WO2014083653A1

WO2014083653A1 - Communication apparatus and communication system

Info

Publication number: WO2014083653A1
Application number: PCT/JP2012/080936
Authority: WO
Inventors: 大佑高橋; 栄一堀内; 高田　佳典; 善文堀田
Original assignee: 三菱電機株式会社
Priority date: 2012-11-29
Filing date: 2012-11-29
Publication date: 2014-06-05

Abstract

The present invention provides a communication apparatus that operates, as a home gateway (1), in a communication system comprising: mobile radio terminals (4) capable of connecting to a home network (3) and to a public network (2); and the home gateway (1) that is located at a point connecting the home network (3) and public network (2) and that provides a first service to the mobile radio terminals (4) on the side of the home network (3) and also provides a second service to the mobile radio terminals (4) on the side of the public network (2). When the communication apparatus operating as the home gateway (1) receives a request from that one of the mobile radio terminals (4) currently using the first service which has a security level satisfying a given condition, the communication apparatus generates and transmits, to the requesting mobile radio terminal (4), information necessary for using the second service, while setting the requesting mobile radio terminal (4) as a mobile radio terminal (4) that can use the second service.

Description

Communication apparatus and communication system

The present invention relates to a communication device that connects a public network and a home network, and a communication system including the communication device.

Due to the advancement of network technology, communication devices can be realized at low cost and in small size, and today, various types of devices are connected to the network and operate. Many appliances installed in the home are equipped with a communication function for operating in conjunction with information outside the device rather than the device alone due to the enhancement of the home network environment. For example, home appliances (hereinafter referred to as home appliances) such as televisions, recorders, and air conditioners that can be connected to a network have recently appeared.

For home appliances that can be connected to these networks, research is being conducted on M2M (Machine to Machine) technology in which devices operate in cooperation with each other, power visualization technology for power saving, and the like.

One of the functions being studied is a remote operation function from outside the house. For example, nowadays, a system for inputting reservation information from an external system to a digital recorder in a home has been realized. This digital recorder is installed in a state of being connected to a home network, but is connected to a public network via the home network and connected to a server that manages reservations of this digital recorder. The user inputs reservation information to the server, and the reservation information input to the server is transferred to the digital recorder by accessing the server from the digital recorder.

Such a control method via a server can be regarded as an indirect remote operation to home appliances. On the other hand, there is also a method of performing control directly without using a server. For example, as a method of connecting to a home network from the outside such as the Internet, a virtual private network (VPN) is connected to the home network using an encryption protocol such as IPsec (Security Architecture for Internet Protocol). This is a method of setting between a home gateway (HGW), which is a connection point with a public network, and a terminal connected to the home network, and accessing home appliances without going through a server.

When remote access using VPN is used, the control method used in the home network can be applied as it is through remote access as it is through the VPN. The advantage is that control / operation can be realized with the same interface. In particular, mobile phones called smartphones that have been rapidly spreading in recent years are equipped with a VPN client function as a standard feature, and since home appliance control apps are distributed due to increasing demand for smartphone use, The affinity to the internal and external common interface is considered high.

Here, in order to make a VPN connection to the home network, it is necessary to open a VPN server on the router or home gateway in the home. However, setting up the VPN connection requires network expertise, which is necessary for general users. The problem is that it is complicated and has a high threshold. The reason why VPN connection setting is difficult is that setting is required on both the server side and the client side. On the server side, for example, user name and password account settings and registration to the DDNS (Dynamic Domain Name System) service for server IP address resolution must be performed, and the client side also needs to be set according to the server. There is. For example, some commercially available home routers have a VPN server function, but it is necessary to manually register the setting value from the browser setting screen of the setting PC and manually set an account on the smartphone side. Manual configuration on both these routers and smartphones is considered to be a barrier for housewives and elderly people with little network knowledge. When VPN connection to the home network becomes common in the future, it is expected that housewives and elderly people will become main users. Therefore, a technique for solving this problem is necessary.

From this point of view, Patent Document 1 discloses a technology for connecting using a SIP server. This technique is called “SIP dial-up connection”, and is a technique for establishing a VPN connection when a call is made to a home gateway having a telephone function. For this reason, registration in a system for searching for an IP address such as DDNS becomes unnecessary, and it is considered that the burden on the user is reduced. However, in Patent Document 1, it is necessary to register an account by a user's hand with respect to a client terminal that actually performs a home gateway and VPN connection, which is complicated in this respect.

On the other hand, Patent Document 2 proposes a method for solving the trouble of account registration by automating account registration for VPN connection.

Japanese Patent No. 4750761 Special table 2007-538311 gazette

However, in the invention described in Patent Document 2, the setting is paid out to all the terminals that have sent the activation key, and in terms of what kind of terminal is authenticated and the account is automatically generated, There was a problem that the above issues existed.

The present invention has been made in view of the above, and it is an object of the present invention to obtain a communication device and a communication system capable of setting up a VPN connection that achieves both maintenance of high security and elimination of complexity of user work. Objective.

In order to solve the above-described problems and achieve the object, the present invention is located at a wireless terminal connectable to a home network and an external network, and a connection point between the home network and the external network. A communication apparatus that operates as the gateway in a communication system including a gateway that provides a service to the wireless terminal and provides a second service to the wireless terminal on an external network side, wherein the first service When a request is received from a wireless terminal whose security level satisfies a certain condition among wireless terminals using the service, information necessary for using the second service is generated and returned. Information management means for setting the original wireless terminal as a wireless terminal that can use the second service; And wherein the Rukoto.

According to the communication device of the present invention, the wireless terminal satisfying a certain condition is automatically set as necessary, and manual setting is not necessary. There is an effect that the complexity of the work of the person can be eliminated.

FIG. 1 is a diagram illustrating a configuration example of a communication system according to the first embodiment. FIG. 2 is a diagram illustrating a communication mode in which the mobile wireless terminal connects to the HGW using the VPN. FIG. 3 is a diagram illustrating a configuration example of the HGW. FIG. 4 is a diagram illustrating a configuration example of the mobile wireless terminal. FIG. 5 is a diagram illustrating a configuration example of the VPN account DB. FIG. 6 is a diagram illustrating a configuration example of the wireless LAN authentication setting DB. FIG. 7 is a diagram illustrating a configuration example of the account automatic generation DB. FIG. 8 is a diagram illustrating an example of a sequence for setting a VPN account in the communication system according to the first embodiment. FIG. 9 is a diagram illustrating a configuration example of a communication system according to the second embodiment. FIG. 10 is a diagram illustrating a configuration example of the HGW according to the second embodiment. FIG. 11 is a diagram illustrating a configuration example of the incoming call history DB. FIG. 12 is a diagram illustrating a configuration example of the account automatic generation DB according to the second embodiment. FIG. 13 is a diagram illustrating an example of a sequence for setting a VPN account in the communication system according to the second embodiment.

Hereinafter, embodiments of a communication apparatus and a communication system according to the present invention will be described in detail with reference to the drawings. Note that the present invention is not limited to the embodiments.

Embodiment 1 FIG.
FIG. 1 is a diagram illustrating a configuration example of a communication system according to the first embodiment. As shown in the figure, the communication system of the present embodiment includes a home gateway (HGW) 1, a public network 2, a home network 3, a portable wireless terminal 4, and in-home devices 5-7.

The HGW 1 is a gateway that connects the public network 2 as an external network and the home network 3. It also has a function to operate as a wireless LAN access point and a function to operate as a VPN server. The public network 2 is a general term for data communication networks of the Internet and mobile phones, and is often configured as an aggregate of a plurality of networks. The home network 3 is a network that accommodates home devices, and the home devices 5 to 7 are connected by a wired LAN or a wireless LAN. The portable wireless terminal 4 is connected to the HGW 1 by the wireless LAN 9. The portable wireless terminal 4 also has a function of making a VPN connection to the HGW 1 via the public network 2, and pre-setting (account setting) necessary for performing the VPN connection is described later when connecting to the wireless LAN 9. To complete the account automatic setting sequence. The in-home devices 5 to 7 are, for example, a television, a recorder, an air conditioner or the like having a function of connecting to a network.

FIG. 2 is a diagram illustrating a communication mode in which the mobile wireless terminal 4 connects to the HGW 1 using the VPN 8. As shown in FIG. 2, the portable wireless terminal 4 can remotely access devices (home devices 5 to 7) in the home network 3 by connecting to the HGW 1 using the VPN 8. In order to use the VPN 8, the mobile wireless terminal 4 needs to perform account setting for the VPN connection with the HGW 1 in the connection form shown in FIG. 1. The in-home devices 5 to 7 connected to the home network 3 can accept control from the portable wireless terminal 4 connected by VPN.

FIG. 3 is a diagram illustrating a configuration example of the HGW 1 which is a communication device according to the present invention. The HGW 1 is roughly composed of two functional blocks, a CPU board 101 and a layer 2 switch (L2SW) 102.

The L2SW 102 includes a plurality of home network connection ports 106 to 108 and an internal connection port 109. The L2SW 102 is not essential for the HGW 101 and may not be mounted depending on the configuration.

The CPU board 101 includes, as main components, a router function unit 103, other function units 104, a WAN interface 105, an internal connection port 110, a wireless LAN connection port 111, a VPN account database (DB) 112, a wireless LAN authentication setting database. (DB) 113, wireless LAN unit 114, account automatic generation unit 121, and account automatic generation database (DB) 122.

The router function unit 103 implements a communication protocol stack and functions used in each protocol, and implements a firewall function as a part of protocol stacks such as PPP 115, IPsec 116, PPPoE 117, L2TP 118, and NAPT 119, and a router function. The packet filtering function (Packet Filtering) 120 is implemented. The other function unit 104 is a processing unit that provides functions other than the functions included in the router function unit 103, and provides a setting parameter management function, a GUI function, a telephone function, and the like necessary for operating the HGW 101 as a device. To do. The WAN interface 105 is an interface for connecting to the public network, the internal connection port 110 is an interface for connecting to the L2SW 102 on the home network 3 side, and the wireless LAN connection port 111 is a connection port for the wireless LAN. The VPN account DB 112 is a database for managing accounts of users who are permitted to use the VPN remote access system (users who are permitted VPN connection to the local HGW 1), that is, user names and passwords for user authentication. The wireless LAN authentication setting DB 113 is a database for storing settings for the wireless LAN unit 114 to authenticate wireless devices. When receiving a connection request from a wireless LAN terminal such as the portable wireless terminal 4, the wireless LAN unit 114 executes terminal authentication processing, and accepts connection by wireless LAN if the authentication is successful. The account automatic generation unit 121 refers to the account automatic generation DB 122 when receiving a request from a terminal (for example, the portable wireless terminal 4) connected by the wireless LAN, and creates an account (user name, password, etc.) for VPN connection. Information) and the setting in the own device is changed so that the requesting terminal can make a VPN connection. The account automatic generation DB 122 is a database that holds settings (information) that the account automatic generation unit 121 refers to when generating an account for VPN connection.

FIG. 4 is a diagram illustrating a configuration example of the mobile wireless terminal 4. The portable wireless terminal 4 includes a public network connection function unit 401, a wireless LAN connection function unit 402, a VPN client function unit 403, an OS function unit 404, and a home appliance control S / W 405 as main components. The home appliance control S / W 405 includes a home appliance control unit 406, a VPN setting communication unit 407, a VPN client setting unit 408, and other functional units 409.

The public network connection function unit 401 is a function for connecting to a public network of a mobile line, and performs Internet data communication and telephone communication. The wireless LAN connection function unit 402 is a function for connecting to the HGW 1 and other wireless LAN access points. The VPN client function unit 403 is a function for performing VPN connection, and VPN client functions such as IPsec, L2TP (Layer 2 Tunneling Protocol), and PPTP (Point-to-Point Tunneling Protocol) are implemented. The VPN client function unit 403 may be incorporated in the home appliance control S / W 405. The OS function unit 404 includes other functions such as an OS. The home appliance control S / W 405 has a function of communicating and controlling with the in-home devices 5 to 7 in the home network, and also has a function of performing VPN automatic setting with the HGW 1. In the home appliance control S / W 405, the home appliance control unit 406 performs home appliance control. The VPN setting communication unit 407 performs VPN setting negotiation for automatically setting an account for VPN connection. The client setting unit 408 holds setting information (that is, an account for VPN connection) for operating as a VPN client. Note that the VPN setting communication unit 407 may have a function of sending information unique to the own device (portable wireless terminal 4), such as a telephone number or a MAC address, to the HGW 1. The other function unit 409 includes a general S / W function such as a GUI. When the portable wireless terminal 4 including the VPN setting communication unit 407 and the VPN client setting unit 408 is connected to the home wireless LAN, the VPN automatic setting communication unit 407 of the home appliance control S / W 405 is activated, and an account automatic setting sequence to be described later As a result, the account setting for VPN connection to the HGW 1 is automatically performed (the account setting is completed without requiring an operation such as information input by the user).

FIG. 5 is a diagram showing a configuration example of the VPN account DB 112 provided in the HGW 1 (see FIG. 3). As illustrated, the VPN account DB 112 manages “user”, “user name”, and “password” in association with each other. “User” is information for identifying the user, and “User name” and “Password” are information used in the authentication process of the associated user. In IPsec assumed in the HGW 1 of this embodiment, it is common to use a user authentication method called XAUTH. When a user name and a password are registered in advance and an IPsec client connection request is made, The received user name and password are checked, and it is determined whether or not to permit connection of the IPsec client. For example, the HGW 1 authenticates when the user name = user_1 and the password = pa *** 1 are transmitted from the portable wireless terminal 4 in the authentication process for the portable wireless terminal 4 of the user # 1 as an IPsec client. Connection is permitted as success, and connection is rejected as authentication failure otherwise. The VPN account DB 112 is described on the assumption that it holds a user account (user name and password) in such IPsec XAUTH authentication. However, depending on the implementation of the VPN function, information stored in the VPN account DB 112 (managed) Information) is not limited to this.

FIG. 6 is a diagram illustrating a configuration example of the wireless LAN authentication setting DB 113 provided in the HGW 1 (see FIG. 3). As illustrated, the wireless LAN authentication setting DB 113 manages parameters such as “wireless interface”, “SSID”, “authentication method”, and “password”. “Wireless LAN interface” is information indicating an actual wireless interface such as the wireless LAN interface 111 (see FIG. 3). “SSID” is an identifier of the wireless LAN access point and is a name given to avoid interference. The “authentication method” is an authentication method used when the wireless LAN client software performs connection authentication, and there is an encryption method such as WEP / WPS / WPS2. The “password” is a password required when a client terminal such as the mobile wireless terminal 4 connects to the wireless LAN access point, that is, a password used for connection authentication for determining whether or not to permit the connection. When receiving a connection request from the portable wireless terminal 4 or the like, the wireless LAN unit 114 of the HGW 1 refers to the wireless LAN authentication setting DB 113 and determines whether to accept the connection request. In this embodiment, the description is based on wireless LAN access point software called hostapd, but the information held in the wireless LAN authentication setting DB 113 is not limited to this depending on the implementation of the wireless LAN function.

FIG. 7 is a diagram illustrating a configuration example of the account automatic generation DB 122 provided in the HGW 1 (see FIG. 3). As shown in the figure, the automatic account creation DB 122 describes settings for automatically creating an account for VPN connection, and manages “reference DB” and “security level” as setting items. “Reference DB” indicates a database to be referred to when an account is generated. In the example of FIG. 7, the wireless LAN authentication setting DB 113 is designated. The “security level” includes “authentication method”, “password”, and the like as detailed parameters. For example, the “authentication method” describes a wireless LAN authentication method that allows automatic account generation, and the “password” describes the number of password characters that allow automatic account generation. The account automatic generation unit 121 of the HGW 1 determines whether or not an account generation request can be made based on the “reference DB” and “security level” managed by the account automatic generation DB 122. Specifically, when the information registered in the database indicated by the “reference DB” satisfies the condition set for the “security level”, the account generation request is accepted. A plurality of databases may be set in the “reference DB”. When the account automatic generation DB 122 has the contents shown in FIG. 7, the account automatic generation unit 121 refers to the wireless LAN authentication setting DB 113, and “authentication method”, “password”, and the like managed therein are stored in the account automatic generation DB 122. If the “security level” is satisfied, specifically, if the authentication method is WEP, WPA or WPA2 and the password is longer than n characters, an account generation request is accepted (a VPN account is generated). Note that depending on the implementation of the account automatic generation unit 121, the information held in the account automatic generation DB 122 is not limited to this.

FIG. 8 is a diagram illustrating an example of a sequence for setting a VPN account in the communication system according to the first embodiment.

If the VPN account setting is not completed, the portable wireless terminal 4 is not permitted to connect even if it transmits a VPN connection request to the HGW 1 via the public network 2 (steps S11 and S12). In this case, the portable wireless terminal 4 can establish a VPN connection to the HGW 1 by performing a wireless LAN connection to the HGW 1 in the home network 3 and setting a VPN account. The VPN account setting procedure is shown below.

In the VPN account setting operation, the portable wireless terminal 4 performs wireless LAN authentication by a specified authentication method such as password authentication and establishes a connection with the HGW 1 (step S21). The wireless LAN authentication is performed with reference to information registered in the wireless LAN authentication setting DB 113. Next, the portable wireless terminal 4 transmits a VPN account generation request to the HGW 1 in order to notify that the VPN connection is desired (step S22). Note that the VPN setting communication unit 407 generates and transmits a VPN account generation request.

In the HGW 1 that has received the VPN account generation request, the VPN account generation request is passed to the account automatic generation unit 121 via the wireless LAN unit 114, and the account automatic generation unit 121 first refers to the account automatic generation DB 122 (steps). S23). Here, the description will be continued assuming that the account automatic generation DB 122 has the contents shown in FIG. Since “reference DB = wireless LAN authentication setting DB” in FIG. 7, the account automatic generation unit 121 next refers to the wireless LAN authentication setting DB 113 to check whether the security level of the portable wireless terminal 4 is equal to or higher than the set value. That is, it is confirmed whether the security level of the portable wireless terminal 4 is equal to or higher than the security level set in the account automatic generation DB 122 (step S24). Here, it is assumed that the security level is equal to or higher. If the security level of the mobile wireless terminal 4 is equal to or higher than the set value, the account automatic generation unit 121 regards the identity as being confirmed in the wireless LAN connection, and generates a VPN account with this as collateral. The generated information is registered in the VPN account DB 112 (step S25). At this time, various settings necessary for permitting VPN connection to the requesting portable wireless terminal 4, such as registration in DDNS, are also performed. Note that the method for generating each piece of information included in the VPN account is not particularly defined. Any existing method may be used. Further, the wireless LAN unit 114 sends the VPN account generated by the account automatic generation unit 121 to the requesting portable wireless terminal 4 and pays it out (step S26).

When the portable wireless terminal 4 receives the VPN account as a response to the VPN account generation request transmitted in step S22, it sets the received VPN account (step S27). The VPN client setting unit 408 sets the VPN account.

8 shows an example in which it is determined in step S24 that the security level of the transmission source portable wireless terminal 4 of the VPN account generation request is equal to or higher than the set value. However, depending on the contents of the account automatic generation DB 122, the security level may be set. It may be determined that the value is less than the value. In such a case, the processing after step S25 is not executed. At this time, the HGW 1 notifies the portable wireless terminal 4 that the VPN account is not generated. In this case, the portable wireless terminal 4 and the HGW 1 use another method, for example, set a VPN account by a user's manual setting, retransmit the VPN account generation request after the security level becomes equal to or higher than the set value, etc. It is necessary to set by this method.

The portable wireless terminal 4 that has received the VPN account in steps S22 to S27 can make a VPN connection to the HGW 1 via the public network 2 (steps S31 and S32).

As described above, in the communication system according to the present embodiment, the mobile wireless terminal transmits a VPN account generation request while connected to the HGW via the wireless LAN, and the HGW that has received the VPN account generation request When it is determined that the requesting mobile wireless terminal satisfies a certain security level, a VPN account is generated. This eliminates the need for manual setting of the VPN account for portable wireless terminals that satisfy certain conditions, and reduces the complexity of the settings necessary to use the VPN. In other words, it is possible to automatically issue an account for a VPN connection service, ensuring that strong authentication is performed at the time of wireless LAN connection, and the complexity of manual VPN setting, which was a problem with the prior art, can be avoided. can be solved. In addition, security at the time of automatic account setting of the portable wireless terminal can be improved.

In the present embodiment, the home gateway has been described as an example, but the present invention can also be applied to a home router having a wireless LAN function and a VPN function.

In addition, the case of setting a VPN account has been described, but also when setting a function that requires the same procedure as that for setting a conventional VPN account, that is, a function that requires manual setting in both of the two communication devices. This embodiment can be applied.

Embodiment 2. FIG.
In the first embodiment described above, the communication device (home gateway) that performs the payment of the VPN account with the authentication strength of the wireless LAN as collateral has been described. On the other hand, the home gateway according to the present embodiment determines whether or not to issue a VPN account in consideration of other information on the HGW in addition to the authentication strength of the wireless LAN. According to the present embodiment, it is possible to further improve security at the time of automatic account setting. In the present embodiment, only parts different from the first embodiment will be described.

FIG. 9 is a diagram illustrating a configuration example of the communication system according to the second embodiment. The communication system according to the present embodiment is obtained by adding a SIP server 10 to the communication system according to the first embodiment shown in FIG. 1 and replacing HGW1 with HGW1a. The SIP server 10 is a server that relays messages transmitted and received in order to establish a session between SIP (Session Initiation Protocol) clients, and holds information on each SIP client. It is assumed that the HGW 1a and the portable wireless terminal 4 of this embodiment have a function that operates as a SIP client.

FIG. 10 is a diagram illustrating a configuration example of the HGW 1a. The HGW 1a is obtained by replacing the CPU board 101 of the HGW 1 (see FIG. 3) described in the first embodiment with a CPU board 101a. The CPU board 101 a has a configuration in which an incoming call history database (DB) 123 is added to the CPU board 101.

FIG. 11 is a diagram illustrating a configuration example of the incoming call history DB 123 provided in the HGW 1a. As shown in the figure, the incoming call history DB 123 manages “phone number” and “incoming time”. “Telephone number” is information indicating the telephone number of the other party who made a call to itself (HGW 1a), and “incoming call time” is information indicating the date and time when the incoming call was made. When there is an incoming call, the HGW 1a registers the other party's telephone number and the time (date and time) at that time in the incoming call history DB 123. Registration in the incoming call history DB 123 is performed by the other function unit 104.

In this embodiment, it is assumed that the configuration of the account automatic generation DB 122 of the HGW 1a is as shown in FIG. That is, it is assumed that the wireless LAN authentication setting DB and the incoming call history DB 123 are set as the reference DB. As in the first embodiment, the security level parameters associated with the wireless LAN authentication setting DB are “authentication method” and “password”. The security level parameter associated with the incoming call history DB 123 is “reception standby time”. The “preliminary arrival time” is the elapsed time since the incoming call. In the example of FIG. 12, the setting of “preliminary arrival time” is “within 5 minutes”. In this case, the HGW 1a has the security level (authentication method and password) associated with the wireless LAN authentication setting DB 113. A VPN account is paid out to a portable wireless terminal that satisfies the conditions and has an elapsed time of 5 minutes or less after the incoming call. It should be noted that the set value of “arrival reserve time” may be another value.

FIG. 13 is a diagram illustrating an example of a sequence for setting a VPN account in the communication system according to the second embodiment. In the sequence of FIG. 13, the same step numbers are assigned to the processes common to the sequence of the first embodiment (see FIG. 8). That is, steps S41, S42, and S24a are different processes from the first embodiment. Here, the description will focus on the parts different from the first embodiment. The configuration of the incoming call history DB 123 is as shown in FIG. 11, and the configuration of the account automatic generation DB 122 is as shown in FIG.

The portable wireless terminal 4 performs wireless LAN authentication (step S21), establishes a connection with the HGW 1a, and then makes a call to the HGW 1a. As a result, the HGW 1a receives an incoming call via the SIP server 10 (step S41). The HGW 1a that received the incoming call registers the telephone number of the caller and the date and time when the incoming call was received in the incoming call history DB 123 (step S42). The HGW 1a does not need to respond to an incoming call. Although illustration is omitted, the portable wireless terminal 4 stops the transmission when detecting that the calling of the HGW 1a is started.

Thereafter, the portable wireless terminal 4 transmits a VPN account generation request to the HGW 1a in order to notify that the VPN connection is desired (step S22). At this time, the own telephone number information is added to the VPN account generation request and transmitted.

In the HGW 1a that has received the VPN account generation request, the account automatic generation unit 121 first refers to the account automatic generation DB 122 (step S23). In the account automatic generation DB 122 of FIG. 12, since the reference DB is the wireless LAN authentication setting DB and the incoming call history DB, the account automatic generation unit 121 is set by referring to the wireless LAN authentication setting DB 113 next. It is confirmed whether the authentication method and password satisfying the conditions set in the account automatic generation DB 122. If the conditions are satisfied, the incoming call history DB 123 is referred to and the VPN account generation request is transmitted. It is checked whether an incoming call from the original portable wireless terminal 4 has occurred within a past fixed time (within 5 minutes) (step S24a). Here, it is assumed that an incoming call has been received within the past 5 minutes. That is, it is assumed that the security level of the portable wireless terminal 4 is equal to or higher than the set value set in the account automatic generation DB 122. In the case where the security level of the portable wireless terminal 4 is equal to or higher than the set value set in the account automatic generation DB 122, it is assumed that the identity is confirmed in the wireless LAN connection and the telephone number, and this is used as a collateral. Similarly, the account automatic generation unit 121 creates a VPN account and registers it in the VPN account DB 112 (step S25). The subsequent procedure is the same as in the first embodiment.

Note that the order of the databases referred to in step S24a may be changed (the incoming call history DB 123 may be confirmed first).

As described above, in the communication system according to the present embodiment, the mobile wireless terminal makes a call to the HGW before transmitting the VPN account generation request while connected to the HGW via the wireless LAN. When the HGW that has received the VPN account generation request determines that the requesting mobile wireless terminal satisfies a certain security level, the HGW generates a VPN account. According to the present embodiment, since the VPN account is not paid out unless the procedure (and telephone number) for making a call to the HGW is known, the security can be further improved as compared with the first embodiment. Can do.

As another example of improving the security level, there is a password authentication method for requesting a password when a VPN account is requested to be issued, specifically, a method for transmitting a password by a VPN account generation request. This method may be combined with the method described in the first embodiment or the method described in the second embodiment.

Embodiment 3 FIG.
In the first and second embodiments described above, the account automatic setting method of the VPN connection service has been described. However, such an automatic setting method can be applied to any service that needs to be set in both the mobile wireless terminal and the HGW. It is. For example, a system that controls home electric appliances in response to a web browser access of a portable wireless terminal from outside the house has been studied. In the case of such a system, it is necessary to create a user account on the HGW side and set the information in the browser software of the portable wireless terminal. By applying the method described in the first and second embodiments to such a service that needs to be set for both the HGW and the portable wireless terminal, manual setting by the user can be eliminated, and setting complexity can be eliminated.

As described above, the communication apparatus according to the present invention is useful as a communication apparatus having a VPN connection function, and is particularly suitable for a communication apparatus having a function of operating as a wireless LAN access point (master station).

1, 1a Home gateway (HGW), 2 public networks, 3 home networks, 4 mobile wireless terminals, 5-7 home devices, 8 VPN, 9 wireless LAN, 10 SIP server, 101, 101a CPU board, 102 layer 2 switch ( L2SW), 103 router function unit, 104 other function unit, 105 WAN interface, 106-108 home network connection port, 109, 110 internal connection port, 111 wireless LAN connection port, 112 VPN account database (DB), 113 Wireless LAN authentication setting database (DB), 114 Wireless LAN unit, 115 PPP, 116 IPsec, 117 PPPoE, 118 L2TP, 119 NAPT, 120 Packet filtering function (Packet Filtering), 121 Account automatic generation unit, 122 Account automatic generation database (DB), 123 Incoming call history database (DB), 401 Public network connection function unit, 402 Wireless LAN connection function unit, 403 VPN client function unit, 404 OS, etc. Functional part, 405 Home appliance control S / W, 406 Home appliance control part, 407 VPN setting communication part, 408 VPN client setting part, 409 Other functional part.

Claims

A wireless terminal that can be connected to a home network and an external network, and located at a connection point between the home network and the external network. The home network provides a first service to the wireless terminal, and the external network provides a second service. In a communication system comprising a gateway provided to the wireless terminal, a communication device that operates as the gateway,
When a request is received from a wireless terminal whose security level satisfies a certain condition among wireless terminals that are using the first service, information necessary for using the second service is generated. Information management means for returning and setting the requesting wireless terminal as a wireless terminal that can use the second service;
A communication apparatus comprising:
The communication apparatus according to claim 1, wherein the first service is wireless LAN communication, and the second service is a VPN connection service.
2. The control according to claim 1, wherein the first service is wireless LAN communication, and the second service is control by a web browser access for a home appliance connected to the home network. Communication device.
An incoming call history database for acquiring and storing the telephone number of the other party and the time of occurrence of the incoming call when an incoming call occurs;
Further comprising
The information management means has a constant security level when the request signal from the wireless terminal includes the telephone number information of the wireless terminal and an incoming call from the wireless terminal has occurred within a certain past time. The communication apparatus according to claim 1, 2 or 3, wherein it is determined that the condition is satisfied.
A wireless terminal connectable to a home network and an external network;
A gateway that is located at a connection point between a home network and an external network, provides a first service to the wireless terminal on the home network side, and provides a second service to the wireless terminal on the external network side;
With
The wireless terminal makes a request for information necessary for using the second service to the gateway while using the first service,
When the gateway receives the request, it checks whether the security level of the requesting wireless terminal satisfies a certain condition, and if it meets the certain condition, it is necessary for using the second service. A communication system characterized by generating and returning information and setting a requesting wireless terminal as a wireless terminal that can use the second service.