server certificate data request packet 63, the certificate authority device 51 uses the CA key 53 to generate a signature 64 based on the information received from the server device 101 and 20 and other necessary information. Next, the certification authority 51 issues the server device 101 as the server certification data 65 by combining the information received from the server device 101, other necessary information, and the signature 64 to the server device 101. Therefore, the issued server certification data 65 is sent from the certification authority device 5 丨 to the server 30 200534653 The device 10H sends a packet 54 for the server certification data. The server device 101 stores the received server certification data 6 5 in the server shock store 丨 〇 丨 internal list memory 101m. The request issuing device 102 and the request receiving device 5 103 which are regarded as client devices, obtain the CA common key 52 in advance from the certificate authority 51, and store the obtained CA public key 52 in their respective internal memory 102m And 103m. Generally, the CA public key 52 is distributed to the client device in the form of a CA certification data packet 55 combined with the information on the certification authority device 51 and the like (ie, other devices that communicate with the server device 101). ίο 备). When the server certification data 65 is received from the server device 101 via the server certification data packet 214, each of the request issuing device 102 and the request receiving device 103 is allowed to be supplied to the respective devices 102 and 10 respectively. Each of the certification information authentication processing sections 102c and 103c in 3 uses the CA public key 52 stored in each of the internal list memories 102m and 103m to authenticate whether the signature 64 included in the certification data 65 of the server 15 is valid . This results in each request issuing device 102 and request receiving device 103 confirming whether the server public key 62 in the server certificate 65 is valid. Specifically, at step S203, a first connection request sequence for secret communication between the request issuing device 102 and the server device 101 is performed as shown below. Fig. 3 is a sequence diagram showing details of processing of the first connection request sequence in step S203. Figure 3 shows a flowchart of using SSL communication to send a connection request packet 217. In Fig. 3, reference numeral 73 indicates a common secret used for secret communication for communication. 31 200534653 It is assumed that the server device 101 further includes a set of encrypted communication processing sections 101e. Then, the encrypted communication processing part i0ie generates common keys 73 and 83 for encrypting and decrypting signals that will be sent and received signals for communication, and uses the generated common key 73 for communication. Encrypt and 5 decrypt the password to / from the device 102 to send and receive the signal, and use the common key 83 for communication to encrypt and decrypt and send the password to the receiving device 103 signal. At the same time, it is assumed that the request issuing device 102 further includes a encrypted communication processing section 102 and a certification information authentication processing section 102c. The encrypted communication processing part 10 of the device 102 generates a common key 73 for communication for the purpose of encrypting and deciphering signals that will be sent and received, and uses the generated common key 73 for communication to Encryption and decryption of signals to be sent and received to / from the server device 101 is performed. The certification information authentication processing section 102c authenticates the server certification data 65 as valid. 15 In SSL communication, the client's request issuing device 102 first sends a TCP connection start packet 211 to the server device 101 via the diameter device 104a, and this results in a request for communication with the server device 101 using a TCP connection Was started. Fig. 6 shows an example of a NAPT list stored in the internal list memory 104am of the router device 104a. When the TCP connection start packet 211 20 passes through the router device 104a, the router device 104a converts the SA on the TCP connection start packet 211 from "192.168.1.1Γ" to "4_17.168 · 2", and At the same time, the NAPT function is used according to the NAPT table to make the SP on the TCP connection start packet 211 change from "1500" to "7000". Further, when receiving a packet addressed to the requesting sending device 102, the router device 104a performs a relative conversion of 32 200534653 to the da on the packet and a different DP to the packet and sends the generated The packet is sent to the requesting device 102. Uben

發明之說明中’為簡潔說明起見，徑由器裝置l〇4a之NAPT 處理操作將不再被說明。但是，實際上，當要求發出設備 5 102希望發送或接收一封包至/自伺服器裝置1〇1或網際網 路(WAN)105上之其他設備時，設備1〇2總是經由徑由器裝 置104a發送且接收該封包，並且徑由器裝置104a執行封包 的NAPT處理。 接著，要求發出設備1〇2和伺服器裝置1〇1執行加密碼 1〇規格協商步驟，因而相互地檢查於秘密通訊中被採用之加 密碼機構規格。要求發出設備1〇2首先使用藉*TCp連接開 始啟動封包211被建立之TCP連接而發送一組加密碼通訊 開始要求封包（此後被稱為客戶-問候封包)212至伺服器裝 置101。加密碼通訊開始要求封包212包含一種可用的SSL 15版本、一種可用的加密碼機構列表、一種會期ID、以及其 類似者，並且同時也包含藉由要求發出設備1〇2所產生之一 組隨機數目ClientHello.random。當接收加密碼通訊開始要 求封包212且允許通訊開始時，伺服器裝置1〇1使用以Tcp 連接開始啟動封包211被建立之TCP連接而發送一組加密 20碼通訊開始反應封包(被稱為“伺服器問候封包，，)213至要求 發出設備102。加密碼通訊開始反應封包213包含將被使用 之SSL版本(在被要求發出設備1〇2和伺服器裝置1〇1所支援 間的那些最新版本）、-會期ID、-將被使用之加密碼機 構、以及其類似者，並且同時也包含利用伺服器裝置ι〇ι以 33 200534653 相似於該隨機數目“ClientHello.random”之方式而被產生之 一組隨機數目“ServerHello.random，，。在步驟S203之下面第 一連接要求序列中，利用加密碼通訊開始啟動反應封包213 被指定之SSL版本以及加密碼機構被使用。隨機數目 5 “ClientHello.random”和 “ServerHello.random”藉由要求發出 設備102和伺服器裝置1〇ι彼此獨立地被產生，而分別地作 為32-位元時間戳記和28位元組隨機數目（或一充分安全地 假性隨機數目）。分別地包含隨機數目ClientHello.random “及’’ServerHello.random之加密碼通訊開始要求封包212和 10 加密碼通訊開始反應封包213被發送，而不需任何加密碼。 接著，伺服器裝置101發送一伺服器證明資料封包214 至要求發出設備102，至要求發出設備102之伺服器證明資 料封包214的發送不總是在加密碼通訊開始反應封包213的 發送之後。只要伺服器證明資料封包214在用於要求-發出 15 設備·端通訊之共用密鑰產生資訊封包215的接收之前被發 送，其稍後將被說明，則封包214可能以任何時序（例如， 在步驟S203的第一連接要求序列之前)被發送。要求發出設 備102之證明資訊認證處理部份i〇2c使用被儲存於設備102 中之CA公用密鑰52而確認被包含於被發送之伺服器證明 20資料封包214中之伺服器證明資料65是否為有效，如先前所 述地。 當藉由證明資訊認證處理部份l〇2c以確認被包含於被 發送之伺服器證明資料封包214中的伺服器證明資料65為 有效時，則要求發出設備102開始一共同密鑰產生資訊交換 34 200534653 步驟，其包含用於要求-發出設備-端通訊之共同密鑰產生資 訊71以及用於飼服器、裝置-端通訊之共同密錄產生資訊72 的發送和接收。 在共同欲鑰產生資訊交換步驟，要求發出設備102首先 5利用設備102之加密碼通訊處理部份職而產生用於要求· 發出設備-端通訊之共同密鑰產生資訊71。此外，要求發出 設備102使用藉由Tcp連接開始封包211被建立iTcp連接 而發送用於要求-發出設備_端通訊之共同密鑰產生資訊封 包215至伺服器裝置1〇1，而該共同密鑰產生資訊封包215則 1〇包含這用以要求-發出設備-端通訊而被產生之共同密鑰產 生資訊71。反應於供用於要求·發出設備_端通訊而被發送之 共同密鑰產生資訊封包215，伺服器裝置1〇1藉由裝置101之 加密碼通訊處理部份l〇le而產生用於伺服器-裝置·端通訊 之共同密鑰產生資訊72。此外，伺服器裝置101使用藉由 15 TCP連接開始封包211被建立之TCP連接而發送用於伺服器 -裝置端通訊之共同密鍮產生資訊封包216至要求發出設備 102 ’該共同密餘產生資訊封包216則包含這用於伺服器_裝 置-端通訊而被產生之共同密鑰產生資訊72。該要求發出設 備102和伺服器裝置101分別地依據共同密鑰產生資訊71和 2〇 72而利用它們的加密碼通訊處理部份102e和101e以產生用 於通訊之相同共同密鑰73。這導致在要求發出設備1〇2和伺 月艮器裝置101之間可能共用通訊用之共同密鑰73。 共同密鑰產生資訊交換之較佳實施例依據供SSL密鑰 交換使用之加密碼機構而改變。當一RSA加密碼機構被使 35 200534653 用時，要求發出设備1 之加岔碼通訊處理部份102e產生， 一組被稱為“預主密（PMS)’’之48位元組隨機數碼，作為供用 於要求-發出設備-端通訊之共同密鑰產生資訊71，並且使用 被包含於伺服器證明資料65中之伺服器共用密鑰62以加密 5碼該被產生之PMS。接著要求發出設備1〇2使用藉由TCP連 接開始封包211而被建立之TCP連接以發送該被加密碼之 PMS至伺服器裝置1〇1。伺服器裝置101導致加密碼通訊處 理部份101e使用伺服器裝置101擁有之伺服器密鑰61，以解 碼被接收而同時也被加密碼之PMS，因而取得該被發送之 10 PMS。伺服器-裝置-端通訊之共同密鑰產生資訊72的產生及 發送不被進行。伺服器裝置101和要求發出設備102使用 PMS而產生通訊用之共同密鑰73，如稍後將被說明，因而 在它們之間共用該密鑰。 如果Diffie-Hellman加密碼機構被使用，要求發出設備 15 1〇2和伺服器裝置1〇1斷定關於二個參數（亦即，一質數“p” 和該質數“P”的原始根“g”)之協定以預先地在它們之間共用 一Diffie_Hellman密鑰。在接收該伺服器證明資料封包214 之後，要求發出設備102產生一隨機數“a，，，計算關於模數“p” 之最小的正餘數ga，作為用於要求_發出設備_端通訊之共同 20雄鍮產生> 5凡71 ’並且發送包含用於要求-發出設備-端通訊 之共同密鑰產生資訊71而供用於要求_發出設備-端通訊之 共同密鍮產生資訊封包215至伺服器裝置1〇1。祠服器裝置 101產生一隨機數“b”，計算關於模數“p”之最小的正餘數 g作為ί、用於伺服器·裝置·端通訊之共同密鑰產生資訊 36 200534653 72,並且發送包含用於伺服器_裝置_端通訊之共同密鑰產生 資訊72而供用於伺服器_裝置-端通訊之共同密鑰產生資訊 封包216至要求發出設備1〇2。因此，因而彼此相互地被發 送之共同密鑰產生資訊的片段被使用作為Diffie_Hellman* 5用密鑰。更進一步地，當共同密鑰產生資訊71和72之片段 分別地被發送時，要求發出設備1〇2和伺服器裝置1〇1之簽 名可以被添加。 如果一種Diffie-Hellman加密碼機構之一固定的 Diffie-Hellman加密碼機構被使用，被包含於伺服器證明資 10 料65中之數值被使用作為來自伺服器裝置1〇1之資訊。因 此，供用於伺服器-裝置-端通訊之共同密鑰產生資訊72的產 生和發送不被進行。 如上所述，當共同密鑰產生資訊71和72之片段在要求 發出設備102和伺服器裝置101之間被交換時，被使用作為 15 稍後通訊之密鑰之通訊用的共同密鑰73首先使用這些共同 密鑰產生資訊71和72片段被產生。為了產生供通訊用之共 同密鑰73，PMS依據相互地被交換之共同密鑰產生資訊71 和72而被產生。於RSA加密碼機構情況中，PMS是如上所 述之供用於要求-發出設備-端通訊的共同密鑰產生資訊 20 71。於Diffie-Hellman加密碼機構之情況中，該PMS是使用 裝置101和設備102兩者之Diffie-Hellman共用密鑰被產生。 換言之，伺服器裝置1〇1計算對於模數“P”之最小的正餘數 做為該PMS，其是利用相乘該被接收之對於模數“P”之#的 最小正餘數與第b次方而被得到之數值。要求發出設備102 37 200534653 計算對於模數“p”之最小的正餘數做為該PMS，其是利用相 乘該被接收之關於模數“P”的最小正餘數gb與第&次方而被 得到之數值。如果Diffie-Hellman加密碼機構被使用，則利 用各要求發出設備102和伺服器裝置101被計算之該Pms是 5 等於關於模數“p”之最小的正餘數gab。 為了從PMS產生通訊用之共同密鑰73，下面的計算使 用一組MD5(说息摘要5)和SHA(秘密混雜演算法）之混雜演 算法被進行。In the description of the invention ', for the sake of brevity, the NAPT processing operation of the router device 104a will not be explained again. However, in reality, when the requesting device 5 102 wants to send or receive a packet to / from the server device 101 or other device on the Internet (WAN) 105, the device 102 always passes the router The device 104a sends and receives the packet, and the device 104a performs NAPT processing of the packet. Next, the issuing device 102 and the server device 101 are required to perform the encryption 10 specification negotiation step, and thus mutually check the specifications of the encryption mechanism used in the secret communication. It is required that the sending device 102 first sends a set of encrypted communication using the TCP connection established by the * TCp connection to start the start packet 211 to start a request packet (hereinafter referred to as a client-greeting packet) 212 to the server device 101. Encrypted communication begins requesting that the packet 212 contains an available SSL 15 version, a list of available encryption organizations, a session ID, and the like, and also a group generated by requesting device 102 Random number ClientHello.random. When receiving the encrypted communication start request packet 212 and allowing the communication to start, the server device 101 sends a set of encrypted 20-code communication start response packets using a TCP connection established with a Tcp connection start start packet 211 (known as " The server hello packet, 213), to the requesting device 102. The encrypted communication starts to respond. The packet 213 contains the SSL version to be used (the latest between those requested to send out the device 102 and the server device 101). Version),-session ID,-cryptographic mechanism to be used, and the like, and also includes the use of a server device ι〇ι in a way similar to the random number "ClientHello.random" 33 200534653 Generate a set of random numbers "ServerHello.random ,." In the first connection request sequence below step S203, the SSL version specified by the response packet 213 and the encryption mechanism are used to start the encryption communication. Random number 5 "ClientHello.random" and "ServerHello.random" are generated independently by requesting the issuing device 102 and the server device 10m as separate 32-bit timestamps and 28-bit random numbers (Or a sufficiently secure pseudo-random number). Encrypted communication including the random numbers ClientHello.random and ServerHello.random respectively requires packets 212 and 10 encrypted communication to start responding to the packet 213 being sent without any encryption. Next, the server device 101 sends a The server certificate data packet 214 to the request issuing device 102 and the server certificate data packet 214 to the request sending device 102 are not always sent after the encrypted communication starts to respond to the sending of the packet 213. As long as the server proves that the data packet 214 is in use Sent before the reception of the request-issued 15 device · end communication common key generation information packet 215, which will be explained later, the packet 214 may be at any timing (for example, before the first connection request sequence of step S203 ) Is sent. The certification information authentication processing part io2c of the device 102 is requested to use the CA public key 52 stored in the device 102 to confirm that the server included in the server certificate 20 data packet 214 is sent Whether the certification data 65 is valid, as described previously. When confirming the certification information processing section 102c to confirm When the server certification data 65 contained in the sent server certification data packet 214 is valid, the requesting device 102 is required to start a common key generation information exchange 34 200534653 step, which includes steps for requesting-issuing device-end communication Sending and receiving of common key generation information 71 and common secret record generation information 72 for feeder and device-end communication. In the common key generation information exchange step, it is required that the issuing device 102 first 5 utilize the addition of the device 102 Cryptographic communication processing part of the job is used to generate request-issued common key generation information for device-end communication 71. In addition, the request-issuing device 102 uses the iTcp connection established by the Tcp connection start packet 211 to send for the request-issue The common key generation information packet 215 of the device-end communication is transmitted to the server device 101, and the common key generation information packet 215 includes the common key generated by the request-issued device-end communication. Generate information 71. The information packet 215 is generated in response to the common key sent for requesting and sending device-end communication, and the server device 101 The common key generation information 72 for server-device · end communication is generated by the encrypted communication processing part 10le of the device 101. In addition, the server device 101 uses a packet 211 that is established through a 15 TCP connection. The TCP connection sends a common secret generated information packet 216 for server-device communication to the requesting device 102 'The common secret generated information packet 216 contains this generated for server_device-end communication Common key generation information 72. The request issuing device 102 and server device 101 use their encrypted communication processing sections 102e and 101e to generate the same for communication based on the common key generation information 71 and 2072, respectively. Common key 73. This results in that the common key 73 for communication may be shared between the request issuing device 102 and the server device 101. The preferred embodiment of the common key generation information exchange varies depending on the encryption mechanism used for the SSL key exchange. When an RSA encryption mechanism is used, 35 200534653 is required to generate a fork code communication processing part 102e of device 1, which is a 48-bit random number called "pre-master secret (PMS)" , As the common key generation information 71 for request-issue device-end communication, and use the server common key 62 included in the server certification data 65 to encrypt the 5-code PMS that should be generated. Then request the issue The device 102 uses a TCP connection established by starting a packet 211 through the TCP connection to send the encrypted PMS to the server device 101. The server device 101 causes the encrypted communication processing section 101e to use the server device The server key 61 owned by 101 is used to decode the PMS that is received and encrypted at the same time, so the 10 PMS that is sent is obtained. The common key generation information 72 of the server-device-end communication is not generated and sent. Is carried out. The server device 101 and the requesting device 102 use PMS to generate a common key 73 for communication, as will be explained later, so the key is shared between them. If Diffie-Hellman adds a cryptographic mechanism To use, it is required that the issuing device 15 102 and the server device 101 determine an agreement on two parameters (ie, a prime number "p" and a primitive root "g" of the prime number "P") in advance in them A Diffie_Hellman key is shared between them. After receiving the server certificate data packet 214, the sending device 102 is required to generate a random number "a," and calculate the smallest positive remainder ga about the modulus "p" as the requirement. _Issuing Device_Communication for Common 20 Generation of Communication> 5 Where 71 'and sending the common key generation information 71 containing the common key used for Request-Issuing-Device-Communication for request_Common Secret鍮 Generate an information packet 215 to the server device 101. The server device 101 generates a random number "b", calculates the smallest positive remainder g about the modulus "p" as ί, and generates common key generation information for server, device, and terminal communication 36 200534653 72, and sends it The common key generation information 72 for server_device_end communication is included and the common key generation information packet 216 for server_device_end communication is sent to the requesting device 102. Therefore, pieces of the common key generation information which are thus transmitted to each other are used as the Diffie_Hellman * 5 key. Further, when fragments of the common key generation information 71 and 72 are transmitted separately, signatures of the requesting device 102 and the server device 101 may be added. If a fixed Diffie-Hellman encryption mechanism, which is one of the Diffie-Hellman encryption mechanisms, is used, the value contained in the server certification data 65 is used as the information from the server device 101. Therefore, the generation and transmission of the common key generation information 72 for server-device-side communication is not performed. As described above, when the pieces of the common key generation information 71 and 72 are exchanged between the request issuing device 102 and the server device 101, the common key 73 used as the communication key for the later communication 73 is first Fragments of information 71 and 72 are generated using these common keys. To generate the common key 73 for communication, the PMS is generated based on the common key generation information 71 and 72 that are exchanged with each other. In the case of the RSA encryption mechanism, the PMS is the common key generation information for request-issue device-side communication as described above. In the case of a Diffie-Hellman encryption mechanism, the PMS is generated using the Diffie-Hellman shared key of both the device 101 and the device 102. In other words, the server device 101 calculates the smallest positive remainder for the modulo "P" as the PMS, which is to multiply the received smallest positive remainder of the # for the modulo "P" by the bth time The value that was obtained. The requesting device 102 37 200534653 calculates the smallest positive remainder for the modulus "p" as the PMS, which is to multiply the received smallest positive remainder gb with respect to the modulus "P" and the & The value obtained. If the Diffie-Hellman encryption mechanism is used, then the Pms calculated using the request issuing device 102 and the server device 101 is 5 equal to the smallest positive remainder gab about the modulus "p". In order to generate a common key 73 for communication from the PMS, the following calculations are performed using a set of MD5 (Interpretation Digest 5) and SHA (Secret Promiscuous Algorithm) hashing algorithms.

Common key master一secret (共同密鑰主—秘密）= 10 MD5(PMS || SHA(6A? || PMS || ClientHello.random 11 ServerHello.random))| |MD5 (PMS 11 SHA(BB? | |PMS ||ClientHello.random||ServerHello.random))||MD5(PMS||SHA(4CCC? I |PMS I |ClientHello.random| I ServerHello.random)) (1) 於方程式（l)中，“ΙΓ代表位元序列之連接。之後，要求 15 發出設備102和伺服器裝置101使用如方程式（1)所表示而被 計算以作為供通訊用之共同密鑰73之共同密鑰“主-秘密” (common key “maste-secret”)而加密碼且解碼連接要求封包 217，並且這導致該秘密通訊可被執行。換言之，當在要求 發出設備102和伺服器裝置101之間供通訊用之共同密鑰73 20 的共用被完成時，要求發出設備102導致設備102之加密碼 通訊部份102e在第一連接要求封包217發送之前使用通訊 用之共同密鑰73將該資料加密碼，其包含連接目標要求接 受設備103之設備ID、要求接受設備103之密碼、以及相關 38 200534653 於要求發出設備102且被使用於通訊之IP位址和接埠數 目。注意到，相關於要求發出設備102之ip位址和接埠數目 是包含要求發出設備102之要求_發出_端1^11^ 1〇6a的廣域 IP位址和WAN端接埠數目，亦即，徑由器裝置1〇4aiWAN 5端廣域IP位址和WAN端接埠數目。要求發出設備1〇2產生連 接要求封包217,其具有包含作為有效裝載之被加密碼的資 料’並且使用藉由TCP連接開始封包211而被建立之TCP連 接以發送該被產生之連接要求封包217至伺服器裝置1〇1。 更明確地說，要求發出設備1〇2發送如第7C圖展示之連接要 10求封包217至徑由器裝置l〇4a。此外，徑由器裝置l〇4a執行 對於該被接收之連接要求封包217的NAPT處理，並且發送 該連接要求封包217(如第7D圖之展示，其已接受該NAPT 處理）至伺服器裝置101。另一方面，伺服器裝置101使用被 建立在伺服器裝置101和要求發出設備102之間的TCP連接 15 而從要求發出設備102接收包含被加密碼之資料作為秘密 資訊的連接要求封包217。反應於封包217之接收，伺服器 裝置101導致伺服器裝置101之加密碼通訊處理部份l〇le使 用通訊用之共用密鑰73以解密碼被加密碼之資料。 當TCP連接開始封包208以及相關於步驟S209之資料 20通訊序列的封包(稍後其將被說明）被發送且被接收時，被寫 入連接要求封包217中之徑由器裝置104a的WAN端廣域IP 位址和WAN端接埠數目被使用。換句話說，要求發出設備 102從要求接受設備103接收TCP連接開始封包208，並且建 立在設備102和1〇3之間的TCP連接。當要求發出設備102使 39 200534653 用被建立之TCP連接以發送且接收相關於步驟S2〇9之資料 通訊序列的封包時（如稍後之說明），徑由器裝置10如之 WAN端廣域IP位址和WAN端接埠數目被寫入因此被發送 且被接收之封包中。其可假設，被寫入封包中之徑由器裝 5置l〇4a的WAN端廣域IP位址和WAN端接埠數目可使用徑由 器裝置104a之NAPT功能而被轉化為要求發出設備丨〇2之私 用IP位址和接埠數目，或反之亦然。 如果要求發出設備102依據接埠數目（例如，“1600”)而 從要求接受設備103接收TCP連接開始封包2〇8，則徑由器 10 裝置104a之NAPT列表是如第6圖之展示。 第6圖展示之NAPT列表第二列，是當要求發出設備1〇2 從要求接受設備103接收TCP連接開始封包208以及在步驟 S209之猶後資料通訊序列的封包時所使用之轉化列表。要 求接受設備103發送具有廣域IP位址“4.17.168.2”和接埠數 15目”5000”之TCP連接開始封包208至徑由器裝置l〇4a，以便 建立TCP連接。接著，被寫入TCP連接開始封包208中之IP 位址和接埠數目利用徑由器裝置l〇4a之NAPT功能而分別 地被轉化為要求發出設備102之私用IP位址以及徑由器裝 置104a之接埠數目。最後，要求接受設備103可建立與要求 20 發出設備102之TCP連接。 當接收連接要求封包217時，伺服器裝置1〇1參考被儲 存於伺服器裝置101内部列表記憶體101m中之設備資訊列 表中的多數組設備資訊，如第9圖之展示，並且在步驟S204 從設備資訊列表中搜尋被包含在被接收之連接要求封包 200534653 217中的要求接受設備103之設備ID“2133”。如果於設備資 訊列表上發現符合“2133”之設備ID，則伺服器裝置101確認 關於包含這設備10“2133”之一設備資訊的設備，作為連接 目標要求接受設備103。此外，伺服器裝置1〇1分別地確認 5 被包含在辨識要求接受設備103上之一設備資訊中的IP位 址和接埠數目，作為相關於要求接受設備103之IP位址和接 埠數目。伺服器裝置101不立即地發送被包含在被接收之連 接要求封包217中且相關於要求發出設備1〇2之IP位址和接 埠數目以及要求接受設備1〇3之密碼，至要求接受設備 10丨〇3 °於這情況中，伺服器裝置1〇1使用具有相關於要求接 受設備103之一 ip位址“2〇2·204_16_13”和接埠數目 “3400”(被包含在相同於設備仍^^，，之設備資訊中）的 UDP作為目的地，而發送連接要求通知封包2〇5。連接要求 通知封包20 5被發送至徑由器裝置丨〇 4 b作為對於設備註冊 15封包201之反應信號。徑由器裝置l〇4b進行IP位址和接埠數 目之轉化，並且包含被轉化之IP位址和接埠數目的封包205 可因此抵達要求接受設備103。如第8A和8B圖所展示，連 接要求通知封包205包含一連接要求通知旗幟，其展示該封 包指示連接要求通知。 20 當接收連接要求通知封包205時，要求接受設備1〇3執 行在要求接受設備1G3和伺服器裝置1G1之間步驟進的第 —連接要求序列。 第4圖是展示在步驟82〇6第二連接要求序 理程序的順序圖。在步驟讓之第二連接要求序列中，以 200534653 相似於步驟S203之第一連接要求序列的方式，必須發送秘 密資訊，例如，要求接受設備103之密碼以及相關於要求發 出設備102之IP位址和接埠數目。由於這理由，SSL被使用 以將本發明較佳實施例中之秘密資訊加密碼。其假設要求 5接受設備1〇3進一步地包含一組加密碼通訊處理部份丨〇3e 和一證明資訊認證處理部份l〇3e。設備1〇3之加密碼通訊處 理部份103e產生供用於通訊之共同密鑰83以供加密碼且解 密碼將被發送且被接收之信號，並且使用被產生之通訊用 的共同密鑰83以執行至/自伺服器裝置101被發送且被接收 10 之信號的加密碼與解密碼。設備1〇3之證明資訊認證處理部 份l〇3e鑑定伺服器證明資料65是否有效。用於在伺服器裝 置101和要求接受設備103之間秘密通訊之步驟S206的第二 連接要求序列如下所示地被執行。 於SSL通訊中，客戶端之要求接受設備1〇3首先經由徑 15由器裝置104b而發送一 TCP連接開始封包221至伺服器裝 置101，因而要求利用TCP連接以開始與伺服器裝置1〇1之 通汎。當TCP連接開始封包221通過徑由器裝置i〇4b時，徑 由器裝置104b使用當設備註冊封包2〇1被發送時所使用之 NAPT功能以轉化在TCP連接開始封包221上之SA和SP。進 20 一步地，當接收被定址至要求接受設備103之封包時，徑由 器裝置104b執行針對在SA上被進行之轉化的一相對轉化， 該轉化在封包上之DA被完成，並且針對在封包上之§〇的一 不同轉化被完成，且該轉化是不同於針對SD而被完成之轉 化’並且接著，發送該形成的封包至要求接受設備103。為 42 200534653 簡化說明起見，於本發明之說明中，徑由器裝置l〇4b之 NAPT處理操作將不再說明。但是，實際上，當要求接受設 備103希望發送或接收一封包時，設備1〇3總是經由徑由器 裝置104b而發送或接收該封包，並且徑由器裝置l〇4b執行 5 關於該封包之NAPT處理。 接著，要求接受設備103和伺服器裝置101執行加密碼 規格協商步驟，因而相互地檢查被採用於秘密通訊中之加 密碼機構規格。要求接受設備103首先使用藉由TCP連接開 始封包221被建立之TCP連接以發送一加密碼通訊開始要 10 求封包（此後被稱為“客戶問候封包(client-hellopacket)”)222 至伺服器裝置101。加密碼通訊開始要求封包222包含一可 用的SSL版本、一可用的加密碼機構列表、一會期115、以及 其類似者，並且同時也包含利用要求接受設備1〇3而被產生 之隨機數ClientHello.random。當從要求接受設備1 〇3接收加 15密碼通訊開始要求封包222時，伺服器裝置101使用藉由 TCP連接開始封包221而被建立之TCp連接以發送一加密碼 通訊開始反應封包（此後被稱為“伺服器問候封包 (Server-helloPacket)”)223至要求接受設備1〇3。加密碼通訊 開始反應封包223包含將被使用之SSL版本(在那些利用要 20求發出設備102和伺服器裝置101所支援之中的最新版 本）、會期ID、以被使用之加密碼機構、以及其類似者，並 且同時也包含利用伺服器裝置101而被產生之一隨機數 “ServerHello.midom”。在下面步驟幻⑽的第二連接要求序 列時，利用加密碼通訊開始反應封包223所指定之SSL版本 43 200534653 和加密碼機構被使用。隨機數“ClientHello.random”以及 “ServerHello.random”彼此獨立地利用要求接受設備103和 伺服器裝置101被產生，而分別地作為一32-位元時間戳記 以及一 2 8位元組之隨機數（或一充分地安全的假性隨機 5 數）。分別地包含隨機數碼“ClientHello.random”以及 “ServerHello.random”之加密碼通訊開始要求封包222和加 密碼通訊開始反應封包223被發送而不需任何之加密碼。 接著伺服器裝置101發送伺服器證明資料封包214至要 求接受設備103。至要求接受設備1〇3之伺服器證明資料封 10包214的發送不必總是在加密碼通訊開始反應封包223發送 之後。只要伺服器證明資料封包214在用於要求-接受設備- 端通訊之共同密鑰產生資訊封包224的接收之前被發送，則 封包214可以在任何時序（例如，在步驟82〇6之第二連接要 求序列之前）被發送。要求接受設備1〇3之證明資訊認證處 15理部份l〇3e以相似於上述提及第5圖實例之要求發出設備 102方式，使用被儲存於設備1〇3中之CA共用密鑰^而確認 被包3於發送伺服器證明資料包214中之飼服器明資料幻 是否為有效。 當利用證明資訊認證處理部份103e確認被包含於被發 20送的飼服器證明資料65為有效時，要求接受設備1〇3開始一 共同密鑰產生資訊交換步驟，其包含供用於要求-接受設備 •端通訊之共同密鍮產生資峨以及供詩魏器-裝置-端 通訊之共用密鍮產生資訊Μ的發送和接收。 在共同密鑰產生資訊交換步财，要求接受設備1〇3 44 200534653 首先利用設備103之加密碼通訊處理部份1 〇3e以產生供用 於要求-接受設備-端通訊之共用密鑰產生資訊81。此外，要 求接受設備103使用藉由TCP連接開始封包221所被建立之 TCP連接而發送供用於要求-接受設備-端通訊之共同密鑰 5 產生資訊封包224至伺服器裝置1〇1，其中封包224包含供用 於要求-接受設備-端通訊之被產生的共同密鑰產生資訊 81。反應供用於要求-接受設備-端通訊之被發送的共同密输 產生資訊封包224，利用伺服器裝置1〇1之加密碼通訊處理 部份101e，伺服器裝置101產生供用於伺服器_裝置_端通訊 10之共同密鑰產生資訊82。此外，伺服器裝置1〇1使用藉由 TCP連接開始封包221被建立之TCP連接而發送供用於词服 器-裝置-端通訊之共同密鑰產生資訊封包225至要求發出設 備102,其中封包225包含供用於伺服器-裝置·端通訊而被產 生之共同密鑰產生資訊82。依據共同密鑰產生資訊81和 15 82，要求發出設備1〇2和伺服器裝置101分別地利用它們的 加密碼通訊處理部份l〇2e和101e而產生通訊用之相同共同 达鑰83。RSA加密碼機構、Diffie-Hellman加密碼機構、或 其類似者被使用，而以相似於步驟S2〇3之第一連接要求序 列方式產生通訊用之共同密鑰83。被產生之共同密鑰產生 20身訊81和82的片段分別地在要求接受設備103和伺服器妒 置1〇1之間被交換。藉由分別地使用共同密鑰產生資訊81和 82的這些片段，要求接受設備1〇3和伺服器裝置1〇1之加密 碼通訊處理部份l〇3e和1〇16產生將被使用作為稍後通訊之 密鑰的通訊用之共同密鑰83。 45 200534653 接著，可能共用供用於在要求接受設備103和伺服器裝 置101之間通訊之共同密鑰83。伺服器裝置1〇1和要求接受 設備103使用該通訊用之共同密鑰83以加密碼且解密碼連 接要求封包226，並且這導致秘密通訊可在它們之間被執 5行。換言之，在第一連接要求封包217的接收之後且在第二 連接要求封包226的發送之前，當在要求接受設備1〇3和伺 服器裝置101之間共用通訊用之共同密鑰83被完成時，伺服 器裝置101導致裝置101之加密碼通訊處理部份1〇4使用通 訊用之共同密鑰83以加密碼包含被包含於連接要求封包 10 217中之要求接受設備103的密碼，以及將被使用於通訊之 徑由器裝置l〇4a的廣域IP位址“4.17.168.2”和接埠數目 “5〇〇〇”。伺服器裝置1〇1產生具有這被包含作為有效裝載之 被加密碼的資料之連接要求封包226，並且使用藉由TCP連 接開始封包221被建立之TCP連接以發送該被產生之連接 15要求封包226至要求接受設備103作為對於設備註冊封包 201之反應信號。更明確地說，使用伺服器裝置1〇1的設備 資訊列表中而在第2圖展示之步驟S204被辨識作為要求接 受設備103之IP位址和接埠數作為目的地，伺服器裝置1〇1 發送第8D圖展示之連接要求封包226至徑由器裝置1〇4b。此 20外’控由器裝置l〇4b執行該被接收之連接要求封包226的 NAPT處理程序，並且發送第gc圖展示之已接受該NAPT處 理的連接要求封包226至要求接受設備103。另一方面，使 用在伺服器裝置101和要求接受設備103之間被建立的TCP 連接’要求接受設備103從伺服器裝置101接收包含作為秘 46 200534653 密資訊之被加密碼的資料之連接要求封包226。反應於封包 226之接收，要求接受設備1〇3導致設備1〇3之加密碼通訊處 理部份103e使用供用於通訊之共同密鑰83以解密碼被加密 碼之資料。以此方式，供通知要求發出設備102要求執行與 5要求接受設備103通訊之資料的連接要求訊息終於從要求 發出設備102被發送至要求接受設備1〇3。 再參看第2圖，要求接受設備103鑑定被包含於連接要 求封包226中之密碼是否與被儲存於要求接受設備1〇3内部 列表記憶體l〇3m中的要求接受設備1〇3密碼相符，並且因 10此，在步驟S207是否為有效。僅當密碼是有效時，要求接 受設備103方發送TCP連接開始封包208至徑由器裝置l〇4a 作為一通訊要求信號，其要求利用被包含於連接要求封包 226中之相關的IP位址“4.17· 168.2”和接埠數目“5000，，之要 求發出設備102的TCP連接而開始在要求發出設備1〇2和要 15求接受設備103之間的通訊。TCP連接開始封包208如上所 述地利用徑由器裝置104a之NAPT功能而抵達要求發出設 備102。要求接受設備103可因此建立與要求發出設備丨〇2之 TCP連接。 在反應於TCP連接開始封包208而要求發出設備丨02接 20受在要求發出設備102和要求接受設備103之間的通訊之 後，要求發出設備102和要求接受設備1〇3可使用藉由TCP 連接開始封包208而被建立之TCP連接以執行步驟S209之 資料通訊序列。 以此方式，藉由使用伺服器裝置101，資料通訊可在要 47 200534653 求發出設備102和要求接受設備i〇3之間被執行，設備i〇2和 設備103分別地各具有私用ip位址且被置放在LAN 106a和 LAN 106b之不同的LAN上。 即使要求發出設備102擁有廣域IP位址且直接地被連 5 接到網際網路(WAN)105，在要求發出設備102和要求接受 設備103之間的通訊可經由上述之相同操作而被執行。進一 步地，即使要求接受設備103擁有廣域IP位址且直接地被連 接到網際網路(WAN)105，在要求發出設備1〇2和要求接受 設備103之間的通訊仍可經由上述之相同操作而被執行。於 10任何情況中，除了控由器裝置不進行IP位址和接埠數目的 轉化之外，上述之相同操作被執行。 於本發明之較佳實施例中，伺服器裝置101、要求發出 没備102、以及要求接受設備1〇3被連接到網際網路 (WAN)105。但是，本發明較佳實施例不受限制於此。伺服 15器裝置101、要求發出設備1〇2、以及要求接受設備103仍可 以被構成而連接到其他的開放網路和專用網路之一或兩 此外，即使各徑由器裝置10知和1〇4b不包含ΝΑρτ功能 而僅包含NAT功能，則在要求發出設備1〇2和要求接受設備 20 103之間的通訊仍可利用如上所述的相同操作而被執行。於 這情況中，徑由器袈置购和10仙各不進行接璋數碼之轉 化。 要求發出設備10 2可以總是保持著如第6圖展示之 NAPT列表㈣設㈣以滅Tcp連㈣始封包細之正位 48 200534653 址和接埠數碼的組合，或當在步驟S2〇3之第一連接要求順 序毛i^TCP連接開始封包211時可以於ΝΑρτ列表中設定這 、、a並且¥ 70成步驟S209之資料通訊序列時則自ΝΑΡΤ列 表€1除這、、且σ。NAPT列表之設定可能使用靜態ΝΑρτ或其 5功能，例如，通用的隨插即用而達成。 更進^地，在步驟S203第一連接要求順序利用TCp 連接開始封包211經由TCP連接而被開始之通訊以及在步 驟S203第一連接要求順序利用Tcp連接開始封包如經由 tcp連接而被開始之通訊可以使用不同於ssl之一加密碼 1〇通訊機構而被建立。另外地，在步驟湖和S206之TCP通 σίΙ加欲碼可以被省略。於後面情況中，在步驟s加，要求 發出設備102可以在發送TCP連接開始爿包211之後很快地 發送連接要求封包217，因而建立Tcp連接。在步驟讓， 祠服器裝置101可以在接收TCP連接開始封包221之後很快 15地發送連接要求封包226。 在步驟S209之資料通訊序列的處理可以使用加密碼連 接機構而被執行，例如，相同於步驟82〇2和82〇6之SSL機 構。此外，在步驟S209之資料發送和接收可以使用其他的 發送協定，例如，UDP，而被執行。 20 第7A至7D以及8A至8D圖展示之設備註冊封包2〇丨、連 接要求封包217、連接要求通知封包2〇5、以及連接要求封 包226僅用於展示目的。其他的欄亦可以另外地被使用或分 別的欄亦可以不同的順序被提供。 第1至9圖所採用之IP位址、接埠數碼、以及設備1〇僅 49 200534653 用於展示目的。它們可能是不同的數值。 如另一較佳實施例，本發明可以被提供作為電腦可讀 取程式，其包含第2至4圖展示的處理之分別步驟。另外地， 本發明可以被提供作為電腦可讀取記錄媒體，其記錄這程 5式。於後面情況中，該程式可利用連接到網際網路之電腦 或設備被讀取，並且被包含於該程式中之步驟利用該電腦 或設備而被執行。接著，該電腦或該設備可依據之前所述 的較佳實施例而如同伺服器裝置1〇1、要求發出設備1〇2、 以及要求接受設備103之所有或其一者操作。記錄程式之記 10錄媒體範例可以包含光學記錄媒體，例如，CD-ROM和 DVD-ROM，磁記錄媒體，例如，軟碟和硬碟，以及半導體 吕己憶體。但疋，δ己錄私式之§己錄媒體的型式是不受限於它 們。此外’該程式可以經由網路，例如，網際網路而被分 佈。 15 如上所述，本發明可提供通訊系統，其能夠容易地實 現在連接到網際網路(WAN)和被置放於不同[αν上的設備 之間的點對點通訊並且禁止非法的存取。 工業應用性 因此，如上面詳細之說明，依據本發明，可實現在各 20具有一私用IP位址但被置放在禁止任何非法存取之不同 LAN上之設備的要求發出設備和要求接受設備之間的點對 點通訊。進/步地，依據本發明，程式可被提供而包含通 訊方法中之步驊以§利用連接到網際網路之電腦或設備 而讀取程式時九許該電腦或設備&行該通訊方法之步驟。 50 200534653 【圖式簡單說明】 第圖疋依據本發明較佳實施例之通訊系統的網路組 悲方塊圖， 第2圖是展示於篦 一 、弟1圖所不之通訊系統中被執行之通訊 5 序列範例的順序圖； 第3圖是展示在第2圖所示之步驟S203中被詳細地處理 之第一連接要求順序的順序圖； 第4圖是絲在第2圖料之步驟S2G6中被詳細處理之 第二連接要求川員序的順序圖； 10 第5圖疋證明授權裝置51之方塊圖，其認證用於第1圖 展不之要求發出設備102和要求接受設備1〇3的伺服器裝置 101是否為有效； 第6圖是展示被儲存於第丨圖所示之徑由器裝置1〇如的 内部列表記憶體104am中之NAPT列表範例的列表； 15 第7A圖是展示第2圖所示之LAN端設備註冊封包2〇1組 態的分解圖； 第7B圖是展示第2圖所示之WAN端設備註冊封包2〇1 組態的分解圖； 第7C圖是展示第3圖所示之LAN端連接要求封包217組 20 態的分解圖； 第7D圖是展示第3圖所示之WAN端連接要求封包217 組態的分解圖； 第8A圖是展示第2圖所示之LAN端連接要求通知封包 205組態的分解圖； 51 200534653 第8B圖是展示第2圖所示之WAN端連接要求通知封包 205組態的分解圖； 第8C圖是展示第4圖所示之LAN端連接要求封包226組 態的分解圖； 5 第8D圖是展示第4圖所示之WAN端連接要求封包226 組態的分解圖； 第9圖是展示被儲存於第1圖所示之伺服器裝置的 列表記憶體l〇lm中之設備資訊列表範例的列表； 第10圖是展示先前技術通訊系統之網路組態範例的方 10 塊圖， 第11圖是展示使賴由H裝置之NAPT功能而用於通 訊之通訊序列範例的順序圖； 第12圖是展示㈣器裝置104之NAPT列錢例的列 表；並且 15 帛13圖是展示第1G圖所示之通訊系統的通訊序列範例Common key master-secret = 10 MD5 (PMS || SHA (6A? || PMS || ClientHello.random 11 ServerHello.random)) | | MD5 (PMS 11 SHA (BB? | | PMS || ClientHello.random || ServerHello.random)) || MD5 (PMS || SHA (4CCC? I | PMS I | ClientHello.random | I ServerHello.random)) (1) In equation (l), " IΓ represents the connection of a bit sequence. Thereafter, the requesting device 15 and the server device 101 are required to use the common key "master-secret" calculated as the common key 73 for communication as represented by equation (1). (common key "maste-secret") while encrypting and decoding the connection requires packet 217, and this results in that secret communication can be performed. In other words, when the request issuing device 102 and the server device 101 have a common secret for communication When the sharing of the key 73 20 is completed, the request to issue the device 102 causes the encrypted communication part 102e of the device 102 to encrypt the data using the common key 73 for communication before sending the first connection request packet 217, which includes the connection target. Device ID of requested device 103, requested device 103 The password, and the related IP address and port number of the requesting device 102 and the number of the IP address and the port number used in the communication are included. _Issue_end 1 ^ 11 ^ 1 06a wide area IP address and WAN end port number, that is, the router device 104aiWAN 5 end wide area IP address and WAN end port number. Request to issue The device 102 generates a connection request packet 217, which contains the encrypted data as a payload, and uses a TCP connection established by starting the packet 211 with the TCP connection to send the generated connection request packet 217 to the server. More specifically, the sending device 10 is required to send a connection request packet 217 to the router device 104a as shown in FIG. 7C. In addition, the router device 104a performs The received connection requires NAPT processing of the packet 217, and sends the connection request packet 217 (as shown in FIG. 7D, which has accepted the NAPT processing) to the server device 101. On the other hand, the server device 101 uses the Built on Servo Device 101 and request issued TCP connection between the device 102 is connected to the secret information as in claim 15 emitted from device 102 receives the encrypted data containing the request packet 217. In response to the receipt of the packet 217, the server device 101 causes the encrypted communication processing part 101 of the server device 101 to use the shared key 73 for communication to decrypt the encrypted data. When the TCP connection start packet 208 and the packet (which will be described later) related to the data 20 communication sequence of step S209 are transmitted and received, the path written in the connection request packet 217 is passed to the WAN end of the router 104a The wide area IP address and the number of WAN end ports are used. In other words, the request issuing device 102 starts packet 208 from the request receiving device 103 to receive the TCP connection, and establishes a TCP connection between the device 102 and 103. When the sending device 102 is requested to use 39 200534653 to use the established TCP connection to send and receive packets related to the data communication sequence of step S209 (as explained later), the router device 10 has the wide area of the WAN side. The IP address and the number of WAN end ports are written into the packets that are therefore sent and received. It can be assumed that the WAN end wide-area IP address and the number of WAN end ports that are written into the packet can be converted to a request-issuing device using the NAPT function of the router device 104a.丨 〇2 the private IP address and the number of ports, or vice versa. If the requesting device 102 starts to receive packets 208 from the request receiving device 103 according to the number of ports (for example, "1600"), the NAPT list of the router 10 and the device 104a is as shown in FIG. 6. The second column of the NAPT list shown in FIG. 6 is the conversion list used when the requesting device 102 receives the TCP connection start packet 208 from the request receiving device 103 and the packet of the subsequent data communication sequence in step S209. The receiving device 103 is required to send a TCP connection start packet 208 with a wide area IP address "4.17.168.2" and a port number of 15 "5000" to the router device 104a in order to establish a TCP connection. Then, the IP address and the number of ports written in the TCP connection start packet 208 are converted into the private IP address and the router of the requesting device 102 using the NAPT function of the router device 104a, respectively. Number of ports on device 104a. Finally, the request receiving device 103 can establish a TCP connection with the request 20 sending device 102. When receiving the connection request packet 217, the server device 101 refers to the multi-array device information stored in the device information list stored in the internal list memory 101m of the server device 101, as shown in FIG. 9, and in step S204 From the device information list, search for the device ID “2133” of the request accepting device 103 included in the received connection request packet 200534653 217. If a device ID corresponding to "2133" is found on the device information list, the server device 101 confirms that the device 103 including the device information of one of the devices "2133" is requested as the connection target. In addition, the server device 101 confirms 5 that the IP address and the number of ports included in one of the device information on the identification request accepting device 103 are respectively related to the IP address and the number of ports of the request accepting device 103. . The server device 101 does not immediately transmit the IP address and the number of ports included in the received connection request packet 217 and the request issuing device 102 and the request receiving device 103 password to the request receiving device 10 丨 〇3 ° In this case, the server device 101 uses an IP address "2202 · 204_16_13" which has one of the relevant receiving device 103 requirements and the port number "3400" (included in the same device ^^ ,, in the device information) UDP as the destination, and send a connection request notification packet 205. The connection request notification packet 20 5 is sent to the router device 4b as a response signal to the device registration 15 packet 201. The router device 104b performs the conversion of the IP address and the number of ports, and the packet 205 containing the converted IP address and the number of ports can thus reach the request acceptance device 103. As shown in Figures 8A and 8B, the connection request notification packet 205 contains a connection request notification flag that displays the packet indicating the connection request notification. 20 When receiving the connection request notification packet 205, the request receiving device 103 executes the first connection request sequence stepped between the request receiving device 1G3 and the server device 1G1. Figure 4 is a sequence diagram showing the second connection request procedure at step 8206. In the second connection request sequence of the step, in a manner similar to the first connection request sequence of step S203 in 200534653, secret information must be sent, for example, the password of the requesting device 103 and the IP address of the requesting device 102 And the number of ports. For this reason, SSL is used to encrypt the secret information in the preferred embodiment of the present invention. It is assumed that the receiving device 103 further includes a set of encrypted communication processing section 03e and a certification information authentication processing section 103e. The encrypted communication processing part 103e of the device 103 generates a common key 83 for communication for the purpose of encrypting and deciphering signals to be sent and received, and uses the generated common key 83 for communication to Encryption and decryption of signals sent to and received from the server device 101 is performed. The certification information authentication processing part 103 of the device 103 judges whether the server certification data 65 is valid. The second connection request sequence for step S206 for secret communication between the server device 101 and the request receiving device 103 is performed as shown below. In the SSL communication, the client's request receiving device 103 first sends a TCP connection start packet 221 to the server device 101 via the router device 104b. Therefore, it is required to use the TCP connection to start the server device 101. The general. When the TCP connection start packet 221 passes through the router device 104b, the router device 104b uses the NAPT function used when the device registration packet 201 is sent to convert the SA and SP on the TCP connection start packet 221 . Further, when receiving a packet addressed to the request-receiving device 103, the router device 104b performs a relative conversion for the conversion performed on the SA, the DA of the conversion on the packet is completed, and the A different transformation of §0 on the packet is completed, and the transformation is different from the transformation completed for SD 'and then, the formed packet is sent to the request receiving device 103. For the sake of simplifying the description, the NAPT processing operation of the router device 104b will not be described in the description of the present invention. However, in reality, when the receiving device 103 is required to send or receive a packet, the device 103 always sends or receives the packet via the router device 104b, and the router device 104b performs 5 about the packet. NAPT processing. Next, the receiving device 103 and the server device 101 are required to perform the encryption specification negotiation step, and thus mutually check the specifications of the encryption mechanism used in the secret communication. The request accepting device 103 first uses the TCP connection established by the TCP connection start packet 221 to send a encrypted communication. The request packet (hereinafter referred to as "client-hello packet") 222 is sent to the server device. 101. Encrypted communication begins requesting that the packet 222 contains an available SSL version, a list of available encryption organizations, a session 115, and the like, and also includes a random number ClientHello generated using the request acceptance device 103. .random. When the request packet 222 is received from the request accepting device 10 and receiving the encrypted communication with 15 ciphers, the server device 101 sends a encrypted communication with the TCp connection established by the TCP connection starting packet 221 to start a response packet (hereinafter referred to as "Server-helloPacket") 223 to the request receiving device 103. The encrypted communication start response packet 223 contains the SSL version to be used (the latest version supported by the request request device 102 and the server device 101), the session ID, the encryption mechanism used, And the like, and also includes a random number “ServerHello.midom” generated using the server device 101. In the second connection request sequence of the next step, the encrypted version of the SSL version 43 200534653 and the encryption mechanism specified by the packet 223 is used to respond to the encrypted communication. The random numbers "ClientHello.random" and "ServerHello.random" are generated independently of each other using the request receiving device 103 and the server device 101, and are respectively used as a 32-bit time stamp and a 28-bit random number. (Or a sufficiently secure pseudorandom number of 5). The encrypted communication starts including the random numbers “ClientHello.random” and “ServerHello.random” respectively require the packet 222 and the encrypted communication start response packet 223 to be sent without any additional password. The server device 101 then sends a server certification data packet 214 to the request receiving device 103. It is not always necessary to send the packet 214 of the server certification data packet 10 to the receiving device 103 after the encrypted communication start response packet 223 is sent. As long as the server proves that the data packet 214 was sent before the reception of the common key generation information packet 224 for request-receiving device-end communication, the packet 214 may be at any timing (for example, the second connection at step 8206) Before the request sequence). The certification information authentication unit 15 of requesting acceptance of the device 103 is issued in a manner similar to the above-mentioned example of the request in FIG. 5 and the device 102 is issued using the CA shared key stored in the device 103. And it is confirmed whether the feeder information in packet 3 in the sending server certification packet 214 is valid. When the certification information authentication processing section 103e confirms that the feeding device certification data 65 sent by the certificate 20 is valid, the requesting device 103 starts a common key generation information exchange step, which includes a request for- The common key generation information of the receiving device-end communication and the common key generation information M for the poetic device-device-end communication are sent and received. In order to exchange information in the generation of common keys, the receiving device 1 033 2005 200553 53 is first used to encrypt the communication processing part 1 103 of the device 103 to generate the shared key generation information 81 for request-receiving device-end communication. . In addition, the request receiving device 103 uses the TCP connection established by the TCP connection start packet 221 to send a common key 5 for request-receiving device-end communication to generate an information packet 224 to the server device 101, where the packet 224 contains the generated common key generation information 81 for request-receiving-device communication. The response is used for request-receiving device-end communication to send a common secret transmission to generate an information packet 224. Using the encrypted communication processing part 101e of the server device 101, the server device 101 generates a server_device_ The common key generation information 82 of the end communication 10. In addition, the server device 101 uses the TCP connection established by the TCP connection start packet 221 to send a common key for the server-device-end communication to generate an information packet 225 to the requesting device 102, of which the packet 225 Contains common key generation information 82 for server-to-device communication. Based on the common key generating information 81 and 15 82, the issuing device 102 and the server device 101 are required to use their encrypted communication processing sections 102e and 101e to generate the same common key 83 for communication, respectively. An RSA encryption mechanism, a Diffie-Hellman encryption mechanism, or the like is used, and a common key 83 for communication is generated in a sequence similar to the first connection request sequence of step S203. Fragments of the generated common key generation 20 body messages 81 and 82 are exchanged between the request receiving device 103 and the server 1001, respectively. By generating these fragments of information 81 and 82 using the common key respectively, the encrypted communication processing section 1033 and 1016 generated by the requesting receiving device 103 and the server device 101 will be used as a little The post communication key uses the common key 83 for communication. 45 200534653 Next, a common key 83 may be shared for communication between the request receiving device 103 and the server device 101. The server device 101 and the request accepting device 103 use the common key 83 for the communication to encrypt and decrypt the connection request packet 226, and this results in that secret communication can be performed between them. In other words, after the reception of the first connection request packet 217 and before the transmission of the second connection request packet 226, when the common key 83 for sharing the communication between the request receiving device 103 and the server device 101 is completed The server device 101 causes the encrypted communication processing part 10 of the device 101 to use the common key 83 for communication to encrypt the password including the password of the request accepting device 103 included in the connection request packet 10 217, and the password The wide-area IP address "4.17.168.2" and the number of ports "500" are used for the communication router device 104a. The server device 101 generates a connection request packet 226 with the encrypted data contained as payload and uses the TCP connection established by the TCP connection start packet 221 to send the generated connection 15 request packet 226 to request the receiving device 103 as a response signal to the device registration packet 201. More specifically, using the device information list of the server device 101 and the step S204 shown in FIG. 2 is identified as the destination address and the IP address and port number of the request receiving device 103 as the destination, the server device 10 1 Send the connection request packet 226 shown in Figure 8D to the router device 104b. The controller device 104b executes the NAPT processing procedure of the received connection request packet 226, and sends the connection request packet 226 which has been accepted by the NAPT process shown in FIG. Gc to the request receiving device 103. On the other hand, using the TCP connection established between the server device 101 and the request accepting device 103, the request accepting device 103 receives a connection request packet containing the encrypted data as the secret information from the server device 101 from the server device 101. 226. In response to the reception of the packet 226, the request to accept the device 103 causes the encrypted communication processing part 103e of the device 103 to use the common key 83 for communication to decrypt the encrypted data. In this way, the connection request message for the notification request issuing device 102 request to perform the communication with the 5 request receiving device 103 is finally sent from the request issuing device 102 to the request receiving device 103. Referring again to FIG. 2, the request accepting device 103 determines whether the password contained in the connection request packet 226 matches the request accepting device 103 password stored in the request accepting device 103 internal list memory 103m. And because of this, is it valid at step S207. Only when the password is valid, the receiving device 103 is required to send a TCP connection start packet 208 to the router device 104a as a communication request signal, which requires the use of the relevant IP address contained in the connection request packet 226 " 4.17 · 168.2 "and the number of ports" 5000 ", the TCP connection of the requesting device 102 is started, and the communication between the requesting device 102 and the requesting device 103 is started. The TCP connection start packet 208 is as described above. Use the NAPT function of the router device 104a to reach the request issuing device 102. The request receiving device 103 can therefore establish a TCP connection with the request issuing device 丨 02. In response to the TCP connection starting packet 208, the request issuing device 丨 02 receives 20 After the communication between the request issuing device 102 and the request receiving device 103, the request issuing device 102 and the request receiving device 103 can use the TCP connection established by starting the packet 208 over the TCP connection to perform the data communication of step S209. In this way, by using the server device 101, data communication can be performed between the request issuing device 102 and the request receiving device i03 Implementation, the device 102 and the device 103 each have a private IP address and are placed on different LANs of the LAN 106a and the LAN 106b. Even if it is required that the device 102 has a wide-area IP address and is directly connected 5 After receiving the Internet (WAN) 105, communication between the request issuing device 102 and the request receiving device 103 can be performed by the same operation as described above. Further, even if the request receiving device 103 has a wide area IP address and Directly connected to the Internet (WAN) 105, the communication between the requesting device 102 and the request receiving device 103 can still be performed by the same operation as above. In any case except the controller The device does not perform the conversion of the IP address and the number of ports, and the same operations described above are performed. In a preferred embodiment of the present invention, the server device 101, the request device 102, and the request device 103 Is connected to the Internet (WAN) 105. However, the preferred embodiment of the present invention is not limited to this. The server device 101, the request issuing device 102, and the request receiving device 103 can still be configured to be connected to other One or both of the open network and the private network In addition, even if the routers 10 and 10b do not include the NAT function and only the NAT function, the requesting device 102 and the requesting device 20 103 Inter-communication can still be performed using the same operation as described above. In this case, the device is purchased and 10 cents are not converted into digital. The requesting device 102 can always maintain the same as The NAPT list shown in Figure 6 is set to clear the TCP packet and start the packet in the correct position. 48 200534653 The combination of the address and the port number, or when the first connection request sequence in step S203 starts. When the packet 211 can be set in the NAPT list, this, a, and ¥ 70 become the data communication sequence of step S209, and this is divided from the NAPT list by € 1, and σ. The NAPT list may be set using static NAPA or its 5 functions, such as universal plug and play. Further, in step S203, the first connection request sequentially starts the communication using the TCp connection to start the packet 211 via TCP connection, and in step S203 the first connection request sequentially starts the communication using the Tcp connection to start the packet such as communication via the tcp connection. It can be established using a communication mechanism different from one of ssl plus password 10. In addition, the TCP communication σ1 plus code in step S206 and S206 can be omitted. In the latter case, at step s, the request issuing device 102 may send a connection request packet 217 soon after sending the TCP connection start packet 211, thereby establishing a Tcp connection. In step S1, the server device 101 can send a connection request packet 226 shortly after receiving the TCP connection start packet 221. The processing of the data communication sequence in step S209 can be performed using a cryptographic connection mechanism, for example, the same SSL mechanism as in steps 8202 and 8206. In addition, the data transmission and reception in step S209 can be performed using other transmission protocols such as UDP. 20 The device registration packet 2o, connection request packet 217, connection request notification packet 205, and connection request packet 226 shown in Figures 7A to 7D and 8A to 8D are for display purposes only. Other columns may be used in addition or separate columns may be provided in a different order. The IP addresses, port numbers, and equipment 1 used in Figures 1 to 9 are only 49 200534653 for display purposes. They may be different values. As another preferred embodiment, the present invention can be provided as a computer-readable program including the respective steps of processing shown in Figs. 2 to 4. Alternatively, the present invention can be provided as a computer-readable recording medium, and the recording is performed in the following manner. In the latter case, the program can be read using a computer or device connected to the Internet, and the steps contained in the program can be executed using the computer or device. Then, the computer or the device can be operated as all or one of the server device 101, the request issuing device 102, and the request receiving device 103 according to the previously described preferred embodiment. Examples of recording programs 10 examples of recording media can include optical recording media, such as CD-ROM and DVD-ROM, magnetic recording media, such as floppy disks and hard disks, and semiconductor Lu Jiyi body. However, δ Jilu private § Jilu recorded media are not limited to them. In addition, the program can be distributed via a network, such as the Internet. As described above, the present invention can provide a communication system that can easily implement point-to-point communication between devices connected to the Internet (WAN) and devices placed on different [αν] and prohibit illegal access. Industrial Applicability Therefore, as explained in detail above, according to the present invention, it is possible to realize a request issuing device and a request accepting device having a private IP address in each 20 but placed on a different LAN which prohibits any illegal access. Point-to-point communication between devices. Further / according to the present invention, a program may be provided including the steps in a communication method. The computer or device connected to the Internet may be used to read the program. The steps. 50 200534653 [Brief description of the diagram] Fig. 悲 A block diagram of a network group of a communication system according to a preferred embodiment of the present invention. Fig. 2 is a diagram showing the implementation of a communication system not shown in Fig. 1 and 1 Communication 5 Sequence example sequence diagram; Figure 3 is a sequence diagram showing the first connection request sequence processed in detail in step S203 shown in Figure 2; Figure 4 is a step S2G6 of silk in Figure 2 Sequence diagram of the second connection request process detailed in Figure 10; Figure 5 is a block diagram of the certification authorization device 51, and its certification is used for the request issuing device 102 and the request receiving device 103 shown in Figure 1. Whether the server device 101 is valid; FIG. 6 is a list showing an example of the NAPT list stored in the internal list memory 104am of the router device 10 shown in FIG. 丨; FIG. 7A is a display FIG. 2 is an exploded view of the configuration of the LAN-end device registration packet 001 shown in FIG. 2; FIG. 7B is an exploded view showing the configuration of the WAN-side device registration packet 001 shown in FIG. 2; FIG. 7C is a display The LAN connection shown in Figure 3 requires the decomposition of 217 groups of 20 states. Figure 7D is an exploded view showing the configuration of the WAN-side connection request packet 217 shown in Figure 3; Figure 8A is an exploded view showing the configuration of the LAN-side connection request notification packet 205 shown in Figure 2; 51 200534653 Figure 8B is an exploded view showing the configuration of the WAN-side connection request notification packet 205 shown in Figure 2; Figure 8C is an exploded view showing the configuration of the LAN-side connection request packet 226 shown in Figure 4; 5 8D The figure is an exploded view showing the configuration of the WAN-side connection request packet 226 shown in FIG. 4; FIG. 9 is a device information list stored in the list memory 10lm of the server device shown in FIG. 1 List of examples; Fig. 10 is a block diagram showing a network configuration example of a prior art communication system, and Fig. 11 is a sequence diagram showing an example of a communication sequence using the NAPT function of the H device for communication; Fig. 12 is a list showing examples of NAPT money of the device 104; and Figs. 15 to 13 are examples of communication sequences showing the communication system shown in Fig. 1G

之順序圖。 【主要元件符號說明】 11…伺服器裝置 12…要求發出設備 13…要求接受設備 21…封包 23…封包 31…封包 34…連接要求封包(配對設備ID) 36…連接要求通知封包 37…TCP連接開始封包 38…命令信號 51…證明授權裝置 52"«CA共用密鑰 53...CA 密鑰 5 4…飼服H證明資料發出封包 52 200534653 55*"CA證明資料封包 61…伺服器密鑰 62…伺服器共用密鑰 63…伺服器證明資料要求封包 64…簽名 65…伺服器證明資料 71…共同密鑰產生資訊 72…共同密鑰產生資訊 73…通訊用之共同密鑰 81…共同密鑰產生資訊 82…共同密鑰產生資訊 83…共同密鑰 101···伺服器裝置 101e…加密碼通訊處理部份 101m…内部列表記憶體 102…要求發出設備 102c…各證明資訊認證處理部份 102e…加密碼通訊處理部份 102m…内部列表記憶體 103…要求接受設備 103c···證明資訊認證處理部份 103e…加密碼通訊處理部份 103m···内部列表記憶體 104···徑由器裝置 104a…徑由器裝置 104am···内部列表記憶體 104b…徑由器裝置 104bm…内部列表記憶體 105···網際網路(WAN)Sequence diagram. [Description of Symbols of Main Components] 11 ... Server Device 12 ... Required Device 13 ... Received Device 21 ... Package 23 ... Package 31 ... Package 34 ... Connection Request Packet (Pairing Device ID) 36 ... Connection Request Notification Packet 37 ... TCP Connection Start packet 38 ... command signal 51 ... certificate and authorize device 52 " «CA common key 53 ... CA key 5 4 ... feeding H certificate data sending packet 52 200534653 55 * " CA certificate data packet 61 ... server secret Key 62 ... Server common key 63 ... Server certification data request packet 64 ... Signature 65 ... Server certification data 71 ... Common key generation information 72 ... Common key generation information 73 ... Common key 81 for communication ... Common Key generation information 82 ... Common key generation information 83 ... Common key 101 ... Server device 101e ... Encrypted communication processing section 101m ... Internal list memory 102 ... Request issuing device 102c ... Certification information authentication processing unit 102e ... encrypted communication processing part 102m ... internal list memory 103 ... receiving device 103c ... certification information authentication processing part 103e ... encrypted communication part Management section 103m ... Internal list memory 104 ... Router device 104a ... Router device 104am ... Internal list memory 104b ... Router device 104bm ... Internal list memory 105 ... Internet Network (WAN)

106a···要求-發出-端LAN106a ... Required-Out-End LAN

106b···要求_接受-端LAN 20卜·設備註冊封包（自我之註 冊ID) S201-S209···執行於通訊系統 之通訊序列步驟 205···連接要求通知封包 208···ΤΓΡ連接開始封包 211…TCP連接開始封包 214···伺服器證明資料封包 217···通訊要求封包 222···加密碼通訊開始要求封包 223···加密碼通訊開始反應封包 224···共用密鑰產生資訊封包 225···共同密餘產生資訊封包 226···連接要求封包 1051···設備 id 2133…設備id 53106b ··· Requirement_Accepted-end LAN 20 · Device registration packet (self-registered ID) S201-S209 ··· Communication sequence step executed in the communication system 205 ··· Connection request notification packet 208 ·· TΓP connection Start packet 211 ... TCP connection start packet 214 ... Server certification data packet 217 ... Communication request packet 222 ... Encryption communication start request packet 223 ... Communication start communication with packet 224 ... Shared secret Key generation information packet 225 ... Common common generation information packet 226 ... Connection request packet 1051 ... Device ID 2133 ... Device ID 53

Claims (1)

200534653 十、申請專利範圍： κ 2提供於—通訊系統中之伺服器裝置，其中 裝置以及包含-要求發出設備和一要求接受設備之; 數個讀树連接到—網路，該伺服器裝置可操作以自 該要求發出設備轉移一連接要求信號至該要求接受咬 備，該伺服器裝置包含·· 一設備資訊儲縣置，其可操細儲存包含供用於 該等多數個設備之各個之一組設備資訊之一設備資訊 列表’該隨備資訊包含相關於料錄個設備之各個 10 之―職址和—接埠號碼，以及該”數個設備之各個 之設備ID ; 其中该伺服器裝置可操作以接收一設備註冊信 號，後者包含供用於該要求接受設備之一組設備資訊， 且其週期性地自該要求接受設備被發送，並且該伺服器 裝置可操作以儲存供用於該要求接受設備的一組設備 負成，後者包含在該設備資訊儲存裝置之被接收設備註 冊信號中； 其中該伺服器裝置可操作以接收從該要求發出設 備被發送之第一 T C Ρ連接開始信號而供建立與該要求 20 發出設備之第一 TCP連接； 其中該伺服器裝置可操作以接收第一連接要求信 號，後者包含該要求接受設備之設備ID，以及相關於該 要求發出設備之IP位址和接埠號碼，並且其是使用第一 TCP連接自該要求發出設備至該要求接受設備的要求； 54 200534653 其中該伺服器裝置可操作以自該設備資訊列表搜 尋被包含於被接收之第-連接要求信號中之該要求接 受設備的設備ID，辨識關於—組設備資訊，其包含符合 於被包含在第-連接要求信號中之要求接受設備的設 5 帛ID之㊉備ID，的設備作為該要求接受設備，並且辨識 包含於被辨識要求接受設備之-組設備資訊中之IP位 址和接埠就碼作為該設備資訊列表上相關於該要求接 _ 受設備之IP位址和接埠號碼；並且 其中該伺服器裝置可操作以發送包含被包括於該 10 職收之第—連接要求信號巾JM目關於該要求發出設 備之IP位址和接埠號碼的第二連接要求信號至該被辨 識之要求接受設備，作為對於該設備註冊㈣之反應信 號而以忒被辨識的IP位址和該被辨識的接埠位址被設 定作為目的地。 15 2·如申请專利範圍第1項之伺服器裝置， φ 其中，在辨識包含於被辨識要求接受設備之一組設 備資訊中之IP位址和接埠號碼作為相關於該要求接受 設備之IP位址和接埠號碼之後，且在發送第二連接要求 信號至該被辨識之要求接受設備之前，該伺服器裝置發 20 送第三連接要求信號至該要求接受設備，並且自該要求 接受設備接收第二TCP連接開始信號作為對於該第三 連接要求信號之反應信號，以建立與該要求接受設備之 第二TCP連接；並且 其中該伺服器裝置可操作以使用該被建立之第二 55 200534653 TCP連接而發送第二連接要求信號至該要求接受設備。 3. 如申請專利範圍第2項之伺服器裝置， 其中該第一連接要求信號進一步地包含供用於該 要求接受設備之密碼資訊；並且 5 其中該伺服器裝置可操作以增加被包含於第一連 接要求信號中之該密碼資訊至第二連接要求信號，並且 發送包含該密碼資訊之第二連接要求信號。 4. 如申請專利範圍第3項之伺服器裝置， 其中該伺服器裝置進一步地包含： 10 第一加密碼通訊裝置，其可操作以產生供用於通訊 之第一共同密鑰以及供用於通訊之第二共同密鑰，使用 供通訊用之該第一共同密鑰以解密碼該被接收之信 號，並且使用供通訊用之該第二共同密鑰而加密碼於該 被發送之信號；以及 15 一證明資訊儲存裝置，其可操作以儲存用以證實該 伺服器裝置之有效性的伺服器證明資訊； 其中該伺服器裝置可操作以在接收第一連接要求 信號之前發送該伺服器證明資訊至該要求發出設備； 其中該伺服器裝置可操作以使用該第一 TCP連接 20 自該要求發出設備而接收因反應於該伺服器證明資訊 被產生之第一共同密鑰產生資訊，反應於該第一共同密 鑰產生資訊而導致該第一加密碼通訊裝置產生第二共 同密鑰產生資訊，導致該第一加密碼通訊裝置依據第一 共同密鑰產生資訊和第二共同密鑰產生資訊而產生供 56 200534653 用於通訊之第一共同密鑰，使用第一TCP連接以發送該 第二共同密鑰產生資訊至該要求發出設備，並且導致該 要求發出設備依據該第一共同密鑰產生資訊和第二共 同密鑰產生資訊而產生與供通訊用之第一共同密輸相 同的通訊用之共同密鑰，以與該要求發出設備共用通訊 用之第一共同密鑰； 其中該伺服器裝置可操作以使用第一TCP連接自 該要求發出設備而接收使用供通訊用的第一共同密輪 被加密碼之第一連接要求信號，並且導致該第一加密石馬 通訊裝置使用供通訊用之第一共同密鑰而解密碼該被 接收之第一連接要求信號； 其中，在發送第二連接要求信號之前，該伺服器裝 置發送該伺服器證明資訊至該要求接受設備； 其中該伺服器裝置可操作以使用該第二Tcp連接 自該要求接受設備而接收因反應於該伺服器證明資訊 被產生之第三共同密鑰產生資訊，導致該第一加密碼通 汛裝置反應於該第三共同密鑰產生資訊而產生第四共 同密鑰產生資訊，導致該第-加密碼通訊裝置依據該第 三共同密鑰產生資訊和第四共同密鑰產生資訊而產生 七、通Λ用之第二共同密鑰，使用第二Tcp連接而發送該 第四共同密输產生資訊至該要求接受設備，並且導致該 '^求接②備依據該第三共同密輸產生資訊和第四共 同密鑰產生資㈣產生與供軌用之第三共同密餘相 同的通訊用之共同密餘以與該要求接受設備共用通訊 57 200534653 用之第二共同密鑰；並且 其中，在接收第一連接要求信號之後且在發送第一 連接要求信號之前，該伺服器裝置導致該第一加密碼^ a裝置使用供通訊用之弟一共同密鍮而加密碼於第一 5 連接要求信號。 5. —種提供於一通訊系統中之要求發出設備，其中一伺服 器襞置以及包含該要求發出設備和一要求接受設備之 夕數個设備各被連接到一網路，該要求發出設備可操作 以與該伺服器裝置和該要求接受設備通訊； 10 其中該要求發出設備可操作以發送第一 TCP連接 開始信號至該伺服器裝置以供建立與該伺服器裝置之 第一 TCP連接；200534653 10. Scope of patent application: κ 2 is provided in a server device in a communication system, which includes a device and a request-receiving device and a request-receiving device; several reading trees are connected to the network, and the server device can Operated to transfer a connection request signal from the request-issuing device to the request-receiving device. The server device includes a device information storage device that can store and store information for one of the plurality of devices. One device information list of the group device information. The accompanying information includes the "job address and-port number" of each 10 of the recorded devices, and the device ID of each of the "several devices; of which the server device Operable to receive a device registration signal, the latter containing a set of device information for use in the request acceptance device, which is sent periodically from the request acceptance device, and the server device is operable to store for use in the request acceptance A group of devices of the device is negative, and the latter is included in the received device registration signal of the device information storage device; The server device is operable to receive a first TCP connection start signal sent from the request issuing device for establishing a first TCP connection with the request 20 issuing device; wherein the server device is operable to receive a first connection request Signal, which contains the device ID of the request receiving device, and the IP address and port number of the request issuing device, and it is a request from the request issuing device to the request receiving device using the first TCP connection; 54 200534653 The server device is operable to search the device information list for the device ID of the request accepting device included in the received first connection request signal, and identify the information about the group of device information, which contains information that matches The 5th ID of the request accepting device in the connection request signal is the device ID of the request accepting device, and identifies the IP address and port included in the device information of the identified request accepting device. Use it as the IP address and port number of the requested device on the device information list; and where The server device is operable to send a second connection request signal including the first connection request signal included in the 10th job, to the identified request acceptance regarding the request to issue the device's IP address and port number. The device, as a response signal to the device registration, sets the identified IP address and the identified port address as the destination. 15 2 · If the server device of the first scope of the patent application, φ Among them, after identifying the IP address and port number included in the device information of a group of identified request accepting devices as the IP address and port number related to the request accepting device, and sending a second connection request Before the signal reaches the identified request accepting device, the server device sends a third connection request signal to the request accepting device, and receives a second TCP connection start signal from the request accepting device as the third connection request signal. A response signal to establish a second TCP connection with the request accepting device; and wherein the server device is operable to use the established The second 55 200534653 TCP connection transmitting the second connection request signal to the request acceptance equipment. 3. If the server device of the scope of patent application item 2, wherein the first connection request signal further includes password information for the request acceptance device; and 5 wherein the server device is operable to be included in the first The password information in the connection request signal is transmitted to the second connection request signal, and a second connection request signal including the password information is sent. 4. The server device according to item 3 of the patent application scope, wherein the server device further comprises: 10 a first encrypted communication device operable to generate a first common key for communication and a communication device for communication A second common key, using the first common key for communication to decrypt the received signal, and using the second common key for communication to encrypt the transmitted signal; and 15 A certification information storage device operable to store server certification information for verifying the validity of the server device; wherein the server device is operable to send the server certification information to the server before receiving the first connection request signal to The request issuing device; wherein the server device is operable to use the first TCP connection 20 to receive the first common key generation information generated from the request issuing device in response to the server certification information, in response to the first A common key generation information causes the first encrypted communication device to generate a second common key generation information, resulting in the first encryption The communication device generates a first common key for communication according to the first common key generation information and the second common key generation information. 56 200534653 uses a first TCP connection to send the second common key generation information to the The request issuing device causes the request issuing device to generate a common key for communication that is the same as the first common secret key for communication based on the first common key generation information and the second common key generation information to communicate with the first The first common key for the device shared communication is requested to be issued; wherein the server device is operable to use the first TCP connection to receive the first connection encrypted with the first common secret wheel for communication from the request issued device. Request the signal, and cause the first encrypted Shima communication device to decrypt the received first connection request signal using the first common key for communication; wherein, before sending the second connection request signal, the server The device sends the server certification information to the request accepting device; wherein the server device is operable to use the second TCP connection Since the request acceptance device receives third common key generation information generated in response to the server certification information, the first cryptographic flooding device responds to the third common key generation information to generate a fourth common key. The key generation information causes the first-key cryptographic communication device to generate a second common key for the seventh and the seventh according to the third common key generation information and the fourth common key generation information, using the second Tcp connection and Sending the fourth common secret key generation information to the request acceptance device, and causing the '^ request ② to be prepared based on the third common secret key generation information and the fourth common key generating resource and generating a third common key for rail use. A common secret used for communications with the same secret to share the second common key used with the request-receiving device 57 200534653; and wherein after receiving the first connection request signal and before sending the first connection request signal, the The server device causes the first encryption code ^ a device to use a common secret for communication and encrypts the password to the first 5 connection request signal. 5. A request issuing device provided in a communication system, in which a server is installed and a plurality of devices including the request issuing device and a request receiving device are connected to a network each, the request issuing device Operable to communicate with the server device and the request accepting device; 10 wherein the request issuing device is operable to send a first TCP connection start signal to the server device for establishing a first TCP connection with the server device; 其中該要求發出設備可操作以使用第一Tcp連接 而發送第一連接要求信號至該伺服器裝置，該第一連接 要求信號包含該要求接受設備之一設備ID以及相關於 該要求發出設備之-IP位址和—接蟑號碼，且該第—連 接要求信號是至該要求接受設備之一要求；並且 其中，在從該要求接受設傷接收供用於要求在該要 求發出設備和該要求接受設備之間的通訊之一通訊要 求減之後’該要求料設狀應於該軌要求信號而 接文在②要求發出設備和該要求接受設備之間的通 訊，並且開始與該要求接受設備之通訊。 6.如申明專利耗圍第5項之要求發出設備，其中該第一連 接要求信號進一步地包含供用於該要求接受設備之密 58 200534653 碼資訊。 7.如申請專利範圍第6項之要求發出設備，其進一步地包 含： 第二加密碼通訊裝置，其可操作以產生供通訊用之 5 第一共同密鑰，且使用供通訊用之第一共同密鑰而加密 碼於被發送之信號；以及 第一證明資訊認證裝置，其可操作以認證用以證實 該伺服器裝置之有效性的伺服器證明資訊； 其中該要求發出設備可操作以在發送第一連接要 10 求信號之前自該伺服器裝置接收該伺服器證明資訊； 其中該要求發出設備可操作以藉由該第一證明資 訊認證裝置以認證被接收之伺服器證明資訊並且確認 該被接收之伺服器證明資訊是否有效； 其中，當確認該被接收之伺服器證明資訊為有效 15 時，該要求發出設備導致該第二加密碼通訊裝置產生第 一共同密鑰產生資訊，使用第一TCP連接以發送該被產 生之第一共同密鑰產生資訊至該伺服器裝置，使用第一 TCP連接以自該伺服器裝置接收因反應於第一共同密 鑰產生資訊所產生之第二共同密鑰產生資訊，導致該第 20 二加密碼通訊裝置依據第一共同密鑰產生資訊和第二 共同密鑰產生資訊而產生供通訊用之第一共同密鑰，並 且導致該伺服器裝置依據第一共同密鑰產生資訊和第 二共同密鑰產生資訊而產生與通訊用之第一共同密鑰 相同的供通訊用之共同密鑰以與該伺服器裝置共用通 59 200534653 訊用之第一共同密鑰； 其中，在發送第-連接要求信號之前，該要求發出 設備導致該第二加密碼通訊裝置使用通訊用之第一共 同费輪而加密碼於第一連接要求信號；並且 其中該要求發出設備可操作以使用第一 TCp連接 而發送該被加密碼之第-連接要求信號至該伺服 置。 σ :種提供於一通訊系統中之要求接受設備，其中一伺服 為裴置以及包含一要求發出設備和該要求接受設備之 夕數個設備各被連接到一網路，該要求接受設備可操作 以與該伺服器裝置和該要求發出設備通訊，該要长 設備包含： & 一設備ID儲存裝置，其可操作以儲存該要求接受嘹 備之一設備ID ; 叹 其中該要求接受設備可操作以週期性地發送包含 邊要求接受設備之設備ID之設備註冊信號至該伺 裝置； & 其中該要求接受設備可操作以自該伺服器裴置接 收包含相關於該要求發出設備之一 IP位址和一接埠口 螞之第二連接要求信號作為對於該設備註冊信號\ 應信號； 、反 其中該要求接受設備可操作以發送用以要求在談 要求接受設備和該要求發出設備之間的通訊之一通^ 要求信號至利用被包含於該被接收之第二連接要长广 200534653 號中的該ip位址和該接埠號碼所代表之該要求發出設 備；並且 其中，在該要求發出設備反應於該通訊要求信號而 接受在該要求接受設備和該要求發出設備之間的通訊 5 之後，該要求接受設備開始與該要求發出設備的通訊。 9.如申請專利範圍第8項之要求接受設備，其中，在發送 該設備註冊信號至該伺服器裝置之後且在接收第二連 接要求信號之前，該要求接受設備自該伺服器裝置接收 第三連接要求信號作為對於該設備註冊信號之反應信 10 號，並且發送第二TCP連接開始信號至該伺服器裝置作 為對於該第三連接要求信號之反應信號以建立與該伺 服器裝置之第二TCP連接；並且 其中該要求接受設備可操作以使用該被建立之第 二TCP連接而自該伺服器裝置接收第二連接要求信號。 15 10.如申請專利範圍第9項之要求接受設備，其進一步地包 含： 一密碼資訊儲存裝置，其可操作以儲存供用於該要 求接受設備之密碼資訊； 其中該要求接受設備可操作以使用第二TCP連接 20 而自該伺服器裝置接收進一步地包含密碼資訊之第二 連接要求信號；並且 其中該要求接受設備可操作，而僅當被包含於第二 連接要求信號中之該密碼資訊與供用於被儲存於該密 碼資訊儲存裝置中之該要求接受設備的該密碼資訊相 61 200534653 符時，則發送通訊要求信號至該要求發出設備。 11.如申請專利範圍第10項之要求接受設備，其進一步地包 含·· 第三加密碼通訊裝置，其可操作以產生供通訊用之 5 第二共同密鍮，並且使用該通訊用之第二共同密鑰以解 密碼該被接收之信號；以及 第二證明資訊認證裝置，其可操作以認證用以證實 該伺服器裝置之有效性的伺服器證明資訊； 其中，在接收第二連接要求信號之前，該要求接受 10 設備自該伺服器裝置接收該伺服器證明資訊； 其中該要求接受設備可操作以導致該第二證明資 訊認證裝置認證該被接收之伺服器證明資訊是否為有 效以確認該被接收之伺服器證明資訊是否為有效； 其中，當確認該被接收之伺服器證明資訊為有效 15 時，該要求接受設備導致該第三加密碼通訊裝置產生第 三共同密鑰產生資訊，使用第二TCP連接以發送該被產 生之第三共同密鑰產生資訊至伺服器裝置，使用第二 TCP連接而自該伺服器裝置接收因反應於該第三共同 密鑰產生資訊被產生之第四共同密鑰產生資訊，導致該 20 第三加密碼通訊裝置依據第二共同密鑰產生資訊和第 四共同密鑰產生資訊而產生通訊用之第二共同密鑰，並 且導致該伺服器裝置依據該第三共同密鑰產生資訊和 該第四共同密鑰產生資訊而產生與通訊用之第二共同 密鑰相同的通訊用之共同密鑰以與該伺服器裝置共用 62 200534653 供通訊用之第二共同密鑰；並且 其中該要求接受設備可操作以使用該第二TCP連 接自該伺服器裝置接收使用供通訊用之第二共同密鑰 而被加密碼之第二連接要求信號，並且導致該第三加密 5 碼通訊裝置使用通訊用之第二共同密鑰而解密碼該被 接收之第二連接要求信號。 12. —種通訊系統，其包含： 如申請專利範圍第1項之該伺服器裝置；以及 多數個設備，其包含如申請專利範圍第5項之該要 10 求發出設備和如申請專利範圍第8項之該要求接受設 備； 其中該等多數個設備之各個和該伺服器裝置被連 接到網路。 13. —種通訊系統，其包含： 15 如申請專利範圍第2項之該伺服器裝置；以及 多數個設備，其包含如申請專利範圍第5項之該要 求發出設備和如申請專利範圍第9項之該要求接受設 備； 其中該等多數個設備之各個和該伺服器裝置被連 20 接到網路。 14. 一種通訊系統，其包含： 如申請專利範圍第3項之該伺服器裝置；以及 多數個設備，其包含如申請專利範圍第6項之該要 求發出設備和如申請專利範圍第10項之該要求接受設 63 200534653 備； 器裝置被連 /、中《亥專多數個設備之各個和該伺服 接到網路。 —種通訊系統，其包含： 如申請專利範圍第4項之該伺服器裝置；以及 多數個設備，其包含如申請專利範圍第7項之該要 求發出設備和如申請專利範圍第11項之該要求接受設Wherein the request issuing device is operable to send a first connection request signal to the server device using the first TCP connection, the first connection request signal includes a device ID of one of the request receiving devices and one of the request issuing devices- The IP address and the number of the connection request, and the first connection request signal is a request to the request acceptance device; and wherein the receiving of the injury received from the request is used for the request issuing device and the request acceptance device. One of the communications between the communication requirements is reduced. The request is set in response to the request signal of the track and the communication is received between the request issuing device and the request receiving device, and the communication with the request receiving device begins. 6. If it is stated that the claim issues the equipment in claim 5, the first connection request signal further contains secret 58 200534653 code information for the request acceptance device. 7. The issuing device as claimed in item 6 of the scope of patent application, further comprising: a second encrypted communication device operable to generate 5 first common keys for communication, and using the first communication key for communication A common key and a password added to the transmitted signal; and a first certification information authentication device operable to authenticate server certification information used to verify the validity of the server device; wherein the request issuing device is operable to Receiving the server certification information from the server device before sending the first connection request signal; wherein the request issuing device is operable to authenticate the received server certification information by the first certification information authentication device and confirm the Whether the received server certification information is valid; wherein, when it is confirmed that the received server certification information is valid, the request issuing device causes the second encrypted communication device to generate the first common key generation information, using the first A TCP connection to send the generated first common key generation information to the server device, using the first TCP connection The second common key generation information generated in response to the first common key generation information is received from the server device, which causes the twentieth-second encrypted communication device to generate the information and the second common key based on the first common key. The key generation information generates a first common key for communication, and causes the server device to generate the same first communication key as the first common key for communication according to the first common key generation information and the second common key generation information. A common key for communication to share the first common key for communication with the server device 59 200534653; wherein, before sending the first connection request signal, the request issuing device causes the second encrypted communication device The first connection request signal is encrypted using the first common fee round for communication; and wherein the request issuing device is operable to send the encrypted first connection request signal to the servo device using the first Tcp connection. σ: a request receiving device provided in a communication system, wherein a servo is Pei Zhi and a plurality of devices including a request issuing device and the request receiving device are each connected to a network, and the request receiving device is operable To communicate with the server device and the request issuing device, the key device includes: & a device ID storage device operable to store a device ID of the request acceptance device; sighing that the request acceptance device is operable To periodically send a device registration signal containing the device ID of the edge request accepting device to the server; & wherein the request accepting device is operable to receive from the server, including an IP bit associated with the request issuing device Address and a second connection request signal of a port as a registration signal for the device; a response signal; and wherein the request receiving device is operable to send a request between the request receiving device and the request issuing device. One communication ^ request signal to use the IP address contained in the received second connection to Changguang 200534653 The request issuing device represented by the port number; and wherein, after the request issuing device responds to the communication request signal and accepts the communication between the request receiving device and the request issuing device5, the request receiving device starts Communication with the requesting device. 9. The request acceptance device according to item 8 of the scope of patent application, wherein after the device registration signal is sent to the server device and before the second connection request signal is received, the request acceptance device receives a third from the server device. The connection request signal is a response signal 10 to the device registration signal, and a second TCP connection start signal is sent to the server device as a response signal to the third connection request signal to establish a second TCP with the server device And wherein the request acceptance device is operable to receive a second connection request signal from the server device using the established second TCP connection. 15 10. The request acceptance device according to item 9 of the scope of patent application, further comprising: a password information storage device operable to store password information for use in the request acceptance device; wherein the request acceptance device is operable to use The second TCP connection 20 receives a second connection request signal further including password information from the server device; and wherein the request accepting device is operable only when the password information and the password information included in the second connection request signal are When the password information for the request accepting device stored in the password information storage device matches 61 200534653, a communication request signal is sent to the request issuing device. 11. The acceptance device as claimed in item 10 of the scope of patent application, which further includes a third encrypted communication device operable to generate a 5 second common key for communication and use the first Two common keys to decrypt the signals that should be received; and a second certification information authentication device operable to authenticate server certification information used to verify the validity of the server device; wherein, upon receiving a second connection request Prior to the signal, the request acceptance device receives the server certification information from the server device; wherein the request acceptance device is operable to cause the second certification information authentication device to authenticate whether the received server certification information is valid to confirm Whether the received server certification information is valid; wherein when confirming that the received server certification information is valid 15, the request acceptance device causes the third encrypted communication device to generate third common key generation information, Use the second TCP connection to send the generated third common key generation information to the server device, use The two TCP connections receive the fourth common key generation information generated from the server device in response to the third common key generation information, resulting in the 20 third encrypted communication device generating information based on the second common key and The fourth common key generation information generates a second common key for communication, and causes the server device to generate a second communication key for communication based on the third common key generation information and the fourth common key generation information. A common key for communication with the same common key to share with the server device 62 200534653 a second common key for communication; and wherein the request acceptance device is operable to use the second TCP connection from the server device Receiving a second connection request signal encrypted by using the second common key for communication, and causing the third encrypted 5-code communication device to use the second common key for communication to decrypt the received second password The connection requires a signal. 12. A communication system comprising: the server device as claimed in item 1 of the scope of patent application; and a plurality of devices including the device for issuing the request as described in item 5 of the scope of patent application and The request acceptance device of item 8; each of the plurality of devices and the server device are connected to a network. 13. A communication system comprising: 15 the server device as described in the scope of patent application item 2; and a plurality of equipment including the request issuing device as described in the scope of patent application item 5 and The request accepts equipment; each of the plurality of equipment and the server device is connected to the network. 14. A communication system comprising: the server device as claimed in the scope of patent application item 3; and a plurality of devices comprising the request issuing device as described in the scope of patent application item 6 and The request accepts the equipment of 200520055353; the device is connected to / from each of the majority of the equipment of the Zhonghai Specialty and the servo is connected to the network. -A communication system comprising: the server device as claimed in item 4 of the scope of patent application; and a plurality of devices comprising the request issuing device as stated in item 7 of the patent application scope and Request for acceptance 其中該等多數個設備之各個和該伺服器裝置被連 接到網路。 W-種使用提供於—通訊系統中之飼服料置的通訊方 法，其中_服||襄置収包含—要求發出設備和一要 ^接受設備之多數個設備各被連接到—網路，該飼服器 裝置可操作以自該要求發出設備轉移—連接要求信號 至該要求接受設備； 其中3亥伺服器裂置包含一設備資訊儲存裳置，其可 操作以儲存包含供用於該等多數個設備之各個之一組 設備資訊之一設備資訊列表，該組設備資訊包含相關於 該等多數個設備之各個之一 ιρ位址和一接埠號碼，以及 該等多數個設備之各個之設備ID ; 其中該通訊方法包含： 接收一設備註冊信號，其包含供用於該要求接受設 備之一組設備資訊，且其週期性地自該要求接受設備被 發送’並且儲存被包含於該被接收設備註冊信號中對於 64 200534653 該要求接受設備之一組設備資訊於該設備資訊儲存裝 置中； 接收自該要求發出設備被發送之第一 TCP連接開 始信號以建立與該要求發出設備之第一 TCP連接； 5 接收第一連接要求信號，其包含該要求接受設備之 設備ID，以及相關於該要求發出設備之ip位址和接埠號 碼’並且其是使用第一TCP連接自該要求發出設備至該 要求接受設備的要求； 自該設備資訊列表搜尋被包含於該被接收之第一 ίο 連接要求信號中的該要求接受設備之設備ro，辨識關於 一組設備資訊，其包含符合於被包含在第一連接要求信 號中之要求接受設備的設備ID之設備ID，的設備作為該 要求接受設備，並且辨識包含於被辨識要求接受設備之 一組設備資訊中之IP位址和接埠號碼作為該設備資訊 15 列表上相關於該要求接受設備之IP位址和接埠號碼；並 且 發送包含被包括在該被接收之第一連接要求信號 中且相關於該要求發出設備之IP位址和接埠號碼的第 一連接要求信號至該被辨識之要求接受設備，作為對於 20 ^%備注冊信號之反應信號，而以該被辨識的IP位址和 該被辨識的接埠位址被設定作為目的地。 17·如申請專利範圍第16項之通訊方法，其進-步地包含： ^在"亥識別之後以及在該發送第二連接要求信號之 月’J，發送第三連接要求信號至該要求接受設備，並且自 65 200534653 該要求接受設備接收第二TCP連接開始信號作為對於 該第三連接要求信號之反應信號，以建立與該要求接受 設備之第二TCP連接； 其中該發送第二連接要求信號包含使用該被建立 5 之第二TCP連接以發送第二連接要求信號至該要求接 受設備。 18. 如申請專利範圍第17項之通訊方法， 其中第一連接要求信號進一步地包含供用於該要 求接受設備之密碼資訊；並且 10 其中該通訊方法進一步地包含增加被包含於第一 連接要求信號中之該密碼資訊至第二連接要求信號，並 且發送包含該密碼資訊之第二連接信號。 19. 如申請專利範圍第18項之通訊方法，其進一步地包含： 在該接收第一連接要求信號之前發送用以證實該 15 伺服器裝置之有效性的伺服器證明資訊至該要求發出 設備； 使用該第一TCP連接自該要求發出設備所接收因 反應於該伺服器證明資訊被產生之第一共同密鑰產生 資訊，反應於第一共同密鑰產生資訊而產生第二共同密 20 鑰產生資訊，依據第一共同密鑰產生資訊和第二共同密 鑰產生資訊而產生供用於通訊之第一共同密鑰，使用第 一 TCP連接而發送該第二共同密鑰產生資訊至該要求 發出設備，並且依據該第一共同密鑰產生資訊和第二共 同密鑰產生資訊而導致該要求發出設備產生與通訊用 66 200534653 之第一共同密鑰相同的通訊用之一共同密鑰以與該要 求發出設備共用通訊用之第一共同密鑰； 使用第一TCP連接自該要求發出設備而接收使用 供通訊用之第一共同密鑰而被加密碼之第_連接要求 5 信號，並且使用該通訊用之第一共同密鑰以解密碼該被 接收之第一連接要求信號； 在該發送第二連接要求信號之前，發送該伺服器證 I 明資訊至該要求接受設備； 使用第二TCP連接自該要求接受設備而接收因反 10 應於該伺服器證明資訊而被產生之第三共同密鑰產生 二貝汛，反應於邊第三共同密鑰產生資訊而產生第四共同 密鑰產生資訊，依據該第三共同密鑰產生資訊和該第四 共同密鑰產生資訊而產生通訊用之第二共同密鑰，使用 第二TCP連接以發送該第四共同密鑰產生資訊至該要 15 求接受設備，並且依據該第三共同密鑰產生資訊和該第 Φ 四共同密鑰產生資訊而導致該要求接受設備產生與通 成用之第二共同密鑰相同的通訊用之共同密鑰以與該 要求接受設備共用通訊用之第二共同密鑰；並且 在該接收第一連接要求信號之後以及在該發送第 20 一連接要求#號之前，使用通訊用之第二共同密鑰以加 密碼於該第二連接要求信號。 2 0 · —種使用提供於一通訊系統中之要求發出設備的通訊 方法，其中一伺服器裝置以及包含該要求發出設備和一 要求接受設備之多數個設備各被連接到一網路，該要求 67 200534653 發出設備可操作以與該伺服器裝置和該要求接受設備 通訊，該通訊方法包含： 發送第一 TCP連接開始信號至該伺服器裝置以建 立與該伺服器裝置之第一 TCP連接； 5 使用第一TCP連接而發送第一連接要求信號，其包 含該要求接受設備之一設備ID以及相關於該要求發出 設備之一IP位址和一接埠號碼，且其是至該要求接受設 備之要求，至該伺服器裝置；並且 在自該要求接受設備接收要求在該要求發出設備 10 和該要求接受設備之間通訊的通訊要求信號之後，則反 應於該通訊要求信號而接受在該要求發出設備和該要 求接受設備之間的通訊，並且開始與該要求接受設備之 通訊。 21. 如申請專利範圍第20項之通訊方法，其中第一連接要求 15 信號進一步地包含供用於該要求接受設備之密碼資訊。 22. 如申請專利範圍第21項之通訊方法，其進一步地包含： 在該發送第一連接要求信號之前自該伺服器裝置 接收該伺服器證明資訊； 認證該被接收之伺服器證明資訊是否有效以確認 20 該被接收之伺服器證明資訊是否有效； 當確認該被接收之伺服器證明資訊為有效時，則產 生第一共同密鑰產生資訊，使用第一TCP連接發送該被 產生之第一共同密鑰產生資訊至該伺服器裝置，使用第 一 TCP連接自該伺服器裝置接收反應於第一共同密鑰 68 200534653 產生資訊被產生的第二共同密鑰產生資訊，依據第一共 同毯鑰產生資訊和第二共同密鑰產生資訊而產生供通 訊用之第一共同密鑰，並且依據第一共同密鑰產生資訊 和第一共同密鑰產生資訊而導致該伺服器裝置產生與 么、通λ用之第_共同密鑰相同的供通訊用之共同密鑰 以與該伺服器裝置共用供通訊用之第一共同密鑰； 在該發送第一連接要求信號之前，使用供通訊用之 •共同密鑰而加密碼於第一連接要求信號。 23· -種使用提供於_通訊系、统中之要求接受設備的通訊 方法八中伺服器裝置以及包含一要求發出設備和該 要求接受設備的多數個設備各被連接到-網路，該要求 接受設備可操作以與該伺服器裝置和該要求發出設備 通訊，該通訊方法包含： 週期性地發送包含該要求接受設備之設備m的設 15 備註冊信號至該伺服器裝置； • 自該伺服器裝置接收包含相關於該要求發出設備 的一 IP位址和一接埠號碼之第二連接要求信號作為對 於該設備註冊信號之反應信號； 發送用以要求在該要求接受設備和該要求發出設 20 備之間通訊之一通訊要求信號至利用被包含於該被接 收之第二連接要求信號中的該IP位址和該接埠號碼所 代表之該要求發出設備；並且 在該要求發出設備反應於該通訊要求信號而接受 在該要求接受設備和該要求發出設備之間的通訊之 69 200534653 後，開始與該要求發出設備的通訊。 24. 如申請專利範圍第23項之通訊方法，其進一步地包含： 在該發送該設備註冊信號至該伺服器裝置之後以 及在該接收第二連接要求信號之前，則自該伺服器裝置 5 接收第三連接要求信號作為對於該設備註冊信號之反 應信號，並且發送第二TCP連接開始信號至該伺服器裝 置作為對於該第三連接要求信號之反應信號以建立與 該伺服器裝置之第二TCP連接；並且 使用被建立之第二TCP連接而自該伺服器裝置接 10 收第二連接要求信號。 25. 如申請專利範圍第24項之通訊方法， 其中該要求接受設備包含一密碼資訊儲存裝置，後 者可操作以儲存供用於該要求接受設備之密碼資訊； 其中第二連接要求信號進一步地包含密碼資訊；並 15 且 其中該通訊方法進一步地包含:僅當被包含於第二 連接要求信號中之該密碼資訊與供用於被儲存於該密 碼資訊儲存裝置中之該要求接受設備的該密碼資訊相 符時，則發送該通訊要求信號至該要求發出設備。 20 26.如申請專利範圍第25項之通訊方法，其進一步地包含： 在該接收第二連接要求信號之前，自該伺服器裝置 接收該伺服器證明資訊； 認證該被接收之伺服器證明資訊是否有效以確認 該被接收之伺服器證明資訊是否為有效；並且 70 200534653 當確認該被接收之伺服器證明資訊為有效時，產生 第三共同密鑰產生資訊，而使用第二TCP連接以發送該 被產生之第三共同密鑰產生資訊至該伺服器裝置，使用 第二TCP連接自該伺服器裝置以接收反應於該第三共 5 同密鑰產生資訊而被產生之第四共同密鑰產生資訊，依 據第二共同密鑰產生資訊和該第四共同密鑰產生資訊 而產生供用於通訊之第二組共同密鑰，並且依據該第三 共同密鑰產生資訊和該第四共同密鑰產生資訊而導致 該伺服器裝置產生與通訊用之第二共同密鑰相同的通 10 訊用之共同密鑰以與該伺服器裝置共用通訊用之第二 共同密鑰； 其中該接收第二連接要求信號進一步地包含使用 供通訊用之第二共同密鑰而解密碼該被接收之第二連 接要求信號。 15 27. —種使用一通訊系統之通訊方法，其中該通訊系統包含 一伺服器裝置以及包含一要求發出設備和一要求接受 設備之多數個設備； 其中該等多數個設備之各個和該伺服器裝置被連 接到一網路；並且 20 其中該通訊方法包含： 如申請專利範圍第16項之通訊方法； 如申請專利範圍第20項之通訊方法；以及 如申請專利範圍第23項之通訊方法。 28· —種使用一通訊系統之通訊方法，其中該通訊系統包含 71 200534653 一伺服器裝置以及包含一要求發出設備和一要求接受 設備之多數個設備； 其中該等多數個設備之各個和該伺服器裝置被連 接到一網路；並且 5 其中該通訊方法包含： 如申請專利範圍第17項之通訊方法； 如申請專利範圍第20項之通訊方法；以及 如申請專利範圍第24項之通訊方法。 29.—種使用一通訊系統之通訊方法，其中該通訊系統包含 10 一伺服器裝置以及包含一要求發出設備和一要求接受 設備之多數個設備； 其中該等多數個設備之各個和該伺服器裝置被連 接到一網路；並且 其中該通訊方法包含； 15 如申請專利範圍第18項之通訊方法； 如申請專利範圍第21項之通訊方法；以及 如申請專利範圍第25項之通訊方法。 30. —種使用一通訊系統之通訊方法，其中該通訊系統包含 一伺服器裝置以及包含一要求發出設備和一要求接受 20 設備之多數個設備； 其中該等多數個設備之各個和該伺服器裝置被連 接到一網路；並且 其中該通訊方法包含： 如申請專利範圍第19項之通訊方法； 72 200534653 如申請專利範圍第22項之通訊方法；以及 如申請專利範圍第26項之通訊方法。 31.—種程式，其供用以導致電腦進行如申請專利範圍第16 項之通訊方法。 5 32.—種程式，其供用以導致電腦進行如申請專利範圍第20 項之通訊方法。 33. —種程式，其供用以導致電腦進行如申請專利範圍第23 項之通訊方法。 34. —種程式，其供用以導致電腦進行如申請專利範圍第27 10 項之通訊方法。 73Each of the plurality of devices and the server device are connected to a network. W-A communication method using feeding equipment provided in a communication system, in which _ 服 || xiangxiang receipt contains—requiring sending equipment and a majority of receiving equipment are connected to—the network, The feeder device is operable to issue a device transfer from the request-to connect the request signal to the request receiving device; wherein the server server includes a device information storage device, which is operable to store a device containing information for use in the majority of such devices. A list of device information for each of a set of device information, the set of device information includes an address and a port number associated with each of the plurality of devices, and a device for each of the plurality of devices ID; wherein the communication method includes: receiving a device registration signal, which includes a set of device information for the request receiving device, and which is periodically sent from the request receiving device 'and stored in the received device In the registration signal for 64 200534653, a group of device information of the request accepting device is stored in the device information storage device; The device sends a first TCP connection start signal to establish a first TCP connection with the request issuing device; 5 receives a first connection request signal, which includes the device ID of the request receiving device, and the ip associated with the request issuing device Address and port number 'and it is the request from the request issuing device to the request accepting device using the first TCP connection; searching from the device information list for the included in the received first connection request signal The device ro of the request accepting device recognizes information about a group of devices including a device ID that conforms to the device ID of the request accepting device included in the first connection request signal, and the device as the request accepting device, and identifies the The IP address and port number in the device information of the identified request-receiving device are used as the device information. 15 The IP address and port number on the list related to the request-receiving device; The first connection request signal and the first connection related to the IP address and port number of the requesting device The request signal is received to the identified request receiving device as a response signal to the 20% registered registration signal, and the identified IP address and the identified port address are set as destinations. 17. The communication method according to item 16 of the scope of patent application, which further comprises: ^ After " Hai identification and in the month of sending the second connection request signal 'J, send a third connection request signal to the request The receiving device, and since 65 200534653 the request receiving device receives a second TCP connection start signal as a response signal to the third connection request signal to establish a second TCP connection with the request receiving device; wherein the second connection request is sent The signal includes using the established second TCP connection to send a second connection request signal to the request receiving device. 18. The communication method according to item 17 of the patent application scope, wherein the first connection request signal further includes password information for use in the request acceptance device; and 10 wherein the communication method further includes adding a signal included in the first connection request signal. The password information is transmitted to the second connection request signal, and a second connection signal including the password information is transmitted. 19. The communication method according to item 18 of the scope of patent application, further comprising: sending server certification information for confirming the validity of the 15 server device to the request issuing device before the receiving the first connection request signal; Use the first TCP connection to receive the first common key generation information received from the request issuing device in response to the server certification information being generated, and generate the second common key generation in response to the first common key generation information. Information, the first common key for communication is generated according to the first common key generation information and the second common key generation information, and the second common key generation information is sent to the request issuing device using the first TCP connection And based on the first common key generation information and the second common key generation information, the request issuing device generates a common key for communication that is the same as the first common key for communication 66 200534653 to correspond to the request Issue the first common key for the device's common communication; use the first TCP connection to receive the request for communication from the request issuing device The first common key used for communication is encrypted with the first _ connection request 5 signal, and the first common key used for communication is used to decrypt the received first connection request signal; the second connection is sent at the Before the request signal, send the server certificate information to the request accepting device; use the second TCP connection to receive the third common key generated from the request accepting device in response to the server certificate information Erbeizun generates a fourth common key generation information in response to the third common key generation information, and generates a second common information for communication based on the third common key generation information and the fourth common key generation information. Key, use the second TCP connection to send the fourth common key generation information to the request receiving device, and cause the request according to the third common key generation information and the fourth common key generation information The receiving device generates a common key for communication that is the same as the second common key for common use to share the second common key for communication with the requesting receiving device; and After receiving a first connection request signal and before the transmission of a connection requires the # 20, using the second common key to the encrypted communication with the second connection request signal to the. 2 0 — A communication method using a request issuing device provided in a communication system, wherein a server device and a plurality of devices including the request issuing device and a request receiving device are each connected to a network, the request 67 200534653 The issuing device is operable to communicate with the server device and the request acceptance device, the communication method includes: sending a first TCP connection start signal to the server device to establish a first TCP connection with the server device; 5 A first connection request signal is sent using the first TCP connection, which includes a device ID of the request accepting device and an IP address and a port number related to the request issuing device, and it is a route to the request accepting device. Request to the server device; and after receiving a communication request signal requesting communication between the request issuing device 10 and the request receiving device from the request receiving device, in response to the communication request signal, accepting the request issued Communication between the device and the request-receiving device, and communication with the request-receiving device begins21. The communication method of claim 20, wherein the first connection request 15 signal further includes password information for use in the request acceptance device. 22. The communication method according to item 21 of the patent application scope, further comprising: receiving the server certification information from the server device before sending the first connection request signal; and authenticating whether the received server certification information is valid To confirm whether the received server certification information is valid; when confirming that the received server certification information is valid, generating the first common key generation information, and using the first TCP connection to send the generated first The common key generates information to the server device, and uses the first TCP connection to receive the second common key generation information in response to the first common key 68 200534653 generated information from the server device, according to the first common blanket key Generating the information and the second common key generation information to generate the first common key for communication, and generating the server device based on the first common key generation information and the first common key generation information. The _ common key used for λ is the same common key for communication to share the first common key for communication with the server device Same key; before sending the first connection request signal, use the common key for communication and add a password to the first connection request signal. 23 ·-A communication method using the request receiving device provided in the communication system and system The eight server device and a plurality of devices including a request issuing device and the request receiving device are each connected to a network, the request The receiving device is operable to communicate with the server device and the request issuing device, and the communication method includes: periodically sending a device 15 registration signal including the device m of the request receiving device to the server device; The device receives a second connection request signal including an IP address and a port number related to the request issuing device as a response signal to the device registration signal; and sends a request for requesting the request accepting device and the request issuing device. 20 A communication request signal from one of the devices to the communication request signal to the request issuing device using the IP address and the port number included in the received second connection request signal; and a response to the request issuing device 69 200534653 to accept communication between the request receiving device and the request issuing device in response to the communication request signal After that, communication with the device that issued the request began. 24. The communication method according to item 23 of the scope of patent application, further comprising: after the device registration signal is sent to the server device and before the second connection request signal is received, receiving from the server device 5 The third connection request signal is used as a response signal to the device registration signal, and a second TCP connection start signal is sent to the server device as a response signal to the third connection request signal to establish a second TCP with the server device. And using the established second TCP connection to receive a second connection request signal from the server device. 25. The communication method according to item 24 of the patent application scope, wherein the request acceptance device includes a password information storage device operable to store password information for use in the request acceptance device; wherein the second connection request signal further includes a password 15; and wherein the communication method further comprises: only when the password information included in the second connection request signal matches the password information for the request accepting device stored in the password information storage device When it is, the communication request signal is sent to the request issuing device. 20 26. The communication method according to item 25 of the patent application scope, further comprising: before receiving the second connection request signal, receiving the server certification information from the server device; authenticating the received server certification information Whether it is valid to confirm whether the received server certification information is valid; and 70 200534653 When it is confirmed that the received server certification information is valid, a third common key generation information is generated, and the second TCP connection is used to send The generated third common key generation information is sent to the server device, and a second TCP connection is used from the server device to receive a fourth common key generated in response to the third total 5 key generation information. Generate information, generate a second set of common keys for communication according to the second common key generation information and the fourth common key generation information, and generate information and the fourth common key according to the third common key Generating information and causing the server device to generate a common key for communication with the second common key for communication to communicate with the server A second common communication means with the common key; wherein the received second connection request signal further comprises the second used for communication with the common key password and the solution of the second connection request signal is received by the contact. 15 27. —A communication method using a communication system, wherein the communication system includes a server device and a plurality of devices including a request issuing device and a request receiving device; each of the plurality of devices and the server The device is connected to a network; and 20 wherein the communication method includes: a communication method such as the scope of application for a patent application item 16; a communication method such as the scope of application for a patent application item 20; and a communication method such as application for a patent application scope item 23. 28 · —A communication method using a communication system, wherein the communication system includes 71 200534653 a server device and a plurality of devices including a request issuing device and a request receiving device; each of the plurality of devices and the servo Device is connected to a network; and 5 wherein the communication method includes: a communication method such as the scope of application for the patent No. 17; a communication method such as the scope of the patent application for 20; and a communication method such as the scope of patent application for 24 . 29. A communication method using a communication system, wherein the communication system includes 10 server devices and a plurality of devices including a request issuing device and a request receiving device; each of the plurality of devices and the server The device is connected to a network; and wherein the communication method includes; 15 a communication method such as the scope of patent application No. 18; a communication method such as the scope of patent application No. 21; and a communication method such as the scope of patent application No. 25. 30. A communication method using a communication system, wherein the communication system includes a server device and a plurality of devices including a request issuing device and a request receiving 20 device; each of the plurality of devices and the server The device is connected to a network; and wherein the communication method includes: a communication method such as the scope of patent application 19; 72 200534653 a communication method such as the scope of patent application 22; and a communication method such as the scope of patent application 26 . 31. A program for causing a computer to perform a communication method as described in item 16 of the patent application. 5 32.—A program for causing a computer to perform a communication method as described in item 20 of the patent application. 33. A program for causing a computer to perform a communication method as described in item 23 of the patent application. 34. — A program for causing a computer to perform a communication method as described in item 27 10 of the patent application scope. 73
TW094101663A 2004-02-20 2005-01-20 Communication system using TCP/IP protocols TW200534653A (en)

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
JP2004044141A JP2005236728A (en) 2004-02-20 2004-02-20 Server apparatus, request issuing the apparatus, request accepting apparatus, communications system and communication method

Publications (1)

Publication Number Publication Date
TW200534653A true TW200534653A (en) 2005-10-16

Family

ID=34879331

Family Applications (1)

Application Number Title Priority Date Filing Date
TW094101663A TW200534653A (en) 2004-02-20 2005-01-20 Communication system using TCP/IP protocols

Country Status (6)

Country Link
EP (1) EP1719324A1 (en)
JP (1) JP2005236728A (en)
CN (1) CN1918887A (en)
CA (1) CA2556689A1 (en)
TW (1) TW200534653A (en)
WO (1) WO2005081492A1 (en)

Families Citing this family (13)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP4647440B2 (en) * 2005-09-08 2011-03-09 東日本電信電話株式会社 Network service security system and network service security method
JP2008085470A (en) * 2006-09-26 2008-04-10 Fujitsu Ltd Ip application service provision system
CN101207579B (en) * 2007-08-15 2010-08-18 杨汉民 Server for implementing network note service and communication method among client machines
JP5444639B2 (en) 2007-11-20 2014-03-19 パナソニック株式会社 Server device and distributed server system
US20130212653A1 (en) * 2012-02-09 2013-08-15 Indigo Identityware Systems and methods for password-free authentication
JP5775034B2 (en) * 2012-07-13 2015-09-09 日本電信電話株式会社 Communication destination solving apparatus, gateway apparatus, communication destination solving method, and program
CN105164968A (en) * 2013-04-25 2015-12-16 瑞保企业 Method performed by at least one server for processing a data packet from a first computing device to a second computing device to permit end-to-end encryption communication
EP3025540A4 (en) * 2013-07-26 2017-03-15 Intel IP Corporation Signaling interference information for user equipment assistance
CN104981025A (en) * 2014-04-02 2015-10-14 腾讯科技（深圳）有限公司 Terminal pairing method, terminal pairing device, server and terminal
CN104993980B (en) * 2015-08-11 2018-01-16 上海斐讯数据通信技术有限公司 A kind of security control method and system of long connection application access
CN106209767B (en) * 2016-06-20 2020-03-17 Tcl海外电子（惠州）有限公司 Data transmission method and system
WO2018197590A1 (en) * 2017-04-25 2018-11-01 Disruptive Technologies Research As Encryption and link bringup for low power devices
CN108053630B (en) * 2017-11-28 2020-08-11 国电南瑞科技股份有限公司 Cross-security-area wireless data access system and method

Family Cites Families (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2000056034A1 (en) * 1999-03-17 2000-09-21 3Com Corporation Method and system for distributed network address translation with network security features
DE10128493A1 (en) * 2000-06-16 2002-01-03 Ibm Integration of network address translation and IP security protocol within virtual private network, involves providing allocation table containing NAT rules in VPN gateway
US20020042875A1 (en) * 2000-10-11 2002-04-11 Jayant Shukla Method and apparatus for end-to-end secure data communication
AU2001297602A1 (en) * 2000-12-14 2002-09-19 Vocaltec Communications Ltd. Traversing firewalls and nats
US7143188B2 (en) * 2002-06-13 2006-11-28 Nvidia Corporation Method and apparatus for network address translation integration with internet protocol security

Also Published As

Publication number Publication date
EP1719324A1 (en) 2006-11-08
CA2556689A1 (en) 2005-09-01
JP2005236728A (en) 2005-09-02
WO2005081492A1 (en) 2005-09-01
CN1918887A (en) 2007-02-21

Similar Documents

Publication Publication Date Title
TW200534653A (en) Communication system using TCP/IP protocols
JP4081724B1 (en) Client terminal, relay server, communication system, and communication method
JP4729602B2 (en) Server device, communication device, communication system, program, and recording medium
JP4033868B2 (en) Method and apparatus for processing authentication in IPv6 network
US7349396B2 (en) Content distribution system
JP4246705B2 (en) Home terminal device and communication system
JP4692600B2 (en) Information processing apparatus, communication system, and program
JP2006121510A (en) Encryption communications system
WO2005004418A1 (en) Remote access vpn mediation method and mediation device
KR20040108533A (en) Contents transmitter, contents receiver, and contents transfer method
CN102624744B (en) Authentication method, device and system of network device and network device
US20030188012A1 (en) Access control system and method for a networked computer system
JP2004056762A (en) Wireless communication method and equipment, communication control program and controller, key management program, wireless lan system, and recording medium
JP2006109152A (en) Connection requesting device, response device, connection management device and communication system for performing communication on network
JP4409377B2 (en) Communication system and service providing method
JP5388088B2 (en) Communication terminal device, management device, communication method, management method, and computer program.
JP6056970B2 (en) Information processing apparatus, terminal, information processing system, and information processing method
JP4181951B2 (en) Content distribution system
JP2005303784A (en) Server device, request issuing equipment, request accepting equipment, communication system, communication method, and program
JP2009081710A (en) Communication apparatus and communication method used for communication apparatus
KR20070017329A (en) Method and system for proxy-based secure end-to-end tcp/ip communications
JP2005311747A (en) Server device, request issuing apparatus, request accepting apparatus, communication system, and program
JP2004056325A (en) Home gateway and communication method of home network
JP4330014B2 (en) Protocol proxy system
KR100738353B1 (en) Apparatus and its method of optimizing security of the home network