COMMUNICATION SYSTEM, COMMUNICATION DEVICE, COMMUNICATION METHOD, AND PROGRAM

Abstract

To provide an information processing method, an information processing program, an information processing device, and an information processing system capable of improving a user experience or user convenience for connection to a communication network.SOLUTION: An information processing method is executed by a processor of a device, and includes: a step (S2) of generating a public key of the device on the basis of, a private key of the device; a step (S3) of generating a hash value on the basis of, the public key and a predetermined hash function; and a step (S6) of determining an IP address of the device on the basis of, the hash value.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present disclosure relates to an information processing method, an information processing program, an information processing device, and an information processing system. [Background technology]

[0002] Information and communication technology has developed remarkably in recent years, and not only personal computers, smartphones, and tablets, but also all kinds of things such as automobiles, home appliances, and sensor devices are being connected to communication networks such as the Internet. Thus, it is expected that an IoT (Internet of Things) society in which trillions of devices on Earth will be connected to communication networks will arrive in the near future (see Patent Document 1). [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japan Special Publication No. 2016-515328 Summary of the Invention [Problem to be solved by the invention]

[0004] Incidentally, as disclosed in Patent Document 1, in current IoT technology, an Internet service provider (ISP) manages the IP address of each device connected to the Internet. For example, when a specific device is connected to the Internet, the ISP assigns an IP address to the specific device. The specific device can then access a web server on the Internet using the IP address assigned by the ISP. Thus, when connecting a device to a communication network such as the Internet, the intervention of a business entity that manages IP addresses, such as an ISP, is required, and there is room for improvement in terms of improving the user experience or user convenience for connecting to a communication network.

[0005] An object of the present disclosure is to provide an information processing method, an information processing program, an information processing device, and an information processing system that can improve the user experience or user convenience in connection to a communication network. [Means for solving the problem]

[0006] An information processing method according to one aspect of the present disclosure is executed by a processor of a device, generating a public key for the device based on a private key of the device; generating a hash value based on the public key and a predetermined hash function; determining a network address of the device based on the hash value; Includes.

[0007] The information processing method may further include the step of generating the private key.

[0008] The information processing method may further include a step of transmitting the public key to an external device that is external to the device.

[0009] The information processing method may further include a step of determining whether the hash value satisfies a predetermined condition. If the hash value satisfies the predetermined condition, the network address may be determined based on the hash value.

[0010] The information processing method may further include the step of generating the private key.

[0011] If the hash value does not satisfy the predetermined condition, the steps of generating the private key, generating the public key, and generating the hash value may be repeated until the hash value satisfies the predetermined condition.

[0012] The predetermined condition may include a condition associated with the first two digits of the hash value.

[0013] The predetermined conditions may also include conditions associated with a type of device.

[0014] Additionally, generating the hash value may include generating the hash value based on the public key, a value associated with a predetermined organization, and the predetermined hash function.

[0015] Additionally, the value associated with the predetermined organization may be a value associated with a trademark of the predetermined organization.

[0016] The information processing method may further include the step of obtaining a digital certificate associated with the public key from a certificate authority.

[0017] The information processing method may further include a step of transmitting the public key and the digital certificate to an external device that is external to the device.

[0018] The digital certificate may also include information relating to attributes of the device.

[0019] The electronic certificate may also include attribute information of a user associated with the device.

[0020] The electronic certificate is: attribute information of the device and / or a user associated with the device; A hash value of the entire attribute information; and may include:

[0021] Also, a portion of the attribute information may be hashed.

[0022] Also, the part of the attribute information may be hashed based on the part of the attribute information and a predetermined coefficient.

[0023] The information processing method further comprises: receiving a public key of an external device from an external device external to the device; generating a hash value for the external device based on the public key of the external device and the predetermined hash function; The method may further include determining a network address of the external device based on the hash value of the external device.

[0024] The step of receiving the public key of the external device may include a step of receiving the public key of the external device and an electronic certificate associated with the public key. The information processing method may further include a step of determining whether the electronic certificate is valid. If the electronic certificate is determined to be valid, the external device may be authenticated based on the public key of the external device. A hash value of the device may be generated.

[0025] An information processing method according to one aspect of the present disclosure includes, executed by a processor of a device, determining a network address of the device based on a public key of the device.

[0026] The information processing method may further include a step of performing communication using the network address of the device without going through a server that manages network addresses.

[0027] The information processing method may also be performed in the network layer of the OSI reference model.

[0028] Also provided is an information processing program for causing a computer to execute the information processing method, and a computer-readable storage medium storing the information processing program.

[0029] According to one aspect of the present disclosure, an information processing device includes at least one processor and a memory that stores computer-readable instructions, the information processing device being configured to perform the information processing method when the computer-readable instructions are executed by the processor.

[0030] An information processing system according to one embodiment of the present disclosure includes a first device and a second device communicatively connected to the first device.

[0031] The first device is generating a first public key of the first device based on a first private key of the first device; generating a first hash value based on the first public key and a predetermined hash function; determining a first network address of the first device based on the first hash value; The first public key is transmitted to the second device.

[0032] The second device is generating second public keys of the two devices based on a second private key of the second device; generating a second hash value based on the second public key and the predetermined hash function; determining a second network address of the second device based on the second hash value; The second public key is transmitted to the first device.

[0033] The first device is receiving the second public key from the second device; generating the second hash value based on the second public key and the predetermined hash function; The second network address is determined based on the second hash value.

[0034] The second device is receiving the first public key from the first device; generating the first hash value based on the first public key and the predetermined hash function; The first network address is determined based on the first hash value.

[0035] Also, the first device Sending the first public key to a certificate authority; obtaining a first digital certificate associated with the first public key from the certificate authority; The first digital certificate and the first public key may be transmitted to the second device.

[0036] The second device is Sending the second public key to the certification authority or another certification authority; obtaining a second digital certificate associated with the second public key from the certification authority or the other certification authority; The second digital certificate and the second public key may be transmitted to the first device.

[0037] The first device is receiving the second public key and the second digital certificate from the second device; It may be determined whether the second electronic certificate is valid.

[0038] The second device is receiving the first public key and the first digital certificate from the first device; It may be determined whether the first digital certificate is valid. Effect of the Invention

[0039] According to the present disclosure, it is possible to provide an information processing method, an information processing program, an information processing device, and an information processing system that can improve the user experience or user convenience in connection to a communication network. [Brief description of the drawings]

[0040] [Figure 1] 1 is a diagram illustrating an example of a hardware configuration of an information processing device according to an embodiment of the present invention (hereinafter, referred to as the present embodiment). [Diagram 2] 10 is a flowchart illustrating an example of a process for determining an IP address of an information processing device. [Diagram 3] FIG. 1 is a diagram illustrating an information processing device and a server on the Internet. [Figure 4]FIG. 1 is a diagram illustrating an information processing system including two information processing devices. [Diagram 5] 10 is a flowchart illustrating an example of a process for determining an IP address of an external device. [Figure 6] 10 is a flowchart illustrating an example of a process for determining the validity of an electronic certificate transmitted from an external device. [Figure 7] FIG. 1 is a diagram showing an information processing system including four information processing devices. [Figure 8] 13A and 13B are diagrams illustrating an example of a digital certificate before and after a portion of user attribute information is hashed. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0041] Hereinafter, the present embodiment will be described with reference to the drawings. First, the hardware configuration of an information processing device 2 according to an embodiment of the present invention (hereinafter simply referred to as "the present embodiment") will be described with reference to FIG.

[0042] Fig. 1 is a diagram showing an example of a hardware configuration of an information processing device 2 according to this embodiment. As shown in Fig. 1, the information processing device 2 (hereinafter simply referred to as "device 2") includes a control unit 20, a storage device 23, a network interface 25, a display unit 26, and an input operation unit 27. These are connected to each other via a bus 29 so as to be able to communicate with each other.

[0043] Device 2 may be, for example, a personal computer, a smartphone, a tablet, or a wearable device (for example, a smart watch or AR glasses) that is attached to the user's body (for example, the arm or head). Device 2 may also be a control device installed in a smart home appliance, a connected automobile, a factory, or the like. In this way, the types of device 2 include all things that are connected to a communication network such as the Internet using an IP address (an example of a network address) and that have a processor and memory. In this embodiment In the present embodiment, the device 2 includes a display unit 26 and an input operation unit 27, but these are not essential components of the device 2.

[0044] The control unit 20 is configured to control the operation of the device 2, and includes a memory and a processor. The memory is configured to store computer-readable instructions (e.g., information processing programs). For example, the memory may be composed of a ROM (Read Only Memory) in which various programs and the like are stored, and a RAM (Random Access Memory) having multiple work areas in which various programs and the like executed by the processor are stored. The memory may also be composed of a flash memory or the like. The processor may be, for example, a CPU, an MPU (Micro Processing Unit), The CPU may be configured with multiple CPU cores. The GPU may be configured with multiple GPU cores. The processor may be configured to load a specified program from various programs embedded in the storage device 23 or the ROM onto the RAM, and execute various processes in cooperation with the RAM. In particular, the processor is configured to execute an information processing method according to this embodiment by executing an information processing program stored in the memory, so that the device 2 executes the information processing method according to this embodiment.

[0045] The storage device 23 is, for example, a storage device (storage) such as a hard disk drive (HDD), a solid state drive (SSD), a flash memory, etc., and is configured to store programs and various data. The information processing program according to the present embodiment transmitted from a server on the Internet may be stored in the storage device 23.

[0046] The network interface 25 is configured to connect the device 2 to a communication network. Specifically, the network interface 25 may include various wired connection terminals for communicating with external devices such as a server via the communication network. The network interface 25 may also include various processing circuits and antennas for communicating with a wireless router or a wireless base station. The wireless communication standard is, for example, Wi-Fi (registered trademark), Bluetooth (registered trademark), ZigBee (registered trademark), LPWA, or a fifth-generation mobile communication system (5G). The communication network includes at least one of a local area network (LAN), a wide area network (WAN), a radio access network (RAN), and the Internet.

[0047] The display unit 26 may be a display device such as a liquid crystal display or an organic EL display, or may be a transmissive or non-transmissive head-mounted display that is worn on the operator's head. Furthermore, the display unit 26 may be a projector device that projects an image onto a screen.

[0048] The input operation unit 27 is configured to receive an input operation by a user who operates the device 2, and to generate an instruction signal corresponding to the input operation. The input operation unit 27 is, for example, a touch panel arranged overlaid on the display unit 26, an operation button attached to a housing, a mouse and / or a keyboard, etc. After the instruction signal generated by the input operation unit 27 is transmitted to the control unit 20 via the bus 29, the control unit 20 executes a predetermined operation according to the instruction signal. The display unit 26 and the input operation unit 27 may be connected to the device 2 via an input / output interface such as a USB.

[0049] Next, the information processing method according to the present embodiment will be described below with reference to Fig. 2. Fig. 2 is a flow chart for explaining an example of a process for determining an IP address (for example, a global IP address) of the device 2. As shown in Fig. 2, in step S1, the device 2 The control unit 20 uses a random number generator to generate a private key for the device 2. Here, the random number generator may be realized by an OS program of the device 2, or may be realized as a hardware configuration (such as a logic circuit) of the device 2. The size of the generated private key is, for example, 512 bits.

[0050] Next, in step S2, the control unit 20 generates a public key of the device 2 based on the generated private key and a predetermined encryption algorithm. Here, the predetermined encryption algorithm is, for example, an elliptic curve encryption algorithm. The size of the generated public key is, for example, 256 bits.

[0051] Next, in step S3, the control unit 20 generates a hash value based on the generated public key and a predetermined hash function. Here, the predetermined hash function is a cryptographic hash function, such as BLAKE. The size of the generated hash value is, for example, 256 bits.

[0052] In addition, in step S3, the control unit 20 may generate a hash value based on the generated public key, a value associated with the predetermined organization, and a predetermined hash function. Here, an example of the value associated with the predetermined organization is a value associated with a trademark of the predetermined organization. For example, if the predetermined organization uses trademark X (e.g., "connectFree"), the value of trademark X may be used when generating the hash value. In this case, it is possible to prevent a third party other than the predetermined organization from creating an information processing program for executing the information processing method according to this embodiment without the permission of the predetermined organization.

[0053] Next, the control unit 20 judges whether the generated hash value satisfies a condition associated with the first two digits (the first and second digits) of the hash value displayed in hexadecimal (step S4). In this regard, when the size of the hash value is 256 bits, the hash value is displayed in 64 hexadecimal digits. For example, when the first two digits of the hash value displayed in 64 digits are "FC" (i.e., hash value=FC...), the control unit 20 may judge that the hash value satisfies the judgment condition of step S4. If the judgment condition of step S4 is YES, the process proceeds to step S5. On the other hand, if the judgment condition of step S4 is NO, the process proceeds to step S1. In other words, the processes of steps S1 to S3 are repeatedly executed until the judgment condition of step S4 is satisfied.

[0054] Next, in step S5, the control unit 20 determines whether the hash value satisfies a condition associated with the type of device 2 (step S5). At this point, it is assumed that the type of device 2 associated with the IP address can be specified according to the values ​​of the third and fourth digits from the beginning of the IP address expressed in hexadecimal. For example, it is assumed that the values ​​of the third and fourth digits from the beginning of the IP address and the type of device have the following relationship.

[0055] [Table 1]

[0056] Here, if the third and fourth digits of the hash value displayed in hexadecimal are consistent with the third and fourth digits from the beginning of the IP address corresponding to the type of device 2, the judgment condition of step S5 is met. For example, assume that the type of device 2 is a personal computer. In this case, the third and fourth digits from the beginning of the IP address of device 2 are “00”, so if the third and fourth digits from the beginning of the hash value displayed in hexadecimal are “00” (i.e., hash value=FC00···), the judgment condition of step S5 is met. On the other hand, if the third and fourth digits from the beginning of the hash value are “11” (i.e., hash value=FC11···), the judgment condition of step S5 is not met. If the judgment condition of step S5 is YES, the process proceeds to step S6. On the other hand, if the judgment condition of step S5 is NO, the process proceeds to step S1. That is, the processes of steps S1 to S3 are repeatedly executed until the judgment condition of step S5 is met. Note that step S5 may be omitted.

[0057] Next, the control unit 20 determines the IP address of the device 2 based on the hash value that satisfies the judgment conditions of steps S4 and S5 (step S6). For example, when the size of the hash value is 256 bits and an IP address (128 bits) corresponding to IPv6 is used as the IP address of the device 2, the control unit 20 may determine the first 32 digits of the 64 digit hash value as the IP address of the device 2. When the size of the hash value is 128 bits and an IP address (128 bits) corresponding to IPv6 is used as the IP address of the device 2, the control unit 20 may determine all values ​​of the 32 digit hash value as the IP address of the device 2. When the size of the hash value is 256 bits and an IP address (32 bits) corresponding to IPv4 is used as the IP address of the device 2, the control unit 20 may determine the first 8 digits of the 64 digit hash value as the IP address of the device 2.

[0058] After the process of step S6, a step of determining whether the determined IP address of the device 2 overlaps with the IP address of another device may be provided. Specifically, after the process of step S6, the device 2 transmits information about the IP address of the device 2 to a management server that manages IP addresses via a communication network. The management server determines whether the IP address transmitted from the device 2 overlaps with one of the IP addresses included in the IP address management table stored in its own storage device. Here, if the IP address of the device 2 overlaps with one of the IP addresses included in the IP address management table, the management server may transmit a message to the device 2 to the effect that registration of the IP address is rejected. In this case, the device 2 transmits information about the determined IP address to the management server again after executing the processes from steps S1 to S6 again. On the other hand, if the IP address of the device 2 does not overlap with any of the IP addresses included in the IP address management table, the management server may transmit a message to the device 2 to the effect that registration of the IP address is permitted.

[0059] Next, in step S7, the control unit 20 obtains an electronic certificate associated with the generated public key from a certification authority of a predetermined organization. That is, the user of device 2 registers a public key with the certification authority and obtains an electronic certificate associated with the registered public key from the certification authority. More specifically, the control unit 20 transmits the public key and an issuance request for an electronic certificate (certificate signing request) to the certification authority server via a communication network. Next, in response to the received issuance request for an electronic certificate, the certification authority server registers the public key and issues an electronic certificate associated with the public key. After that, the certification authority server transmits the electronic certificate to device 2 via the communication network.

[0060] The certification authority of the specified organization may be an intermediate certification authority of the specified organization. In addition, a specified fee may be required to obtain a digital certificate related to the public key from the certification authority.

[0061] According to this embodiment, an IP address unique to the device 2 is determined based on the public key of the device 2. In this way, the device 2 can be connected to a communication network such as the Internet using the IP address determined by the device 2 itself. In particular, the device 2 can connect to the Internet using the IP address determined by the device 2 itself, without going through a service provider (server) that manages global IP addresses such as an ISP. In this regard, as shown in FIG. 3, a user U who operates the device 2 can access a WEB server 6 on the Internet 4 by a predetermined routing via a wireless LAN router 3 by using the IP address determined by the device 2 itself. Furthermore, the device 2 can directly communicate with an external device using the IP address determined by the device 2 itself, without going through a server (e.g., a DHCP server) that manages private IP addresses (details will be described later).

[0062] Therefore, it is possible to provide an information processing method and device 2 that can improve the user experience or user convenience in connection to a communication network such as the Internet.

[0063] Furthermore, according to this embodiment, it is possible to generate a hash value that satisfies the conditions in steps S4 and S5, i.e., it is possible to generate an IP address associated with a hash value that satisfies the conditions in steps S4 and S5.

[0064] Specifically, the first two digits of the hash value displayed in hexadecimal can be set to a fixed value (for example, hash value = FC...). In other words, the first two digits of the IP address can be set to a fixed value (for example, IP address = FC...). This allows a third party to determine whether the IP address of device 2 is an IP address determined by device 2 itself.

[0065] Furthermore, in this embodiment, it is possible to generate a hash value according to the type of device 2. In other words, it is possible to generate an IP address according to the type of device 2. Therefore, a third party can identify the type of device 2 based on the IP address of the device 2.

[0066] Furthermore, in this embodiment, since hash values ​​are repeatedly generated until the determination conditions in steps S4 and S5 are satisfied, it is possible to reliably generate an IP address associated with a hash value that satisfies the conditions in steps S4 and S5.

[0067] Furthermore, according to this embodiment, the public key is directly authenticated by the certification authority through the acquisition of the electronic certificate, and the IP address determined based on the public key is also indirectly authenticated by the certification authority. In this way, the device 2 can connect to a communication network such as the Internet using an IP address that has been indirectly authenticated by a certification authority.

[0068] In the description of this embodiment, the private key of the device 2 is generated using a random number generator of the device 2, but the private key of the device 2 may be provided by an external device communicatively connected to the device 2. The order of the steps shown in Fig. 2 is not particularly limited. For example, the process of step S6 may be executed after the process of step S7.

[0069] Furthermore, the electronic certificate associated with the public key may include information (attribute information) related to the attributes of the device 2. The attribute information of the device 2 may include, for example, at least one of version information of the OS program of the device 2 and information on the serial number of the hardware (for example, a processor, a storage device, etc.) constituting the device 2. Furthermore, the attribute information of the device 2 included in the electronic certificate may be encrypted by a hash function or the like. In this case, the device 2 may transmit the attribute information of the device 2 to the server of the certification authority when transmitting a request for issuance of the public key and electronic certificate (certificate signing request). In this way, since the attribute information of the device 2 is included in the electronic certificate, it is authenticated that the electronic certificate has been issued in accordance with the request of the device 2. Therefore, it is preferable to prevent devices other than the device 2 from using the public key and electronic certificate of the device 2.

[0070] The electronic certificate may also include attribute information of a user associated with the device 2 (e.g., a user who owns the device 2). For example, examples of the user's attribute information include the user's name, identification number, contact information, age, sex, address, or credit card information. In this way, since the user's attribute information is included in the electronic certificate, it is preferable to prevent a third party other than the user from using the public key and electronic certificate of the device 2. Furthermore, when the device 2 transmits the electronic certificate including the user's attribute information to a WEB server, the WEB server can confirm the user attribute information included in the electronic certificate. Therefore, the user of the device 2 can use an online service (such as an EC site) provided by the WEB server without registering user information, etc. In other words, the user of the device 2 can be freed from the trouble of managing login information (login ID and login password) for each online service, and it is possible to provide the user with a rich online experience.

[0071] Also, the electronic certificate may include a hash value of the attribute information of the device 2 and / or the attribute information of the user (hereinafter, sometimes simply referred to as "attribute information") described in the electronic certificate. The hash value is generated based on the attribute information and a cryptographic hash function. In this case, if the attribute information described in the electronic certificate is tampered with by a third party, the hash value changes, so that tampering of the attribute information can be detected based on the hash value. For example, when the device 2 transmits the electronic certificate to an external device, the external device calculates a hash value of the attribute information in the electronic certificate and determines whether the calculated hash value matches the hash value indicated in the electronic certificate. Here, if the calculated hash value matches the hash value indicated in the electronic certificate, the external device determines that the attribute information in the electronic certificate has not been tampered with. On the other hand, if the two do not match, the external device determines that the attribute information in the electronic certificate has been tampered with.

[0072] The digital certificate may also include a hash value of all the contents written in the digital certificate. In this case, if any part of the contents written in the digital certificate is tampered with by a third party, the hash value will also change, making it possible to detect that the contents of the digital certificate have been tampered with by a third party based on the hash value.

[0073] As described above, the electronic certificate includes attribute information of the device 2 and / or attribute information of the user. In this case, all of the attribute information described in the electronic certificate may be transmitted to the external device. Alternatively, some of the attribute information described in the electronic certificate may not be transmitted to the external device. In other words, some of the attribute information described in the electronic certificate may be hashed by a hash function. For example, as shown in FIG. 8, a user can hash the address and credit card information, etc., of the user attribute information 40 described in the electronic certificate 8 through an input operation on the device 2. In this way, the external device that receives the electronic certificate 8 from the device 2 cannot identify the address and credit card information of the user attribute information 40 described in the electronic certificate 8, but can identify the user attribute information 40 other than the address and credit card information.

[0074] 8, the hash value of all the attribute information when all the attribute information is in a displayed state matches the hash value of all the attribute information when some of the attribute information is in a hidden (hashed) state. Similarly, the hash value of all the contents described in the electronic certificate when all the attribute information is in a displayed state matches the hash value of all the contents described in the electronic certificate when some of the attribute information is in a hidden (hashed) state. In other words, even if some of the attribute information is hashed, the hash value of all the attribute information or the hash value of all the contents described in the electronic certificate does not change, so that tampering of the electronic certificate by a third party can be easily detected based on the hash value.

[0075] Moreover, the non-display (hashing) of part of the attribute information may be preset by the user, or may be changeable in response to a request from an external device. It is assumed that the original attribute information may be ascertained based on the hash value of the attribute information by referring to a database showing the relationship between the hash value and the original information. To prevent such a situation, the original attribute information may be hashed based on a predetermined coefficient and the original attribute information. In this case, the predetermined coefficient may be a constant, or may be a variable that changes based on predetermined information (for example, date information of an electronic certificate, etc.).

[0076] Next, an information processing system 30 according to this embodiment will be described below mainly with reference to Fig. 4 and Fig. 5. Fig. 4 is a diagram showing an information processing system 30 including an information processing device 2A (hereinafter simply referred to as "device 2A") and an information processing device 2B (hereinafter simply referred to as "device 2B"). Fig. 5 is a flowchart for explaining an example of a process for determining an IP address of an external device.

[0077] In the information processing system 30 of the present embodiment, for the sake of simplicity, the number of information processing devices communicatively connected to each other is two, but the number of information processing devices communicatively connected to each other may be three or more. Each of the devices 2A and 2B has the hardware configuration of the device 2 shown in FIG.

[0078] Furthermore, each of the devices 2A and 2B is assumed to have already executed the process of determining the IP address shown in Fig. 2. That is, the device 2A is assumed to have already executed the process of determining the IP address of the device 2A. Therefore, as shown in Fig. 4, the device 2A is assumed to have already generated a public key 7A associated with the IP address of the device 2A, and has already acquired an electronic certificate 8A associated with the public key 7A from a certification authority. Similarly, the device 2B is assumed to have already executed the process of determining the IP address of the device 2B. Therefore, as shown in Fig. 4, the device 2B is assumed to have already generated a public key 7B associated with the IP address of the device 2B, and has already acquired an electronic certificate 8B associated with the public key 7B from a certification authority.

[0079] As shown in Fig. 5, in step S10, the device 2A (specifically, the control unit 20 of the device 2A) transmits (broadcasts) a public key 7A and an electronic certificate 8A associated with the public key 7A to the outside of the device 2A. After that, the device 2B existing near the device 2A Then, device 2A receives the public key 7A and electronic certificate 8A broadcast from device 2A. Furthermore, in step S11, device 2B (specifically, control unit 20 of device 2B) transmits (broadcasts) the public key 7B and the electronic certificate 8B associated with the public key 7B to the outside of device 2B. Thereafter, device 2A receives the public key 7B and electronic certificate 8B broadcast from device 2B. The process of step S11 may be executed simultaneously with the process of step S10, or may be executed before the process of step S10.

[0080] Next, in step S12, device 2B determines whether or not the digital certificate 8A broadcast from device 2A is valid. Here, the process of determining the validity of digital certificate 8A (i.e., the process of step S12) will be described below with reference to FIG.

[0081] As shown in FIG. 6, in step S20, the device 2B judges the integrity of the electronic certificate 8A. Specifically, the device 2B checks the owner information of the electronic certificate 8A, the issuer information of the electronic certificate 8A, and the digital signature of the issuer. Next, in step S21, the device 2B judges the expiration date of the electronic certificate 8A. After that, in step S22, the device 2B judges the reliability of the issuer of the electronic certificate 8A. In particular, if the certificate authority that issued the electronic certificate 8A is an intermediate certificate authority, the device 2B identifies the root certificate authority of the intermediate certificate authority that issued the electronic certificate 8A and judges whether the identified root certificate authority is trustworthy. For example, if the identified root certificate authority is included in information on multiple root certificate authorities stored in the memory of the device 2B, the device 2B judges that the issuer of the electronic certificate 8A is trustworthy.

[0082] Returning to Fig. 5, when device 2B determines that digital certificate 8A is valid, it generates a hash value based on public key 7A and a predetermined hash function (step S13). Here, the predetermined hash function is a cryptographic hash function such as BLAKE, as already described. In this embodiment, the hash function used by device 2B and the hash function used by device 2A are assumed to be the same.

[0083] Next, in step S14, device 2B determines the IP address of device 2A based on the generated hash value. For example, as already described, if the size of the hash value is 256 bits and an IP address (128 bits) corresponding to IPv6 is used as the IP address of device 2A, device 2B may determine the first 32 digits of the 64 digit hash value as the IP address of device 2A.

[0084] On the other hand, in step S15, device 2A determines whether or not the electronic certificate 8B broadcast from device 2B is valid. The specific process of step S15 is as shown in FIG. 6. Next, if device 2A determines that the electronic certificate 8B is valid, it generates a hash value based on public key 7B and a predetermined hash function (step S16). As already explained, the hash function used by device 2A is the same as the hash function used by device 2B.

[0085] Thereafter, in step S17, device 2A determines the IP address of device 2B based on the generated hash value. As in the process of step S14, when the size of the hash value is 256 bits and an IP address (128 bits) corresponding to IPv6 is used as the IP address of device 2B, device 2A may determine the first 32 digits of the 64 digit hash value as the IP address of device 2B.

[0086] In this way, the device 2A can know the IP addresses of the devices 2A and 2B, and the device 2B can know the IP addresses of the devices 2A and 2B. Therefore, the devices 2A and 2B can be directly connected to each other without going through a server that manages IP addresses (i.e., In particular, since it is not necessary to connect the devices 2A and 2B via a virtual private network (VPN) server, the power consumption required for a direct connection between the devices 2A and 2B can be significantly reduced. Also, since it is not necessary to connect three or more devices directly, it is not necessary to connect three or more devices directly, so the power consumption required for a direct connection between three or more devices can be significantly reduced.

[0087] For example, since the device 2A can send a message to the device 2B without going through a mail server or the like, it is possible to prevent a situation in which the message of the device 2A is understood by a third party (for example, a server administrator, etc.). Furthermore, the device 2A can send image data showing the screen of the device 2A to the device 2B without going through a VPN server. On the other hand, the device 2B can send an operation signal for operating the screen of the device 2A to the device 2A without going through a VPN server. In this way, the user of the device 2B can remotely operate the device 2A. Furthermore, the devices 2A and 2B can share electronic files with each other without going through a file exchange server. This makes it possible to prevent a situation in which the shared electronic files are understood by a third party.

[0088] Furthermore, when device 2A transmits a message to device 2B (or when device 2B transmits a message to device 2A), the transmitted message (transmitted packet) may be encrypted. For example, the transmitted message may be encrypted with a common key generated based on public key 7A of device 2A and public key 7B of device 2B. Furthermore, the common key may be changed every time a session between device 2A and device 2B is established. In this way, it is possible to realize secure communication between device 2A and device 2B.

[0089] Furthermore, according to this embodiment, when it is determined that the electronic certificate transmitted from the external device is valid, a hash value of the external device is generated based on the public key of the external device. After that, an IP address of the external device is determined based on the hash value of the external device (here, the device 2B is the external device when viewed from the device 2A, while the device 2A is the external device when viewed from the device 2B). In this way, the device 2A can confirm that the received public key 7B is the public key of the device 2B. Furthermore, the device 2A can confirm that the IP address generated based on the public key 7B is the IP address of the device 2B. Therefore, the device 2A can reliably obtain the IP address of the device 2B, and can reliably communicate with the device 2B using the IP address of the device 2B.

[0090] On the other hand, device 2B can confirm that the received public key 7A is the public key of device 2A. Furthermore, device 2B can confirm that the IP address generated based on public key 7A is the IP address of device 2A. Therefore, device 2B can reliably obtain the IP address of device 2A and can reliably communicate with device 2A using the IP address of device 2A.

[0091] As described above, the information processing system according to this embodiment may have three or more information processing devices. For example, as shown in FIG. 7, assume that the information processing system 30A has four information processing devices 2A to 2D (hereinafter simply referred to as "devices 2A to 2D"). Here, each of the devices 2A to 2D has the hardware configuration of the device 2 shown in FIG. 1. In this case, each of the devices 2A to 2D executes each process executed by the device 2A or device 2B shown in FIG. 5.

[0092] In this regard, the device 2A broadcasts its public key and electronic certificate to the outside, and receives public keys and electronic certificates from each of the devices 2B to 2D that exist in the vicinity of the device 2A. The device 2B broadcasts its public key and electronic certificate to the outside, and receives public keys and electronic certificates from each of the devices 2A, 2C, and 2D. Device 2C broadcasts its public key and electronic certificate to the outside, and receives the public key and electronic certificate from each of devices 2A, 2B, and 2D. Device 2D broadcasts its public key and electronic certificate to the outside, and receives the public key and electronic certificate from each of devices 2A to 2C.

[0093] Thereafter, device 2A determines IP addresses of devices 2B to 2D. Device 2B determines IP addresses of devices 2A, 2C, and 2D. Device 2C determines IP addresses of devices 2A, 2B, and 2D. Device 2D determines IP addresses of devices 2A to 2C. In this manner, each of devices 2A to 2D can be directly connected to three external devices using the IP addresses of devices 2A to 2D. In other words, a mesh network can be configured by devices 2A to 2D. Furthermore, the connection of devices 2A to 2D may be via a predetermined routing in the communication network. Devices 2A to 2D can be connected to each other by forming an optimal route.

[0094] Furthermore, in the information processing system 30A shown in FIG. 7, each of the devices 2A to 2D uses the same hash function, and therefore a mesh network is formed by the devices 2A to 2D, but the present embodiment is not limited to this.

[0095] For example, devices 2A and 2B may use a first hash function, while devices 2C and 2D may use a second hash function different from the first hash function. In this case, devices 2A and 2B are communicatively connected to each other, and devices 2C and 2D are communicatively connected to each other. On the other hand, devices 2A and 2B are not communicatively connected to devices 2C and 2D. In this way, by using two different hash functions, two communication network groups can be constructed within information processing system 30A.

[0096] In order to realize the device 2 according to the present embodiment by software, the information processing program may be pre-installed in the storage device 23 or ROM. Alternatively, the information processing program may be stored in a computer-readable storage medium such as a magnetic disk (e.g., HDD, floppy disk), an optical disk (e.g., CD-ROM, DVD-ROM, Blu-ray (registered trademark) disk), a magneto-optical disk (e.g., MO), or a flash memory (e.g., SD card, USB memory, SSD). In this case, the information processing program stored in the computer-readable storage medium may be installed in the storage device 23. Furthermore, the information processing program installed in the storage device 23 may be loaded onto the RAM, and the processor may execute the information processing program loaded onto the RAM. In this manner, the information processing method according to the present embodiment is executed by the device 2.

[0097] The information processing program may also be stored in a storage medium (e.g., HDD) of a server on a communication network such as the Internet. In this case, the information processing program may be downloaded from the server via the network interface 25. In this case, the downloaded information processing program may also be incorporated into the storage device 23.

[0098] Moreover, the information processing program (information processing method) according to the present embodiment is executed by the network layer in the OSI (Open Systems Interconnection) reference model, which allows secure communication to be realized in the transport layer, session layer, presentation layer, and application layer of the OSI reference model, and allows existing application programs and physical infrastructure to be applied as is.

[0099] Although the embodiment of the present invention has been described above, the technical scope of the present invention should not be interpreted as being limited by the description of the embodiment. The embodiment is merely an example, and it is understood by those skilled in the art that various modifications of the embodiment are possible within the scope of the invention described in the claims. The technical scope of the present invention should be determined based on the scope of the invention described in the appended claims and their equivalents.

[0100] For example, in the process of step S7 shown in Fig. 2, device 2 may obtain digital certificates associated with the public key of device 2 from the certification authorities of multiple organizations. The digital certificates may also include information related to the organizational attributes of the certification authorities. For example, if the digital certificate is issued by the certification authority of organization X, the digital certificate may include information related to the attributes of organization X.

[0101] Also, as shown in FIG. 4, the device 2A acquires multiple digital certificates 8A from certification authorities of multiple different organizations, and the device 2B acquires multiple digital certificates 8B from certification authorities of multiple different organizations. In this case, the device 2A transmits the public key 7A and the multiple digital certificates 8A to the device 2B in step S10. The device 2B transmits the public key 7B and the multiple digital certificates 8B to the device 2A in step S11. Furthermore, the device 2B may determine whether each of the multiple digital certificates 8A is valid in step S12, and then determine whether at least one of the organizations of the multiple certification authorities that have issued the multiple digital certificates 8A is included in an organization list indicating the organizations of the multiple certification authorities stored in the memory of the device 2B. Specifically, the device 2B may determine whether at least one of the organizations of the multiple certification authorities that have issued the multiple digital certificates 8A is included in the organization list based on information related to the attributes of the organization included in the digital certificate 8A and the organization list. The device 2B may execute the processes of steps S13 and S14 when at least one of the organizations of the multiple certification authorities that have issued the multiple digital certificates 8A is included in the organization list.

[0102] Similarly, in step S15, after determining whether each of the multiple electronic certificates 8B is valid, device 2A may determine whether at least one of the organizations of the multiple certification authorities that issued the multiple electronic certificates 8B is included in an organization list indicating the multiple organizations stored in the memory of device 2A. Specifically, device 2A may determine whether at least one of the organizations of the multiple certification authorities that issued the multiple electronic certificates 8B is included in the organization list, based on information related to the attributes of the organization included in electronic certificate 8B and the organization list. Device 2A may execute the processes of steps S16 and S17 when at least one of the organizations that issued the multiple electronic certificates 8B is included in the organization list.

[0103] In this way, when the organization that issued the digital certificate for public key 7A is included in the organization list stored in device 2B and the organization that issued the digital certificate for public key 7B is included in the organization list stored in device 2A, device 2A and device 2B can be directly connected to each other. In other words, it is possible to select a communication partner according to conditions related to the organization that issued the digital certificate, and to build multiple communication network groups within the information processing system.

[0104] In the above example, devices 2A and 2B obtain multiple electronic certificates, but even when devices 2A and 2B obtain one electronic certificate, processing related to a judgment condition related to the organization that issued the electronic certificate may be applied. For example, when the organization of the certification authority that issued the electronic certificate of device 2A is different from the organization of the certification authority that issued the electronic certificate of device 2B, the processing of steps S13 and S14 (steps S16 and S17) may not be performed.

[0105] In this embodiment, an IP address that is a network address corresponding to the Internet Protocol is described as an example of the network address of the devices 2A and 2B, but the network address is not limited to an IP address. For example, the network addresses of the devices 2A and 2B may be network addresses corresponding to a predetermined communication protocol other than the Internet Protocol.

[0106] This application incorporates by reference the contents disclosed in a Japanese patent application (Patent Application No. 2018-166429) filed on September 5, 2018, as appropriate.

Claims

1. A communication system including a first device and a second device capable of communicating with each other, The second device is means for acquiring a first public key of the first device that is paired with a first private key of the first device; means for determining a first network address of the first device using all or only a part of a first hash value generated based on the first public key and a predetermined hash function; The first device is means for acquiring a second public key of the second device paired with a second private key of the second device; and means for determining a second network address of the second device from all or only a portion of a second hash value generated based on the second public key and the predetermined hash function.

2. 2. The communication system according to claim 1, wherein the second device determines, as the second private key, one of the private keys generated using a random number generator, whose hash value generated based on a public key that pairs with the private key and the predetermined hash function, which satisfies a condition for being used as a network address.

3. The communication system according to claim 1 or 2, wherein the second device broadcasts a digital certificate associated with the second public key.

4. The communication system of claim 3 , wherein the second device obtains the digital certificate from a certificate authority.

5. The communication system according to claim 3 , wherein the electronic certificate includes at least one of attribute information related to an attribute of the second device and attribute information of a user associated with the second device.

6. A communication device capable of communicating with another communication device, means for acquiring a first public key of the other communication device that is paired with a first private key of the other communication device; a means for determining a network address of the other communication device using all or a part of a first hash value generated based on the first public key and a predetermined hash function; means for providing a second public key paired with the second private key; A communication device in which the other communication device determines a network address of the communication device using all or only a part of a second hash value generated based on the provided second public key and the predetermined hash function.

7. 7. The communication device according to claim 6, further comprising: a means for determining, as the second private key, a private key generated using a random number generator, the hash value of which satisfies a condition for being used as a network address, the hash value being generated based on a public key that is a pair with the private key and the predetermined hash function.

8. The communication device of claim 6 or 7, further comprising means for providing a digital certificate associated with the second public key.

9. The communication device of claim 8 , further comprising: means for obtaining the digital certificate from a certificate authority.

10. The communication device according to claim 8 , wherein the electronic certificate includes at least one of attribute information relating to an attribute of the communication device and attribute information of a user associated with the communication device.

11. A communication method executed by a communication device capable of communicating with another communication device, comprising: obtaining a first public key of the other communication device that is paired with a first private key of the other communication device; determining, as a network address of the other communication device, all or only a part of a first hash value generated based on the first public key and a predetermined hash function; providing a second public key paired with the second private key; A communication method, wherein the other communication device determines a network address of the communication device using all or only a part of a second hash value generated based on the provided second public key and the predetermined hash function.

12. 12. The communication method according to claim 11, further comprising a step of determining, as the second private key, a private key generated using a random number generator, the second private key, the hash value of which satisfies a condition for being used as a network address and is generated based on a public key that is a pair with the private key and the predetermined hash function.

13. The method of claim 11 or 12, further comprising the step of providing a digital certificate associated with the second public key.

14. The method of claim 13 further comprising the step of obtaining the digital certificate from a certificate authority.

15. The communication method according to claim 13 or 14, wherein the electronic certificate includes at least one of attribute information relating to an attribute of the communication device and attribute information of a user associated with the communication device.

16. A communication program for causing a computer to execute the communication method according to any one of claims 11 to 15.

Images