WO2010116642A1

WO2010116642A1 - Monitoring system and communication management device

Info

Publication number: WO2010116642A1
Application number: PCT/JP2010/002119
Authority: WO
Inventors: 藤沢正幸
Original assignee: セコム株式会社
Priority date: 2009-03-30
Filing date: 2010-03-25
Publication date: 2010-10-14
Also published as: CN102378982A; KR101516708B1; JP4781447B2; CN102378982B; KR20120028298A; JP2010233167A

Abstract

A communication management device (11) is connected to a plurality of terminals. The plurality of terminals are a monitoring device (15) and a user device (17). When communication between terminals is performed, a connection source terminal transmits an invitation message of SIP to the communication management device (11). The communication management device (11) is provided with a permission information storage unit (101) which stores connection permission information storing a combination of terminals which should be permitted for connection, in addition to the SIP server (37); and a permission processing unit (103) which permits a connection between terminals with reference to the connection permission information. When the SIP server (37) acquires the invitation message from the connection source terminal, if the permission processing unit (103) permits the connection between the connection source and connection destination terminals, the SIP server (37) supplies the invitation message from the connection source terminal to the connection destination terminal. Thereby, a monitoring system capable of improving the security when applying the SIP to the monitoring system is provided.

Description

Monitoring system and communication management device

The present invention relates to a monitoring system in which a terminal to be monitored that acquires monitoring information and a terminal on the user side that acquires and uses the monitoring information are communicably connected.

2. Description of the Related Art Conventionally, a monitoring system has been put into practical use, in which a monitoring camera is installed at a monitoring target such as a store or a factory, and a monitoring image is remotely monitored. The surveillance video is sent to the remote surveillance center and to the office of the owner to be monitored. A general public line such as ISDN is used for transmission of surveillance video (for example, Patent Document 1).

In recent years, with the spread of broadband lines such as ADSL and FTTH, there is a growing need for realizing transmission and reception of surveillance video and the like in a surveillance system over the Internet. Use of the Internet can be expected to reduce costs and improve system flexibility.

As a technology for transmitting voice and video over the Internet, a protocol called SIP (Session Initiation Protocol) is known. SIP is applied to IP phones, video conferences, and the like. In order to connect two bases by SIP, the address of each base is registered in the SIP server. This enables SIP communication between sites where addresses are registered.

However, when trying to apply SIP to a surveillance system, there are security issues. That is, high security is required in a monitoring system that monitors a video or the like to be monitored from the outside. On the other hand, in SIP, arbitrary locations can be connected by registering an address. Therefore, applying SIP as it is to a monitoring system is not desirable from the viewpoint of security.

For example, it is assumed that the monitoring target is a store and terminals of a plurality of stores are connected to the monitoring center. The monitoring center is also connected to the terminal of the owner of each store. In this case, the terminals of each store should be able to connect only to the terminals of the corresponding owner.

However, in the conventional SIP, connection is possible between any terminals whose address is registered in the SIP server. The SIP server can perform password and ID authentication as a basic authentication function. However, this is limited to authentication between the terminal and the SIP server. Once the connection between the terminal and the SIP server is permitted, the combination of the terminals via the SIP server can not be restricted. Therefore, the connection between the shop terminal and the owner terminal can not be restricted. Therefore, there is a possibility that the owner can obtain monitoring information of other stores.

JP 2001-54102 A

The present invention has been made under the above background. An object of the present invention is to provide a monitoring system that can improve the security when applying SIP to the monitoring system.

One aspect of the present invention is a monitoring system, which has a plurality of terminals communicating monitoring information, and a communication management device managing communication of a plurality of terminals, each of the plurality of terminals Is a monitoring system provided on the monitoring target side or on the user side using monitoring information received from the monitoring target, and when one of a plurality of terminals requests connection to another terminal, the terminal of the connection source Is configured to send an invitation message of SIP including identification information of a terminal of connection destination to the communication management apparatus, and the communication management apparatus is a connection authorization information indicating a combination of a SIP server and a terminal whose connection should be authorized. The authorization server stores the authorization information, and the authorization processing unit which determines whether to authorize the connection between the terminals by referring to the connection authorization information, and the SIP server receives the invitation message from the terminal of the connection source. When acquired The identification information of the connection destination terminal included in the invitation message is supplied to the authorization processing unit, and when the authorization processing unit authorizes the connection between the terminals, the SIP server transmits the invitation message from the connection source terminal to the connection destination terminal Supply to.

Another aspect of the present invention is a communication management apparatus, which is a communication management apparatus for managing communication of a plurality of terminals communicating monitoring information, and connection with the SIP server should be authorized. The SIP server includes an authorization information storage unit storing connection authorization information representing a combination of terminals, and an authorization processing unit that determines whether to authorize connection between the terminals by referring to the connection authorization information. When an SIP invitation message including identification information to another terminal is acquired from one of a plurality of terminals, the authorization processing unit determines, based on the identification information of the connection destination terminal included in the invitation message, between the terminals. If the authorization processing unit authorizes the connection, the SIP server supplies an invitation message from the terminal of the connection source to the terminal of the connection destination.

As described below, there are other aspects of the present invention. Accordingly, the disclosure of the present invention is intended to provide some aspects of the present invention, and is not intended to limit the scope of the invention described and claimed herein.

FIG. 1 is a diagram showing the overall configuration of the monitoring system of the present invention. FIG. 2 is a block diagram more specifically showing the configuration of the monitoring system. FIG. 3 is a block diagram showing the main configuration of the monitoring system of the present invention. FIG. 4 is a diagram showing an example of a table of connection authorization information stored in the authorization information storage unit. FIG. 5 is a diagram showing an operation when performing communication between terminals in the monitoring system. FIG. 6 is a diagram showing an operation in which the monitoring apparatus serves as a connection source and performs communication between terminals. FIG. 7 is a diagram showing an operation in which the user apparatus is a connection source and performs communication between terminals.

The detailed description of the present invention will be described below. However, the following detailed description and the attached drawings do not limit the invention.

The present invention has a plurality of terminals for communicating monitoring information and a communication management device for managing communication of the plurality of terminals, and each of the plurality of terminals utilizes the monitoring information received from the monitoring target side or the monitoring target In a monitoring system provided on the user side, when one of a plurality of terminals requests connection to another terminal, the terminal of the connection source transmits an SIP invitation message including identification information of the terminal of the connection destination. The communication management apparatus is configured to transmit data to the communication management apparatus, and the communication management apparatus refers to the authorization information storage unit storing connection authorization information representing the combination of the SIP server and the terminal to which connection should be authorized, and the connection authorization information. And an authorization processing unit that determines whether to authorize the connection between the terminals, and the SIP server acquires identification information of the connection destination terminal included in the invitation message when the SIP server acquires the invitation message from the connection source terminal. Authority It is supplied to the parts, if the authorization unit is authorized to connect between terminals and supplies SIP server the invitation message from the connection source terminal to the destination terminal.

As described above, according to the present invention, a plurality of terminals of a monitoring system are connected to a communication management apparatus provided with a SIP server. Whether the communication management apparatus authorizes the connection between the terminals with reference to the connection authorization information and an authorization information storage unit storing connection authorization information representing a combination of terminals to be authorized for connection in addition to the SIP server And an authorization processing unit for determining In SIP signaling, an invitation message is sent from the terminal of the connection source to the SIP server. At this time, in the present invention, the authorization processing unit determines whether to authorize the connection. When the authorization processing unit authorizes the connection, the SIP server sends an invitation message from the connection source terminal to the connection destination terminal, and SIP signaling succeeds.

As described above, according to the present invention, information on a combination of terminals to which connection should be authorized is stored in advance, and authorization of connection between terminals is performed at the time of SIP signaling. In this way, not only authentication between the terminal and the SIP server, but authorization between terminals via the SIP server, that is, P2P can be performed, and users of the monitoring information can be suitably restricted. Thus, the security in applying SIP to the monitoring system can be improved.

The connection destination terminal may transmit a SIP OK message to the communication management device when receiving the invitation message from the communication management device, and the invitation message and the OK message indicate the connection source and connection destination terminals after establishing the SIP session. Connection establishment information used to establish an end-to-end connection not via the communication management device may be added.

Thus, after the SIP session is established, monitoring information can be communicated between the terminals without passing through the communication management device. In the present invention, two-step communication is performed. The first stage communication is SIP and is performed via the communication management device. The second stage communication is an inter-terminal connection not via the communication management device. Signaling is performed during SIP connection, and an invitation message and an OK message are exchanged in the signaling. The present invention uses SIP signaling messages to exchange connection establishment information for establishing an end-to-end connection. Thus, terminal-to-terminal connection can be performed using SIP well. Then, the amount of communication between the communication management device and the terminal can be reduced, and the load on the communication management device can be reduced.

The end-to-end connection not via the communication management apparatus may be an end-to-end VPN that establishes and connects a VPN between the ends. Thereby, security can be enhanced by applying VPN (Virtual Private Network) to communication between terminals (second communication after the above-described SIP connection). Two-way message exchange in SIP signaling is suitably used for exchanging information necessary for establishing a VPN connection.

The invitation message may include the IP address of the connection source terminal and the electronic certificate as connection establishment information, and the OK message may include the IP address of the connection destination terminal and the electronic certificate as connection establishment information. In this way, SIP can be suitably used to exchange information used for VPN connection and secure communication can be performed between terminals.

The communication management device may be provided in a monitoring center that monitors a monitoring target using communication with a plurality of terminals. Thereby, communication between the monitoring center and the terminal and communication between the terminals can be suitably performed using the communication management device.

The connection between the communication management device and the plurality of terminals may be made by the VPN between center terminals establishing a VPN between the communication management device and the plurality of terminals, and the SIP server communicates with the plurality of terminals via the VPN between center terminals. SIP messages may be communicated. Thereby, SIP communication is performed on the VPN between center terminals. In the foregoing, it has been described that VPN connection is made between the terminals after establishing the SIP session. The center-to-center terminal VPN here is a VPN between the center and each terminal. By using the VPN between center terminals, security of communication between the monitoring center and each terminal can be secured, and security of SIP communication can also be secured.

The monitoring information may include at least one of an image captured by the monitoring target, a monitoring signal detected by the monitoring target, and control information generated by the user. This enables communication of useful monitoring information between terminals.

Another aspect of the present invention is a communication management device that manages communication of a plurality of terminals that communicate monitoring information. This communication management apparatus determines whether or not to authorize connection between terminals with reference to the connection authorization information, and an authorization information storage unit storing connection authorization information representing a combination of a SIP server and terminals to be authorized for connection. The authorization processing unit has an authorization processing unit that determines the invitation message, and the SIP processing unit acquires an invitation message of SIP including identification information to another terminal from one of the plurality of terminals. Based on the identification information of the connection destination terminal included in, it is determined whether or not the connection between the terminals is authorized, and when the authorization processing unit authorizes the connection, the SIP server receives an invitation message from the terminal of the connection source. To the connected terminal. The various configurations described above may be applied to this aspect as well.

The present invention is not limited to the aspects of the monitoring system and the communication management device. Another aspect of the present invention is, for example, a terminal device. Furthermore, the present invention may be embodied in the form of a method, a program, or a computer readable recording medium having the program recorded thereon.

As described above, the present invention can improve security when applying SIP to a monitoring system.

Hereinafter, a monitoring system according to an embodiment of the present invention will be described with reference to the drawings.

FIG. 1 shows the overall configuration of the monitoring system of the present invention. As illustrated, in the monitoring system 1, communication is performed among the monitoring center 3, the monitoring target 5, and the user base 7. Here, the user means a user of the monitoring service of the monitoring target 5 by the monitoring system 1. In the example of the present embodiment, the monitoring target 5 is a store, and the user base 7 is an office of a store owner.

The monitoring center 3 is provided with a communication management device 11 and a plurality of center devices 13, which are communicably connected. The communication management device 11 and the plurality of center devices 13 may be geographically separated. The plurality of center devices 13 may be respectively disposed in a plurality of responsible areas. Also, the plurality of center devices 13 may share functions. For example, one center device 13 may function as a control center device that processes signals related to security, and another center device 13 may function as an image center device that mainly processes surveillance video. The number of the center device 13 may be one within the scope of the present invention.

A monitoring device 15 and a user device 17 are provided in the monitoring target 5 and the user base 7, respectively. The monitoring device 15 and the user device 17 correspond to the terminal of the present invention. The monitoring device 15 sends monitoring information to the center device 13 and the user device 17. The monitoring information is, for example, an image of the monitoring camera, and is a monitoring signal detected by the monitoring target 5. The monitoring signal is, for example, a security signal indicating occurrence of abnormality, and the security signal is generated based on a detection signal from a sensor installed in the monitoring target 5, or generated when the alarm button (switch) is operated. Be done. Also, the user device 17 sends a control signal or an audio signal to the monitoring device 15. Such a signal from the user device 17 to the monitoring device 15 is also included in the monitoring information.

In FIG. 1, one monitoring target 5 and one user site 7 are shown. However, in practice, the monitoring center 3 communicates with the plurality of monitoring targets 5 and the plurality of user bases 7. Therefore, the communication management device 11 also communicates with the plurality of monitoring devices 15 and the plurality of user devices 17. Each monitoring device 15 communicates with the associated user device 17 (the terminal of the store owner).

According to the monitoring system 1 of FIG. 1, for example, it is assumed that the monitoring device 15 detects an abnormality based on a sensor signal or the like. In this case, a security signal as monitoring information is transmitted to the monitoring center 3 together with the video of the monitoring target 5. In the monitoring center 3, the operator confirms the guard signal and the image on the monitor of the center apparatus 13, and issues a necessary instruction to the guard. The guard who received the instruction rushes to the monitoring target 5 to deal with the abnormality.

Further, for example, the monitoring device 15 sends the video or the like of the monitoring target 5 to the user device 17 periodically or according to other settings. For example, when a visitor is detected by the sensor, an image or the like is sent to the user device 17. In addition, transmission of a video or the like may be requested from the user device 17. The owner can grasp the situation of the store by the image etc. In addition, the owner can send a voice or the like from the user device 17 to the monitoring device 15, and can instruct the store clerk with necessary items.

Next, the communication form of the monitoring system 1 will be described. The communication management device 11, the monitoring device 15, and the user device 17 are connected to the Internet.

Furthermore, the communication management device 11 is connected to the monitoring device 15 and the user device 17 by an inter-center terminal VPN (Virtual Private Network) 21 over the Internet. In order to construct the inter-center terminal VPN 21, the communication management apparatus 11 is provided with a VPN server function, and the monitoring apparatus 15 and the user apparatus 17 are provided with a VPN client function. In VPN, a VPN tunnel is constructed, encrypted communication is performed, and high security is realized.

Also, the monitoring device 15 and the user device 17 perform SIP communication 23 via the communication management device 11. The SIP communication 23 is performed via the above-described center-to-center VPN 21. The communication management apparatus 11 is provided with a SIP server function.

Further, the monitoring device 15 and the user device 17 are directly connected by the inter-terminal VPN 25 without passing through the communication management device 11. In order to construct the end-to-end VPN 25, the user apparatus 17 is provided with a VPN server function, and the monitoring apparatus 15 is provided with a VPN client function.

Here, the center-to-center terminal VPN 21 is always connected to construct a VPN tunnel, and is used for communication between the center device 13 and the monitoring device 15 and the user device 17. On the other hand, the end-to-end VPN 25 is constructed only when necessary.

The reason for using the end-to-end VPN 25 will be described. The surveillance system 1 communicates large-volume data such as video. When the inter-center terminal VPN 21 is used for all communications, the load on the communication management apparatus 11 becomes enormous. Therefore, by performing communication between the monitoring device 15 and the user device 17 by the inter-terminal VPN 25, the load on the communication management device 11 is reduced while securing security.

In addition, the role of the SIP communication 23 in the present embodiment is special, which is different from ordinary IP telephones and the like. That is, in the present embodiment, SIP signaling is regarded as processing for preparation before VPN connection. More specifically, signaling is performed when establishing a SIP 23 session. Two-way communication is performed by this signaling, and an invitation message and an OK message are exchanged. On the other hand, in order to establish a VPN connection, it is necessary to exchange information. In the present embodiment, the IP address and the electronic certificate are exchanged. The electronic certificate is used when verifying the legitimacy of the electronic signature or the like, and is issued by a trusted third party. Therefore, the signaling of the SIP communication 23 is used as a means of information exchange for establishing a VPN connection.

The overall configuration of the monitoring system 1 has been described above. As described above, in the present embodiment, two types of VPNs are used. One connects the communication management device 11 and a terminal (monitoring device 15 or user device 17), and the other connects the terminals (monitoring device 15 and user device 17). Therefore, in FIG. 1, in order to distinguish these two VPNs, terms such as the inter-center terminal VPN 21 and the inter-terminal VPN 25 are used. However, the terms simply VPN21 and VPN25 may be used.

Next, the configuration of the monitoring system 1 will be more specifically described with reference to FIG. The communication management apparatus 11 includes a firewall 31, an HTTP server 33, a VPN server 35, a SIP server 37, a STUN server 39, an account management server 41, a database 43, and a log server 45.

The firewall 31 is a device that blocks data other than communication data used between the communication management device 11 and the monitoring device 15 and the user device 17. The HTTP server 33 is a configuration for Internet connection. The VPN server 35 is a server that performs authentication and encryption for establishing a VPN tunnel.

The VPN server 35 is configured to realize the inter-center terminal VPN 21, constructs a VPN between the communication management device 11 and the monitoring device 15, and constructs a VPN between the communication management device 11 and the user device 17. . The signal from the monitoring device 15 is decoded by the VPN server 35 and transmitted to the center device 13. Also, the signal from the center device 13 is encrypted by the VPN server 35 and transmitted to the monitoring device 15. Also, when the communication management apparatus 11 sends a signal to the monitoring apparatus 15, encryption is performed by the VPN server 35. Also in the communication between the communication management apparatus 11 and the user apparatus 17, the VPN server 35 similarly performs encryption and decryption.

The SIP server 37 processes signaling according to the SIP protocol, and connects the monitoring device 15 and the user device 17. The SIP server 37 performs the function of SIP connection control when the user device 17 requests a connection from the monitoring device 15 or when the monitoring device 15 requests a connection from the user device 17.

In SIP signaling, messages are exchanged. Specifically, an INVITE (invited) message and an OK message are exchanged. This message exchange is used to exchange IP addresses and electronic certificates for establishing a VPN connection, as described above.

The STUN server 39 provides a STUN function to support the NAT function of the monitoring device 15 and the router of the user device 17.

The account management server 41 is a server that manages various types of information such as authentication. Information to be managed is stored in the database 43. The information to be managed includes IP line accounts, electronic certificates for VPN connection (tunnel construction), and information on key pairs. Also, in the present embodiment, authentication and authorization are performed for connection between terminals in the process of signaling of SIP. Information for this process is also held in the database 43 and used by the account management server 41. The authentication and authorization for the connection between the terminals may be performed by the SIP server itself. In this case, the authorization processing unit and the authorization information storage unit of the present invention are provided in the SIP server.

The log server 45 is a server for storing the log generated by the monitoring device 15.

The center device 13 includes a monitoring console 51 and a line connection device 53. The monitoring console 51 is connected to the communication management unit 11 via the line connection unit 53. For example, when the center device 13 is an image center, a monitoring video is supplied to the monitoring console 51 and managed by the monitoring console 51. Further, when the center device 13 is a control center, security-related information is supplied to the monitoring console 51. The surveillance video is also suitably displayed on the monitor of the control center. The monitoring video or the like may be communicated between the center devices.

Next, the monitoring device 15 will be described. The monitoring device 15 includes a controller 61, an IP line unit 63, a router 65, peripheral devices 67, a multi-line adapter 69, and a PC (personal computer) 71 to be monitored.

The controller 61 is configured by a computer, and cooperates with the peripheral device 67 to realize a monitoring function. The controller 61 is connected to the monitoring center 3 via the IP line unit 63. The controller 61 is also connected to the user device 17 via the IP line unit 63.

In FIG. 2, a surveillance camera 73, a sensor 75 and an alarm button 77 are illustrated as the peripheral device 67. The controller 61 performs image recognition processing on the monitoring video to detect an abnormality. Further, the controller 61 detects an abnormality based on a detection signal input from the sensor 75. An abnormality is also detected when the alarm button 77 is pressed. Other peripherals may be used for anomaly detection. When an abnormality occurs, the controller 61 communicates with the center device 13 to transmit a guard signal and an image signal. A microphone is provided together with the surveillance camera 73, and an audio signal is also transmitted. Thus, the controller 61 implements the security function of the monitoring target 5.

The monitoring video and audio are also transmitted when requested by the center device 13. Furthermore, surveillance video and audio are also sent to the user device 17. The transmission to the user device 17 is performed, for example, periodically, and is performed according to other settings. For example, when a visitor is detected by the sensor 75, an image or the like is sent to the user device 17. Also, when requested by the user device 17, the monitoring device 15 transmits a video or the like.

The IP line unit 63 constructs a VPN tunnel for the controller 61 to communicate with the communication management apparatus 11. In addition, the controller 61 constructs a VPN tunnel for communicating with the user device 17. The former corresponds to the VPN between center terminals, and the latter corresponds to the VPN 25 between terminals. In these connections, the IP line unit 63 implements the function of the VPN client.

In FIG. 2, the IP line unit 63 is shown as an internal configuration of the controller 61. This represents the physical arrangement. As a communication configuration, the IP line unit 63 is disposed between the controller 61 and the router 65. The IP line unit 63 is LAN-connected to the controller 61 by Ethernet (registered trademark). The router 65 is a router for a broadband line.

The multi-line adapter 69 is connected to the center device 13 via a mobile phone network. The multi-line adapter 69 is used to transmit a guard signal when the broadband line is disconnected. A security signal is sent from the controller 61 to the multi-line adapter 69 via the IP line unit 63 and is sent from the multi-line adapter 69 to the center device 13.

The monitoring target PC 71 is a PC installed in the monitoring target 5. In the example of the present embodiment, the monitoring target 5 is a store. Therefore, the monitoring target PC 71 may be a shop PC.

Next, the user device 17 will be described. The user device 17 includes a VPN termination device (hereinafter, VTE) 81, a router 83, and a user PC (personal computer) 85.

The VTE 81 is a line termination device for broadband connection. Then, the VTE 81 constructs a VPN tunnel with the VPN server 35 of the communication management apparatus 11, and constructs a VPN tunnel with the IP line unit 63 of the monitoring apparatus 15. In the former, VTE 81 functions as a VPN client, and in the latter, VTE 81 functions as a VPN server. The router 83 is a router for a broadband line.

The VTE 81 is connected to the user PC 85. The VTE 81 transfers the video, audio and control signal received from the controller 61 of the monitoring device 15 to the user PC 85. The VTE 81 also transfers the voice and control signal received from the user PC 85 to the controller 61.

In the present embodiment, the user base 7 is an office or the like of the shop owner. Therefore, the user PC 85 may be a shop owner's PC. The user PC 85 is used by the owner to watch the surveillance video of the surveillance target 5. In order to provide this function, application software capable of displaying and switching the monitoring image of the monitoring target 5 by communicating with the controller 61 is installed in the user PC 85.

In the present embodiment, the user device 17 is fixed. However, the function of the user device 17 may be incorporated in a portable terminal or the like to be movable.

The overall configuration of the monitoring system 1 has been described above. Next, the configuration according to the feature of the present invention will be described.

FIG. 3 is a part of the monitoring system 1 shown in FIGS. 1 and 2 and shows the main part of the present invention. In FIG. 3, the elements described in FIG. 1 and FIG. 2 are given the same reference numerals.

As shown in FIG. 3, the communication management apparatus 11 includes an authorization information storage unit 101 and an authorization processing unit 103 in addition to the VPN server 35 and the SIP server 37. The authorization information storage unit 101 stores connection authorization information representing a combination of terminals (the monitoring device 15 and the user device 17) whose connection should be authorized. Then, the authorization processing unit 103 refers to the connection authorization information to determine whether to authorize the connection between the terminals. The authorization information storage unit 101 and the authorization processing unit 103 are realized by the database 43 and the account management server 41 of FIG.

FIG. 4 shows an example of connection authorization information to be stored in the authorization information storage unit 101. In this example, the connection authorization information is a table representing a combination of terminal IDs. In this table, each user (store owner), monitoring device ID (ID of monitoring device 15), and user device ID (ID of user device 17) are associated. The monitoring device ID and the user device ID may be any information that can identify the monitoring device 15 and the user device 17. In an example described later, the monitoring device ID is the ID of the IP line unit 63, and the user device ID is the ID of the VTE 81.

One owner may have multiple stores. In this case, one monitoring device 15 is combined with a plurality of user devices 17. In the example of FIG. 4, the user C has two stores, and two monitoring devices 15 (C01, C02) are associated with the user device 17 (C11). In addition, when one owner uses a plurality of user devices 17, one monitoring device 15 may be associated with a plurality of user devices 17.

Returning to FIG. 3, in the monitoring device 15, the IP line unit 63 has a SIP processing unit 111, a VPN processing unit 113, and a storage unit 115. The SIP processing unit 111 and the VPN processing unit 113 perform processing related to SIP and VPN, respectively. The storage unit 115 stores various types of information processed by the IP line unit 63. In particular, in relation to the present invention, the storage unit 115 stores the IP address of the IP line unit 63 and the electronic certificate. These pieces of information correspond to the connection establishment information of the present invention, and are provided to the connection partner for VPN connection. Further, the storage unit 115 stores an IP line unit ID (ID of the IP line unit 63), and this IP line unit ID is used as the ID of the monitoring target 5.

As shown in FIG. 3, the VTE 81 of the user device 17 also has a SIP processing unit 121, a VPN processing unit 123, and a storage unit 125. The storage unit 125 stores the IP address of the VTE 81 and the electronic certificate. In addition, the storage unit 125 stores VTE-ID (ID of VTE 81).

Next, the operation of the present embodiment will be described. Here, an operation at the time of establishing the end-to-end VPN 25, that is, an operation at the time of performing a VPN connection between the monitoring device 15 and the user device 17 will be described.

First, an outline of the operation will be described. As described above, the inter-center terminal VPN 21 is always established between the communication management device 11 and the monitoring device 15. Between the communication management device 11 and the user device 17 also, an inter-center terminal VPN 21 is constantly established. The inter-terminal VPN 25 is constructed directly between the monitoring device 15 and the user device 17 by the following operation separately from the inter-center-terminal VPN 21.

When the end-to-end VPN 25 is connected, exchange of information is performed. In the present embodiment, the IP address and the electronic certificate are exchanged between the monitoring device 15 and the user device 17. As a means of this information exchange, this embodiment focuses on SIP. In SIP signaling, messages are exchanged between terminals. The above IP address and electronic certificate are incorporated into these SIP messages. Thereby, in the signaling process of SIP, the information exchange for the preparation of construction of VPN25 between terminals can be performed.

In the basic function of SIP, SIP connection is established between arbitrary addresses registered in the SIP server 37. In this case, the monitoring device 15 may be connected to the unrelated user device 17, which is not desirable in terms of security. Taking this point into consideration, in the present embodiment, signaling is performed as follows. In the following, one of the monitoring device 15 and the user device 17 is used as a SIP connection source terminal, and the other is used as a SIP connection destination terminal. Further, the SIP message is transmitted on the inter-center terminal VPN 21.

Referring to FIG. 5, first, the connection source terminal sends an INVITE message (specifically, a SIP INVITE message, hereinafter the same) to the SIP server 37 (S1). In the INVITE message, the ID of the connection source terminal and the ID of the connection destination terminal, and the IP address and the electronic certificate of the connection source terminal are added.

When the SIP server 37 receives the INVITE message, the SIP server 37 supplies the ID of the connection source terminal and the ID of the connection destination terminal to the authorization processing unit 103, and inquires the authorization processing unit 103 whether the connection source terminal and connection destination terminal can be connected. (S3). The authorization processing unit 103 refers to the connection authorization information of the authorization information storage unit 101, and determines whether or not to authorize the connection (S5). If the combination of the connection source terminal and the connection destination terminal is registered in the authorization information storage unit 101, the connection is authorized.

The SIP server 37 receives the authorization result from the authorization processing unit 103 (S7). When the connection is approved by the authorization processing unit 103, the SIP server 37 transmits an INVITE message to the connection destination terminal (S9). This INVITE message includes the IP address of the connection source terminal and the electronic certificate.

When the connection destination terminal receives the INVITE message, it sends an OK message (specifically, a SIP 200 OK message, hereinafter the same) to the SIP server 37 (S11). The IP address of the connection destination terminal and the electronic certificate are added to the OK message. This OK message is transmitted to the connection source terminal via the SIP server 37 (S13). Thus, the IP address and the electronic certificate are exchanged by SIP signaling. Then, when attempting to establish a VPN between the terminals, authentication is performed using the electronic certificate included in the connection request and the electronic certificate exchanged earlier, and the inter-terminal VPN 25 is constructed (S15).

As described above, in the present embodiment, when the INVITE message is received by the SIP server 37, processing for authorizing the combination of terminals is performed. If the connection is not authorized, the INVITE message is not sent to the destination terminal, and neither the SIP processing nor the VPN processing is performed. Only when the combination of the monitoring device 15 and the user device 17 is correct, the connection is authorized, an INVITE message is sent to the connection destination terminal, the subsequent SIP processing is performed, and the VPN connection is finally possible. .

Next, details of the operation of the monitoring system 1 will be described with reference to FIGS. 6 and 7. Here, first, the case where the monitoring device 15 is a connection source terminal will be described, and then, the case where the user device 17 is a connection source will be described.

In the time chart of FIG. 6, the controller 61 and the IP line unit 63 have the configuration of the monitoring device 15, and the SIP server 37 and the authorization information storage unit 101 (account management server 41) have the configuration of the communication management device 11. The user PC 85 is a configuration of the user device 17.

The controller 61 sends a connection instruction (P2P connection instruction) including the VTE-ID (ID of the VTE 81) to the IP circuit unit 63 (S101). Here, the VTE-ID is used as the connection destination terminal ID.

The IP line unit 63 reads the IP line unit IP address (the IP address of the IP line unit 63) and the IP line unit individual certificate from the storage unit 115. The IP circuit unit individual certificate is an electronic certificate assigned to each IP circuit. Also, the IP line unit 63 reads the IP line unit ID (ID of the IP line unit 63) as the connection source terminal ID from the storage unit 115. Then, the IP circuit unit 63 adds these pieces of information to the INVITE message, and sends the INVITE message to the SIP server 37 (S103). Specifically, the INVITE message includes an IP line unit IP address, an IP line unit ID, a VTE-ID, and an IP line unit individual certificate.

The SIP server 37 receives the INVITE message, transmits the IP circuit unit ID and the VTE-ID to the authorization processing unit 103, and inquires whether to authorize the connection (S105). The authorization processing unit 103 refers to the connection authorization information of the authorization information storage unit 101, and determines whether to authorize the connection (S107). Here, the table of FIG. 4 is read out. Then, the authorization processing unit 103 determines whether the combination of the terminal IDs of the inquiry is registered in the table. If the corresponding combination is registered, the authorization processing unit 103 authorizes the connection. The authorization result is transmitted from the authorization processing unit 103 to the SIP server 37 (S109). When the authorization processing unit 103 authorizes the connection, the SIP server 37 transmits an INVITE message to the VTE 81 (S111). The IP line unit IP address and the IP line unit individual certificate are added to the INVITE message.

In the above process, if the connection is not approved in step S107, the SIP server 37 does not send the INVITE message to the VTE 81. Therefore, subsequent processing of SIP is not performed, and further subsequent VPN connection is not performed.

When the VTE 81 receives the INVITE message, the VTE 81 holds the IP circuit unit IP address and the IP circuit unit individual certificate in the storage unit 125, and inquires of the user PC 85 for a connection request (P2P connection request) (S113). An IP line unit IP address is added to this connection request. Then, the user PC 85 sends a connection response to the VTE 81 (S115).

The VTE 81 reads out the VTE-IP address (the IP address of the VTE 81) and the VTE individual certificate (the electronic certificate allocated to the VTE 81) from the storage unit 125. Then, the VTE 81 transmits an OK message to the SIP server 37 (S117). The VTE-IP address and VTE individual certificate are added to this OK message.

The SIP server 37 transmits an OK message to the IP circuit unit 63 together with the VTE-IP address and the VTE individual certificate (S119). When the IP line unit 63 receives the OK message, it holds the VTE-IP address and VTE individual certificate in the storage unit 115, sends an ACK message to the SIP server 37 (S121), and the SIP server 37 further sends an ACK message. It is sent to the VTE 81 (S123).

In the above process, the IP line unit 63 obtains the IP address and the electronic certificate of the VTE 81. Also, the VTE 81 has acquired the IP address of the IP line unit 63 and the electronic certificate. Therefore, the other party is recognized using these pieces of information, and it becomes possible to establish a VPN connection between the IP circuit unit 63 and the VTE 81. This is the end-to-end VPN 25.

As illustrated, the IP line unit 63 makes a VPN connection request to the VTE 81 (S125). Here, a VPN connection is directly required without going through the SIP server 37. The VTE 81 performs authentication using the IP line unit individual certificate included in the VPN connection request and the individual certificate of the IP line unit held in the storage unit 125, and uses incoming information including the IP line unit IP address of the other party. It sends to the person's PC 85 (S127). The IP line unit IP address is used by the user PC 85 for VPN communication. Also, the VTE 81 notifies the IP circuit unit 63 that it has processed the VPN connection as a VPN server (S129). The IP line unit 63 notifies the controller 61 that the connection result is OK, and notifies the controller 61 of the VTE-IP address of the other party (S131). The VTE-IP address is used by the controller 61 for VPN communication. Thus, the VPN connection is established, and the information is communicated via the end-to-end VPN 25. Monitoring video and audio are provided from the monitoring device 15 to the user device 17.

Next, a case where the user device 17 is a connection source will be described with reference to FIG. For example, it is assumed that the user (owner) inputs an instruction to display an image to the user PC 85, for example. The user PC 85 sends a connection instruction (P2P connection instruction) including the IP circuit unit ID to the VTE 81 (S201). Here, the IP line unit ID is used as the ID of the connection destination terminal.

The VTE 81 reads the VTE-IP address and the VTE individual certificate from the storage unit 125. Further, the VTE 81 reads the VTE-ID as the connection source terminal ID from the storage unit 125. Then, the VTE 81 adds the information to the INVITE message, and sends the INVITE message to the SIP server 37 (S203). Specifically, the INVITE message includes a VTE-IP address, a VTE-ID, an IP circuit unit ID, and a VTE individual certificate.

The SIP server 37 receives the INVITE message, transmits the VTE-ID and the IP circuit unit ID to the authorization processing unit 103, and inquires whether to authorize the connection (S205). The authorization processing unit 103 refers to the connection authorization information of the authorization information storage unit 101 in the same manner as described above, determines whether to authorize the connection (S207), and sends the authorization result to the SIP server 37 (S209). That is, if the combination of VTE-ID and IP line unit ID is registered, the connection is authorized. When the authorization processing unit 103 authorizes the connection, the SIP server 37 transmits an INVITE message to the IP circuit unit 63 (S211). The VTE-IP address and the VTE individual certificate are added to this INVITE message.

In the above process, if the connection is not approved in step S207, the SIP server 37 does not send the INVITE message to the IP circuit unit 63. Therefore, subsequent processing of SIP is not performed, and further subsequent VPN connection is not performed.

When the IP line unit 63 receives the INVITE message, the IP line unit 63 holds the VTE-IP address and the VTE individual certificate in the storage unit 115. Also, the IP line unit 63 inquires the controller 61 of a connection request (P2P connection request) (S213). The VTE-IP address is added to this connection request. Then, the controller 61 sends a connection response to the IP line unit 63 (S215).

The IP line unit 63 reads the IP line unit IP address and the IP line unit individual certificate from the storage unit 115. And. The IP line unit 63 transmits an OK message to the SIP server 37 (S217). The IP line unit IP address and IP line unit individual certificate are added to the OK message.

The SIP server 37 transmits an OK message to the VTE 81 together with the IP circuit unit IP address and the IP circuit unit individual certificate (S219). When the VTE 81 receives the OK message, the VTE 81 holds the IP line unit IP address and the IP line unit individual certificate in the storage unit 125, and sends an ACK message to the SIP server 37 (S221). The establishment of the connection is notified (S223). The SIP server 37 transmits an ACK message to the IP circuit unit 63 (S225).

In the above process, the IP address and the electronic certificate are exchanged between the IP line unit 63 and the VTE 81. When the IP line unit 63 receives the ACK message, it makes a VPN connection request to the VTE 81 (S227). The VPN connection is performed without the SIP server 37. The VTE 81 sends incoming information including the VTE-IP address of the other party to the user PC 85 (S229). Also, the VTE 81 notifies the IP circuit unit 63 that it has processed the VPN connection as a VPN server (S231). The IP line unit 63 sends the incoming call information including the VTE-IP address of the other party to the controller 61 (S233). Thus, the VPN connection is established, and the information is communicated via the end-to-end VPN 25.

As shown in FIG. 6 and FIG. 7, in the process of both figures, the VPN connection request is sent from the IP circuit unit 63 to the VTE 81. The reason is as follows. In VPN, a connection request needs to be sent from the client to the server. In the present embodiment, the function of the VPN server is provided only in the VTE 81. Therefore, a VPN connection request is sent from the IP circuit unit 63 to the VTE 81 in both of FIG. 6 and FIG.

The preferred embodiments of the present invention have been described above. According to the present embodiment, a plurality of terminals (the monitoring device 15 and the user device 17) are connected to the communication management device 11 provided with the SIP server 37. As shown in FIG. 3, the communication management apparatus 11 has an authorization information storage unit 101 and an authorization processing unit 103 in addition to the SIP server 37. In SIP signaling, an INVITE (invited) message is sent from the terminal of the connection source to the SIP server. At this time, the authorization processing unit 103 determines whether to authorize the connection. Only when the authorization processing unit 103 authorizes the connection, the SIP server 37 sends an INVITE message from the connection source terminal to the connection destination terminal, and SIP signaling succeeds.

As described above, according to the present invention, information on a combination of terminals to which connection should be authorized is stored in advance, and authorization of connection between terminals is performed at the time of SIP signaling. Thus, not only authentication between the terminal and the SIP server 37, but authorization between terminals via the SIP server 37, that is, P2P can be performed, and users of the monitoring information can be suitably restricted. Thus, the security in the case of applying the SIP to the monitoring system 1 can be improved.

Further, in the present invention, connection establishment information used for establishing an end-to-end connection not via the communication management apparatus 11 may be added to the exchange of the INVITE message and the OK message in the signaling of SIP. Thus, connection establishment information can be exchanged between terminals, and an inter-terminal connection can be established. In this manner, terminal-to-terminal connection can be made by using SIP well. Then, the amount of communication between the communication management apparatus 11 and the terminal can be reduced, and the load on the communication management apparatus 11 can be reduced.

In the present embodiment, the IP address and the electronic certificate are described as the connection establishment information as an example, but the other party may be authenticated using other information instead of the electronic certificate. For example, a common name included in the electronic certificate may be used as connection establishment information.

Further, according to the present invention, the inter-terminal connection not via the communication management apparatus 11 may be the inter-terminal VPN 25 which establishes and connects a VPN between the terminals. Bidirectional message exchange in SIP signaling can be suitably used for exchanging information necessary for establishing a VPN connection, and application of VPN can increase security.

Further, according to the present invention, the invitation message includes the IP address of the connection source terminal and the electronic certificate as connection establishment information, and the OK message includes the IP address of the connection destination terminal and the electronic certificate as connection establishment information. Good. In this way, SIP can be suitably used to exchange information used for VPN connection and secure communication can be performed between terminals.

Further, according to the present invention, the communication management device 11 may be provided in the monitoring center 3. Thereby, communication between the monitoring center 3 and the terminal and communication between the terminals can be suitably performed by using the communication management apparatus 11.

Further, according to the present invention, the connection between the communication management apparatus 11 and the plurality of terminals may be connected between the communication management apparatus 11 and the plurality of terminals by the inter-center terminal VPN 21 establishing a VPN, and the SIP server 37 SIP messages may be communicated with a plurality of terminals via the VPN between center terminals. Thereby, SIP communication is performed on the inter-center terminal VPN 21. The end-to-end VPN 25 established after the SIP session is the end-to-end VPN, whereas the inter-center end VPN 21 is a VPN between the communication management apparatus 11 and the end. By using the VPN between center terminals, security of communication between the monitoring center 3 and each terminal can be secured, and security of SIP communication can also be secured.

Further, according to the present invention, the monitoring information may include at least one of an image captured by the monitoring target 5, a monitoring signal detected by the monitoring target 5, and control information generated by the user. This enables communication of useful monitoring information between terminals.

The preferred embodiments of the present invention have been described above. However, the present invention is not limited to the above-described embodiment, and it goes without saying that those skilled in the art can modify the above-described embodiment within the scope of the present invention.

While the presently preferred embodiments of the present invention have been described, it will be appreciated that various modifications may be made to the embodiments and are within the true spirit and scope of the present invention. It is intended that the appended claims cover all such variations.

As described above, the monitoring system according to the present invention is useful for monitoring a store or the like from a remote place using communication.

Reference Signs List 1 monitoring system 3 monitoring center 5 monitoring target 7 user base 11 communication management device 13 center device 15 monitoring device 17 user device 21 VPN between center terminals
23 SIP communication 25 End-to-end VPN
33 HTTP Server 35 VPN Server 37 SIP Server 41 Account Management Server 43 Database 61 Controller 63

IP Line Unit

65, 83 Router 69 Multi-Line Adapter 73 Surveillance Camera 81 VPN Terminal Device (VTE)
85 User PC
101 Authorization Information Storage Unit 103 Authorization Processing Unit

Claims

A plurality of terminals for communicating monitoring information, and a communication management device for managing communication of the plurality of terminals, each of the plurality of terminals receiving the monitoring information received from the monitoring target side or the monitoring target It is a monitoring system provided on the user side to use,
When one of the plurality of terminals requests connection to another terminal, the connection source terminal is configured to transmit a SIP invitation message including identification information of a connection destination terminal to the communication management apparatus.
The communication management device is
SIP server,
An authorization information storage unit storing connection authorization information representing a combination of terminals to which connection is to be authorized;
An authorization processing unit that determines whether to authorize the connection between terminals by referring to the connection authorization information;
Have
The SIP server is
When the invitation message is acquired from the connection source terminal, the identification information of the connection destination terminal included in the invitation message is supplied to the authorization processing unit, and the authorization processing unit authorizes the connection between the terminals. In this case, the SIP server supplies an invitation message from the terminal of the connection source to the terminal of the connection destination.
When the terminal of the connection destination receives the invitation message from the communication management apparatus, the terminal transmits a SIP OK message to the communication management apparatus.
Connection establishment information used to establish an inter-terminal connection not via the communication management apparatus between the connection source and the connection destination after the establishment of the SIP session is added to the invitation message and the OK message. The monitoring system according to claim 1, characterized in that:
3. The monitoring system according to claim 2, wherein the end-to-end connection not via the communication management device is an end-to-end VPN that establishes and connects a VPN between the ends.
The invitation message includes the IP address of the connection source terminal and an electronic certificate as the connection establishment information, and the OK message includes the IP address of the connection destination terminal and an electronic certificate as the connection establishment information. The monitoring system according to claim 3, characterized in that
The connection between the communication management device and the plurality of terminals is connected between the communication management device and the plurality of terminals by a VPN between center terminals that establishes a VPN,
The monitoring system according to claim 1, wherein the SIP server communicates SIP messages with the plurality of terminals via the center-to-center VPN.
The monitoring information includes at least one of an image captured by the monitoring target, a monitoring signal detected by the monitoring target, and control information generated by the user. The monitoring system according to any one of 5.
A communication management apparatus that manages communication of a plurality of terminals that communicate monitoring information, comprising:
The communication management device is
SIP server,
An authorization information storage unit storing connection authorization information representing a combination of terminals to which connection is to be authorized;
An authorization processing unit that determines whether to authorize the connection between terminals by referring to the connection authorization information;
When the SIP server acquires a SIP invitation message including identification information to another terminal from one of the plurality of terminals, the authorization processing unit determines that the connection destination is included in the invitation message. Based on the identification information of the terminal, it is determined whether to authorize the connection between the terminals,
The communication management apparatus, wherein the SIP server supplies an invitation message from the terminal of the connection source to the terminal of the connection destination when the authorization processing unit approves the connection.