Network System and Communication Method

Abstract

To provide constitution that requires neither special application nor additional authentication procedure in provision of service tailored to a device or a user using the device, and therefore enables shortening of a response time related to provision of service.SOLUTION: A network system includes at least one server device, and at least one terminal device that can access any of the at least one server device. The terminal device performs data communication with at least one server device after authenticating a network address. When the server device receives a request from the terminal device, the server device provides a service according to the authenticated network address of the requesting terminal device.SELECTED DRAWING: Figure 1

Description

Technical Field

[0001] The present invention relates to a network system using a new concept of authenticating a network address itself.

Background Art

[0002] In recent years, the progress of information and communication technology (ICT) has been remarkable, and devices connected to networks such as the Internet have spread not only to conventional information processing devices such as personal computers and smartphones but also to various things. Such a technological trend is called "IoT (Internet of Things)", and various technologies and services are being proposed and put into practical use. In the future, a world where billions of people and hundreds of billions or trillions of devices on the earth are connected simultaneously is envisioned. In order to realize such a networked world, it is necessary to provide a solution that can be connected more simply, more securely, and more freely.

[0003] Normally, on a network, data communication between devices is realized using network addresses statically or dynamically assigned to each device. As such a network address, typically, an IP (Internet Protocol) address is used.

[0004] Generally, IP addresses are of two types: those uniquely determined on the Internet like global addresses, and those assigned without duplication on a private network like private addresses. Also, there is a mechanism such as DHCP (Dynamic Host Configuration Protocol) for dynamically assigning IP addresses. Protocol) to dynamically assign IP addresses.

[0005] In this way, for data communication, only the setting of IP addresses that are assigned without duplication on the same network is considered. That is, an IP address is a network address that is arbitrarily set according to the target network.

[0006] For example, Japanese Patent Application Laid-Open No. 2017-059868 (Patent Document 1) discloses a configuration for reducing the man-hour of setting IP addresses.

Prior Art Documents

Patent Documents

[0007]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0008] As described above, although the conventional network address was identification information for specifying a communication destination, no reliability was given to the address itself. Therefore, although data communication was performed between devices using IP addresses, authentication processing and the like were realized in a higher layer (for example, the application layer, etc.).

[0009] Therefore, in order to provide services that require various authentication processes, an application or the like for realizing the authentication process that forms the basis of the service must be provided in advance or each time, which has been an obstacle to popularization.

[0010] The present invention provides a solution to the above-described problems.

Means for Solving the Problems

[0011] A network system according to an aspect of the present invention includes at least one server device and at least one terminal device accessible to any of the at least one server devices. The terminal device is configured to perform data communication with any of the at least one server devices after authenticating a network address. When the server device receives a request from the terminal device, it provides a service corresponding to the authenticated network address of the terminal device that is the source of the request.

[0012] Preferably, the server device identifies the terminal device that is the source of the request using only the network address used in the communication at the network layer between the server device and the terminal device without performing authentication processing at the application layer.

[0013] Preferably, the terminal device includes a first communication program responsible for the data link layer, a second communication program responsible for the transport layer and the network layer, and an address authentication program connected between the first communication program and the second communication program. The address authentication program authenticates the network address used for data transmission requested by the second communication program with the destination device.

[0014] Preferably, the terminal device includes a communication function module that provides a communication function and a semiconductor device in which an authenticated network address is hard-coded. The semiconductor device authenticates the network address with the destination device using the communication function module.

Advantages of the Invention

[0015] According to an aspect of the present invention, when providing a service according to a device or a user using the device, a special application or the like is not required, and an additional authentication procedure is not required, so that the response time related to service provision can be shortened.

Brief Description of the Drawings

[0016]

Figure 1

Figure 2

Figure 3

Figure 4

Figure 5

Figure 6

Figure 7

Figure 8

Figure 9

Embodiments for Carrying Out the Invention

[0017] Embodiments of the present invention will be described in detail with reference to the drawings. For the same or corresponding parts in the drawings, the same reference numerals are given and the description thereof will not be repeated.

[0018] <A. Overview> According to this embodiment, a service using an authenticated network address and an infrastructure for providing the service are provided. That is, in a conventional network, there is no technical concept of authenticating the network address itself, and mainly, the network address is only used for establishing a communication connection. On top of that, it was normal to perform an authentication procedure using an application for authentication. In contrast, in this embodiment, since the network address itself is authenticated, the establishment of the communication connection itself also serves as an authentication procedure, and additional authentication procedures using an application and the like become unnecessary.

[0019] Therefore, when providing a service according to a device or a user using the device, a special application or the like is not required, and since an additional authentication procedure is also not required, the response time related to service provision can be shortened.

[0020] In this specification, the "network address" means identification information for uniquely identifying a device on some network, and generally consists of a character string composed of a combination of characters, numbers, symbols, etc. As a typical example of a network address, an IP (Internet Protocol) address is assumed, but a lower-layer address such as a MAC (Media Access Control address) may also be used, or a higher-layer address such as a host name or URL (Uniform Resource Locator) managed by DNS (Domain Name System ) may also be used. Also, as for the network, regardless of differences such as a global network and a private network, and the protocol used can also be arbitrarily selected. As the network address, one unique to the protocol adopted may be adopted.

[0021] When an IP address is adopted as a typical example, the specified number of bits differs depending on the version. Currently established IPv4 (Internet Protocol Version 4) defines a 32-bit address range, and currently established IPv6 (Internet Protocol Version 6) defines a 128-bit address range. In the present embodiment, an IP address conforming to IPv6 is mainly described as the network address.

[0022] In this specification, the "authenticated network address" means a state in which the authenticity of the network address assigned to each device is guaranteed to the communication destination or a third party. That is, by adopting a mechanism as described later, it means a state in which it is guaranteed that the network address used by each device for data communication is not forged.

[0023] In this specification, the "device" includes any object capable of data communication via a network. Typically, a device may be configured as a single communication device, or may be configured as a part of some object or incorporated into some object.

[0024] <B. Overall Configuration of Network System> First, the overall configuration of the network system 1 according to the present embodiment will be described.

[0025] FIG. 1 is a schematic diagram showing an example of the overall configuration of the network system 1 according to the present embodiment. Referring to FIG. 1, the network 2 such as the Internet is connected to terminal devices 100-1, 100-2, 100-3,... (hereinafter sometimes collectively referred to as "terminal devices 100"), which are an example of devices, and server devices 200-1, 200-2, 200-3,... (hereinafter sometimes collectively referred to as "server devices 200"), which are another example of devices. It is assumed that they are connected continuously.

[0026] The terminal device 100-1 is assumed to be, for example, a smartphone or a mobile phone, and is connected to the network 2 via a base station 6 or the like arranged by a mobile communication carrier. Also, the terminal device 100-2 is assumed to be, for example, a tablet, and the terminal device 100-3 is assumed to be, for example, a laptop personal computer. The terminal devices 100-2 and 100-3 are connected to the network 2 via an access point 4, for example.

[0027] Each of the server devices 200-1, 200-2, 200-3, ··· is a device that provides an arbitrary service. Each of the server devices 200 receives access from any of the terminal devices 100 and provides the requested service.

[0028] As described above, the network system 1 includes at least one server device 200 (second device) and at least one terminal device 100 (first device) that can access any of the at least one server devices 200.

[0029] In the network system 1 according to the present embodiment, the server device 200 can acquire the authenticated network address of the access source terminal device 100. Similarly, the terminal device 100 can acquire the authenticated network address of the access destination server device 200.

[0030] Between the terminal device 100 and the server device 200, a process of authenticating each other's network address is executed, and data communication is started when the authentication of the network address is successful. That is, the terminal device 100 is configured to perform data communication after authenticating the network address with any of at least one server device. By adopting such a configuration for performing such data communication, the terminal device 100 and the server device 200 can acquire the authenticated network address of the communication destination from each other.

[0031] For example, when the server device 200 receives a request from the terminal device 100, it provides a service corresponding to the authenticated network address of the terminal device 100 that is the source of the request. That is, the server device 200 can provide a service corresponding to the acquired authenticated network address to the terminal device 100 that is the source of the request. An example of a service corresponding to the network address will be described later. Also, for the terminal device 100, since it can acquire the authenticated network address of the server device 200, it can also transmit a unique command corresponding to the server device 200 that is the communication destination.

[0032] As described above, in the network system 1 according to the present embodiment, since the authenticated network address for each of the terminal devices 100 can be acquired, a service unique to each of the terminal devices 100 can be provided without the need for an application or the like for realizing the authentication process. Also, since data communication between devices such as the terminal device 100 and the server device 200 means the acquisition of the authenticated network address, the time required to provide a service unique to the terminal device 100 is extremely short, and the waiting time required for service provision can be shortened as compared with a configuration in which the authentication process is performed using an application.

[0033] <C. Device Configuration of Devices for Realizing Authentication of Network Addresses> Next, an example of the device configuration of a device for realizing the authentication of network addresses used in the network system 1 according to the present embodiment will be described. In order to realize the authentication of network addresses, for example, hardware implementation and software implementation are assumed. These will be described below with examples of each implementation form.

[0034] (c1: Hardware Implementation) FIG. 2 is a schematic diagram showing an example of the device configuration of the terminal device 100A according to the present embodiment. Referring to FIG. 2, the terminal device 100A includes a processor 102, a main memory 104, a display 106, an input unit 108, a communication module 110, and a secondary storage device 130.

[0035] The processor 102 is a processing entity that executes various processes in the terminal device 100A. The processor 102 expands and executes programs and various instructions stored in the secondary storage device 130 in the main memory 104.

[0036] The main memory 104 is a volatile storage device such as a DRAM (Dynamic Random Access Memory) or an SRAM (Static Random Access Memory). The secondary storage device 130 is a non-volatile storage device such as a flash memory or a hard disk. The secondary storage device 130 stores an OS (Operating System) 132 and one or more arbitrary applications 134.

[0037] The display 106 is a component for presenting the processing results in the processor 102 to the outside, and is composed of, for example, an LCD (Liquid Crystal Display) or an organic EL (Electro-Luminescence) display.

[0038] The input unit 108 is a component for receiving operations from the user, and is composed of an arbitrary input device such as a keyboard, a touch panel, or a mouse.

[0039] The communication module 110 is a main component for providing an authenticated network address, and includes an address authentication chip 112, a WiFi module 114, and an LTE module 118.

[0040] The address authentication chip 112 is a semiconductor device in which the authenticated network address and the information necessary for authentication are hard-coded. When performing data communication with other devices using the WiFi module 114 and / or the LTE module 118, it authenticates the network address.

[0041] More specifically, the address authentication chip 112 executes a process of mutually authenticating the pre-assigned authenticated network address with other devices in data communication using the WiFi module 114 or the LTE module 118. In this way, the address authentication chip 112 authenticates the network address with the destination device using the communication function module (WiFi module 114 and / or LTE module 118). For the address authentication chip 112, it is preferable to adopt a circuit configuration with tamper resistance.

[0042] The WiFi module 114 and / or the LTE module 118 provide the functions of the physical layer and the data link layer of the OSI (Open Systems Interconnection) reference model. The WiFi module 114 is connected to the antenna 116 and provides a wireless communication function according to a wireless access method such as a wireless LAN (Local Area Network) or WiMAX. The LTE module 118 is connected to the antenna 120 and provides a wireless communication function according to a wireless access method such as LTE (Long Term Evolution), W -CDMA (Wideband Code Division Multiple Access), CDMA2000, etc.

[0043] For the sake of convenience in explanation, the communication module 110 including the WiFi module 114 and / or the LTE module 118 is illustrated. However, it is not necessarily required to include both modules, and it may be configured to carry only one of the modules, or may be configured to carry one or more modules that provide other communication functions. In this case, the communication function is not limited to the wireless communication function, and may be a wired communication function.

[0044] As described above, the communication module 110 includes a communication function module (WiFi module 114 and / or LTE module 118) that provides a communication function, and a semiconductor device (address authentication chip 112) in which an authenticated network address is hard-coded.

[0045] By adopting the above hardware implementation, in the terminal device 100A, it is possible to provide and obtain an authenticated network address.

[0046] (c2: Software implementation) FIG. 3 is a schematic diagram showing an example of the device configuration of the terminal device 100B according to the present embodiment. Referring to FIG. 3(A), the terminal device 100B includes a processor 102, a main memory 104, a display 106, an input unit 108, a secondary storage device 130, a WiFi module 144, and an LTE module 148.

[0047] The processor 102 is a processing entity that executes various processes in the terminal device 100B. The processor 102 expands and executes programs and various instructions stored in the secondary storage device 130 in the main memory 104. In addition to the OS 132 and one or more arbitrary applications 134, an address authentication program 136 and authentication management information 138 are stored in the secondary storage device 130.

[0048] The WiFi module 144 and / or the LTE module 148 provide the functions of the physical layer and the data link layer of the OSI reference model. The WiFi module 144 is connected to the antenna 146 to provide a wireless communication function according to a wireless access method such as a wireless LAN or WiMAX. The LTE module 148 is connected to the antenna 150 to provide a wireless communication function according to a wireless access method such as LTE, W-CDMA, or CDMA2000.

[0049] For the sake of convenience of explanation, a configuration including the WiFi module 144 and / or the LTE module 148 is illustrated, but it is not necessarily required to include both modules, and it may be configured to mount only one of the modules, or may be configured to mount one or more modules that provide other communication functions. In this case, the communication function is not limited to a wireless communication function, and may be a wired communication function.

[0050] In the terminal device 100B, by executing the address authentication program 136, the provision of an authenticated network address is realized. Hereinafter, a software configuration for providing an authenticated network address will be illustrated.

[0051] FIG. 3(B) shows a schematic diagram for explaining the processing related to data communication in the terminal device 100B. As shown in FIG. 3(B), the WiFi module 114 and / or the LTE module 118 that provide the functions of the physical layer realize the exchange of actual signals (data) by the data link driver 1322 (a part of the function of the OS 132).

[0052] An application 134 such as a web browser uses the TCP / IP socket 1324 for data communication. The TCP / IP socket 1324 may be provided as a part of the function of the OS 132. Note that in FIG. 3(B), as an example, the TCP / IP socket 1324 is illustrated, but for example, a UDP / IP socket may be adopted.

[0053] Normally, TCP / IP socket 1324 realizes data transmission to other devices and data reception from other devices by internally exchanging data with data link driver 1322.

[0054] On the other hand, in terminal device 100B according to the present embodiment, address authentication program 136 is arranged between TCP / IP socket 1324 and data link driver 1322. Address authentication program 136 authenticates the network addresses assigned to each device with the communication destination device in a specific session, and only when the authentication is successful, data is transmitted and received using the specific session. By adopting such a mechanism, transparency can be maintained without the application 134 being aware of the existence of address authentication program 136. That is, application 134 only needs to transmit a packet containing necessary data, and can trust and use the network address included in the header of the packet received from any device as it is.

[0055] Address authentication program 136 authenticates the network addresses with other devices based on the information stored in authentication management information 138 prepared in a secure manner in advance. Authentication management information 138 includes, in addition to the network address assigned to each device, a code for ensuring that the network address is legitimate (i.e., authenticated). Address authentication program 136 authenticates the network addresses with each other by transmitting the additional information included in authentication management information 138 to the communication destination together with the network address defined in authentication management information 138.

[0056] Note that not only the communication destination device for data communication but also the network address may be authenticated with an external authentication server device or the like.

[0057] In this way, the terminal device 100B includes a communication program (data link driver 1322) responsible for the data link layer, a communication program (TCP / IP socket 1324) responsible for the transport layer and the network layer, and an address authentication program 136 connected between the data link driver 1322 and the TCP / IP socket 1324.

[0058] Note that FIG. 3 shows a configuration in which the address authentication program 136 is logically arranged between the TCP / IP socket 1324 and the data link driver 1322. However, the present invention is not limited to this. Any implementation form may be used as long as the address authentication program 136 can mutually authenticate the communication destination and the network address.

[0059] For example, the TCP / IP socket 1324 and the address authentication program 136 may be logically arranged in parallel. If the network address authenticated by the address authentication program 136 with the communication destination device is not correct, the TCP / IP socket 1324 may be configured not to start packet transmission and reception. In this case, after the address authentication program 136 authenticates the network address, data transfer between the TCP / IP socket 1324 and the data link driver 1322 may continue, and the address authentication program 136 may not be involved in internal data transfer.

[0060] Among the components of the terminal device 100B, the corresponding components are the same as those of the terminal device 100A, and thus detailed descriptions will not be repeated.

[0061] By adopting the software implementation as described above, an authenticated network address can be assigned to the terminal device 100B.

[0062] (c3: Another form of software implementation) ​It is not limited to the functional configuration related to data communication shown in FIG. 3(B), and another implementation form may be adopted. FIG. 4 is a schematic diagram showing another example of the device configuration of the terminal device according to the present embodiment.

[0063] In the implementation example shown in FIG. 4(A), on top of a general layer structure, that is, the physical layer and the data link layer (WiFi module 144 and / or LTE module 148), a data link driver 1322 and a TCP / IP socket 1324 are arranged in sequence. Any application 134 uses the TCP / IP socket 1324 for data communication.

[0064] In the implementation example shown in FIG. 4(A), when starting or during data exchange with the communication destination node, the TCP / IP socket 1324 requests address authentication and the like from the address authentication program 136. The address authentication program 136 authenticates whether the communication destination is a trustworthy node or whether there is any tampering in the data exchanged with the communication destination by performing the authentication process as described above, and responds with the result to the TCP / IP socket 1324. The TCP / IP socket 1324 transmits the authentication result and the like to the application 134. The basic process of the address authentication program 136 is the same as the address authentication program 136 shown in FIG. 3(B) above.

[0065] In the implementation form as shown in FIG. 4(A), since the TCP / IP socket 1324 requests the address authentication program 136 to execute the necessary authentication process, from the perspective of the application 134, secure communication can be performed with a communication destination having an authenticated network address through the same interface as normal communication.

[0066] In the implementation example shown in FIG. 4(B), in a general layer structure, that is, above the physical layer and the data link layer (WiFi module 144 and / or LTE module 148), a data link driver 1322 and a TCP / IP socket 1324 are arranged in sequence. Any application 134 uses the TCP / IP socket 1324 for data communication and also conducts necessary authentication-related exchanges with the address authentication program 136.

[0067] In the implementation example shown in FIG. 4(B), when the application 134 exchanges data with the destination node at the start or during the execution of the data exchange, it requests the address authentication program 136 for authentication of the destination, etc. The address authentication program 136 exchanges data with the TCP / IP socket 1324 and conducts the above-described authentication process to authenticate whether the destination is a trustworthy node or whether the data exchanged with the destination has been tampered with. Then, the address authentication program 136 responds to the application 134 with the authentication result. The basic processing of the address authentication program 136 is the same as the address authentication program 136 shown in FIG. 3(B) above.

[0068] By adopting the implementation form as shown in FIG. 4(B), secure communication can be achieved with a communication destination having an authenticated network address without changing the structure of communication layers such as the data link driver 1322 and the TCP / IP socket 1324.

[0069] (c4: Exchange between devices) Next, an example of the exchange between devices, such as between the terminal device 100 and the server device 200, will be described.

[0070] FIG. 5 is a schematic diagram for explaining the exchange between devices in the network system 1 according to the present embodiment. FIG. 5 shows an example of the processing when exchanging data between device 1 and device 2.

[0071] Referring to FIG. 5, both device 1 and device 2 have a network authentication function (corresponding to the address authentication chip 112 shown in FIG. 2 or the address authentication program 136 shown in FIG. 3). The network authentication functions of the respective devices execute authentication processing for the network address with respect to each other. This authentication processing is basically executed at the network layer. When the authentication processing is completed, the network authentication functions of the respective devices are used as the network addresses when the applications (application layer) executed on each device exchange data.

[0072] The application may be notified of the authenticated network address, or the TCP / IP socket responsible for packet generation and packet reception, etc. may be notified of the authenticated network address.

[0073] By adopting the configuration as shown in FIG. 5, it is possible to use the network addresses authenticated with each other without requiring special authentication processing, etc. on the application side.

[0074] <D. Example of processing procedure> Next, an example of the processing procedure in the network system 1 according to the present embodiment will be described.

[0075] FIG. 6 is a sequence diagram showing an example of the processing procedure related to server provision in the network system 1 according to the present embodiment. FIG. 6 shows a typical example of the processing procedure for the server device 200 to provide the service requested in response to the access from the terminal device 100.

[0076] Specifically, referring to FIG. 6, first, when the user performs some operation on the application 134 (step S2), an access request from the application 134 to the server device 200 is transferred to the network authentication function (the address authentication chip 112 shown in FIG. 2, or the address authentication program 136 shown in FIG. 3) (step S4). The network authentication function of the terminal device 100 executes an authentication process for the mutual network addresses with the network authentication function of the server device 200 (the function corresponding to the address authentication chip 112 shown in FIG. 2, or the address authentication program 136 shown in FIG. 3) (step S6). When the authentication process is completed, the terminal device 100 transfers the requested access request to the server device 200 using the authenticated network address (step S8).

[0077] In the server device 200, the access request transmitted from the terminal device 100 is received by the network authentication function, then subjected to necessary processing, and then transferred to the application (step S10). The application of the server device 200 identifies the network address used for the data communication of the access request received from the terminal device 100 (step S12), and determines the service to be determined according to the identified network address (step S14).

[0078] Then, the application of the server device 200 transmits data corresponding to the determined service to the terminal device 100 (step S16). This data is received by the network authentication function of the server device 200, then subjected to necessary processing, and then transmitted to the terminal device 100 (step S18).

[0079] In the terminal device 100, the data transmitted from the server device 200 is received by the network authentication function, then subjected to necessary processing, and then transferred to the application 134 (step S20). Then, the content corresponding to the received data is presented to the user from the application 134 (step S22).

[0080] In the network system 1 according to the present embodiment, when the server device 200 receives an access from the terminal device 100, since the network address included in the access has been authenticated, it can provide a service unique to the terminal device 100 without performing an additional authentication process. That is, the server device 200 identifies the source terminal device 100 only using the network address used in the communication at the network layer between the server device 200 and the terminal device 100, without performing an authentication process at the application layer.

[0081] <E. Application Example> Next, an example of a service provided in the network system 1 shown in FIG. 6 will be described.

[0082] (e1: Application Example 1) First, assuming that the server device 200 is a Web server, a configuration in which a unique Web page is provided according to the network address of the access source terminal device 100 will be described as an example.

[0083] FIG. 7 is a diagram for explaining an application example of service provision using the network system 1 according to the present embodiment. FIG. 7(A) shows an example of the network management table 210 held by the server device 200. In the network management table 210, initial screen information 214 indicating an initial screen and preference information 216 indicating preferences are defined in association with the network address (IP address) 212 of the terminal device 100 that has accessed in the past or is scheduled to access. The contents of the network management table 210 may be updated manually by the user or updated by the server device 200 according to the user's operation.

[0084] When the server device 200 receives an access from the terminal device 100, it refers to the network management table 210 using the network address assigned to the terminal device 100 as a key, and determines the corresponding initial screen information 214 and preference information 216. Then, based on the determined initial screen information 214 and preference information 216, the server device 200 determines the content of the web page to be provided to the terminal device 100 that is the access source.

[0085] FIG. 7(B) shows, as an example, a web screen example when the server device 200 provides an online banking service. For example, on the web screen example 220A presented on the display of the terminal device 100 to which the IP address 1 is assigned, basic account management buttons such as "transfer procedure", "account balance check", and "transfer procedure" are arranged. On the other hand, on the web screen example 220B presented on the display of the terminal device 100 to which the IP address 2 is assigned, buttons related to foreign currency such as "foreign currency purchase" and "foreign currency sale" are arranged together with a chart showing the temporal change of the exchange rate.

[0086] Such an initial screen can be determined, for example, by referring to the initial screen information 214 of the network management table 210. Furthermore, by referring to the preference information 216 of the network management table 210, etc., not only the initial screen but also services according to the preferences can be provided for each terminal device 100 (that is, the user operating the terminal device 100).

[0087] As described above, based on the network address assigned to the terminal device 100, the initial screen and various service contents provided when accessing the server device 200 can be customized.

[0088] (e2: Application Example Part 2) Next, assuming a usage management server such as a hotel as the server device 200, a configuration in which the terminal device 100 is used as an electronic key (usage certificate) will be described as an example.

[0089] FIG. 8 is a diagram for explaining another application example of service provision using the network system 1 according to the present embodiment. FIG. 8(A) shows an example of the usage management table 230 held by the server device 200. In the usage management table 230, the reserved content (room number 234 and available time 236) through a reservation site or the like is stored in association with the network address 232 assigned to the terminal device 100 used for the reservation operation.

[0090] That is, when the user operates his / her terminal device 100 to make a hotel reservation on a reservation site, the server device 200 adds the reservation content to the usage management table 230 together with the network address assigned to the terminal device 100 used for the hotel reservation.

[0091] As shown in FIG. 8(B), a wireless communication unit 242 is arranged in front of each room of the accommodation facility 240. When a user who has a hotel reservation approaches the reserved room with the terminal device 100 used for the hotel reservation, the wireless communication unit 242 performs wireless communication with the terminal device 100. Note that the wireless communication between the terminal device 100 and the wireless communication unit 242 may be automatically started or may be started after the user explicitly performs an operation.

[0092] When the network address assigned to the terminal device 100 held by the user matches any entry in the network address 232 of the usage management table 230, based on the corresponding room number 234 and available time 236, the server device 200 unlocks the room to be reserved.

[0093] FIG. 8 illustratively shows, as a typical example, a configuration in which the terminal device 100 is used as a key for each room in an accommodation facility such as a hotel. However, the present invention is not limited to this, and the terminal device 100 can be used as any utilization certificate. For example, the terminal device 100 itself can be used as an admission ticket for various facilities such as amusement facilities and various events such as concerts. Furthermore, the terminal device 100 itself can also be used as a ticket for railways and airplanes.

[0094] As described above, in the network system 1 according to the present embodiment, since the network address itself assigned to the terminal device 100 is authenticated, there is no need for an application or the like for displaying a ticket as in the prior art, and the spread of a system that uses the terminal device 100 itself as a utilization certificate can be reduced.

[0095] As described above, based on the network address assigned to the terminal device 100, the terminal device 100 can be easily used as any utilization certificate.

[0096] (e3: Third Application Example) Next, a configuration for more comprehensively realizing the authentication process of the network address itself will be described. FIG. 9 is a diagram for explaining an example of filtering of a network address using the network system 1 according to the present embodiment. In FIG. 9, as an example, a configuration example in which an address authentication program 136 is arranged in the third layer (network layer) of the OSI reference model and TCP (or UDP) is arranged in the fourth layer (transport layer) is shown.

[0097] In FIG. 9, authentication management information 138 is arranged as a configuration for realizing filtering. The authentication management information 138 may include a blacklist 1382 and / or a whitelist 1384. Note that it is not necessary to prepare both the blacklist 1382 and the whitelist 1384, and only one of them may be prepared.

[0098] The blacklist 1382 is a list that defines network addresses to be blocked, and the whitelist 1384 is a list that defines network addresses to be permitted access.

[0099] Figure 9(A) shows an example where a filtering function is implemented in the address authentication program 136. More specifically, when the network address authenticated for the destination matches any entry defined in the blacklist 1382, the address authentication program 136 blocks or prohibits communication with the destination (blacklist node) having the authenticated network address. That is, packets from the blacklist node are blocked in the address authentication program 136 and not given to the application 134.

[0100] On the other hand, the address authentication program 136 allows communication with the destination (whitelist node) having the authenticated network address only when the authenticated network address matches any entry defined in the whitelist 1384. That is, packets from the whitelist node are given from the address authentication program 136 to the application 134. The application 134 provides a service based on the network address itself authenticated in the address authentication program 136 and the received packet.

[0101] Figure 9(B) shows an example where a filtering function is implemented in the application 134. More specifically, when the application 134 receives a packet from the address authentication program 136, it determines whether the network address of the source of the packet (authenticated by the address authentication program 136) matches any entry in either the blacklist 1382 or the whitelist 1384.

[0102] If the network address of the source of the received packet matches any entry defined in the blacklist 1382, the application 134 blocks the packet. On the other hand, if the network address of the source of the received packet matches any entry defined in the whitelist 1384, the application 134 processes the packet and provides the requested service.

[0103] As described above, by combining the authentication function of the network address itself with the filtering function using the blacklist / whitelist, a more practical network system can be realized.

[0104] <F. Other Embodiments> In the above-described embodiment, as a configuration example using the network address authenticated between devices, a network system including one or more terminal devices 100 and one or more server devices 200 is exemplified. However, the present invention is not limited to this, and it is also applicable to data communication between terminal devices 100 or between server devices 200. Furthermore, without being limited to the framework such as the terminal device 100 or the server device 200, it can be used for data communication between any devices. It is.

[0105] <G. Advantages> According to the present embodiment, a service using an authenticated network address and a foundation for providing the service are provided. Since the network address itself is authenticated, the establishment of the communication connection itself also serves as an authentication procedure, and additional authentication procedures using an application are unnecessary. As a result, a variety of services suitable for IoT can be provided.

[0106] The embodiments disclosed this time should be considered as illustrative in all respects and not restrictive. The scope of the present invention is shown not by the above description but by the claims, and it is intended that all modifications within the meaning and scope equivalent to the claims are included.

Description of Symbols

[0107] 1 Network system, 4 Access point, 6 Base station, 100, 100A, 100B Terminal device, 102 Processor, 104 Main memory, 106 Display, 108 Input unit, 110 Communication module, 112 Address authentication chip, 114, 144 WiFi module, 116, 120, 146, 150 Antenna, 118, 148 LTE module, 130 Secondary storage device, 132 OS, 134 Application, 136 Address authentication program, 138 Authentication management information, 200 Server device, 210 Network management table, 212 Network address (IP address), 214 Initial screen information, 216 Preference information, 220A, 220B Screen example, 230 Usage management table, 232 Network address, 234 Room number, 236 Available time, 240 Accommodation facility, 242 Wireless communication unit, 1322 Data link driver, 1324 TCP / IP socket.

Claims

1. A first device and, a second device, wherein the first device receives an access request to the second device and starts an address authentication process with the second device, in the address authentication process, the second device directly authenticates the network address itself of the first device based on information provided by the first device for ensuring that the network address of the first device is legitimate in the network layer of the second device, and determines a first authenticated network address, the first device directly authenticates the network address itself of the second device based on information provided by the second device for ensuring that the network address of the second device is legitimate in the network layer of the first device, and determines a second authenticated network address, after the address authentication process, the first device and the second device communicate with each other in a layer higher than the network layer based on the first and second authenticated network addresses, a network system.

2. The network system according to claim 1, wherein the address authentication process is executed independently of an application executed on the second device.

3. The second device is a server, The network system according to claim 1 or 2, wherein the second device determines a service provided to the first device based on the first authenticated address.

4. The network system according to claim 1 or 2, wherein the second device provides content corresponding to the first authenticated address.

5. The network system according to claim 1 or 2, wherein the second device provides content corresponding to a user associated with the first authenticated address.

6. The network system according to claim 3, wherein the provided service includes at least one of an online banking service, a room unlocking service, and a hotel reservation service.

7. The network system according to claim 1, wherein an address authentication program for the address authentication process is installed on an OS (Operating System) including a TCP / IP socket.

8. The network system according to claim 7, wherein the address authentication program is independent of an application program for providing a service.

9. The network system according to claim 1, wherein the address authentication process refers to at least one of a blacklist defining a network address to be blocked and a whitelist defining a network address to be permitted access.

10. The network system according to claim 1, wherein each of the first and second authenticated network addresses includes an IP (Internet Protocol) address.

11. A network communication method in a network system including a first device and a second device, comprising: a step in which the first device receives an access request to the second device and starts an address authentication process with the second device; in the address authentication process, a step in which the second device authenticates a network address of the first device based on information provided by the first device for ensuring that the network address of the first device is legitimate in the network layer of the second device, and determines a first authenticated network address; a step in which the first device directly authenticates the network address itself of the second device based on information provided by the second device for ensuring that the network address of the second device is legitimate in the network layer of the first device, and determines a second authenticated network address; after the address authentication process, a step in which the first device and the second device communicate with each other based on the first and second authenticated network addresses in a layer higher than the network layer.

Images