Data transmission method, communication processing method, device, and communication processing program

Abstract

To provide a configuration in which each device can achieve data communication independently in a network including many devices.SOLUTION: A data transmission method includes: a step in which each of a plurality of devices determines an IP address of each device based on a hash value calculated according to a hash function from a public key of each device; a step in which each of the devices maintains state information reflecting a connection relationship of each device and sends a notification message indicating content of the state information to other devices; a step in which each of the devices updates the state information maintained by each device based on the notification message received from the other devices; and a step of determine a routing table maintained among the devices included in the set to be used to search for devices being destinations of data transmission among a set of devices logically defined based on the state information held by each device.SELECTED DRAWING: Figure 15

Description

[Technical field]

[0001] The present disclosure relates to techniques for data communication between devices having authenticated IP addresses. [Background technology]

[0002] Recent Information and Communication Technology Advances in ICT (Information and Communication Technology) have been remarkable, and devices connected to networks such as the Internet are no longer limited to traditional information processing devices such as personal computers and smartphones, but are now expanding to include a wide variety of things. This technological trend is known as the Internet of Things (IoT), and a variety of technologies and services are being proposed and put into practical use. In the future, it is expected that billions of people and tens of billions or even trillions of devices on Earth will be connected simultaneously. To realize such a networked world, it is necessary to provide solutions that allow for simpler, safer, and more free connections.

[0003] Typically, on a network, data communication between devices is achieved using an Internet Protocol (IP) address that is statically or dynamically assigned to each device.

[0004] In order to realize data communication between devices, data sent from the source device must be transferred to the destination device. This data transfer process is called "routing." To realize this routing, many routers are placed on the network.

[0005] As disclosed in Japanese Patent Laid-Open No. 05-022293 (Patent Document 1), a router has a route information table that stores route information, and determines a route and relays a received frame according to the internetworking address in the received frame and the contents of the route information table (paragraphs

[0005] and

[10] of Japanese Patent Laid-Open No. 05-022293).

[0006] etc.). [Prior art documents] [Patent documents]

[0006] [Patent Document 1] Japanese Patent Application Publication No. 05-022293 Summary of the Invention [Problem to be solved by the invention]

[0007] According to the above-mentioned Patent Document 1, assuming a network with many devices, many routers are required, and the responsibility of each router also becomes large. Therefore, in a network with many devices, it is preferable that each device is configured to perform data communication independently. This disclosure provides a solution for realizing such a configuration. [Means for solving the problem]

[0008] According to an embodiment of the present disclosure, there is provided a data transmission method in a network to which a plurality of devices are connected. The data transmission method includes a step of each of the plurality of devices determining an IP address of each of the plurality of devices based on a hash value calculated from a public key held by each of the plurality of devices according to a hash function, a step of each of the plurality of devices retaining state information reflecting the connection relationship of each of the plurality of devices and transmitting a notification message indicating the contents of the state information to other devices, and a step of each of the plurality of devices receiving a notification message from the other devices. The method includes a step of updating state information held by each device based on the notification message received, and a step of determining a routing table used to search for a device to be a destination of data transmission, the routing table being held among devices included in a set of devices logically defined based on the state information held by each device.

[0009] The notification message may include identification information for identifying each device, which is calculated based on the IP address determined by each device.

[0010] The data transmission method may further include a step in which each of the multiple devices transmits to another device a public key and an electronic certificate associated with the public key, and in the device receiving the public key and electronic certificate, determines an IP address of the device that transmitted the public key and electronic certificate based on a hash value calculated from the public key according to a hash function.

[0011] The determined IP address may include a predetermined unique value for identification. The determined IP address may include a value that depends on the type of device that determined the IP address.

[0012] According to another aspect of the present disclosure, there is provided a communication processing method for a device connected to a network, which includes the steps of: determining an IP address of the device itself based on a hash value calculated from a public key according to a hash function; storing state information reflecting a connection relationship with other devices and transmitting a notification message indicating the contents of the state information to the other devices; updating the state information based on the notification message received from the other devices; and storing a routing table used to search for a device that is a destination of data transmission among a set of devices logically defined based on the state information stored in each device.

[0013] The notification message may include identification information for identifying the own device, which is calculated based on the determined IP address of the own device.

[0014] The communication processing method may further include a step of determining a routing table when it is determined based on the state information that the own device operates as a root node in the set.

[0015] Maintaining the routing table may include receiving the routing table from another device.

[0016] The state information and the notification message may include identification information for identifying a device that is determined to be the root node. The updating step may include a step of determining, when a device that is determined to be the root node and that is included in the received notification message does not match a device that is determined to be the root node and that is included in the state information, determining that one of the devices is the root node in accordance with a predetermined rule.

[0017] The communication processing method may further include the steps of obtaining a digital certificate associated with the public key from a certificate authority, and transmitting the public key and the digital certificate to the other device.

[0018] The communication processing method includes a step of determining the authenticity of the electronic certificate when receiving a public key and an electronic certificate associated with the public key from another device, and, if the electronic certificate is determined to be authentic, transmitting the electronic certificate to the other device based on a hash value calculated from the public key according to a hash function. and determining an IP address of the device.

[0019] The determined IP address may include a predetermined unique value for identification. The determined IP address may include a value that depends on the type of device that determined the IP address.

[0020] According to another aspect of the present disclosure, there is provided a communication processing method for a device connected to a network, the communication processing method including the steps of receiving a public key held by another device and a digital certificate associated with the public key, determining the validity of the digital certificate, determining, if the digital certificate is determined to be valid, an IP address determined based on a hash value calculated from the public key according to a hash function as an authenticated IP address of the other device, and providing a service according to the authenticated IP address of the other device in response to a request from the other device.

[0021] The public key may be determined such that an IP address determined based on a hash value calculated from the public key according to a hash function matches a predetermined format.

[0022] An apparatus according to yet another aspect of the present disclosure includes a network interface for connecting to a network, and a control unit connected to the network interface. The control unit executes a process of determining an IP address of the device itself based on a hash value calculated from a public key according to a hash function, a process of retaining state information reflecting a connection relationship with other devices and transmitting a notification message indicating the contents of the state information to the other devices, a process of updating the state information based on the notification message received from the other devices, and a process of retaining a routing table used to search for a device that is a destination of data transmission among a set of devices logically defined based on the state information retained by each device.

[0023] According to yet another aspect of the present disclosure, there is provided a communication processing program for a computer having a network interface for connecting to a network, the communication processing program causing the computer to execute the above-mentioned communication processing method when executed by the computer. Effect of the Invention

[0024] According to the present disclosure, it is possible to provide a configuration in which, in a network including a large number of devices, each device can independently realize data communication. [Brief description of the drawings]

[0025] [Figure 1] 1 is a schematic diagram showing an example of an overall configuration of a network system according to the present embodiment; [Diagram 2] FIG. 2 is a schematic diagram showing an example of a hardware configuration of a device according to the present embodiment. [Diagram 3] FIG. 2 is a schematic diagram showing an example of a configuration of programs and data of a device according to the present embodiment. [Figure 4] 10 is a diagram illustrating an IP address authentication procedure in the network system according to the present embodiment. FIG. [Diagram 5] 11 shows an example of type specifying information embedded in an IP address used in the network system according to the present embodiment. FIG. [Figure 6] 13 is a flowchart showing a processing procedure in which a device provides an authenticated IP address in the network system according to the present embodiment. [Figure 7] 1 is a diagram for illustrating a process relating to notification of an IP address in a network system according to an embodiment of the present invention. FIG. [Figure 8] 1 is a diagram for illustrating a process relating to notification of an IP address in a network system according to an embodiment of the present invention. FIG. [Figure 9] 10 is a sequence chart showing a process procedure relating to notification of an IP address in the network system according to the present embodiment. [Figure 10] FIG. 1 is a diagram for explaining an example of an application for providing a service using a network system according to an embodiment of the present invention. [Figure 11] FIG. 11 is a diagram for explaining another application example of service provision using the network system according to the present embodiment. [Figure 12]This is a diagram for explaining an example of routing in a network system according to the present embodiment. [Figure 13] This is a diagram for explaining a method for realizing routing in a network system according to the present embodiment. [Figure 14] This is another diagram for explaining a method for realizing routing in a network system according to the present embodiment. [Figure 15] This is a sequence chart showing a processing procedure related to the realization of routing in a network system according to the present embodiment. [Figure 16] This is a diagram showing an example of the data structure of state information and state notification messages used in a network system according to the present embodiment. [Figure 17] This is a diagram showing an example of updating state information by a state notification message in a network system according to the present embodiment. [Figure 18] This is a flowchart showing a processing procedure related to the determination of a routing table in a network system according to the present embodiment. [Figure 19] This is a flowchart showing a processing procedure related to packet transmission and reception of each device in a network system according to the present embodiment.

Embodiments for Carrying Out the Invention

[0026] Embodiments according to the present disclosure will be described in detail with reference to the drawings. Note that the same or corresponding parts in the drawings are denoted by the same reference numerals and their descriptions will not be repeated.

[0027] <A. Overall Configuration of Network System 1> First, the overall configuration of network system 1 according to the present embodiment will be described.

[0028] Fig. 1 is a schematic diagram showing an example of the overall configuration of a network system 1 according to the present embodiment. With reference to Fig. 1, it is assumed that a plurality of devices 100-1, 100-2, 100-3, 100-4, 100-5, ... (hereinafter, sometimes collectively referred to as "devices 100") are connected to an arbitrary network 2 such as the Internet or an intranet. Some of the devices 100 may be connected to the network 2 via wireless communication established with an access point 4. Alternatively, another portion of the devices 100 may be connected to the network 2 via wireless communication established with a mobile base station 6.

[0029] Thus, network 2 may include any of a local area network (LAN), a wide area network (WAN), a radio access network (RAN), and the Internet.

[0030] Each of the devices 100 connected to the network can be considered a "node" of the network, and in the following description, the devices 100 may also be referred to as a "node."

[0031] In the network system 1 according to the present embodiment, the following communication is performed between the devices 100: The data communication is realized according to such a procedure. Note that any method of physical connection between the devices 100 may be used.

[0032] The device 100 includes any device that has a function of performing data communication with other devices using the IP address that each device has. The device 100 may be configured as a communication device alone, or may be configured as a part of some object, or may be configured by being incorporated into some object.

[0033] More specifically, the device 100 may be, for example, a personal computer, a smartphone, a tablet, or a wearable device (for example, a smart watch or AR glasses) that is attached to the user's body (for example, an arm or a head). The device 100 may also be a control device or a part thereof installed in a smart home appliance, a connected automobile, a factory, or the like.

[0034] The network system 1 according to this embodiment further includes one or more certificate authorities 200. Each of the certificate authorities 200 is a computer configured with one or more servers. Using one or more certificate authorities 200, the IP address of each device 100 is authenticated by a procedure to be described later. As a result, each device 100 has an authenticated IP address.

[0035] In this specification, an "authenticated IP address" refers to a state in which the validity of the IP address held by each device 100 is guaranteed to the communication destination or a third party. More specifically, an "authenticated IP address" refers to an IP address that is generated by an irreversible cryptographic hash function and is authenticated directly or indirectly by a certification authority (details will be described later). By using such an "authenticated IP address," it is possible to guarantee that the IP address used by each device 100 for data communication is not forged.

[0036] As a result, any device 100 included in the network system 1 is uniquely identified based on the IP address of each device 100. That is, each device can determine the destination or destination device for data transmission based on the IP address of each device.

[0037] The IP address is assumed to be a global IP address that can be used for data communication between devices 100 connected to the Internet, but may be a private IP address that is used only within a specific network.

[0038] IP addresses differ in the number of bits that make up the address depending on the version. In the currently established IPv4 (Internet Protocol Version 4), a 32-bit address range is defined, and in the currently established IPv6 (Internet Protocol Version 6), a 128-bit address range is defined. In the present embodiment, the IP address conforming to IPv6 will be mainly described. However, the present disclosure is also applicable to network addresses defined with a larger number of bits or network addresses defined with a smaller number of bits.

[0039] <B. Configuration Example of Device 100> Next, a configuration example of the hardware and software of the device 100 used in the network system 1 according to the present embodiment will be described.

[0040] FIG. 2 is a schematic diagram showing a hardware configuration example of the device 100 according to the present embodiment. Referring to FIG. 2, the device 100 includes, as main components, a control unit 110 which is a processing circuitry.

[0041] The control unit 110 is an operation entity for realizing the provision of functions and the execution of processing according to the present embodiment. The control unit 110 may be configured such that a processor executes computer readable instructions (an OS (Operating System) and a communication processing program as shown in FIG. 3) stored in a memory using a processor and a memory as shown in FIG. 2. Alternatively, an ASIC (Application The control unit 110 may be realized by using a hardwired circuit such as a field specific integrated circuit (FPGA). Alternatively, the control unit 110 may be realized by implementing a circuit corresponding to computer readable instructions on an FPGA (field-programmable gate array). The control unit 110 may also be realized by appropriately combining a processor, a memory, an ASIC, an FPGA, and the like.

[0042] In a configuration using a processor and memory as shown in FIG. 2, the control unit 110 includes a processor 102, a main memory 104, a storage 106, and a ROM (Read Only Memory) 108.

[0043] The processor 102 is an arithmetic circuit that sequentially reads and executes computer-readable instructions. The processor 102 is composed of, for example, a central processing unit (CPU), a micro processing unit (MPU), a graphics processing unit (GPU), etc. The control unit 110 may be realized using a plurality of processors 102 (multiprocessor configuration), or may be realized using a processor having a plurality of cores (multicore configuration).

[0044] The main memory 104 is a volatile storage device such as a dynamic random access memory (DRAM) or a static random access memory (SRAM). The processor 102 loads a specified program from among various programs stored in the storage 106 or the ROM 108 onto the main memory 104, and cooperates with the main memory 104 to realize various processes according to the present embodiment.

[0045] The storage 106 is, for example, a non-volatile storage device such as a hard disk drive (HDD), a solid state drive (SSD), a flash memory, etc. The storage 106 stores various programs executed by the processor 102 and various data to be described later.

[0046] The ROM 108 permanently stores various programs executed by the processor 102 and various data to be described later.

[0047] In a configuration in which the processor 102 executes computer-readable instructions stored in a memory as shown in FIG. 2, the memory corresponds to the storage 106 and the ROM 108 .

[0048] Here, an example of the programs and data stored in the memory of the device 100 will be described.

[0049] 3 is a schematic diagram showing an example of the configuration of programs and data of the device 100 according to the present embodiment. With reference to FIG. 3, the memory (storage 106 and / or ROM 108) of the device 100 stores, for example, an OS, 160, a communication processing program 170, and various applications 300 are stored.

[0050] The OS 160 is a program that provides basic functions for implementing processes executed by the device 100. The communication processing program 170 is a program that mainly provides functions and executes processes according to the present embodiment. Note that the communication processing program 170 may provide functions and execute processes according to the present embodiment by using libraries provided by the OS 160, etc.

[0051] The various applications 300 are programs for implementing various functions provided by the device 100, and can be installed at the user's discretion. Typically, the various applications 300 provide various processes that utilize the data communication function provided by the communication processing program 170.

[0052] In addition, in the memory (storage 106 and / or ROM 108) of the device 100, for example, a private key 172, a public key 174, and an electronic certificate 176 are stored as data necessary for providing the function and executing the process according to the present embodiment. The private key 172 and the public key 174 are a so-called key pair generated according to an arbitrary encryption / decryption algorithm. The private key 172 is used for encrypted communication with other devices. The public key 174 is used to determine the IP address of each device 100 according to a procedure to be described later. The electronic certificate 176 is issued by the certificate authority 200 for the public key 174, and is intended to guarantee the validity of the IP address of the device 100. Usually, the electronic certificate 176 includes a hash value (electronic signature) calculated from the public key 174 of each device 100 using the private key of the certificate authority 200. The device 100 that receives the digital certificate 176 uses the public key of the certificate authority 200 to verify the authenticity of the digital certificate 176 and the public key 174 associated with the digital certificate 176 .

[0053] The generation of a key pair (private key 172 and public key 174), the acquisition of a digital certificate 176, and the procedures for using this data will be described later.

[0054] It is not necessary to provide both the storage 106 and the ROM 108, and only one of them may be provided depending on the implementation form. In addition, when both the storage 106 and the ROM 108 are provided, for example, the key pair (private key 172 and public key 174) may be stored in the ROM 108 to enhance confidentiality.

[0055] 2, the device 100 further includes a network interface 120 for connecting the device 100 to a network. The network interface 120 performs data communication with other devices over the network.

[0056] The network interface 120 includes a wired connection terminal such as an Ethernet port, a Universal Serial Bus (USB) port, a serial port such as IEEE1394, or a legacy parallel port. Alternatively, the network interface 120 may include a processing circuit and an antenna for wireless communication with a device, a router, a mobile base station, or the like. The wireless communication supported by the network interface 120 may be, for example, any of Wi-Fi (registered trademark), Bluetooth (registered trademark), ZigBee (registered trademark), Low Power Wide Area (LPWA), GSM (registered trademark), W-CDMA, CDMA200, Long Term Evolution (LTE), and a fifth generation mobile communication system (5G).

[0057] The device 100 may include, as optional components, a display unit 130 and an input unit 131. 40 and a media interface 150.

[0058] The display unit 130 is a component for externally presenting the processing results of the processor 102, etc. The display unit 130 may be, for example, an LCD (Liquid Crystal Display) or an organic EL (Electro-Luminescence) display. The display unit 130 may also be a head-mounted display that is worn on the user's head, or a projector that projects an image onto a screen.

[0059] The input unit 140 is a component for receiving an input operation of a user who operates the device 100. The input unit 140 may be, for example, a keyboard, a mouse, a touch panel arranged on the display unit 130, an operation button arranged on the housing of the device 100, or the like.

[0060] The media interface 150 reads various programs (computer-readable instructions) and / or various data from a non-transitory medium 152 in which the various programs and / or data are stored.

[0061] The medium 152 may be, for example, an optical medium such as a DVD (Digital Versatile Disc), a semiconductor medium such as a USB memory, etc. The media interface 150 adopts a configuration according to the type of the medium 152. Various programs and / or various data read by the media interface 150 may be stored in the storage 106, etc.

[0062] Instead of installing various programs and / or various data in device 100 via medium 152, necessary programs and data may be installed in device 100 from a distribution server on a network. In this case, necessary programs and data are acquired via network interface 120.

[0063] As described above, the display unit 130, the input unit 140, and the media interface 150 are optional components, and may be connected from outside the device 100 via any interface such as a USB.

[0064] It is the control unit 110 that realizes the provision of functions and the execution of processes according to this embodiment, and the technical scope of the present application includes at least the hardware and / or software for realizing the control unit 110. As described above, the hardware may include not only a configuration consisting of a processor and a memory, but also a hard-wired circuit using an ASIC or the like and a configuration using an FPGA. That is, the control unit 110 can be realized by installing a program in a general-purpose computer, or can also be realized as a dedicated chip.

[0065] In addition, the software executed by the processor may include not only those distributed via the medium 152, but also those appropriately downloaded via a distribution server.

[0066] Note that the configuration for realizing the provision of functions and the execution of processes according to this embodiment is not limited to the control unit 110 shown in FIG. 2, and can be implemented using any technology according to the era in which it is realized.

[0067] <C. Authenticated IP Address> Next, the process for providing an authenticated IP address to each device 100 and the like will be described.

[0068] (c1: IP Address Determination Process) In the network system 1 according to this embodiment, typically, the IP address of each device 100 is authenticated using an authenticated IP address. As an example, the IP address of each device 100 may be authenticated using a public key infrastructure (PKI).

[0069] FIG. 4 is a diagram for explaining the IP address authentication procedure in the network system 1 according to this embodiment. Note that the symbols such as "S1" to "S4" in FIG. 4 correspond to the step numbers shown in FIG. 6.

[0070] 4, device 100 has a key pair consisting of private key 172 and public key 174. A hash value 178 is calculated by inputting public key 174 to a predetermined hash function 180, and all or a part of the calculated hash value 178 is used as an IP address 190 of device 100.

[0071] In accordance with this process of determining the IP address 190, the device 100 transmits the public key 174 to the certificate authority 200, and links the public key 174 to the digital certificate 176 issued by the certificate authority 200. The device 100 transmits its own public key 174 and digital certificate 176 to the other device. The other device confirms the validity of the IP address 190 of the device 100 based on the public key 174 and digital certificate 176 published by the device 100. When the validity of the IP address 190 is confirmed, data communication is started using the IP address 190 whose validity has been confirmed. The device and the other device can directly communicate with each other, but in addition to the direct communication process, an inquiry process at the certificate authority 200 may also be included.

[0072] In this manner, in the network system 1 according to the present embodiment, the IP address 190 itself can be authenticated, and since the device itself holds such an authenticated IP address 190, an autonomous network can be constructed without using IP addresses statically or dynamically assigned to each device.

[0073] The process for providing an authenticated IP address in network system 1 according to the present embodiment will now be described in detail.

[0074] The key pair, private key 172 and public key 174, may be generated by device 100 itself, or may be provided from an external source and stored in advance in device 100. If provided from an external source, device 100 may obtain only private key 172 and generate public key 174 by itself.

[0075] As an example of a method for generating the public key 174 of the key pair, a bit string of a predetermined length (e.g., 512 bits) generated by a random number generator may be used as the private key 172, and the public key 174 consisting of a bit string of a predetermined length (e.g., 256 bits) may be generated from the private key 172 in accordance with a known encryption algorithm (e.g., elliptic curve encryption algorithm). Note that when the device 100 itself generates the key pair, the random number generator may be realized by utilizing a function provided by the OS 160, or may be realized by using a hardwired circuit such as an ASIC.

[0076] The hash function 180 may be a known irreversible cryptographic hash function (e.g., BLAKE). The hash function 180 may be a bit string of a predetermined length (e.g., 256 bits). A hash value 178 consisting of the 178 bits is calculated.

[0077] In addition to public key 174, an arbitrary keyword may be input to hash function 180. A message associated with a specific organization may be used as the arbitrary keyword. A message including the name of a trademark owned by the specific organization may be used as the message associated with the specific organization. For example, the name of a registered trademark owned by the specific organization (e.g., "connectFree") may be used as the keyword to be input to hash function 180. By adopting such an implementation method, it is possible to prevent a third party other than the specific organization from implementing network system 1 according to this embodiment and related methods and programs without the permission of the specific organization.

[0078] All or a part of hash value 178 calculated by hash function 180 is used as IP address 190. For example, when a 256-bit (64 hexadecimal digits) hash value 178 is calculated, any 32 digits (e.g., the first 32 digits) of the 64-digit hash value 178 may be determined as IP address 190 (128 bits) corresponding to IPv6. Alternatively, the first 8 digits of the 64-digit hash value 178 may be determined as IP address 190 (32 bits) corresponding to IPv4.

[0079] Alternatively, the 128-bit hash value 178 may be calculated from the hash function 180, taking into consideration the IP address 190 (128 bits) corresponding to IPv6. In this case, the entire calculated hash value 178 can be determined as the IP address 190 (128 bits) corresponding to IPv6.

[0080] According to this embodiment, the IP address 190 unique to the device 100 can be determined based on the public key 174 of the device 100. In this manner, the device 100 can be connected to a network such as the Internet using the IP address 190 determined by the device 100. Furthermore, the device 100 can perform data communication using the IP address 190 determined by itself, even if there is no service provider (server) that manages global IP addresses such as an Internet service provider (ISP). Furthermore, the device 100 can connect to a global network such as the Internet and perform data communication using the IP address 190 determined by itself, even if there is no server that manages private IP addresses such as a DHCP (Dynamic Host Configuration Protocol) server implemented in an access point or the like. Therefore, the user experience and user convenience regarding connection to a network such as the Internet can be improved.

[0081] (c2: Unique string) The IP address 190 determined by the device 100 may be specified as having been determined in accordance with the processing procedure according to the present embodiment. In order to perform such specification, for example, a predetermined unique value (unique character string) for specification may be included in the IP address 190. In other words, the determined IP address may include a predetermined unique value (unique character string) for specification.

[0082] As an example, the first two digits (the first and second digits from the top) of the IP address 190 expressed in hexadecimal may be fixed to a predetermined unique character string (for example, "FC"). Since the hash function 180 is usually a one-way function, it is not possible to reverse-calculate the public key 174 from the IP address 190. Therefore, a random number generator may be used to repeatedly generate the private key 172 and the public key 174 until the determined IP address 190 satisfies a predetermined condition (in this case, the first two digits become a predetermined unique value). In other words, the public key 174 is determined based on a hash value calculated from the public key 174 according to the hash function. The P-Address 190 may be determined to conform to a predetermined format.

[0083] In this way, by including a predetermined unique value for identification (for example, the first two digits are “FC”) in IP address 190, a third party can determine whether IP address 190 of device 100 was determined by device 100 itself.

[0084] (c3: type specific information) The IP address 190 determined by the device 100 may include information that can identify the type of the device 100. In order to perform such identification, for example, the IP address 190 may include a value according to the type of the device 100. In other words, the determined IP address 190 may include a value according to the type of the device 100 that determined the IP address 190.

[0085] As an example, a value (type-specific information) according to the type of device 100 may be embedded in the third and fourth digits from the beginning of the IP address 190 expressed in hexadecimal notation.

[0086] Fig. 5 is a diagram showing an example of type identification information embedded in an IP address used in network system 1 according to the present embodiment. The type identification information shown in Fig. 5 may be stored in advance in ROM 108 (see Fig. 2) of control unit 110 of each device 100. As an example, a value according to the type of device as shown in Fig. 5 can be used.

[0087] As shown in FIG. 5, for example, if the type of device 100 is a personal computer, the value "00" indicating a personal computer is set in the third and fourth digits from the beginning of the IP address 190.

[0088] As described above, since hash function 180 is usually a one-way function, public key 174 cannot be calculated backward from IP address 190. Therefore, a random number generator may be used to repeatedly generate private key 172 and public key 174 until the determined IP address 190 satisfies a predetermined condition (in this case, the third and fourth digits from the beginning are values ​​indicating the type of device 100). In other words, public key 174 may be determined so that IP address 190 determined based on a hash value calculated from public key 174 according to a hash function matches a predetermined format.

[0089] In this way, by including a value indicating the type of device 100 in the IP address 190, a third party can identify the type of device 100 from the IP address 190 determined by the device 100.

[0090] (c4: Registration of public key 174 and acquisition of electronic certificate 176) Next, the registration of the public key 174 and the acquisition of the electronic certificate 176 will be described.

[0091] The device 100 obtains the digital certificate 176 for verifying the validity of the public key 174 from the certification authority 200. The procedure for obtaining the digital certificate 176 is as follows: the device 100 transmits the public key 174 to the certification authority 200 and registers it there; and the device 100 obtains the digital certificate 176 associated with the registered public key 174 from the certification authority 200.

[0092] More specifically, the device 100 (control unit 110) transmits the public key 174 and a request for issuing an electronic certificate (hereinafter also referred to as a "certificate signing request") to the certification authority 200 via the network. In response to the certificate signing request received from the device 100, the certification authority 200 registers the public key 174 and issues the electronic certificate 176 associated with the registered public key 174. The certification authority 200 then transmits the electronic certificate 176 via the network. 6 to device 100.

[0093] Typically, the digital certificate 176 includes information about the owner of the digital certificate 176 (in this example, the device 100), information about the issuer of the digital certificate 176 (in this example, the certificate authority 200), the issuer's digital signature, and the expiration date of the digital certificate 176.

[0094] The certificate authority 200 may be operated by a specific organization, or may be an intermediate certificate authority associated with a root certificate authority operated by a specific organization. In addition, a specific fee and / or maintenance fee may be charged to the specific organization for registering the public key 174 and issuing the digital certificate 176 associated with the public key 174.

[0095] According to the present embodiment, public key 174 is directly authenticated by certification authority 200 through registration and acquisition of public key 174, and thus IP address 190 determined based on public key 174 is also indirectly authenticated by certification authority 200. Such authentication by certification authority 200 enables device 100 to realize data communication over the network using authenticated IP address 190.

[0096] Note that the electronic certificate 176 associated with the public key 174 may include information related to the attributes of the device 100 (hereinafter also referred to as "attribute information") in order to improve confidentiality. The attribute information of the device 100 may be, for example, version information of the OS 160 and the communication processing program 170 of the device 100, or a serial number of the hardware (e.g., processor, storage, etc.) constituting the device 100. In this case, the device 100 may transmit the attribute information of the device 100 to the certificate authority 200 when transmitting the public key 174 and the certificate signing request. Note that the attribute information of the device 100 included in the electronic certificate 176 may be encrypted using a known irreversible cryptographic hash function or the like.

[0097] In this way, by including attribute information of device 100 in digital certificate 176, it is possible to authenticate that digital certificate 176 has been issued in response to a certificate signing request from device 100 itself. In other words, it is possible to more reliably prevent a device other than device 100 from masquerading as device 100 and using public key 174 and digital certificate 176 of device 100.

[0098] (c5: Processing procedure) Next, a process for providing an authenticated IP address in each device 100 will be described.

[0099] Fig. 6 is a flowchart showing a processing procedure in which the device 100 provides an authenticated IP address in the network system 1 according to the present embodiment. The processing procedure shown in Fig. 6 is executed in each device 100, and each step shown in Fig. 6 is executed by the control unit 110 of each device 100.

[0100] 6, device 100 acquires a key pair (private key 172 and public key 174) generated according to an arbitrary algorithm (step S1). This key pair may be generated by device 100 itself, or may be acquired by device 100 from outside. Alternatively, device 100 may acquire only private key 172 from outside and generate public key 174 internally.

[0101] Next, the device 100 calculates a hash value 178 by inputting the public key 174 into a predetermined hash function 180, and then converts all or part of the calculated hash value 178 into The IP address 190 of the device 100 is determined from the public key 174 in accordance with the hash function 180 (step S2).

[0102] In addition, an appropriate key pair (private key 172 and public key 174) may be generated so that IP address 190 includes a unique string (e.g., the first and second digits of IP address 190) and / or type-specific information (e.g., the first and fourth digits of IP address 190).

[0103] Furthermore, the device 100 transmits the public key 174 and a request for issuing an electronic certificate (certificate signing request) to the certificate authority 200 (step S3). In response to the certificate signing request received from the device 100, the certificate authority 200 registers the public key 174 and issues an electronic certificate 176 associated with the registered public key 174. The certificate authority 200 then transmits the electronic certificate 176 to the device 100 via the network. The device 100 then receives and stores the electronic certificate 176 from the certificate authority 200 (step S4).

[0104] Thus, the device 100 obtains a digital certificate 176 associated with a public key 174 from a certificate authority.

[0105] Note that the execution order of the process in step S2 and the processes in steps S3 and S4 is not limited.

[0106] <D. Data Communication Process> Next, the data communication process between devices 100 using the authenticated IP addresses will be described.

[0107] (d1: Notification of IP Address) First, the process related to the notification of IP addresses between devices 100 in the network system 1 according to the present embodiment will be described.

[0108] FIGS. 7 and 8 are diagrams for explaining the process related to the notification of IP addresses in the network system 1 according to the present embodiment. FIGS. 7 and 8 show an example of exchanging IP addresses among three devices 100-1, 100-2, and 100-3. Note that the same process is possible between two devices 100, and the same process is also possible among more devices 100.

[0109] In the states shown in FIGS. 7 and 8, each of the devices 100-1, 100-2, and 100-3 has determined IP addresses 190-1, 190-2, and 190-3 according to the procedure described above, and has also completed the registration of public keys 174-1, 174-2, and 174-3 with the certification authority 200 and the acquisition of electronic certificates 176-1, 176-2, and 176-3 from the certification authority 200, respectively.

[0110] As shown in FIGS. 7 and 8, each device 100 transmits (broadcasts) the public key 174 and the electronic certificate 176 associated with the public key 174 that each device has, periodically or for each event. That is, each device 100 transmits the public key 174 and the electronic certificate 176 to other devices. Note that when the public key 174 is included in the electronic certificate 176, only the electronic certificate 176 may be transmitted.

[0111] FIG. 7 shows, as an example, device 100-1 having public keys 174-1 and 174- 7 shows an example in which devices 100-2 and 100-3 transmit (broadcast) public key 174-1 and electronic certificate 176-1 associated with device 100-1. In the example shown in Fig. 7, it is assumed that devices 100-2 and 100-3 receive public key 174-1 and electronic certificate 176-1 transmitted by device 100-1. Devices 100-2 and 100-3 then determine whether electronic certificate 176-1 is authentic, and if it is determined to be authentic, determine IP address 190-1 of device 100-1 based on associated public key 174-1 and register it in connection tables 194-2 and 194-3, respectively.

[0112] Here, the connection table contains information about each device 100 for performing data communication, and each device 100 refers to the connection table to identify the IP address of the destination device 100 and establish the necessary session.

[0113] More specifically, device 100-2 first determines whether or not digital certificate 176-1 broadcast from device 100-1 is valid. In the process of determining the validity, the integrity of digital certificate 176-1 is verified.

[0114] As an example of a process for verifying the integrity, the device 100-2 first checks the owner information of the electronic certificate 176-1, the issuer information of the electronic certificate 176-1, and the existence of the issuer's digital signature. Then, the device 100-2 judges whether the electronic certificate 176-1 is within the validity period. Furthermore, the device 100-2 judges whether the issuer of the electronic certificate 176-1 is trustworthy. In particular, when the electronic certificate 176-1 is issued by an intermediate certification authority, the device 100-2 identifies a root certification authority associated with the intermediate certification authority that issued the electronic certificate 176-1, and judges whether the identified root certification authority is trustworthy. For example, when the identified root certification authority matches any one or more root certification authorities stored in the device 100-1, it is judged that the issuer of the electronic certificate 176-1 is trustworthy.

[0115] If the above-mentioned determination process is passed, the device 100-2 determines that the electronic certificate 176-1 broadcast from the device 100-1 is valid. The device 100-2 then inputs the public key 174-1 broadcast from the device 100-1 into a predetermined hash function 180 to calculate a hash value 178-1, and determines the IP address 190-1 of the device 100-1 using all or a part of the calculated hash value 178-1. Here, it is assumed that the devices 100-1 and 100-2 have a common hash function 180. It is also assumed that the process of determining the IP address 190-1 from the hash value 178-1 is common between the devices 100-1 and 100-2.

[0116] Through the above-mentioned process, the device 100-2 can determine the IP address 190-1 of the device 100-1. Then, the device 100-2 adds an entry for the determined IP address 190-1 of the device 100-1 to the connection table 194-2. The public key 174-1 may be registered in association with the IP address 190-1.

[0117] The same process as that of the device 100-2 is also executed in the device 100-3, and an entry for the determined IP address 190-1 of the device 100-1 is added to the connection table 194-2 of the device 100-3. The public key 174-1 may be registered in association with the IP address 190-1.

[0118] Through the process shown in FIG. 7, device 100-2 and device 100-3 can obtain IP address 190-1 of device 100-1.

[0119] As an example, Fig. 8 shows a case where device 100-2 transmits (broadcasts) public key 174-2 and electronic certificate 176-2 associated with public key 174-2. In the example shown in Fig. 8, it is assumed that devices 100-1 and 100-3 receive public key 174-2 and electronic certificate 176-2 transmitted by device 100-2. Then, devices 100-1 and 100-3 determine whether electronic certificate 176-2 is valid, and if it is determined to be valid, determine IP address 190-2 of device 100-2 based on associated public key 174-2 and register it in connection tables 194-1 and 194-3, respectively.

[0120] The series of processes executed in devices 100-1 and 100-3 are similar to the processes described with reference to Fig. 7, and therefore detailed description will not be repeated. By the process shown in Fig. 8, device 100-1 and device 100-3 can obtain IP address 190-2 of device 100-2.

[0121] Furthermore, device 100-3 may transmit (broadcast) public key 174-3 and electronic certificate 176-3 associated with public key 174-3. Assume that devices 100-1 and 100-2 receive public key 174-3 and electronic certificate 176-3 transmitted by device 100-3. Then, devices 100-1 and 100-2 determine whether electronic certificate 176-3 is valid, and if it is determined to be valid, determine IP address 190-3 of device 100-3 based on associated public key 174-3 and register it in connection tables 194-1 and 194-2, respectively. Through such processing, device 100-1 and device 100-2 can obtain IP address 190-3 of device 100-3.

[0122] Fig. 9 is a sequence chart showing a processing procedure relating to notification of an IP address in network system 1 according to the present embodiment. Fig. 9 shows processing procedures in three devices 100-1, 100-2, and 100-3 in correspondence with Figs. 7 and 8.

[0123] The device 100-1 transmits (broadcasts) the public key 174-1 and the digital certificate 176-1 associated with the public key 174-1 (sequence SQ10).

[0124] When device 100-2 receives public key 174-1 and electronic certificate 176-1 transmitted by device 100-1, it determines the validity of electronic certificate 176-1 (sequence SQ11). If it is determined that electronic certificate 176-1 is valid, device 100-2 determines IP address 190-1 of device 100-1 based on public key 174-1 (sequence SQ12), and registers the determined IP address 190-1 of device 100-1 in connection table 194-2 (sequence SQ13).

[0125] Similarly, upon receiving the public key 174-1 and electronic certificate 176-1 transmitted by the device 100-1, the device 100-3 determines the validity of the electronic certificate 176-1 (sequence SQ14). If it is determined that the electronic certificate 176-1 is valid, the device 100-3 determines the IP address 190-1 of the device 100-1 based on the public key 174-1 (sequence SQ15), and registers the determined IP address 190-1 of the device 100-1 in the connection table 194-3 (sequence SQ16).

[0126] In addition, the device 100-2 transmits (broadcasts) the public key 174-2 and the digital certificate 176-2 associated with the public key 174-2 (sequence SQ20).

[0127] Upon receiving the public key 174-2 and the digital certificate 176-2 transmitted by the device 100-2, the device 100-1 judges the validity of the digital certificate 176-2 (sequence If it is determined that the electronic certificate 176-2 is valid, the device 100-1 determines an IP address 190-2 of the device 100-2 based on the public key 174-2 (sequence SQ22), and registers the determined IP address 190-2 of the device 100-2 in the connection table 194-1 (sequence SQ23).

[0128] Similarly, upon receiving the public key 174-2 and electronic certificate 176-2 transmitted by the device 100-2, the device 100-3 determines the validity of the electronic certificate 176-2 (sequence SQ24). If it is determined that the electronic certificate 176-2 is valid, the device 100-3 determines the IP address 190-2 of the device 100-2 based on the public key 174-2 (sequence SQ25), and registers the determined IP address 190-2 of the device 100-2 in the connection table 194-3 (sequence SQ26).

[0129] In addition, the device 100-3 transmits (broadcasts) the public key 174-3 and the digital certificate 176-3 associated with the public key 174-3 (sequence SQ30).

[0130] When the device 100-1 receives the public key 174-3 and the electronic certificate 176-3 transmitted by the device 100-3, the device 100-1 judges the validity of the electronic certificate 176-3 (sequence SQ31). If it is judged that the electronic certificate 176-3 is valid, the device 100-1 determines the IP address 190-3 of the device 100-3 based on the public key 174-3 (sequence SQ32), and registers the determined IP address 190-3 of the device 100-3 in the connection table 194-1 (sequence SQ33).

[0131] Similarly, upon receiving the public key 174-3 and electronic certificate 176-3 transmitted by the device 100-3, the device 100-2 determines the validity of the electronic certificate 176-3 (sequence SQ34). If it is determined that the electronic certificate 176-3 is valid, the device 100-2 determines the IP address 190-3 of the device 100-3 based on the public key 174-3 (sequence SQ35), and registers the determined IP address 190-3 of the device 100-3 in the connection table 194-2 (sequence SQ36).

[0132] The processing of sequences SQ10 to SQ16, the processing of sequences SQ20 to SQ26, and the processing of sequences SQ30 to SQ36 may be executed in any order or in parallel.

[0133] In this way, when each device 100 receives public key 174 and digital certificate 176 associated with public key 174 from another device, it determines the validity of digital certificate 176 (sequences SQ11, SQ14, SQ21, SQ24, SQ31, SQ34). Then, when each device 100 determines that digital certificate 176 is valid, it determines the IP address of the other device based on a hash value calculated from public key 174 according to a hash function (sequences SQ12, SQ15, SQ22, SQ25, SQ32, SQ35).

[0134] As described above, in network system 1 according to the present embodiment, on condition that electronic certificate 176 transmitted from other device 100 is determined to be valid, IP address 190 of the other device 100 is determined based on public key 174 associated with electronic certificate 176. On condition that electronic certificate 176 associated with public key 174 is determined to be valid, IP address 190 is determined based on public key 174, so that the validity of public key 174 and the validity of IP address 190 can be guaranteed. Therefore, reliable data communication between devices 100 can be realized.

[0135] In the network system 1 according to the present embodiment, each device 100 is Since the IP address of each device 100 can be known based on the broadcast public key 174, the devices 100 can directly connect to each other even if there is no server that manages IP addresses. In particular, even if there is no virtual private network (VPN) server, confidential communication can be realized between the devices 100, so the cost and power consumption for maintaining the VPN server can be reduced.

[0136] (d2: Application example) In the network system 1 according to the present embodiment, the IP addresses of the devices 100 can be mutually authenticated, so that the communication destination can be specified based only on the IP address. By using such authenticated IP addresses, various services can be provided. An example of a service provided using an authenticated IP address will be described below.

[0137] Fig. 10 is a diagram for explaining an example of an application for providing a service using the network system 1 according to the present embodiment. In the example of the application shown in Fig. 10, a Web-based application server and a mobile terminal that accesses the application server are assumed to be devices 100. The application server provides a unique Web page according to the authenticated IP address of the mobile terminal from which the application server is accessed.

[0138] 10(a) shows an example of a network management table 210 held by the application server. In the network management table 210, initial screen information 214 indicating an initial screen and preference information 216 indicating preferences are defined in association with authenticated IP addresses 212 of mobile terminals that have accessed the network in the past or are scheduled to access the network. The contents of the network management table 210 may be updated manually by the user or by the application server in response to a user operation.

[0139] When an application server receives access from a mobile terminal, the application server refers to the network management table 210 using the authenticated IP address assigned to the mobile terminal as a key, and determines the corresponding initial screen information 214 and preference information 216. Then, based on the determined initial screen information 214 and preference information 216, the application server determines the contents of the Web page to be provided to the accessing mobile terminal.

[0140] Fig. 10(b) shows, as an example, a web screen example when an application server provides an online banking service. For example, a web screen example 220A presented on the display of a mobile terminal assigned authenticated IP address 1 has basic account management buttons such as "Transfer Procedure," "Check Account Balance," and "Transfer Procedure." On the other hand, a web screen example 220B presented on the display of a mobile terminal assigned authenticated IP address 2 has buttons related to foreign currencies such as "Buy Foreign Currency" and "Sell Foreign Currency" along with a chart showing the time-dependent change in exchange rates.

[0141] Such an initial screen can be determined, for example, by referring to initial screen information 214 in network management table 210. Furthermore, by referring to preference information 216 in network management table 210, it is possible to provide not only the initial screen but also services according to the preferences of each mobile terminal (i.e., each user who operates the mobile terminal).

[0142] As described above, the web-based application server responds to a request from a mobile terminal and provides a service according to the authenticated IP address of the mobile terminal. This makes it possible to customize the initial screen and various service contents provided when accessing an application server based on the authenticated IP address of a mobile terminal.

[0143] Fig. 11 is a diagram for explaining another application example of service provision using the network system 1 according to the present embodiment. In the application example shown in Fig. 11, a usage management server of a hotel or the like and a mobile terminal that accesses the usage management server are assumed to be devices 100. In the application example shown in Fig. 11, the mobile terminal can be used as an electronic key (usage certificate).

[0144] 11(a) shows an example of a usage management table 230 held by the server. In the usage management table 230, the details of a reservation made through a reservation site or the like (room number 234 and available time 236) are stored in association with a network address 232 assigned to the mobile terminal used for the reservation operation.

[0145] When a user operates his / her mobile terminal to make a reservation at a reservation site, the server adds the reservation details to the usage management table 230 together with the network address assigned to the mobile terminal used to make the reservation.

[0146] As shown in Fig. 11(b), a wireless communication unit 242 is placed in front of each room of the accommodation facility 240. When a user who plans to stay approaches the reserved room with the mobile terminal used for the accommodation reservation, the wireless communication unit 242 wirelessly communicates with the mobile terminal. Note that the wireless communication between the mobile terminal and the wireless communication unit 242 may be started automatically, or may be started after the user explicitly performs an operation.

[0147] If the network address assigned to the mobile terminal held by the user matches any of the entries of network address 232 in usage management table 230, the server unlocks the reserved room based on the corresponding room number 234 and available time 236. In this way, in response to a request from a mobile terminal, the server provides a service according to the authenticated IP address of the mobile terminal.

[0148] 11 shows a typical example of a mobile terminal being used as a key for each room in a lodging facility such as a hotel, but the present invention is not limited to this and can be used as any type of usage certificate. For example, the mobile terminal itself can be used as an admission ticket to various facilities such as amusement facilities, or various events such as concerts. Furthermore, the mobile terminal itself can be used as a train or airplane ticket.

[0149] In network system 1 according to the present embodiment, the IP address itself of device 100 is authenticated, so that an application for displaying a ticket, as in the existing technology, is not required, and device 100 itself can be used as a usage certificate.

[0150] In this way, in the network system 1 according to the present embodiment, since the authenticated IP address of the mobile terminal can be obtained, a service specific to each mobile terminal can be provided without the need for an application for implementing the authentication process. Also, since performing data communication between devices such as a mobile terminal and a server means obtaining an authenticated IP address, the time required to provide a service specific to a mobile terminal is very short, and the waiting time required for the service provision can be shortened compared to a configuration in which the authentication process is performed using an application.

[0151] (d3: Routing) Next, a description will be given of processing related to data communication between devices 100. In network system 1 according to the present embodiment, each device 100 has a routing function and a data transfer function, and these functions enable realization of a network capable of autonomously performing data communication.

[0152] The routing employed by network system 1 according to the present embodiment will now be described. In the following description, it is assumed that data is transmitted in the form of "packets" as a typical example.

[0153] Fig. 12 is a diagram for explaining an example of routing in network system 1 according to the present embodiment. Fig. 12 illustrates, as an example, routing in a network including seven devices 100-1 to 100-7.

[0154] 12, by the above-mentioned IP address notification process, the devices 100 that have exchanged IP addresses can establish a connection 10. The devices 100 that can establish a connection 10 exchange data in a sort of peer-to-peer manner. Note that the connection 10 between the devices 100 can use any protocol, including TCP (Transmission Control Protocol) and UDP (User Datagram Protocol).

[0155] For example, consider an example in which device 100-1 transmits a packet destined for device 100-7. Through routing at device 100-1, the packet is sent from device 100-1 to device 100-5 (route RT1), then through routing at device 100-5, the packet is sent from device 100-5 to device 100-6 (route RT2), and finally through routing at device 100-6, the packet is sent from device 100-6 to device 100-7 (route RT3).

[0156] Each of the devices 100 included in the network system 1 according to the present embodiment has the following functions in order to realize the routing as shown in FIG.

[0157] Fig. 13 is a diagram for explaining a method of implementing routing in network system 1 according to the present embodiment. With reference to Fig. 13, in network system 1 according to the present embodiment, a plurality of devices 100 included in network system 1 are logically divided into one or a plurality of node groups 30 (node ​​groups 30-1, 30-2, 30-3, ...), and each node group 30 shares routing table 32 (routing tables 32-1, 32-2, 32-3, ...).

[0158] A node group 30 refers to a logically defined collection of devices 100, and is determined based on the contents of state information 40 held by each device 100, as will be described later.

[0159] The routing table 32 is a table used to search for the device 100 that is the destination of data transmission (destination of a transmission packet), and can typically be realized using a distributed hash table (DHT). The routing table 32 includes identification information for identifying the device 100 (node) included in the corresponding node group 30, its location, and the like.

[0160] Each of the node groups 30 includes a device 100 that becomes a root node 34 (root nodes 34-1, 34-2, 34-3, . . . ). To the root node 34, one or more devices 100 that become nodes 36 are hierarchically connected logically.

[0161] FIG. 14 is another diagram for illustrating a method of implementing routing in network system 1 according to the present embodiment.

[0162] 14, each device 100 included in the network system 1 holds state information 40 (state information 40-1, 40-2, 40-3, ...) reflecting the connection relationships (logical and physical connection relationships) of each device 100. The state information 40 reflects the connection relationships between each device 100 and other devices.

[0163] Furthermore, each device 100 periodically (e.g., every few minutes) transmits a state notification message 42 indicating the contents of the held state information 40 to other surrounding devices 100. Each device 100 updates its own state information 40 as necessary based on the state notification messages 42 from the other devices 100.

[0164] 14 shows an example in which device 100-1 transmits a state notification message 42, but each device 100 included in network system 1 transmits a state notification message 42. Each device 100 updates its state information 40 based on the state notification messages 42 from the other devices 100, thereby logically defining a tree structure as shown in FIG.

[0165] It is not necessary to determine in advance which device 100 will be the root node 34. A value indicating the case in which the device operates as the root node 34 is initially set in the state information 40 of each device 100. Based on state notification messages 42 received thereafter from other devices, the state information 40 is updated, whereby the device 100 that should operate as the root node 34 and the device 100 that should operate as a normal node 36 are autonomously determined.

[0166] 15 is a sequence chart showing a processing procedure for implementing routing in network system 1 according to the present embodiment. FIG 15 shows exchanges focusing on devices 100-1, 100-2, 100-5, and 100-4 shown in FIG.

[0167] 15, when connected to the network system 1, first, each of the devices 100-1, 100-3, 100-5, and 100-4 initializes its own state information 40 (sequence SQ100).

[0168] Then, device 100-1 transmits state notification message 42 indicating the contents of its own state information 40 to the surrounding devices 100 (sequence SQ102). Each device that receives state notification message 42 from device 100-1 executes an update process for its own device's state information 40 based on the received state notification message 42 (sequence SQ104).

[0169] Similarly, device 100-2 transmits state notification message 42 indicating the contents of its own state information 40 to the surrounding devices 100 (sequence SQ106). Each device that receives state notification message 42 from device 100-2 updates its own state information 40 based on the received state notification message 42 (sequence SQ108).

[0170] Similarly, the device 100-5 transmits a state notification message 42 indicating the contents of the state information 40 of its own device to the surrounding devices 100 (sequence SQ110). Based on the state notification message 42, the state information 40 of the own device is updated (sequence SQ112).

[0171] Similarly, device 100-4 transmits state notification message 42 indicating the contents of its own state information 40 to the surrounding devices 100 (sequence SQ114). Each device that receives state notification message 42 from device 100-4 executes an update process for its own state information 40 based on the received state notification message 42 (sequence SQ116).

[0172] In this manner, each of the multiple devices 100 holds state information 40 reflecting the connection relationships of each device 100 (sequence SQ100), and transmits state notification messages 42 indicating the contents of the state information 40 to the other devices (sequences SQ102, SQ106, SQ110, SQ114). Also, each of the multiple devices 100 updates the state information 40 held by each device 100 based on the state notification messages 42 received from the other devices (sequences SQ104, SQ108, SQ112, SQ116). These processes may be executed periodically.

[0173] Note that the sequences SQ102 and SQ104, the sequences SQ106 and SQ108, the sequences SQ110 and SQ112, and the sequences SQ114 and SQ116 can be executed at timings independent of one another, and therefore may be executed in any order, or may be executed in parallel.

[0174] When the device 100 that operates as the root node 34 is determined as a result of the transmission of the state notification message 42 by each device 100, the device 100 that operates as the root node 34 (device 100-1 in the example shown in FIG. 15) determines the routing table 32 (sequence SQ120). In this manner, between node groups 30 (a set of devices 100) that are logically defined based on the state information 40 held by each device 100, a process is executed to determine the routing table 32 to be held between the devices 100 included in the node group 30. The routing table 32 is used to search for a device that is the destination of data transmission.

[0175] Then, the device 100 operating as the root node 34 transmits the determined routing table 32 to the other devices 100 operating as descendant nodes of the other device (sequence SQ122).

[0176] Then, the processes of sequences SQ102 to SQ120 are repeated. 15 shows an example in which each device 100 initially sets the state information 40, but in reality, it is assumed that an arbitrary device 100 may newly join the network system 1 or may leave the network system 1. In such a case, processing such as changing the device 100 operating as the root node 34 or updating the contents of the routing table 32 is executed.

[0177] Next, a detailed description will be given of the state information 40 and the state notification message 42. In the network system 1 according to the present embodiment, each device 100 sequentially updates its own state information 40 based on the state notification message 42 exchanged between adjacent devices 100, thereby logically constructing a node group 30 in which the devices 100 are hierarchically connected as shown in FIG.

[0178] FIG. 16 is a diagram showing an example of the data structure of state information 40 and state notification message 42 used in network system 1 according to the present embodiment. 16(a) shows an example of the data structure of the state information 40, and FIG. 16(b) shows an example of the data structure of the state notification message 42.

[0179] 16A, state information 40 includes, as setting items, ParentID 401, Children 402, RootID 403, height 404, and binary representation 405.

[0180] In ParentID 401, identification information for identifying a device that is a parent node of each device 100 (typically, a KeyID, which will be described later) is stored.

[0181] Children 402 stores identification information (typically, a KeyID, described later) for identifying a device that is a child node of each device 100. Note that the number of devices that are child nodes is not limited to one, so Children 402 stores one or more devices in list form.

[0182] In the RootID 403, identification information (typically, a KeyID, which will be described later) for identifying the device 100 that operates as the root node 34 of the node group 30 to which each device belongs is stored.

[0183] Height 404 stores the height of each device in the node group 30 to which each device belongs. Height means the maximum number of edges from the root node 34 to a leaf node in the node group 30 to which each device belongs. In other words, the depth from the root node 34 to a leaf node in the node group 30 can be determined based on the size of height.

[0184] The binary representation 405 stores identification information for identifying the device (node) to be searched for in the node group 30 to which each device belongs.

[0185] The state information 40 may further include a time stamp as a setting item. The time stamp may be, for example, information indicating the update time of each device 100, or information indicating the time of the state notification message 42.

[0186] Each device 100 has identification information called a KeyID for identifying the device itself. The KeyID uses identification information that can uniquely identify the device 100 in the network system 1. Typically, the KeyID may use an IP address that each device 100 has, or a hash value calculated from the IP address based on a hash function.

[0187] 16(b), the state notification message 42 indicates the contents of the state information 40. More specifically, the state notification message 42 includes a ParentID 421, a RootID 422, a height 423, and a KeyID 424.

[0188] ParentID 421 stores the same value as ParentID 401 in the state information 40. RootID 422 stores the same value as RootID 403 in the state information 40. Height 423 stores the same value as height 404 in the state information 40. KeyID 424 stores KeyID, which is identification information of the own device.

[0189] In this way, the state information 40 and the state notification message 42 include a KeyID (identification information of the device itself) as identification information for identifying each device 100. In this case, the KeyID (identification information of the own device) may be a value calculated based on the IP address determined by each device 100.

[0190] Moreover, the state information 40 and the state notification message 42 include identification information (KeyID) for identifying the device 100 that is the root node 34 of each device 100 .

[0191] Fig. 16 shows a state in which the state information 40 and the state notification message 42 are both initialized. That is, "null" is set in ParentID 401, the value of the KeyID of the device itself (KeyID1 in the example of Fig. 16) is set in RootID 403, and "0" is set in height 404.

[0192] The state information 40 initially set as shown in Fig. 16(a) is updated as appropriate based on state information 40 from other devices. An example of updating the state information 40 will be described below.

[0193] Fig. 17 is a diagram showing an example of updating state information 40 by state notification message 42 in network system 1 according to the present embodiment. Fig. 17 shows, as an example, an example of updating the contents of state information 40 in the case where devices 100-1, 100-5, and 100-6 form a tree structure in this order in network system 1 shown in Fig. 12.

[0194] After being initially set, state information 40 of devices 100-1, 100-5, and 100-6 is successively updated based on state notification messages 42 from the other devices. As a result, in all state information 40, "KeyID1" indicating device 100-1 is stored in RootID 403, and "2", which is the maximum number of edges from root node 34 to a leaf node in the node group, is stored in height 404.

[0195] In each of the state information 40, the ParentID 401 and the Children 402 store a KeyID corresponding to the connection relationship between the nodes.

[0196] In the binary representation 405, as an example, identification information of the number of bits according to the distance from the leaf node is stored. As an example, FIG. 17 shows three types of examples ("0", "01", and "001"). The greater the number of bits constituting the value of the binary representation 405, the farther it is from the leaf node. In other words, a device 100 having "0" as the binary representation 405 means that it is closer to the corresponding leaf node, and a device 100 having "001" as the binary representation 405 means that it is farther from the corresponding leaf node.

[0197] 17, the tree structure of a node group is identified based on state information 40 of each device, and device 100 operating as root node 34 determines a routing table 32 based on the identified tree structure and provides it to each device belonging to the same node group. By such a procedure, it is possible to determine a node group and a root node 34 for the node group, and to determine the routing table 32 in the root node 34.

[0198] Note that the timing of sending the state notification message 42 from each device 100 is determined arbitrarily by each device 100, so updating of the state information 40 may not necessarily be complete for all devices. For this reason, it is preferable for each device 100 to perform version management over several generations when updating the state information 40. In other words, it is preferable to hold both the contents of the state information 40 before and after the update. In this case, The device 100 operating as the client node 34 determines the routing table 32 based on an appropriate version of the state information 40 among the state information 40 held by each device 100.

[0199] Fig. 18 is a flowchart showing a processing procedure relating to the determination of a routing table in network system 1 according to the present embodiment. The processing relating to the determination of a routing table shown in Fig. 18 includes processing such as determining node group 30 and updating state information 40. Each step shown in Fig. 18 is executed by control unit 110 (see Fig. 2) of device 100 (typically realized by cooperation between a processor and a memory).

[0200] Referring to FIG. 18, when connected to any network, device 100 initializes state information 40 of its own device (step S100).

[0201] Next, the device 100 determines whether or not a condition for transmitting the state notification message 42 is met (step S102). For example, it is determined whether or not the time elapsed since the previous state notification message 42 has reached a predetermined time.

[0202] If the conditions for transmitting the state notification message 42 are met (YES in step S102), the device 100 generates the state notification message 42 based on the current state information 40, and transmits the state notification message 42 to other devices (step S104). If the conditions for transmitting the state notification message 42 are not met (NO in step S102), the process of step S104 is skipped.

[0203] In this way, the device 100 holds state information 40 that reflects the connection relationships with other devices, and executes a process of transmitting a state notification message 42 indicating the contents of the state information 40 to the other devices (steps S100 to S104).

[0204] Next, the device 100 determines whether or not a state notification message 42 has been received from another device (step S106). If the state notification message 42 has been received from another device (YES in step S106), the device 100 determines whether or not it is necessary to update the state information 40 based on the received state notification message 42 (step S108). If it is determined that it is necessary to update the state information 40 (YES in step S108), the device 100 updates the state information 40 of its own device (step S110). If it is determined that it is not necessary to update the state information 40 (NO in step S108), the process of step S110 is skipped.

[0205] In this way, the device 100 executes the process of updating the state information 40 based on the state notification message 42 received from the other devices 100 (steps S106 to S110).

[0206] On the other hand, if the state notification message 42 has not been received from another device (NO in step S106), the processes of steps S108 and S110 are skipped.

[0207] Here, the processes in steps S108 and S110 will be described in detail. 13, a node group 30 can determine the devices included in each tree structure by determining an arbitrary device as the root node 34. The device 100 that operates as such a root node 34 may be determined based on the value of the KeyID of each device 100. In other words, in the process of updating the state information 40, the device (RootID4) that is set as the root node included in the received state notification message 42 is determined. If the device 100 identified by the KeyID stored in RootID 402 does not match the device 100 identified as the root node included in the state information 40 (the device 100 identified by the KeyID stored in RootID 403), a process is executed to determine one of the devices 100 as the root node in accordance with predetermined rules.

[0208] In this embodiment, the magnitude relationship of KeyID is used as an example of a predetermined rule. For example, a device with the smallest KeyID among devices in a certain range may be determined as the root node 34 of the range. In this case, each device 100 refers to a RootID 422 (see FIG. 16(b)) included in a state notification message 42 received from another device corresponding to a parent node to determine whether or not to update the state information 40.

[0209] Specifically, when the following conditions (1) and (2) are met, the contents of the state information 40 are updated.

[0210] (1) Value of RootID 403 in state information 40 > value of RootID 422 in state notification message 42 received from parent node and (2) Value of height 404 in state information 40 < value of height 423 in state notification message 42 received from the parent node Here, condition (1) means that the KeyID of the root node 34 recognized by the parent node is smaller than the KeyID of the root node 34 recognized by the device, and condition (2) means that the parent node belongs to a tree structure that is deeper than the tree structure recognized by the device.

[0211] When the conditions (1) and (2) are met, the contents of the state information 40 are updated so that the device is nested in the parent node. More specifically, as shown below, the ParentID 401, RootID 403, and height 404 of the state information 40 are updated to the values ​​included in the state notification message 42 received from the parent node.

[0212] ParentID401 in state information 40 ← Value of KeyID424 in state notification message 42 received from the parent node · RootID403 in state information 40 ← Value of RootID422 in state notification message 42 received from the parent node · Height 404 in state information 40 ← Value of height 423 in state notification message 42 received from parent node + 1 (increment the value of height 423) Any rule may be used to determine the root node 34, and the device with the largest KeyID among devices in a certain range may be determined as the root node 34 for that range, or the device with the KeyID closest to an arbitrarily set value may be determined as the root node 34. In this case, the above condition (1) may be changed appropriately.

[0213] Next, the device 100 judges whether or not a sufficient number of state notification messages 42 have been received from other devices (step S112). If a sufficient number of state notification messages 42 have been received from other devices (YES in step S112), the device 100 executes a process of maintaining a routing table 32 used to search for a device that is a destination for data transmission among node groups 30 (a logically defined collection of devices 100) based on the state information 40 held by each device 100, as described below (S116, S118, S122, S124).

[0214] More specifically, the device 100 determines whether or not the device itself operates as the root node 34 based on the state information 40 (step S114).

[0215] If the device itself is operating as a root node 34 (YES in step S114), the device 100 determines a routing table 32 based on the state information 40 of the device itself and the state information 40 of the other devices (step S116), and transmits the determined routing table 32 to the other devices (step S118).

[0216] In this way, when the device 100 determines based on the state information 40 that the device 100 itself will operate as a root node in the node group 30, the device 100 executes a process for determining the routing table 32.

[0217] On the other hand, if the device 100 does not operate as a root node 34 (NO in step S114), the device 100 transmits state information 40 of the device to a device set as a root node (step S120), and determines whether or not the device 100 has received a routing table 32 from a device operating as a root node (step S122). If the device 100 receives a routing table 32 from a device operating as a root node (YES in step S122), the device 100 stores the received routing table 32 (step S124). In this way, the device 100 holds the routing table 32 by receiving the routing table 32 from another device 100.

[0218] If the routing table 32 has not been received from the device operating as the root node (NO in step S122), the process of step S124 is skipped. Also, if a sufficient number of state notification messages 42 have not been received from other devices (NO in step S112), the processes from step S102 onwards are repeated.

[0219] Then, the processes of steps S102 to S124 shown in FIG. 18 are repeatedly executed. Fig. 19 is a flowchart showing a processing procedure related to packet transmission and reception in each device 100 in the network system 1 according to the present embodiment. Fig. 19(a) shows processing when a packet to be transmitted occurs in the own device, and Fig. 19(b) shows processing when a packet is received from another device. Each step shown in Fig. 19(a) and Fig. 19(b) is executed by the control unit 110 (see Fig. 2) of the device 100 (typically realized by cooperation between a processor and a memory).

[0220] 19(a), the device 100 determines whether or not a transmission packet destined for another device has been provided by the various applications 300 or the like (step S200). If a transmission packet destined for another device has not been provided (NO in step S200), the process of step S200 is repeated.

[0221] On the other hand, when a transmission packet addressed to another device is given (YES in step S200), the device 100 refers to the routing table 32 and transmits the transmission packet to the other device according to the route to the destination device (step S202). At this time, if the destination device is included in the descendant nodes of the device 100, the device 100 transmits the transmission packet to a child node according to the route to the descendant node. On the other hand, if the destination device is not included in the descendant nodes of the device 100, the device 100 transmits the transmission packet to a parent node of the device 100. This ends the transmission process of the transmission packet.

[0222] 19(b), it is determined whether or not a transmission packet has been received from another device (step S250). If a transmission packet has not been received from another device (NO in step S250), the process of step S250 is repeated.

[0223] On the other hand, if a transmission packet has been received from another device (YES in step S250), the device 100 determines whether the received transmission packet is addressed to the device itself (step S252). If the received transmission packet is addressed to the device itself (YES in step S252), the device 100 receives the packet from the sending device and outputs it to the corresponding application 300 (step S254). This ends the process when a packet is received.

[0224] On the other hand, if the received transmission packet is not addressed to the own device (NO in step S252), the device 100 refers to the routing table 32 and transmits the transmission packet to another device according to the route to the destination device (step S256). The process of determining the destination by referring to this routing table 32 is the same as that in step S202. Thus, the process when receiving a packet ends.

[0225] As described above, in the network system 1 according to the present embodiment, the routing table 32 is determined and shared for each node group (a logically defined set of devices 100). By adopting the routing table 32 shared for each node group in this way, when transmitting data to any device included in the network system 1, its transmission path can be determined in a shorter time.

[0226] In the network system 1 according to the present embodiment, each of the devices 100 included in the network system 1 transmits a state notification message 42 indicating the content of the state information 40 it holds to other devices 100. And each of the devices 100, when receiving the state notification message 42 from other devices 100, appropriately updates the content of the state information 40 held by the own device based on the content of the received state notification message 42. By periodically or regularly executing such update processing of the state notification message 42 and the state information 40, even when there are changes such as the joining / leaving of devices 100 or the change of the connection topology in the network system 1, an appropriate routing table 32 can be maintained.

[0227] <E. Advantages> According to the network system 1 according to the present embodiment, in a network where a large number of devices exist, a solution can be provided in which each device can independently realize data communication.

[0228] The embodiments disclosed herein should be considered to be illustrative and not restrictive in all respects. The scope of the present invention is defined by the claims, not the above description, and is intended to include all modifications within the meaning and scope of the claims. [Explanation of symbols]

[0229] 1 network system, 2 network, 4 access point, 6 mobile base station, 10 connection, 30 node group, 32 routing table, 34 Root node, 36 node, 40 state information, 42 state notification message, 100 device, 102 processor, 104 main memory, 106 storage, 108 ROM, 110 control unit, 120 network interface, 130 display unit, 140 input unit, 150 media interface, 152 media, 160 OS, 170 communication processing program, 172 private key, 174 public key, 176 electronic certificate, 178 hash value, 180 hash function, 190 IP address, 194 connection table, 200 certification authority, 210 network management table, 214 initial screen information, 216 preference information, 220A, 220B screen example, 230 usage management table, 232 network address, 234 room number, 236 available time , 240 accommodation, 242 radio communication units, 300 applications, 405 binary representation, RT1,RT2,RT3 routes.

Claims

1. A data transmission method in a network to which a plurality of devices are connected, comprising the steps of: determining an IP address of each of the plurality of devices based on a hash value calculated from a public key held by each of the devices according to a hash function; each of the plurality of devices retaining state information reflecting a connection relationship between the devices and transmitting a notification message indicating the contents of the state information to the other devices; updating state information held by each of the plurality of devices based on the notification messages received from the other devices; A data transmission method comprising a step of determining a routing table used to search for a device to be a destination of data transmission, the routing table being maintained among devices included in a set of devices logically defined based on the state information held by each device.

2. 2. The data transmission method according to claim 1, wherein the notification message includes identification information for identifying each device, the identification information being calculated based on an IP address determined by each device.

3. Each of the plurality of devices transmits to another device a public key and a digital certificate associated with the public key; 3. The data transmission method according to claim 1, further comprising a step of: in a device receiving the public key and the electronic certificate, determining an IP address of a device that has transmitted the public key and the electronic certificate based on a hash value calculated from the public key according to a hash function.

4. 4. The data transmission method according to claim 1, wherein the determined IP address includes a predetermined unique value for identification.

5. 5. The data transmission method according to claim 1, wherein the determined IP address includes a value according to a type of device that determined the IP address.

6. A communication processing method for a device connected to a network, comprising: determining an IP address of the device based on a hash value calculated from the public key according to a hash function; a step of retaining state information reflecting a connection relationship with other devices and transmitting a notification message indicating the contents of the state information to the other devices; updating the state information based on the notification messages received from other devices; and maintaining a routing table used to search for a device to be a destination for data transmission among a set of devices logically defined based on the state information held by each device.

7. The communication processing method according to claim 6 , wherein the notification message includes identification information for identifying the own device, the identification information being calculated based on the determined IP address of the own device.

8. The communication processing method according to claim 6 , further comprising the step of determining the routing table when it is determined that the own device operates as a root node in the set based on the state information.

9. The step of maintaining the routing table includes storing the routing table from other devices. A method for processing communications according to any one of claims 6 to 8, comprising the step of receiving a table.

10. the state information and the notification message include identification information for identifying a device that is a root node; A communication processing method according to any one of claims 6 to 9, wherein the updating step includes a step of determining, when a device designated as the root node included in the received notification message does not match a device designated as the root node included in the state information, that one of the devices is the root node in accordance with a predetermined rule.

11. obtaining a digital certificate associated with said public key from a certificate authority; The communication processing method according to any one of claims 6 to 10, further comprising the step of transmitting the public key and the electronic certificate to another device.

12. receiving the public key and a digital certificate associated with the public key from another device, determining the authenticity of the digital certificate; The communication processing method according to any one of claims 6 to 11, further comprising a step of determining an IP address of the other device based on a hash value calculated from the public key according to a hash function when it is determined that the electronic certificate is valid.

13. The communication processing method according to any one of claims 6 to 12, wherein the determined IP address includes a predetermined unique value for identification.

14. The communication processing method according to any one of claims 6 to 13, wherein the determined IP address includes a value according to a type of device that determined the IP address.

15. A communication processing method for a device connected to a network, comprising: receiving a public key held by another device and a digital certificate associated with the public key; determining the authenticity of the electronic certificate; determining, when the electronic certificate is determined to be valid, an IP address determined based on a hash value calculated from the public key according to a hash function as an authenticated IP address of the other device; and providing a service according to the authenticated IP address of the other device in response to a request from the other device.

16. The communication processing method according to claim 15, wherein the public key is determined such that an IP address determined based on a hash value calculated from the public key according to the hash function matches a predetermined format.

17. A network interface for connecting to a network; a control unit connected to the network interface; The control unit is A process of determining an IP address of the device itself based on a hash value calculated from the public key according to a hash function; A process of retaining state information reflecting a connection relationship with other devices and transmitting a notification message indicating the contents of the state information to the other devices; updating the state information based on the notification messages received from other devices; A set of devices that is logically defined based on the state information held by each device. and a process of maintaining a routing table used to search for a device to be a destination for data transmission between the device and the network.

18. A communication processing program for a computer having a network interface for connecting to a network, the communication processing program causing the computer to execute a communication processing method according to any one of claims 6 to 16, when executed by the computer.

Images