Device, communication method, and communication program

Abstract

To provide a configuration which can reduce a response time etc. related to service provision, when providing a service according to a device or a user using the device, because a special application or the like becomes unnecessary, and an additional authentication procedure is unnecessary as well.SOLUTION: A network system includes at least one server device and at least one terminal device which is accessible to at least one of server devices. The terminal device is configured to perform, after authenticating a network address, data communication with at least one of the server devices. The server device, on receiving a request from a terminal device, provides a service according to an authenticated network address included in the request source terminal device.SELECTED DRAWING: Figure 1

Description

Technical Field

[0001] The present invention relates to a network system using a new concept of authenticating a network address itself.

Background Art

[0002] In recent years, the progress of information and communication technology (ICT) has been remarkable. Devices connected to networks such as the Internet are spreading not only to conventional information processing devices such as personal computers and smartphones but also to various things. Such a technological trend is called "IoT (Internet of Things)", and various technologies and services are being proposed and put into practical use. In the future, a world where billions of people and hundreds of billions or trillions of devices on the earth are connected simultaneously is envisioned. In order to realize such a networked world, it is necessary to provide a solution that can be connected more simply, more securely, and more freely.

[0003] Normally, on a network, data communication between devices is realized using network addresses statically or dynamically assigned to each device. As such a network address, typically, an IP (Internet Protocol) address is used.

[0004] Generally, IP addresses are of two types: those uniquely determined on the Internet like global addresses, and those assigned without duplication on a private network like private addresses. Also, there is a mechanism such as DHCP (Dynamic Host Configuration Protocol) for dynamically assigning IP addresses.

[0005] In this way, for data communication, only the setting of IP addresses that are assigned without duplication on the same network is considered. That is, an IP address is a network address that is arbitrarily set according to the target network.

[0006] For example, Japanese Patent Application Laid-Open No. 2017-059868 (Patent Document 1) discloses a configuration for reducing the man-hour of setting IP addresses.

Prior Art Documents

Patent Documents

[0007]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0008] As described above, although the conventional network address was identification information for specifying a communication destination, no reliability was given to the address itself. Therefore, although data communication is performed between devices using an IP address, authentication processing and the like have been realized in a higher layer (for example, an application layer, etc.).

[0009] Therefore, in order to provide services that require various authentication processes, an application or the like for realizing the authentication process that is the basis of the service must be provided in advance or each time, which has hindered the spread.

[0010] The present invention provides a solution to the above problems.

Means for Solving the Problems

[0011] A network system according to an aspect of the present invention includes at least one server device and at least one terminal device accessible to any of the at least one server devices. The terminal device is configured to perform data communication with any of the at least one server devices after authenticating a network address. When the server device receives a request from the terminal device, it provides a service corresponding to the authenticated network address that the terminal device of the request source has.

[0012] Preferably, the server device identifies the terminal device of the request source using only the network address used in the communication at the network layer between the server device and the terminal device without performing authentication processing at the application layer.

[0013] Preferably, the terminal device includes a first communication program responsible for the data link layer, a second communication program responsible for the transport layer and the network layer, and an address authentication program connected between the first communication program and the second communication program. The address authentication program authenticates the network address used for data transmission requested by the second communication program with the communication destination device.

[0014] Preferably, the terminal device includes a communication function module that provides a communication function and a semiconductor device in which the authenticated network address is hard-coded. The semiconductor device authenticates the network address with the communication destination device using the communication function module.

Effects of the Invention

[0015] According to an aspect of the present invention, when providing a service according to a device or a user using the device, a special application or the like is not required, and an additional authentication procedure is not required, so that the response time related to service provision can be shortened.

Brief Description of the Drawings

[0016]

Figure 1

Figure 2

Figure 3

Figure 4

Figure 5

Figure 6

Figure 7

Figure 8

Figure 9

Embodiment for Carrying Out the Invention

[0017] Embodiments of the present invention will be described in detail with reference to the drawings. For the same or corresponding parts in the drawings, the same reference numerals are given and the description thereof will not be repeated.

[0018] <A. Overview> According to this embodiment, a service using an authenticated network address and an infrastructure for providing the service are provided. That is, in a conventional network, there is no technical concept of authenticating the network address itself, and mainly, the network address is only used for establishing a communication connection. On top of that, it was normal to perform an authentication procedure using an application for authentication. In contrast, in this embodiment, since the network address itself is authenticated, the establishment of a communication connection itself also serves as an authentication procedure, and additional authentication procedures using an application and the like become unnecessary.

[0019] Therefore, when providing a service according to a device or a user using the device, a special application or the like is not required, and since an additional authentication procedure is also not required, the response time related to service provision can be shortened.

[0020] In this specification, the "network address" means identification information for uniquely identifying a device on some network, and generally consists of a character string composed of a combination of characters, numbers, symbols, etc. As a typical example of a network address, an IP (Internet Protocol) address is assumed, but a lower-layer address such as a MAC (Media Access Control address) may also be used, or a higher-layer address such as a host name or URL (Uniform Resource Locator) managed by DNS (Domain Name System ) may also be used. Also, regardless of the difference between a global network and a private network as the network, and the protocol used can also be arbitrarily selected. As the network address, one unique to the protocol adopted may be adopted.

[0021] When an IP address is adopted as a typical example, the specified number of bits differs depending on the version. The currently established IPv4 (Internet Protocol Version 4) defines a 32-bit address range, and the currently established IPv6 (Internet Protocol Version 6) defines a 128-bit address range. In the present embodiment, an IP address conforming to IPv6 is mainly described as the network address.

[0022] In this specification, the "authenticated network address" means a state in which the authenticity of the network address assigned to each device is guaranteed to the communication destination or a third party. That is, by adopting a mechanism as described later, it means a state in which it can be guaranteed that the network address used by each device for data communication is not forged.

[0023] In this specification, the "device" includes any object capable of data communication via a network. Typically, a device may be configured as a single communication device, or may be configured as a part of some object or incorporated into some object.

[0024] <B. Overall Configuration of Network System> First, the overall configuration of the network system 1 according to the present embodiment will be described.

[0025] FIG. 1 is a schematic diagram showing an example of the overall configuration of the network system 1 according to the present embodiment. Referring to FIG. 1, a network 2 such as the Internet is connected to terminal devices 100-1, 100-2, 100-3,... (hereinafter sometimes collectively referred to as "terminal devices 100"), which are an example of devices, and server devices 200-1, 200-2, 200-3,... (hereinafter sometimes collectively referred to as "server devices 200"), which are another example of devices. It is assumed that they are connected continuously.

[0026] The terminal device 100-1 is assumed to be, for example, a smartphone or a mobile phone, and is connected to the network 2 via a base station 6 or the like arranged by a mobile communication carrier. Further, the terminal device 100-2 is assumed to be, for example, a tablet, and the terminal device 100-3 is assumed to be, for example, a laptop personal computer. The terminal devices 100-2 and 100-3 are connected to the network 2 via an access point 4, for example.

[0027] Each of the server devices 200-1, 200-2, 200-3,... is a device that provides an arbitrary service. Each of the server devices 200 receives access from any one of the terminal devices 100 and provides the requested service.

[0028] As described above, the network system 1 includes at least one server device 200 (second device) and at least one terminal device 100 (first device) that can access any one of the at least one server devices 200.

[0029] In the network system 1 according to the present embodiment, the server device 200 can acquire the authenticated network address of the access source terminal device 100. Similarly, the terminal device 100 can acquire the authenticated network address of the access destination server device 200.

[0030] Between the terminal device 100 and the server device 200, a process of authenticating each other's network addresses is executed, and data communication is started when the authentication of the network addresses is successful. That is, the terminal device 100 is configured to perform data communication after authenticating the network address with any one of at least one server device. By adopting such a configuration for performing such data communication, the terminal device 100 and the server device 200 can acquire the authenticated network addresses of the communication destinations from each other.

[0031] For example, when the server device 200 receives a request from the terminal device 100, it provides a service corresponding to the authenticated network address of the terminal device 100 that is the source of the request. That is, the server device 200 can provide a service corresponding to the acquired authenticated network address to the terminal device 100 that is the source of the request. An example of a service corresponding to a network address will be described later. Also, for the terminal device 100, since it can acquire the authenticated network address of the server device 200, it can also transmit a unique command corresponding to the destination server device 200.

[0032] As described above, in the network system 1 according to the present embodiment, since the authenticated network address for each of the terminal devices 100 can be acquired, it is possible to provide a unique service for each of the terminal devices 100 without requiring an application or the like for realizing an authentication process. Also, since data communication between devices such as the terminal device 100 and the server device 200 means acquisition of an authenticated network address, the time required to provide a unique service for the terminal device 100 is extremely short, and the waiting time required for service provision can be shortened as compared with a configuration in which an authentication process is performed using an application.

[0033] <C. Device Configuration of Devices for Realizing Authentication of Network Addresses> Next, an example of the device configuration of a device for realizing authentication of a network address used in the network system 1 according to the present embodiment will be described. To realize authentication of a network address, for example, hardware implementation and software implementation are assumed. These will be described below with examples of each implementation form.

[0034] (c1: Hardware Implementation) FIG. 2 is a schematic diagram showing an example of the device configuration of the terminal device 100A according to the present embodiment. Referring to FIG. 2, the terminal device 100A includes a processor 102, a main memory 104, a display 106, an input unit 108, a communication module 110, and a secondary storage device 130.

[0035] The processor 102 is a processing entity that executes various processes in the terminal device 100A. The processor 102 expands and executes programs and various instructions stored in the secondary storage device 130 in the main memory 104.

[0036] The main memory 104 is a volatile storage device such as a DRAM (Dynamic Random Access Memory) or an SRAM (Static Random Access Memory). The secondary storage device 130 is a non-volatile storage device such as a flash memory or a hard disk. The secondary storage device 130 stores an OS (Operating System) 132 and one or more arbitrary applications 134.

[0037] The display 106 is a component for presenting the processing results of the processor 102 to the outside, and is composed of, for example, an LCD (Liquid Crystal Display) or an organic EL (Electro-Luminescence) display.

[0038] The input unit 108 is a component for receiving operations from the user, and is composed of an arbitrary input device such as a keyboard, a touch panel, or a mouse.

[0039] The communication module 110 is a main component for providing an authenticated network address, and includes an address authentication chip 112, a WiFi module 114, and an LTE module 118.

[0040] The address authentication chip 112 is a semiconductor device in which the authenticated network address and the information necessary for authentication are hard-coded. When performing data communication with other devices using the WiFi module 114 and / or the LTE module 118, it authenticates the network address.

[0041] More specifically, the address authentication chip 112 executes a process of mutually authenticating the pre-assigned and authenticated network address with other devices in data communication using the WiFi module 114 or the LTE module 118. In this way, the address authentication chip 112 authenticates the network address with the destination device using the communication function module (WiFi module 114 and / or LTE module 118). For the address authentication chip 112, it is preferable to adopt a circuit configuration having tamper resistance.

[0042] The WiFi module 114 and / or the LTE module 118 provide the functions of the physical layer and the data link layer of the OSI (Open Systems Interconnection) reference model. The WiFi module 114 is connected to the antenna 116 and provides a wireless communication function according to a wireless access method such as a wireless LAN (Local Area Network) or WiMAX. The LTE module 118 is connected to the antenna 120 and provides a wireless communication function according to a wireless access method such as LTE (Long Term Evolution), W -CDMA (Wideband Code Division Multiple Access), CDMA2000, etc.

[0043] For convenience of explanation, the communication module 110 including the WiFi module 114 and / or the LTE module 118 is illustrated. However, it is not necessarily required to include both modules, and it may be configured to include only one of the modules, or may be configured to include one or more modules that provide other communication functions. In this case, the communication function is not limited to a wireless communication function, and may be a wired communication function.

[0044] As described above, the communication module 110 includes a communication function module (WiFi module 114 and / or LTE module 118) that provides a communication function, and a semiconductor device (address authentication chip 112) in which an authenticated network address is hard-coded.

[0045] By adopting the above hardware implementation, in the terminal device 100A, it is possible to provide and acquire an authenticated network address.

[0046] (c2: Software implementation) FIG. 3 is a schematic diagram showing an example of the device configuration of the terminal device 100B according to the present embodiment. Referring to FIG. 3(A), the terminal device 100B includes a processor 102, a main memory 104, a display 106, an input unit 108, a secondary storage device 130, a WiFi module 144, and an LTE module 148.

[0047] The processor 102 is a processing entity that executes various processes in the terminal device 100B. The processor 102 expands and executes programs and various instructions stored in the secondary storage device 130 in the main memory 104. In the secondary storage device 130, in addition to the OS 132 and one or more arbitrary applications 134, an address authentication program 136 and authentication management information 138 are stored.

[0048] The WiFi module 144 and / or the LTE module 148 provide the functions of the physical layer and the data link layer of the OSI reference model. The WiFi module 144 is connected to the antenna 146 to provide a wireless communication function according to a wireless access method such as a wireless local area network or WiMAX. The LTE module 148 is connected to the antenna 150 to provide a wireless communication function according to a wireless access method such as LTE, W-CDMA, or CDMA2000.

[0049] For the sake of convenience of explanation, a configuration including the WiFi module 144 and / or the LTE module 148 is illustrated. However, it is not necessarily required to include both modules, and it may be configured to carry only one of the modules, or may be configured to carry one or more modules that provide other communication functions. In this case, the communication function is not limited to a wireless communication function, and may be a wired communication function.

[0050] In the terminal device 100B, by executing the address authentication program 136, the provision of an authenticated network address is realized. Hereinafter, a software configuration for providing an authenticated network address will be illustrated.

[0051] FIG. 3(B) shows a schematic diagram for explaining the processing related to data communication in the terminal device 100B. As shown in FIG. 3(B), the WiFi module 114 and / or the LTE module 118 that provide the functions of the physical layer realize the exchange of actual signals (data) by the data link driver 1322 (a part of the function of the OS 132).

[0052] An application 134 such as a web browser uses the TCP / IP socket 1324 for data communication. The TCP / IP socket 1324 may be provided as a part of the function of the OS 132. Note that in FIG. 3(B), as an example, the TCP / IP socket 1324 is illustrated, but for example, a UDP / IP socket may be adopted.

[0053] Normally, TCP / IP socket 1324 realizes data transmission to other devices and data reception from other devices by internally exchanging data with data link driver 1322.

[0054] On the other hand, in terminal device 100B according to the present embodiment, address authentication program 136 is arranged between TCP / IP socket 1324 and data link driver 1322. Address authentication program 136 authenticates the network addresses assigned to each device with the communication destination device in a specific session, and only when the authentication is successful, uses the specific session to send and receive data. By adopting such a mechanism, transparency can be maintained without the application 134 being aware of the existence of address authentication program 136. That is, application 134 only needs to send a packet containing necessary data, and can trust and use the network address included in the header of the packet received from any device as it is.

[0055] Address authentication program 136 authenticates the network addresses with other devices based on the information stored in authentication management information 138 prepared in a secure manner in advance. Authentication management information 138 includes, in addition to the network address assigned to each device, a code for ensuring that the network address is legitimate (i.e., authenticated). Address authentication program 136 authenticates the network addresses with each other by sending the additional information included in authentication management information 138 to the communication destination together with the network address defined in authentication management information 138.

[0056] Note that it is also possible to authenticate the network address not only with the communication destination device for data communication but also with an external authentication server device or the like.

[0057] In this way, the terminal device 100B includes a communication program (data link driver 1322) responsible for the data link layer, a communication program (TCP / IP socket 1324) responsible for the transport layer and the network layer, and an address authentication program 136 connected between the data link driver 1322 and the TCP / IP socket 1324.

[0058] Note that Fig. 3 shows a configuration in which the address authentication program 136 is logically arranged between the TCP / IP socket 1324 and the data link driver 1322. However, this is not the only case. Any implementation form is acceptable as long as the address authentication program 136 can mutually authenticate the communication destination and the network address.

[0059] For example, the TCP / IP socket 1324 and the address authentication program 136 may be logically arranged in parallel. If the network address authenticated by the address authentication program 136 with the communication destination device is not correct, the TCP / IP socket 1324 may be configured not to start packet transmission and reception. In this case, after the address authentication program 136 authenticates the network address, data transfer between the TCP / IP socket 1324 and the data link driver 1322 may continue, and the address authentication program 136 may not be involved in internal data transfer.

[0060] Among the components of the terminal device 100B, the corresponding components are the same as those of the terminal device 100A, so detailed descriptions will not be repeated.

[0061] By adopting the software implementation as described above, an authenticated network address can be assigned to the terminal device 100B.

[0062] (c3: Another form of software implementation) ​Another implementation form may be adopted without being limited to the functional configuration related to the data communication shown in FIG. 3(B). FIG. 4 is a schematic diagram showing another example of the device configuration of the terminal device according to the present embodiment.

[0063] In the implementation example shown in FIG. 4(A), on top of a general layer structure, that is, the physical layer and the data link layer (WiFi module 144 and / or LTE module 148), a data link driver 1322 and a TCP / IP socket 1324 are arranged in sequence. Any application 134 uses the TCP / IP socket 1324 for data communication.

[0064] In the implementation example shown in FIG. 4(A), when starting or during data exchange with the communication destination node, the TCP / IP socket 1324 requests address authentication program 136 to authenticate the communication destination, etc. The address authentication program 136 authenticates whether the communication destination is a trustworthy node or whether there is any tampering in the data exchanged with the communication destination by performing the authentication process as described above, and responds with the result to the TCP / IP socket 1324. The TCP / IP socket 1324 transmits the authentication result, etc. to the application 134. The basic process of the address authentication program 136 is the same as the address authentication program 136 shown in FIG. 3(B) above.

[0065] In the implementation form as shown in FIG. 4(A), since the TCP / IP socket 1324 requests the address authentication program 136 to execute the necessary authentication process, from the perspective of the application 134, secure communication can be performed with a communication destination having an authenticated network address through the same interface as normal communication.

[0066] In the implementation example shown in FIG. 4(B), in a general layer structure, that is, on top of the physical layer and the data link layer (WiFi module 144 and / or LTE module 148), a data link driver 1322 and a TCP / IP socket 1324 are arranged in sequence. Any application 134 uses the TCP / IP socket 1324 for data communication and also conducts necessary authentication-related interactions with the address authentication program 136.

[0067] In the implementation example shown in FIG. 4(B), when the application 134 exchanges data with the destination node at the start or during the execution of the data exchange, it requests the address authentication program 136 for authentication of the destination, etc. The address authentication program 136 exchanges data with the TCP / IP socket 1324 and conducts the above-described authentication process to authenticate whether the destination is a trustworthy node or whether the data exchanged with the destination has been tampered with. Then, the address authentication program 136 responds to the application 134 with the authentication result. The basic processing of the address authentication program 136 is the same as the address authentication program 136 shown in FIG. 3(B) above.

[0068] By adopting the implementation form as shown in FIG. 4(B), secure communication can be achieved with a communication destination having an authenticated network address without changing the structure of communication layers such as the data link driver 1322 and the TCP / IP socket 1324.

[0069] (c4: Interaction between devices) Next, an example of interaction between devices, such as between the terminal device 100 and the server device 200, will be described.

[0070] FIG. 5 is a schematic diagram for explaining the interaction between devices in the network system 1 according to the present embodiment. FIG. 5 shows an example of the processing when data is exchanged between device 1 and device 2.

[0071] Referring to FIG. 5, both device 1 and device 2 have a network authentication function (corresponding to the address authentication chip 112 shown in FIG. 2 or the address authentication program 136 shown in FIG. 3). The network authentication functions of the respective devices execute authentication processing for the network address with respect to each other. This authentication processing is basically executed at the network layer. When the authentication processing is completed, the network authentication functions of the respective devices are used as the network addresses when the applications (application layer) executed on each device exchange data.

[0072] It may be possible to notify the application of the authenticated network address, or to notify the TCP / IP socket or the like responsible for packet generation and packet reception of the authenticated network address.

[0073] By adopting the configuration as shown in FIG. 5, it is possible to use the network addresses authenticated with respect to each other without requiring special authentication processing or the like on the application side.

[0074] <D. Example of processing procedure> Next, an example of the processing procedure in the network system 1 according to the present embodiment will be described.

[0075] FIG. 6 is a sequence diagram showing an example of the processing procedure related to server provision in the network system 1 according to the present embodiment. FIG. 6 shows a typical example of the processing procedure for the server device 200 to provide the service requested in response to the access from the terminal device 100.

[0076] Specifically, referring to FIG. 6, first, when the user performs some operation on the application 134 (step S2), an access request from the application 134 to the server device 200 is transferred to the network authentication function (the address authentication chip 112 shown in FIG. 2, or the address authentication program 136 shown in FIG. 3) (step S4). The network authentication function of the terminal device 100 executes an authentication process for the mutual network addresses with the network authentication function of the server device 200 (the function corresponding to the address authentication chip 112 shown in FIG. 2, or the address authentication program 136 shown in FIG. 3) (step S6). When the authentication process is completed, the terminal device 100 transfers the requested access request to the server device 200 using the authenticated network address (step S8).

[0077] In the server device 200, the access request transmitted from the terminal device 100 is received by the network authentication function, then subjected to necessary processing, and then transferred to the application (step S10). The application of the server device 200 identifies the network address used for the data communication of the access request received from the terminal device 100 (step S12), and determines the service to be determined according to the identified network address (step S14).

[0078] Then, the application of the server device 200 transmits data corresponding to the determined service to the terminal device 100 (step S16). This data is received by the network authentication function of the server device 200, then subjected to necessary processing, and then transmitted to the terminal device 100 (step S18).

[0079] In the terminal device 100, the data transmitted from the server device 200 is received by the network authentication function, then subjected to necessary processing, and then transferred to the application 134 (step S20). Then, the content corresponding to the received data is presented to the user from the application 134 (step S22).

[0080] In the network system 1 according to the present embodiment, when the server device 200 receives an access from the terminal device 100, since the network address included in the access has been authenticated, the server device 200 can provide a service unique to the terminal device 100 without performing an additional authentication process. That is, the server device 200 identifies the requesting terminal device 100 only using the network address used in the communication at the network layer between the server device 200 and the terminal device 100, without performing an authentication process at the application layer.

[0081] <E. Application Example> Next, an example of a service provided in the network system 1 shown in FIG. 6 will be described.

[0082] (e1: Application Example 1) First, assuming that the server device 200 is a Web server, a configuration in which a unique Web page is provided according to the network address of the access source terminal device 100 will be described as an example.

[0083] FIG. 7 is a diagram for explaining an application example of service provision using the network system 1 according to the present embodiment. FIG. 7(A) shows an example of the network management table 210 held by the server device 200. In the network management table 210, initial screen information 214 indicating an initial screen and preference information 216 indicating preferences are defined in association with the network address (IP address) 212 of the terminal device 100 that has accessed in the past or is scheduled to access in the future. The content of the network management table 210 may be updated manually by the user or updated by the server device 200 according to the user's operation.

[0084] When the server device 200 receives an access from the terminal device 100, it refers to the network management table 210 using the network address assigned to the terminal device 100 as a key, and determines the corresponding initial screen information 214 and preference information 216. Then, the server device 200 determines the content of the web page to be provided to the terminal device 100 that is the access source based on the determined initial screen information 214 and preference information 216.

[0085] FIG. 7(B) shows, as an example, a web screen example when the server device 200 provides an online banking service. For example, on the web screen example 220A presented on the display of the terminal device 100 to which the IP address 1 is assigned, basic account management buttons such as "transfer procedure", "account balance confirmation", and "transfer procedure" are arranged. On the other hand, on the web screen example 220B presented on the display of the terminal device 100 to which the IP address 2 is assigned, buttons related to foreign currency such as "foreign currency purchase" and "foreign currency sale" are arranged together with a chart showing the time change of the exchange rate.

[0086] Such an initial screen can be determined, for example, by referring to the initial screen information 214 of the network management table 210. Furthermore, by referring to the preference information 216 of the network management table 210, etc., it is possible to provide services according to the preferences not only for the initial screen but also for each terminal device 100 (that is, the user operating the terminal device 100).

[0087] As described above, based on the network address assigned to the terminal device 100, it is possible to customize the initial screen and various service contents provided when accessing the server device 200.

[0088] (e2: Application Example Part 2) Next, assuming a utilization management server such as a hotel as the server device 200, a configuration in which the terminal device 100 is used as an electronic key (utilization certificate) will be described as an example.

[0089] FIG. 8 is a diagram for explaining another application example of service provision using the network system 1 according to the present embodiment. FIG. 8(A) shows an example of a usage management table 230 held by the server device 200. In the usage management table 230, the content reserved through a reservation site or the like (room number 234 and available time 236) is stored in association with the network address 232 assigned to the terminal device 100 used for the reservation operation.

[0090] That is, when the user operates his / her terminal device 100 to make a hotel reservation on a reservation site, the server device 200 adds the reservation content to the usage management table 230 together with the network address assigned to the terminal device 100 used for the hotel reservation.

[0091] As shown in FIG. 8(B), a wireless communication unit 242 is arranged in front of each room of the accommodation facility 240. When a user who has a hotel reservation approaches the reserved room with the terminal device 100 used for the hotel reservation, the wireless communication unit 242 performs wireless communication with the terminal device 100. Note that the wireless communication between the terminal device 100 and the wireless communication unit 242 may be automatically started or may be started after the user explicitly performs an operation.

[0092] When the network address assigned to the terminal device 100 held by the user matches any entry in the network address 232 of the usage management table 230, based on the corresponding room number 234 and available time 236, the server device 200 unlocks the room to be reserved.

[0093] In FIG. 8, as a typical example, the configuration in which the terminal device 100 is used as a key for each room in an accommodation facility such as a hotel is illustrated. However, the present invention is not limited to this, and it can be used as any usage certificate. For example, the terminal device 100 itself can be used as an admission ticket for various facilities such as amusement facilities and various events such as concerts. Furthermore, the terminal device 100 itself can also be used as a ticket for railways and airplanes.

[0094] As described above, in the network system 1 according to the present embodiment, since the network address itself assigned to the terminal device 100 is authenticated, there is no need for an application or the like for displaying a ticket as in the prior art, and it is possible to reduce the barrier to the spread of a system that uses the terminal device 100 itself as a usage certificate.

[0095] As described above, based on the network address assigned to the terminal device 100, the terminal device 100 can be easily used as any usage certificate.

[0096] (e3: Third Application Example) Next, a configuration for more comprehensively realizing the authentication process of the network address itself will be described. FIG. 9 is a diagram for explaining an example of filtering of a network address using the network system 1 according to the present embodiment. In FIG. 9, as an example, an address authentication program 136 is arranged in the third layer (network layer) of the OSI reference model, and a configuration example in which TCP (or UDP) is arranged in the fourth layer (transport layer) is shown.

[0097] In FIG. 9, as a configuration for realizing filtering, authentication management information 138 is arranged. The authentication management information 138 may include a blacklist 1382 and / or a whitelist 1384. Note that it is not necessary to prepare both the blacklist 1382 and the whitelist 1384, and only one of them may be prepared.

[0098] The blacklist 1382 is a list that defines network addresses to be blocked, and the whitelist 1384 is a list that defines network addresses to be permitted access.

[0099] Figure 9(A) shows an example where a filtering function is implemented in the address authentication program 136. More specifically, when the network address authenticated for the destination matches any entry defined in the blacklist 1382, the address authentication program 136 blocks or prohibits communication with the destination (blacklist node) having the authenticated network address. That is, packets from the blacklist node are blocked in the address authentication program 136 and not given to the application 134.

[0100] On the other hand, the address authentication program 136 allows communication with the destination (whitelist node) having the authenticated network address only when the authenticated network address matches any entry defined in the whitelist 1384. That is, packets from the whitelist node are given from the address authentication program 136 to the application 134. The application 134 provides a service based on the network address itself authenticated in the address authentication program 136 and the received packets.

[0101] Figure 9(B) shows an example where a filtering function is implemented in the application 134. More specifically, when the application 134 receives a packet from the address authentication program 136, it determines whether the network address of the source of the packet (authenticated by the address authentication program 136) matches any entry in either the blacklist 1382 or the whitelist 1384.

[0102] If the network address of the source of the received packet matches any of the entries defined in the blacklist 1382, the application 134 blocks the packet. On the other hand, if the network address of the source of the received packet matches any of the entries defined in the whitelist 1384, the application 134 processes the packet and provides the requested service.

[0103] As described above, by combining the authentication function of the network address itself with the filtering function using the blacklist / whitelist, a more practical network system can be realized.

[0104] <F. Other Embodiments> In the above-described embodiment, as an example of a configuration using an authenticated network address between devices, a network system including one or more terminal devices 100 and one or more server devices 200 was exemplified. However, the present invention is not limited to this, and it is also applicable to data communication between terminal devices 100 or between server devices 200. Furthermore, without being limited to the framework of the terminal device 100 or the server device 200, it can be used for data communication between any devices. It is.

[0105] <G. Advantages> According to the present embodiment, a service using an authenticated network address and a foundation for providing the service are provided. Since the network address itself is authenticated, the establishment of the communication connection itself also serves as an authentication procedure, and additional authentication procedures using an application are not required. As a result, a variety of services suitable for IoT can be provided.

[0106] The embodiments disclosed this time should be considered as illustrative in all respects and not restrictive. The scope of the present invention is shown not by the above description but by the claims, and it is intended that all modifications within the meaning and scope equivalent to the claims are included.

Description of Symbols

[0107] 1 Network system, 4 Access point, 6 Base station, 100, 100A, 100B Terminal device, 102 Processor, 104 Main memory, 106 Display, 108 Input section, 110 Communication module, 112 Address authentication chip, 114, 144 WiFi module, 116, 120, 146, 150 Antenna, 118, 148 LTE module, 130 Secondary storage device, 132 OS, 134 Application, 136 Address authentication program, 138 Authentication management information, 200 Server device, 210 Network management table, 212 Network address (IP address), 214 Initial screen information, 216 Preference information, 220A, 220B Screen example, 230 Usage management table, 232 Network address, 234 Room number, 236 Available time, 240 Accommodation facility, 242 Wireless communication unit, 1322 Data link driver, 1324 TCP / IP socket.

Claims

1. A device capable of communicating with other devices, means for providing information to the other device to ensure that the network address of the device is valid; means for obtaining information provided by the other device to ensure that the network address of the other device is valid; a means for directly authenticating the network address of the other device itself based on information for ensuring that the network address of the other device is valid, in a network layer of the device; and means for communicating at a layer higher than the network layer of the device using the authenticated network address of the other device.

2. The device of claim 1 , wherein the means for authenticating is independent of applications running on the device.

3. 3. The device according to claim 1, wherein the authentication means is realized by a program installed on an operating system (OS) including a TCP / IP socket.

4. The device according to any one of claims 1 to 3, further comprising means for referencing at least one of a blacklist defining network addresses to which access should be blocked and a whitelist defining network addresses to which access should be permitted.

5. The device according to any one of claims 1 to 4, wherein the network address of the other device includes an IP (Internet Protocol) address.

6. The device according to any one of claims 1 to 5, wherein the device provides content according to a network address of the other device.

7. A communication method for a device to communicate with another device, comprising: providing information to the other device to ensure that the network address of the device is valid; obtaining information provided by the other device to ensure that the network address of the other device is valid; At the network layer of the device, directly authenticating the network address of the other device itself based on information for ensuring that the network address of the other device is valid; and performing communication at a layer higher than the network layer of the device using the authenticated network address of the other device.

8. A communication program for a device to communicate with another device, the communication program existing in a layer higher than a network layer of the device, the communication program being included in a computer of the device, providing information to the other device to ensure that the network address of the device is valid; obtaining information provided by the other device to ensure that the network address of the other device is valid; directly authenticating the network address of the other device itself based on information to ensure that the network address of the other device is valid; and performing communication using the network address of the authenticated other device.

Images