WO2007132764A1

WO2007132764A1 - Network system

Info

Publication number: WO2007132764A1
Application number: PCT/JP2007/059731
Authority: WO
Inventors: Hirotatsu Shinomiya
Original assignee: Panasonic Electric Works Co., Ltd.
Priority date: 2006-05-11
Filing date: 2007-05-11
Publication date: 2007-11-22
Also published as: CN101443777A; KR100969906B1; CN101443777B; JP2007306331A; KR20080082971A; JP3992067B1

Abstract

A network system for realizing a stable secure communication in a LAN is provided. The system includes a WAN such as the Internet, the LAN connected to the WAN through a local server, and a plurality of facility devices connected to the LAN and WAN. The local server acquires identifiers applied to the objects of all the facility devices in the LAN and reports them to a center server connected to the WAN. The center server contains the correspondence relationships of the identifiers with respect to the approval of access between all the facility devices, extracts only the correspondence relationship of the identifiers concerning the approval of the access between the facility devices in the LAN in response to the report, and sets them in the local server.

Description

Specification

Network system

Technical field

The present invention relates to a network system for realizing secure communication between equipment devices.

Background art

[0002] Conventionally, in order to realize secure communication in a network system, it has been proposed that when an access request is made between communication devices, authentication processing for determining whether to permit access is performed by an authentication server.

[0003] For example, according to the information processing system described in Japanese Patent Application Publication No. 10-49443, when a communication request is made between a client object and a target object, the client object uses an ID and a password as a key copy. To server. When the key property server searches the key property list and permits the requested communication, the key property server issues a key ticket to the client object, and the communication between the client object and the target object. Is realized.

[0004] In addition, in the network system described in Japanese Patent Application Publication No. 2004-21666, as shown in FIG. 18, a device 120 that provides various services, a recording medium 130 for data recording, a user terminal 110, and the like are connected. Main network 140, home sano 100 connected between external network 150 such as the Internet and internal network 140, and terminal 160 for home server vendors connected to external network 150. .

The home server 100 manages the user terminal 110, the device 120, and the recording medium 130 that are connected to the internal network 140. That is, the home server 100 selects control signals transmitted and received between these. Furthermore, the home server has a firewall function that rejects unauthorized access requested from the external network 150. That is, the control signal from the external network 150 to the internal network 140 is selected based on a predetermined condition. In this way, the home server 100 receives predetermined control signals between a plurality of devices connected to the internal network 140 and control signals from the external network 150 to the plurality of devices. It has a control signal selection function for selecting and selecting.

On the other hand, home server vendor terminal 160 is a terminal for setting network conditions such as predetermined conditions used by home server vendors to select control signals for home server 100 through external network 150. The user terminal 110 or the home sano 100 is provided with setting request input means for requesting the terminal 160 to set the predetermined condition. Via this setting request input means, the user inputs how he / she wants to set the predetermined condition, and when the input setting request is transmitted to the terminal 160 via the home sano 100, the terminal 160 Information corresponding to the setting request is returned to the home server 100, and a predetermined condition is set in the home sano 100 based on this information. As a result, a network system that combines high security with ease of use and ease of use is realized.

[0007] However, in the former prior art, as the number of client objects and target objects managed under the capacity server increases, access such as IDs and passwords of client objects and target objects is increased. When multiple access requests are concentrated just by increasing the amount of information required for authentication processing, the burden of information processing on the capacity server increases and response to access requests decreases. There is a fear. Also, if the key server goes down, authentication processing between the client object and the target object cannot be performed.

[0008] In the latter prior art, the predetermined conditions for selecting control signals between a plurality of devices connected to the internal network 140 and control signals from the external network 150 to the plurality of devices are changed. Each time, the user must update using the setting request input means provided in the user terminal 110 or the home server 100, and there is a problem that the work is complicated.

Disclosure of the invention

[0009] Therefore, the present invention has been made in view of the above problems, and its object is to provide a LAN (local area) even if a WAN (wide area network) such as the Internet goes down. (Network) can secure an environment where secure communication is possible

Every time there is a change in the environmental settings of the equipment in the LAN, the equipment in the LAN The object is to provide a network system that can automatically update the information necessary for authentication processing of whether or not it is possible to permit access between devices.

[0010] That is, the network system of the present invention includes a LAN to which a plurality of equipment and local servers each having an object with an identifier attached, and a WAN to which the LAN is connected. A network server that is connected to the center server and at least one equipment having an identifier outside the object, and one of the equipment can make an object execution request to the other of the equipment using the identifier. System,

The center server includes a center storage unit in which a correspondence relationship of identifiers related to approval of access between facility devices is set for the facility devices connected to the LAN and the facility devices connected to the WAN. When the identifier information is received from the local server, based on the identifier information, only the correspondence relationship of the identifiers related to the approval of access between the equipment devices in the LAN is extracted from the correspondence relationships of the identifiers stored in the center storage unit. To the local server

The local server stores the correspondence between the identifiers received from the center sano, and when one of the facility devices makes an object execution request to another one of the facility devices, the object execution request is received. A verification unit that determines whether the access is between facilities in the LAN and whether to allow the access based on the settings of the local storage unit,

When the verification unit determines that the object execution request is an access between the equipment devices in the LAN and the access is permitted, an access permission signal is output from the local server, and the object request requested from one of the equipment devices is outside the object. Is executed by another one of the equipment.

[0011] In the above network system, at least one facility device connected to the WAN may be a facility device directly connected to the WAN (see Fig. 1), or a local server provided in another LAN. It may be equipment (see Fig. 6) that is indirectly connected to the WAN via a (gateway).

[0012] In the network system described above, the collation unit sends an object execution request to the LAN. When it is determined that the access is not between the equipment in the network, the identifier used for the object execution request is transferred from the local server to the center server, and the center server checks the access by checking the contents of the center storage unit. When a center verification unit that determines whether or not to permit is permitted and the access is permitted, an access permission signal is output from the center server through the local server, and the object requested from one of the equipment is installed in the facility. Preferably it is performed by another one of the devices. Verification Force When it is determined that the object execution request is not an access between the equipment in the LAN, an access denial signal may be issued immediately, but as described above, the equipment in the LAN and the equipment in the LAN By re-determining whether or not access between facilities is approved by the center server, it is possible to manage secure communications regardless of inside or outside of the LAN, thus realizing a network system with higher customer satisfaction. .

[0013] In addition, the local server preliminarily acquires the identifiers of all the equipment in the LAN, notifies the center server of the acquired identifiers, and extracts the LAN extracted from the center sano based on this notification. It is preferable to have an initial setting function for setting the correspondence relationship of the identifiers regarding the approval of access between the facility devices in the local storage unit. In this case, it is possible to reduce the burden on the LAN user for the complicated initial setting work that does not require the setting of the WAN authentication server address on the equipment side in the initial setting.

[0014] In the network system described above, an identifier used for authentication processing of access between facility devices includes a unique identifier (object identifier) that provides information related to the facility device to be executed outside the object, and the facility device. The interface identifier defined based on the contents of the object to be executed (for example, a variable indicating the current state of the equipment, a function for controlling the equipment, and event information indicating the occurrence of a change in the state of the equipment) It is preferable to include at least one. In addition, as a correspondence relationship between identifiers for access authorization between facility devices in the local storage capacity LAN, a unique identifier of the facility device that requests execution of the object, and a unique identifier of the facility device that is requested to execute outside the object It is further preferable to include a table in which a correspondence relationship with a combination of interface identifiers is set. [0015] When the collation unit determines that the object execution request is an access between the equipment devices in the LAN and the access is permitted, the local server requests at least the object execution with an access permission signal. It is preferable to transmit to the equipment to be performed. On the other hand, when the collation unit determines that the object execution request is an access between the equipments in the LAN, but the access is not permitted, the local server requests at least the object execution with an access denial signal. It is preferable to send it to the equipment.

[0016] When the center verification unit determines that the access is not permitted, it is preferable to transmit an access denial signal to at least the equipment that requests execution of the object via the center server.

[0017] Further features of the present invention and the effects it provides will be more clearly understood based on the best mode for carrying out the invention described below.

Brief Description of Drawings

FIG. 1 is a schematic diagram of a network system according to a first embodiment of the present invention.

FIG. 2 is a configuration diagram of a gateway of the network system.

[Fig. 3] (A) is a configuration diagram of equipment in the network system, and (B) is a configuration diagram of MOS installed in the equipment.

FIG. 4 is a flowchart showing a method for initially setting access permission information in a gateway.

FIG. 5 is a diagram showing an example of extracting access permission information from the center server to the gateway.

FIG. 6 is a diagram showing another example of extracting access permission information from the center Sano to the gateway.

FIG. 7 is a flowchart showing the operation of the network system of the present invention.

FIG. 8 is a diagram showing an authentication key distribution method in the network system.

FIG. 9 is a diagram showing a modification of the distribution method in FIG.

FIG. 10 is a diagram showing another method for distributing the authentication key in the network system.

FIG. 11 is a diagram showing a modification of the distribution method in FIG. FIG. 12 is a diagram showing still another method for distributing the authentication key in the network system.

FIG. 13 is a diagram showing another method for distributing the authentication key in the network system.

FIG. 14 is a diagram showing still another method of distributing the authentication key in the network system.

FIG. 15 is a schematic diagram of a network system according to the second embodiment of the present invention.

FIG. 16 is a diagram showing an operation example of the network system.

FIG. 17 is a schematic diagram of a network system that works on a modification of the second embodiment.

FIG. 18 is a schematic diagram of a conventional network system.

BEST MODE FOR CARRYING OUT THE INVENTION

Hereinafter, the network system of the present invention will be described in detail based on a preferred embodiment.

(First embodiment)

As shown in FIG. 1, the network system of the present embodiment includes a WAN (wide area network) 4 such as the Internet to which the center sano 5 is connected, and a LAN connected to the WAN 4 via a gateway 3 that functions as a server. (Local Area Network) 1 and LAN and multiple equipment 2 connected to WAN4, and can execute an object execution request to any one of the equipment and another one of the equipment Like

[0020] The LAN 1 is constructed based on a communication standard such as Ethernet (registered trademark). As shown in FIG. 2, the gateway 3 connected to the LAN 1 includes a hub unit 30 for concentrating the LAN 1, a communication unit 31, a modem unit 32, and a server function unit (OAS: Object Access Saver) 33 called an object access server. The server function unit 33 includes a local storage unit (not shown) for storing information related to access approval between the facility devices 2 only for the facility device 2 connected to the LAN 1, and a local storage unit. A local authentication server 34 (Local Authentication Server: hereinafter referred to as Local AS 34) that has a function as a local verification unit that verifies whether or not to permit access by two devices. Is installed. The center server 5 is installed on the Internet, which is the WAN 4, and the installed server function unit (OAS) 50 has substantially the same function as the server function unit 33 of the gateway 3. The server function unit 50 includes a central storage unit (not shown) that stores information related to access approval between the facility devices 2 for all the facility devices connected to the LAN 1 and the WAN 4, and a center. Using the information stored in the storage unit, it functions as a center verification unit that verifies whether access is permitted between equipment 2 outside LAN1 or between equipment outside LAN and equipment inside LAN A center authentication server 52 (Center Authentications ever: hereinafter referred to as the center AS52) is provided!

[0022] The equipment 2 used in this network system is installed in a building or house having a communication function. For example, environmental equipment (lighting, air conditioning), crime prevention / disaster prevention equipment, There are a temperature sensor, a luminance sensor, a human sensor, a fire sensor, etc. to be used.

[0023] As shown in Fig. 3 (A), the basic configuration of the equipment device 2 includes a functional unit 20 for providing a service unique to the equipment device, and an interface unit 21 and a bus 22 connected to the functional unit 20. Function for instructing operation (operation control), obtaining a variable indicating the current state of the function unit 20, and obtaining event information indicating that a change in the state of the function unit 20 has occurred. An information processing unit 23 that performs processing and a communication unit 24 for network communication (Ethernet (registered trademark) standard communication) are provided. The storage unit 25 in the information processing unit 23 implements an object function in this system. Module part MOS (Micro Object Server) is built in.

[0024] Here, the server function unit (OAS) 33 provided in the gateway 3 is a software and facility that realizes a function as an object router for hiding the network connection of the facility device 2 of this system. By accessing the object of the device 2, various application software executed for the user to enjoy the service provided by the functional unit 20 of the facility device 2, and different protocols can be converted into the system seamlessly. Protocol for connecting Bridge service and additional service functions such as firewall bridge service for converting the protocol used for communication with CenterSano 5 to SOAP (Simple Object Access Protocol) and passing through the firewall The software is configured to achieve this. In addition, the local AS 34 provided in the server function unit 33 of the gateway 3 according to the present embodiment is provided for each object included in the module unit MOS of the equipment 2 for each object identifier (and further, a secret key or a user name). , Password), a local storage unit that holds an identifier (or user name and permission information) having permission for the object, and a local verification unit as a computing means for performing authentication, an authentication key and access control described later. This is shared with the storage means and calculation means of the functional unit 33. The server function unit 33 and the local AS 34 may be configured separately from each other in hardware and software.

[0026] In the network system of the present invention, in addition to the equipment 2 described above, a client terminal 6 such as a personal computer or a mobile terminal (terminal having a communication function such as a mobile phone or PDA) can be connected to the LAN 1 or WAN 4 It is. The client terminal 6 also has the power of a computer device equipped with client software (OAL: Object Access Library) and client application (software) to enjoy the service provided in the network system. Execution requests can be made to the MOS object of the module part of the equipment 2 from the WAN4, and the services provided by the equipment 2 by executing the client application, that is, control requests to the equipment 2 and the equipment 2 side Monitoring information (variables, event information) can be enjoyed in the desired form.

[0027] The network system of the present embodiment is composed of an OSI7 hierarchical model, and the module unit MOS of the information processing unit 23 of the equipment device 2 passes variables and event information to the client terminal 6 and other equipment devices 2. Or, configure the application layer from the original protocol (OAP) for receiving functions, etc., and use this OAP to exchange information between the server function unit (OAS) and the module unit MOS of the equipment 2 It has become. Here, as shown in FIG. 3 (B), the module part M OS is the information between the application part 26 for the equipment 2, the software communication module 27 corresponding to the OSI7 hierarchical model, and the function part 20. It consists of a hardware communication module 28 for sending and receiving. The software communication module 27 is responsible for the protocols in the network layer to presentation layer of the OSI7 layer, and performs the above-mentioned OAP definition and integration of TCP and UDP.

[0028] By the way, each of the equipment devices 2 described above is used when the function unit 20 performs a process for providing a service. It has one or more equipment-side objects used in the module under the module MOS incorporated in the information processing section 23, and each equipment-side object is provided with information on the equipment on which the object is to be executed. Unique identifier (object identifier: OID) and the contents of the object executed in the equipment (for example, a variable indicating the current state of the equipment 2, a function for controlling the equipment 2, a change in the state of the equipment 2 One or more interface identifiers (IID) defined by the event information indicating the occurrence of the event and the function executed by the facility device 2). Therefore, the unique identifier (OID) is unique to the object, and the interface identifier (IID) can be assigned to the same defined interface. For execution of equipment-side objects, the information processing unit 23 receives an execution request using the unique identifier (OID) or interface identifier (IID) of the equipment-side object or a combination of both from the server function unit 33 in the gateway 3. It is done when. Specifically, in the case of an execution request corresponding to a specific interface under a specific facility-side object, a combination of OID and IID is used, and an interface with the same definition content has multiple facilities 2 facilities. If it is under the side object, an execution request can be made only with the IID of the interface.

[0029] A method of initializing access permission information in the local AS 34 of the gateway 3 will be described before describing the operation in the case of executing secure communication in the network system of the present invention.

[0030] At the time of starting the system, as shown in FIG. 4, the server function unit 33 of the gateway 3 performs a process of detecting the equipment 2 connected to the LAN 1 by broadcast or multicast, and the equipment 2 on the LAN 1 Acquire information necessary for network communication such as IP address. After the connection process, the local AS 34 of the server function unit 33 requests each equipment device to report the OID of the equipment object or the IID of the interface below or the combination information of 01D and IID (step Sl ).

[0031] In response to this request, the local AS 34 acquires the identifier information sequentially sent from the equipment 2 (step S2), and uses the identifier information for network communication (TCP / It is stored in the local storage unit as a connected equipment information table in association with the IP address that is the identifier on the IP base. In addition, from each equipment 2 broadcast The IP address of gateway 3 may be acquired by network or multicast, and communication with local AS 34 of server function unit 33 of gateway 3 may be enabled. In addition, when the local AS3 4 is provided separately from the server function unit 33 of the gateway 3 on the LAN 1 (or when the local AS 34 is provided independently without providing the server function unit 33), By obtaining the IP address of the local AS 34 directly from each equipment device 2 by broadcast or multicast, communication with the local AS 34 becomes possible. In this embodiment, it is not necessary to set the IP address of the center server 5 (center AS 52) on the WAN 4 in advance on the equipment device 2 side.

[0032] After that, the server function unit 33 of the gateway 3 sends the identifier information acquired from the subordinate equipment 2 to the Sano function unit 50 of the center Sano 5 on the Internet 4 as a function of the local AS 34. Processing is performed (step S3). This process is performed periodically or whenever there is a change in the environment setting of equipment 2 in LAN 1 (for example, addition or disposal of equipment).

[0033] The center AS 52 of the center server 5 extracts only identifier information relating to communication between the equipment 2 in the LAN 1 under the gateway 3 from the database of access permission information stored in the center storage unit. The identifier information is sent to the local AS 34 of the gateway 3 as access permission information related to intra-LAN communication (step S4). The access permission information acquired from the center AS 52 of the center sano 5, that is, the identifier information is set in the local storage unit of the gateway 3 (step S 5). In other words, access permission information can be automatically set in the gateway 3 by obtaining permission information from the center AS 52, without manual operation by the LAN user.

[0034] As with the gateway 3, the center server 5 sends the identifier information of the object OID and interface IID to the server function unit 50 and the center for the equipment 2 connected to the Internet, which is WAN4. It can be obtained by the function of AS52.

[0035] In addition, setting of permission information in the local AS 34, that is, access permission information for an object execution request between the equipment 2 in the LAN 1, is an object identifier (OID) and Z is an interface identifier ( IID) identifier information table Provided by That is, the object identifier (OID) and Z of the equipment device 2 on the access request side are the interface identifier (IID), and the object identifier (OID) and Z of the equipment device 2 on the access request side are the interface The authorization information that is associated with the identifier (IID) and stored in a table is acquired from the center AS 52 and set in the local AS 34 as described above.

Note that communication permission information between the equipment 2 in the LAN 1 and the equipment 2 outside the LAN 1 is set in the center AS 52 in advance. That is, in the center AS52, access permission information between the equipment 2 connected to the LAN 1 and the equipment 2 connected to the WAN 4 in addition to the access permission information between the equipment 2 connected to the LAN 1 The object identifier (OID) and Z or interface identifier (IID) of the equipment that requests access, and the object identifier (OID) and Z or interface identifier (IID) of the equipment that requests access It is preset by the association.

As an example, Tables 1 and 2 show permission information tables stored in the center storage unit of the center server 5. In the center AS table shown in Table 1, the outside-object identifier (OID) of the equipment that requests access to all equipment ₂ connected to the network system, whether inside or outside the LAN, and access is permitted. Equipment information (in this example, a combination of object identifier (OID) and interface identifier (IID)) and "r (read permission)", "w (write permission)", "x (execution permission) The correspondence with the permission type indicated by "is listed. In the table, “* * *” indicates that any interface identifier that does not specify the interface identifier can be accessed. If "* * *" is added to the object identifier, access to equipment with a common interface is permitted regardless of the object identifier. In short, when specifying only an object identifier, objects in a system can mutually recognize access to all interfaces, and when specifying only an interface identifier, specify an object for an interface specific to a certain system or application. Permitting without making it possible to access only application-specific functions regardless of the object.

[0038] [Table 1] Access requesting access permission information

Equipment OID access is allowed Access is allowed Access is allowed

Equipment equipment OID Equipment equipment IID types

OID 1 OID2 * 氺氺 r / w / x

OID3 * * * Γ

Thu * * IID 1 r / w / x

OID2 OID 1 IID2 r / /

OID 1 IID3 r / w /

OID3 * Thu r

OID3 OID 1 * * * r / w /

OID2 * 氺氺 r / w /

OID4 * 氺 IID 1 r / w / x

[0039] In addition, the center AS table shown in Table 2 includes a combination of the object identifier (OID) and interface identifier (IID) of the equipment that requests access, and the object identifier (OID) of the equipment that is permitted to access. And the interface identifier (IID) combination and the access permission type ("r / w / x") are listed. By setting the combination of identifiers in this way, it is possible to make a special setting that allows access to an object only under certain conditions.

[0040] [Table 2]

[0041] The center AS table in Table 1 displays only the OID of the equipment that requests access. Therefore, when extracting the permission information set in the gateway (local server), only the OID of the equipment 2 under the control of the gateway 3 needs to be notified to the center Sano 5. On the other hand, since the combination of the OID and IID of the equipment that requests access is displayed in the center AS table in Table 2, when extracting the permission information set for the gateway, the gateway 3 subordinates it. The combination of OID and IID of equipment 2 is notified to the center server 5. In short, when extracting the permission information set for the gateway from the center one server, the gateway 3 manages the equipment 2 subordinate to it from the gateway 3 based on the contents of the center AS table held by the center server 5 (access permission information). It is sufficient that at least one of the object identifier and the interface identifier is transmitted. As shown in the bottom row of Table 2, if only the interface identifier of the equipment requesting access is specified, there are uses such as permitting access to other equipment only when an event corresponding to the interface occurs. Conceivable.

[0042] Next, with respect to the identifier permission information registered in the center AS table, the method for extracting the identifier permission information set in the local AS table of gateway 3 will be described with reference to FIGS. 5 and 6. This will be described more specifically.

[0043] In the network system of FIG. 5, equipment A corresponds to each of the object identifier OID1 (OIDIJIDI), (OID1, IID2), (0 ID1, IID3) and the functions of equipment A. 3 sets of identifier information consisting of combinations of three interface identifiers (IID1 to IID3) defined in addition, and equipment B has object identifiers OID2 (0ID2, IID1) and (OID2, IID2). And two sets of identifier information consisting of combinations of two interface identifiers (IID1, IID2) defined in association with each of a plurality of functions of equipment B. Gateway 3 receives the identifier information from these two equipment 2 in LAN 1 and transmits it to Center Sano 5. On the other hand, the center server 5 stores a table in which permission information of facility equipment that can be accessed for all of the equipment of LAN1 and WAN4 is indicated by the correspondence between identifiers. For equipment C and D connected to WAN4, the identifier information of accessible equipment is listed.

[0044] The information received from the equipment 2 in the LAN 1 includes the object identifier and the It is preferable to receive both an object identifier and an interface identifier, preferably just at least one of the interface identifiers. After gateway 3 receives both the object identifier and the interface identifier from subordinate equipment 2, only necessary identifier information is obtained based on the contents of the access permission information table stored in the center server. It can be sent to the center server.

[0045] According to the center AS table shown in Fig. 5, in response to an access request for equipment A (OID1), the equipment combination B in the LAN is permitted to access the combination of identifiers (OID2, * * *). Has been. Here, “* * *” indicates that the interface identifier is optional. Specifically, each of (OID2, IID1) and (OID2, IID2) of equipment B has permission to access. Means that On the other hand, in response to an access request from equipment B (OID2), equipment A in the LAN is authorized to access the identifier combinations (OIDl, IID2) and (OIDl, IID3). It can be seen that the combination of (OIDl, IID1) is not allowed.

[0046] When the center server 5 receives the notification of the identifier information of the equipment (A, B) in the LAN transmitted from the gateway 3, the center AS table power also accesses the equipment (A, B). Only the authorization information is extracted and sent to Gateway 3, and is set in the local AS table as shown in the lower right table in Fig. 5. In the table, “r (read permission)”, “w (write permission)”, and “X (execution permission)” indicate the type of access permission associated with each identifier information.

[0047] Figure 6 shows the first LAN (LAN-1) to which equipment A and B are connected, the second LAN (LAN-2) to which equipment C and D are connected, and the power via WAN4, which is the Internet. An example of extracting access permission information in another network system connected to Center Isano 5 is shown. In the first LAN's local AS table, only the access permission information between equipment A and B is extracted and set using the same method as in Fig. 5. Using the same method as in Fig. 5, only the access permission information between equipment C and D is extracted and set for the center AS table.

[0048] In the network system described above, the gateway 3 does not include the server function unit 33, and simply converts the protocol between the WAN 4 and the LAN 1, which are the Internet, on the LAN. It may be provided with a routing function for connecting the facility equipment 2 to the Internet. In this case, the local AS 34 performs processing for detecting the equipment 2 by broadcast or multicast, and acquires information necessary for network communication such as the IP address of the equipment 2 on the LAN. After connection processing, request the identifier of the object to be mounted on each equipment device 2 in the LAN to acquire the identifier of each object (OID and IID described later), and acquire the identifier of the acquired object. May be sent to the center AS52, which will be described later, and the authorization information sent from the center AS52 in response to this notification may be obtained and initialized.

[0049] In the network system constructed as described above, one of the facility devices (facility device A) makes an access request regarding execution outside the object to another facility device (facility device B). The authentication operation in this case will be described in detail with reference to FIG.

[0050] First, when there is an access request from the equipment A in the network to the equipment B (Step S6), this access request is received by the server function unit 33 of the gateway 3, and the server function unit In the local AS 34 in 33, the equipment device B in the LAN depends on whether it exists in the table set in the local storage unit of the gateway 3 of the execution request destination, that is, the equipment device B on the receiving side. Is determined (step S7). If the equipment device B is an equipment device in the LAN, the identifier information (for example, OID) of the sending equipment device A that made the execution request and the identifier of the equipment device B on the execution request destination, that is, the receiving equipment device B It is checked whether the relationship with the information (for example, a combination of OID and IID) exists in the table set as access permission information in the local storage unit (step S8). This collation work is performed, for example, by executing a predetermined program of the local collation unit provided in the server function unit 33 of the gateway 3.

[0051] When the access is permitted, the permission notice and the authentication key are distributed to the equipment devices A and B (step S9). As a result, secure communication is performed between the equipment (A—B) that has received the authentication key together with the permission notification, and information can be exchanged by executing the object (step S10). In this case, the routing function using the connection facility information table of the sano function section 33 of the gateway 3 allows communication between the facility devices without special awareness of the IP address or the like. The access permission information is set in the local storage unit. If the access between the equipment A and B is not permitted, the local AS 34 delivers a disapproval notice to at least the equipment A that requests the execution of the object ( In step S11), the object of secure communication can be achieved by denying undesired access.

[0052] If it is determined that the equipment device B is not a LAN equipment device, that is, if the information related to the equipment device B is not listed in the table set in the oral storage unit, The authentication request for performing the object execution request is transferred to the center AS 52 via the server function unit 50 of the center sano 5 (step S12).

[0053] In the center AS52, the identifier information of the object of the equipment A that made the execution request, the identifier information outside the object of the equipment B of the execution request destination, the information on the type of access permission, etc. It is checked against the information stored in the file to determine whether or not to permit the access request (step S13). This collation work is performed, for example, by executing a center collation unit force predetermined program provided in the server function unit 50 of the center server 5.

[0054] As the information stored in the center storage unit, only the identifier information of the equipment that is permitted to access is registered! Alternatively, the presence / absence of access permission may be displayed for the identifier information of all the equipment devices. In short, as shown in Fig. 5 and Fig. 6, at least one of the object identifier (OID) or interface identifier (IID) of the equipment requesting access and the object identifier of the equipment requested to access ( Whether access to equipment outside the LAN is permitted based on a table in which a correspondence relationship with at least one of (OID) or interface identifier (IID) is set, and identifier information provided from gateway 3 If it can be judged.

[0055] When the center server 5 permits access, the authorization notification and authentication key are distributed to the local AS 34 (step S14), and the local AS 34 distributes the authorization notification and authentication key distributed to the equipment A , B is distributed (step S15). As a result, secure communication is performed between the equipment devices A and B that have received the authentication key together with the permission notification, and information can be exchanged Z by executing the object (step S16). In this case, the connection facility information table of the server function part (33, 50) of the gateway 3 and the center server 5 is used. With the function of a single function, equipment can communicate with each other without being particularly aware of the IP address.

[0056] On the other hand, if the center server 5 does not permit access, a non-permission notification is sent to the local AS 3 4 (step S17), and at least the non-permission notification distributed by the local AS 34 is executed outside the object. Is transmitted to the equipment A on the requesting side, and the object execution request from the equipment A to the equipment B is rejected (step S18).

[0057] In this way, if there is an access request between equipment devices, both inside and outside the LAN, it is determined whether or not the access is permitted, and this is denied for an undesired access request. By doing so, the purpose of secure communication can be achieved.

[0058] According to the network system of the present invention described above, the access request between the equipments in the LAN is authenticated by the gateway 3 as a local server that follows the center server 5, and the network outside the LAN Even if the environment (for example, the Internet) is disconnected, communication within the LAN can be ensured in a normal state. In addition to when the system is started, the local AS 34 periodically obtains the identifier information of the equipment in the LAN and notifies the center AS 52, and only the access permission information between the equipment in the LAN from the center server 5 Is extracted and automatically updated to the local AS34, so initial settings can be made without the user's particular awareness, and even if there is a change in the environment settings in the LAN, the user needs to perform troublesome settings. Absent. Furthermore, the low-power AS34 has the advantage that only the access permission information between the equipments in the LAN is set, and the amount of information processing that the gateway 3 should perform can be reduced.

[0059] Furthermore, in the case of an access request with equipment outside the LAN, since whether or not to permit access is re-determined in the center sano ¾, the equipment between the equipment outside the LAN and the equipment inside the LAN Secure communication can be ensured even between.

Hereinafter, a method for distributing an authentication key when access is permitted will be described with reference to FIGS.

In the authentication key distribution method shown in FIG. 8, the equipment device A in the LAN requests access to the equipment device B in the LAN. The authentication request includes the identifier information for equipment A, the identifier information for equipment B, and the access request authority (r / w / x). The Equipment Equipment A Equipment Equipment B that has received an access request from Rikigo, requests authentication to permit access to the local AS34. If the access is permitted in the access permission information table of the local AS 34, the local AS 34 distributes the authentication key to the equipment B, and the equipment A distributes the authentication key from the equipment B. Is done. The authentication keys include those for equipment A and equipment B, and are encrypted with their private keys. As a result, the equipment devices A and B can extract the communication encryption key (the communication key for the session common to the equipment device A and equipment device B) using the respective secret key and other secure keys and execute secure communication.

Note that, as shown in FIG. 9, the equipment device A in the LAN may directly request access to the equipment device B in the LAN from the local AS 34. In this case, when the access request is approved, the authentication key is distributed to the equipment A and the authentication key is distributed from the equipment A to the equipment B. As a result, the equipment devices A and B can perform secure communication by extracting the encryption key for communication using the secret key of each of the authentication keyers.

[0063] The authentication key distribution method shown in FIG. 10 is illustrated in that the equipment A in the LAN requests access to the equipment B in the LAN, and the equipment B sends an authentication request to the local AS 34. Same as the case of 8, except that the local AS34 distributes the authentication keys for equipment A and B, respectively. The authentication key distribution method shown in Fig. 11 is the same as in Fig. 9 in that equipment A in the LAN directly requests access to the equipment B in the LAN from the local AS34. It is characterized in that the local AS34 distributes authentication keys for equipment A and B respectively. In these cases, secure communication is performed between the equipment A and B that have received the authentication key.

FIG. 12 shows an authentication key distribution method when a plurality of facility devices in the LAN have a group ID. In this case, the equipment device A presents the equipment device A identifier information and group ID and access request authority (r / w / x) to the local AS 34, and the equipment devices 2 having the same group ID Request permission for access. Similarly, the equipment device B presents the equipment device B identifier information, group ID, and access request authority (r / w / x) to the local AS 34, and the equipment devices 2 having the same group ID share each other. Request permission for access. Local AS34 grants for each request Judgment is made on whether or not it is possible. The equipment devices A and B that have received the authentication key can use the respective secret keys to extract the communication encryption key (the communication key for the session that is common to the equipment devices A and B) and execute secure communication.

FIG. 13 shows a method for distributing the authentication key when the equipment device A in the LAN does not have a group ID. That is, since equipment B has a group ID, the same information is provided by providing the equipment AS B identifier information, group ID, and access request authority (r / w / x) to the local AS 34. Request permission for access between two equipment with group IDs. The local AS 34 determines whether or not the request from the equipment B can be permitted. If the request is permitted, the local AS 34 distributes the authentication key to the equipment B. On the other hand, when equipment A requests access to equipment B, equipment B notifies equipment A that a group ID is required for access authentication (group notification). As a result, equipment A presents the identifier information of equipment A, the group ID obtained from the group notification from equipment B, and the access request authority (r / w / x) to local AS34. Request permission for access between the equipment devices 2 having the same group ID. The local AS 34 determines whether or not the request from the equipment A can be permitted, and if so, distributes the authentication key to the equipment A. As a result, facility devices A and B that have received the authentication key can use the respective private keys to extract the communication encryption key (session communication key common to facility device A and facility device B) and execute secure communication. .

FIG. 14 shows a method of distributing an authentication key when the equipment device B holds the encryption key in advance and the encryption key necessary for access to the equipment device B is managed by the local AS 34. That is, the equipment A in the LAN that desires access to the equipment B has the identifier information of the equipment A, the identifier information of the equipment B, and the access request authority (r / w / x ) To request authentication, the local AS 34 determines whether or not it is possible to permit this request for equipment A, and if so, distributes the authentication key to equipment A. As for the authentication key, the encryption key of the equipment device B is encrypted with the private key of the equipment device A. Secure communication with equipment B can be performed by extracting the encryption key.

(Second embodiment)

In the present embodiment, as shown in FIG. 15, a remote control system for in-house equipment, which is a user area, is configured using the network system of the present invention. A duplicate description of the same configuration as that of the embodiment is omitted.

[0067] In the network system of the present embodiment, the luminaire 2a, the air conditioner 2b, the electric lock 2c, the alarm monitoring device 2d, the recording transfer device 2e, and the equipment equipment 2 shown in FIG. A dedicated client terminal device 2f, a personal computer 6, etc. are connected to the gateway 3 via a LAN1 cable installed in the house.

[0068] The alarm monitoring device 2d has a function of wirelessly collecting the status of abnormality detection sensors 60 such as various security sensors and disaster prevention sensors, and outputting alarm information when the occurrence of an abnormality is detected. Abnormality detection sensor In addition to the wireless receiver that wirelessly receives the detection signal of 60 forces, the detection signal received by the wireless receiver is received, and when an abnormality is detected, the alarm is sent to the alarm device, or the externally transmitted information 3 is provided, and this functional unit corresponds to the functional unit 20 in FIG. 3 (A), and the notification information is passed to the information processing unit 23.

[0069] The recording transfer device 2e has a function of distributing a recorded video of a visitor captured by a television camera (not shown) of the interphone system 70 to an external monitor or a home monitor, and stores the recorded video data. The function unit 20 is used as a recording unit, and the recorded video data is transferred to the information processing unit 23 after being recorded and stored in the function unit 20.

As in the first embodiment, the gateway 3 is connected to the center sano 5 via the WAN 4 such as the Internet provided by a connection service provider such as ADSL or an optical fiber communication network. In the local AS 34 of the gateway 3, access permission information between the facility devices is set for the facility device 2 in the LAN 1 described above. In the same manner as in the first embodiment, desired equipment 2 can be connected to the WAN 4 in addition to the client terminal 6 that also has the power of a personal computer and a mobile phone.

Next, the operation of the network system of this embodiment will be described. First, when the system is powered up, gateway 3 performs a detection process for devices connected to LAN1, and Requests to provide information necessary for network communication such as the IP address and identifier information. In addition, the module part MOS of each equipment (2a to 2f) provides the service function part 33 of the gateway 3 with the OID of the object on the equipment side on its module part MOS or the IID information of the interface below it. .

On the other hand, the service function unit 33 of the gateway 3 transmits the identifier information of the equipment object received by the equipment (2a to 2f) force to the center sano 5. The center server 5 sends only the access permission information registered in the center AS52 between the equipment in the LAN to the gateway 3, and the access permission information corresponding to the current environment setting in the LAN. Is updated to the local AS34. Such updates are made whenever there is a change in the LAN environment settings, such as increase or decrease of equipment.

[0073] An object execution request to the equipment in the LAN 1, which is the user area, can be performed in substantially the same manner as in the first embodiment. That is, the power of one of the equipment in LAN1 (for example, the client terminal device 2f) is also applied to another one of the equipment (for example, the lighting fixture 2a), and the object identifier (OID) or interface identifier ( When an execution request using IID) or a combination of both is made via the gateway 3, whether or not to allow access between the equipments is compared by the local AS 34 of the gateway 3. If access is permitted, an authentication key is distributed, and the desired object is executed by secure communication between the equipment that requests access and the equipment that is permitted access (in this case, 2f and 2a). .

As a more specific operation of the network system, for example, as shown in FIG. 16, when an object execution request is made to the client terminal device 2, the air conditioner 2 b and the electric lock 2 c, the client terminal Correspondence between device 2f object outside identifier OID ("outing"), air conditioner 2b object identifier OID ("air conditioner") and interface identifier IID ("air condition shutdown"), and client terminal Device 2f's object identifier OID ("going out"), electric lock 2c's object identifier OID ("electric lock") and interface identifier IID ("locked") It is verified whether it is registered as access permission information in S34. If access is permitted, the two objects are secured: the shutdown of the air conditioner 2b and the locking of the electric lock 2c. It is executed by communication.

[0075] When an execution request for the client terminal device power object connected to the WAN 4 which is the Internet is made, it is an access request from the LAN external force, so the identifier information is sent from the gateway 3 to the center server 5 And whether it is registered as access permission information in the center AS 5 2 of the center server 5 is determined, and it is determined whether or not to permit the access. When permitting access, the authentication key and permission information are notified to Gateway 3, and secure communication is executed between the equipment in the LAN and equipment outside the LAN in the same manner as described above.

[0076] In addition, the client terminal device 2 also performs scenes in which the illuminance of the lighting fixture 2a is reduced and the video recording / transferring device 2e is operated at the same time and a video is viewed on a monitor device (not shown) on the LAN. It can also be created by making an object execution request to other equipment. In other words, in the video recording / transferring apparatus 2e, the transfer of the recorded video data is set as the equipment side object of the module part MOS, and in the lighting fixture 2a, the dimming is set as the equipment side object of the module part MOS. If access between each equipment is permitted, the above-mentioned program for the object is executed, and the compound service of creating the above-mentioned scene can be enjoyed.

[0077] Furthermore, according to the present invention, when a fire detector as a facility device detects a malfunction (when an event occurs), a lighting device that is another facility device connected to the home LAN. It is also possible to build a network system that notifies the resident of the abnormality by blinking. In addition, by associating the identifiers of the equipment that requests the object with the identifiers of the equipment that executes the object outside the object, the identifiers of the objects that execute the object are assigned to one execution request. You can also enjoy execution at the same time.

FIG. 17 shows a modification example of the network system of the present embodiment. This network system consists of a luminaire 82 on the first floor of a two-story house, a central controller 2g for remotely controlling the air conditioner 84, and an electric lock 86, and a luminaire on the second floor of a two-story house. The central control controller 2h for remotely controlling the air conditioner 82 and the air conditioner 84 is connected to the gateway 3 via the LAN 1 as the equipment 2 respectively. The centralized control controller (2g, 2h) is connected to the lighting fixture 82, air conditioner 84 and electric lock 86 via the signal line 80. A function to generate control signals corresponding to the rating (Japan Electrical Manufacturers' Association standard) and a function to receive operation signals as monitoring information, and a function to exchange information corresponding to these signals with the information processing unit 23 Is provided as the functional unit 20 shown in FIG.

[0079] In this network system, the power of one of the equipment in the LAN 1 (for example, the client terminal device 2f) is also applied to another one of the equipment (for example, the centralized controller 2g). When an execution request using the (OID) or interface identifier (IID) or a combination of both is made via the gateway 3, the local AS 34 of the gateway 3 verifies whether to permit access between the equipments. Is done. When access is permitted, the information processing unit 23 uses the module unit MOS as a function to the control unit 2g of the centralized control controller 2g as a function of the control information of the shutdown of the air conditioner 84 and the control information of the lock of the electric lock 86. Process to pass. Based on this control information, the function unit 20 sends a control signal for stopping the operation of the air conditioner 84 or a control signal for locking the electric lock 86 via the signal line 80 to which each is connected. I started to do it. As described above, according to the present network system, it is possible to remotely control the locking of the electric lock 86 and the operation stop of the air conditioner 84 when the user goes out.

[0080] In the network system of the present invention, the distribution destination of the authentication key and the permission information when access between the facility devices is permitted is not limited, and the facility device that requests the object is not limited. An access permission signal may also be transmitted to the equipment that executes the object. In addition, although the transmission destination of the access denial information when access between facility devices is denied is not particularly limited, it is preferable in terms of system operation to transmit to the facility device that requests the object.

Industrial applicability

[0081] As described above, in the network system of the present invention, by providing a server in the LAN that can perform authentication processing for access by the same equipment in the LAN, even if an abnormality occurs in the WAN, Secure communication can be ensured. In addition, since only the information necessary for authentication processing to determine whether or not to allow access between equipment on the LAN is sent to the local server and set from the center Sano, the information processing load on the local server is small. Furthermore, change to the environmental settings of the equipment in the LAN ( Whenever equipment is added or removed, functions are added to equipment, etc., identifier information is sent from the local server to the center server, and information required for authentication processing within the LAN is automatically updated. Therefore, it is possible to easily construct a system that can perform highly reliable and secure communication within a LAN.

As described above, the present invention has a high utility value as providing an optimal network system for the information-oriented society in recent years, where improvement of access control security is increasingly important.

Claims

The scope of the claims

[1] A LAN (local area network) to which a plurality of equipment and objects each having an object with an identifier are connected, and a WAN (wide area network) to which the LAN is connected, The WAN is connected to at least one facility device having a center server and an outside of the object with the identifier. One of the facility devices is connected to another one of the facility devices using the identifier. A network system that can execute requests,

The center server includes a center storage unit in which a correspondence relationship of identifiers related to approval of access between facility devices is set for the facility devices connected to the LAN and the facility devices connected to the WAN. When the identifier information of the equipment in the LAN is received from the local server, the access authorization between the equipment in the LAN is out of the correspondence relationship of the identifiers stored in the center storage unit based on the identifier information. Extract only the correspondence of identifiers for and send to the local server,

The local server stores a correspondence between the identifiers received from the center sano, and when one of the facility devices makes an object execution request to another one of the facility devices, A verification unit that determines whether or not the execution request is an access between facility devices in the LAN and whether to permit the access based on the setting contents of the local storage unit, and the verification unit However, the execution request for the object is an access of the same equipment in the LAN, and when it is determined that the access is permitted, an access permission signal is output from the local sano, and one request for the power of the equipment is requested. The network system is characterized in that the executed object is executed by another one of the facility devices. .

[2] When the collation unit determines that the execution request for the object is not an access between facility devices in the LAN, the identifier used for the execution request for the object is transferred from the local server to the center server. The center server includes a center verification unit that determines whether to permit the access by verifying with the content of the center storage unit, When permitting the access, an access permission signal is output from the center sano via the local server, and the requested object of one of the facility devices is executed by another one of the facility devices. The network system according to claim 1, wherein:

[3] The local server preliminarily acquires the identifiers of all equipment in the LAN, notifies the acquired identifiers to the center server, and is extracted from the center sano based on the notification. 2. The network system according to claim 1, further comprising an initial setting function for setting a correspondence relationship of identifiers related to access approval between facility devices in a LAN in the local storage unit.

[4] The identifier is a unique identifier that provides information related to the equipment to be executed outside the object, and an interface identifier that is defined based on the contents of the object that is executed on the equipment. The network system according to claim 1, comprising at least one of them.

[5] The local storage unit was requested to execute the above-mentioned object and the unique identifier of the equipment requesting execution outside the object as a correspondence relationship of the identifier regarding the access approval between the equipment in the LAN. 5. The network system according to claim 4, further comprising a table in which a correspondence relationship with the combination of the unique identifier of the equipment and the interface identifier is set.

6. The network system according to claim 1, wherein the local server transmits an access permission signal to at least a facility device that requests execution of the object.

[7] When the collation unit determines that the execution request for the object is an access between the equipment devices in the LAN, but the access is not permitted, the local server sends at least the object rejection signal to the object. 2. The network system according to claim 1, wherein the network system is transmitted to an equipment device that requests execution outside.

[8] When the center verification unit determines that the access is not permitted, the center server transmits an access denial signal to at least the equipment that requests execution of the object via the local server. The network system according to claim 2.