Setting method, network device, and communication system

Abstract

This method for setting a network device that forwards frames in a home network involves: acquiring a first certificate of one type among a plurality of types from a first device that is to be connected to the network device and that possesses the first certificate; identifying a first type, which is the type of the acquired first certificate; and executing first setting processing for causing the first device to connect to the network device such that the first device belongs to a first segment associated with the identified first type, among one or more segments, which are one or more forwarding ranges for frames by the network device, each of the one or more segments being associated with a certificate type.

Description

Setting method, network device, and communication system

[0001] The present invention relates to a setting method, a network device, and a communication system.

[0002] There is a technique for updating records relating to security associations in a communication system (see Patent Document 1).

[0003] Patent No. 6490703

[0004] However, there is a problem in that it is difficult to prevent security attacks in a home network.

[0005] Therefore, the present disclosure provides a method for configuring network devices that can suppress security attacks in a home network.

[0006] A configuration method according to one aspect of the present disclosure is a configuration method for a network device that forwards frames in a home network, the configuration method comprising: obtaining a first certificate from a first device that is attempting to connect to the network device and that holds a first certificate of one of a plurality of types; identifying a first type that is the type of the obtained first certificate; and executing a first configuration process that connects the first device to the network device so that the first device belongs to a first segment that is associated with the identified first type among one or more segments that are one or more forwarding ranges of the frames by the network device, each of the one or more segments corresponding to a certificate type.

[0007] These comprehensive or specific aspects may be realized as a system, an apparatus, an integrated circuit, a computer program, or a computer-readable recording medium such as a CD-ROM, or may be realized as any combination of a system, an apparatus, an integrated circuit, a computer program, and a recording medium.

[0008] The configuration method of the present disclosure can mitigate security attacks in a home network.

[0009] 1 is a schematic diagram showing the configuration of a communication system in embodiment 1. FIG. 2 is a block diagram showing the configuration of a network device in embodiment 1. FIG. 3 is a block diagram showing the configuration of a terminal in embodiment 1. FIG. 4 is a block diagram showing the configuration of an air conditioner in embodiment 1. FIG. 5 is an explanatory diagram showing a device certificate in embodiment 1. FIG. 6 is an explanatory diagram showing a setting table in embodiment 1. FIG. 7 is a first flow chart showing a method for setting a network device in embodiment 1. FIG. 8 is a second flow chart showing the method for setting a network device in embodiment 1. FIG. 9 is a first sequence chart showing the operation of a communication system in embodiment 1. FIG. 10 is a second sequence chart showing the operation of a communication system in embodiment 1. FIG. 11 is an explanatory diagram showing a transfer control table for controlling frame transfer by a network device in embodiment 1. FIG. 12 is a first sequence chart showing the transfer operation of an operation instruction of a communication system in embodiment 1. FIG. 13 is a second sequence chart showing the transfer operation of an operation instruction of a communication system in embodiment 1. FIG. 14 is a first flow chart showing processing when revocation information is acquired by a network device in embodiment 1. FIG. 15 is a second flow chart showing processing when revocation information is acquired by a network device in embodiment 1. FIG. 16 is an explanatory diagram showing another example of a setting table in embodiment 1. FIG. 17 is an explanatory diagram showing a client certificate in embodiment 2. FIG. 18 is a first flow chart showing processing when revocation information is acquired by a network device in embodiment 2. Fig. 10 is a second flow chart showing processing when revocation information is acquired by a network device in embodiment 2. Fig. 11 is a schematic diagram showing the configuration of a communication system in embodiment 3. Fig. 12 is an explanatory diagram showing an example of a setting table in embodiment 3. Fig. 13 is an explanatory diagram showing a transfer control table that controls frame transfer by a network device in embodiment 3.

[0010] (Findings that Form the Basis of the Present Disclosure) The present inventors have found that the following problems arise with the technology relating to communication systems described in the "Background Art" section.

[0011] In a communication system, there is a technology in which two devices form a security association using a simple protocol and update records related to the security association (see Patent Literature 1). The records related to the security association may be backed up to a cloud server.

[0012] On the other hand, when multiple devices are connected to a home network, one of the devices may launch a security attack on another device, particularly by transmitting a frame to the other device through a relay device (generally referred to as a broadband router or home router) in the home network.

[0013] Conventional techniques have the problem that it is difficult to prevent security attacks such as those described above in home networks.

[0014] Therefore, the present invention provides a method for configuring network devices that can suppress security attacks in a home network.

[0015] Below, embodiments that can be obtained from the disclosure of this specification will be exemplified, and the effects and the like that can be obtained from these embodiments will be described.

[0016] (1) A method for configuring a network device that forwards frames in a home network, the method comprising: obtaining a first certificate from a first device that is to connect to the network device and that holds a first certificate of one of a plurality of types; identifying a first type that is the type of the obtained first certificate; and performing a first configuration process to connect the first device to the network device so that the first device belongs to a first segment that is associated with the identified first type among one or more segments that are one or more forwarding ranges of the frames by the network device, each of the one or more segments being associated with a certificate type.

[0017] According to the above aspect, a network device is connected to the network so that the device belongs to a different segment depending on the type of certificate held by the device. This allows the network device to refuse frame transfer between devices holding different types of certificates, thereby preventing security attacks that may be carried out between devices holding different types of certificates. Therefore, the above setting method can suppress security attacks in a home network.

[0018] (2) The setting method further includes the steps of: acquiring a second certificate from a second device that is to connect to the network device and that holds a second certificate of a type different from the first type among the multiple types; identifying a second type that is the type of the acquired second certificate; and performing a second setting process to connect the second device to the network device so that the second device belongs to a second segment that is associated with the identified second type among the one or more segments and is different from the first segment.

[0019] According to the above aspect, a network device connects a first device holding a first type of certificate and a second device holding a second type of certificate to the network device so that the devices belong to different segments. This allows the network device to reject frame transfers between the first device and the second device, which hold different types of certificates, thereby preventing security attacks that may occur between the first device and the second device, which hold different types of certificates. Therefore, the above setting method can suppress security attacks in a home network.

[0020] (3) The setting method described in (1), wherein obtaining the first type of certificate includes obtaining the first certificate from the first device when request information for an address to be used for communication in the home network is received from the first device, and the first setting process configures the first device to connect to the network device so that the first device belongs to the first segment by sending response information to the first device that assigns an address corresponding to the first segment.

[0021] According to the above aspect, in response to receiving address request information transmitted by a network device when attempting to connect to the network device, the network device can obtain a certificate for the device and configure the network device so that the device belongs to a segment. Therefore, according to the above setting method, by configuring a segment when a device attempts to connect to the network device, security attacks on the home network can be easily suppressed.

[0022] (4) A setting method according to any one of (1) to (3), in which the type of the first certificate is predetermined in accordance with the certificate authority that authenticated the first device.

[0023] According to the above aspect, a network device can determine the segment to which the device belongs based on the certificate authority that authenticated the device. This allows devices authenticated by the same certificate authority to be connected to the network device so that they belong to the same segment. This allows devices authenticated by the same certificate authority to be connected to the network device so that they can communicate, thereby reducing the likelihood of security attacks on devices. Therefore, the above setting method can suppress security attacks in a home network.

[0024] (5) A configuration method described in (4), wherein the first certificate is a certificate that proves that the first device has been authenticated by the certification authority and that includes identification information unique to the first device.

[0025] According to the above aspect, the network device uses a certificate that proves that the device itself is authenticated, and by connecting the device to the network device so that devices authenticated by the same certification authority belong to the same segment, it is possible to more easily reduce the likelihood of security attacks on the device. Therefore, the above setting method makes it easier to suppress security attacks in the home network.

[0026] (6) The setting method described in (4), wherein the first certificate is an authentication made by a service provider that provides a service to the first device as the certification authority, and is a certificate that proves that the first device has been authenticated as a client of the service, and is a certificate that includes identification information unique to the client.

[0027] According to the above aspect, the network device uses a certificate that proves that the device has been authenticated as a client receiving a service, and connects the device to the network so that devices authenticated by the same certification authority belong to the same segment. Therefore, the above setting method makes it easier to reduce the likelihood of security attacks on the device.

[0028] (7) The setting method described in any of (1) to (6) further includes obtaining revocation information indicating that the first certificate obtained from the first device has been revoked, and when the revocation information is obtained, configuring the first device to be excluded from the first segment.

[0029] According to the above aspect, when a certificate held by a network device becomes invalid, the network device excludes the device from the segment to which the device belonged, thereby reducing the likelihood of a security attack on other devices from a device with an invalid certificate. Therefore, according to the above setting method, security attacks on the home network can be suppressed even when a device's certificate becomes invalid.

[0030] (8) A setting method described in (7), in which the type of the first certificate is predetermined corresponding to the certification authority that authenticated the first device, and the revocation information includes identification information unique to the first device and is revocation information indicating that a certificate that proves that the first device has been authenticated by the certification authority has been revoked.

[0031] According to the above aspect, when a certificate that proves that a network device itself is authenticated expires, the network device can exclude the device from the segment, thereby reducing the likelihood of security attacks on other devices. Therefore, according to the above setting method, even when a device's certificate expires, security attacks on the home network can be suppressed.

[0032] (9) The setting method described in (7), wherein the type of the first certificate is predetermined corresponding to the certification authority that authenticated the first device, and the revocation information is revocation information indicating that a certificate that is an authentication made by a service provider that provides a service to the first device as the certification authority and that proves that the first device has been authenticated as a client of the service has expired.

[0033] According to the above aspect, when a certificate that proves that a network device is authenticated as a client receiving a service expires, the network device can exclude the device from the segment, thereby reducing the likelihood of a security attack on other devices. Therefore, according to the above setting method, even when a device's certificate expires, security attacks on the home network can be suppressed.

[0034] (10) The setting method described in any of (1) to (6) further acquires revocation information indicating that the certificate of the certification authority that issued the first certificate acquired from the first device has expired, and when the revocation information is acquired, configures the first device to be excluded from the first segment.

[0035] According to the above aspect, when the certificate authority that issued the certificate held by the network device has expired, the network device excludes the device from the segment to which the device belonged, thereby reducing the likelihood of a security attack on other devices from a device that was certified by the expired certificate authority. Therefore, according to the above setting method, security attacks on the home network can be suppressed even when the certificate of a device has expired.

[0036] (11) The setting method described in any of (1) to (6) further includes a third setting process for identifying that the first device does not hold any of the multiple types of certificates and connecting the first device to the network device so that the first device belongs to a default segment among the one or more segments.

[0037] According to the above aspect, the network device connects a device that does not have a certificate to the network device so that the device belongs to a default segment. This allows the network device to be connected to both a device that has a certificate and a device that does not have a certificate while refusing to transfer frames between the device that has a certificate and the device that does not have a certificate. Therefore, the above setting method can suppress security attacks in the home network.

[0038] (12) A network device that forwards frames in a home network, the network device comprising: an acquisition unit that acquires a first certificate from a first device that is attempting to connect to the network device and that holds a first certificate of one of multiple types; an identification unit that identifies a first type that is the type of the first certificate acquired by the acquisition unit; and a setting unit that executes a first setting process to connect the first device to the network device so that the first device belongs to a first segment that is associated with the first type identified by the identification unit, among one or more segments that are one or more forwarding ranges of the frames by the network device, each of the one or more segments being associated with a certificate type.

[0039] According to the above aspect, the network device achieves the same effects as the above setting method.

[0040] (13) A communication system comprising the network device according to (12) and the first device attempting to connect to the network device.

[0041] According to the above aspect, the communication system has the same effect as the above setting method.

[0042] These comprehensive or specific aspects may be realized as a system, an apparatus, an integrated circuit, a computer program, or a recording medium such as a computer-readable CD-ROM, or may be realized as any combination of a system, an apparatus, an integrated circuit, a computer program, or a recording medium.

[0043] Hereinafter, the embodiments will be specifically described with reference to the drawings.

[0044] The embodiments described below are all comprehensive or specific examples. The numerical values, shapes, materials, components, component placement and connection configurations, steps, and step order shown in the following embodiments are merely examples and are not intended to limit the present invention. Furthermore, among the components in the following embodiments, components that are not described in the independent claims that represent the highest concepts are described as optional components.

[0045] (First Embodiment) In this embodiment, a method for setting up a network device to suppress security attacks in a home network will be described.

[0046] FIG. 1 is a schematic diagram showing the configuration of a communication system 1 according to the present embodiment.

[0047] The communication system 1 shown in FIG. 1 is a communication system in a home network.

[0048] The communication system 1 includes a network device 10, a terminal 20, an air conditioner 30, a television 40, and a refrigerator 50. The terminal 20 corresponds to a device (also simply referred to as a device) connected to the communication system 1. The air conditioner 30, the television 40, and the refrigerator 50 are each a so-called Internet of Things (IoT) home appliance that corresponds to a device (also simply referred to as a device) connected to the communication system 1. Note that the devices connected to the communication system 1 are not limited to the terminal 20, the air conditioner 30, the television 40, and the refrigerator 50, but may be two or more, and may include other devices (for example, communication devices or IoT home appliances).

[0049] The network device 10 is a relay device (generally referred to as a broadband router or a home router) that transfers communication frames (also simply referred to as frames) in a home network. The network device 10 can establish communication links with each device connected to the communication system 1, and can communicate with each device connected to the communication system 1 using the established communication links. The network device 10 is also connected to a network N, and can communicate with a communication device connected at the other end of the network N. The network device 10 transfers frames between devices connected to the network device 10 and the network N, thereby enabling communication between the devices connected to the network device 10 and the communication device connected at the other end of the network N.

[0050] The network N may include an internet service provider's network, a mobile communication system (such as 3G (3rd Generation), 4G (4th Generation), or 5G (5th Generation)), or the internet.

[0051] The terminal 20 is an information processing terminal owned by a user. The terminal 20 may be, for example, a smartphone, a tablet terminal, or a personal computer. The user may be, for example, but is not limited to, a resident of a house having the home network. The terminal 20 may have a certificate that proves that it has been authenticated by a certification authority. The certificate may be a certificate written to a storage device when the terminal 20 is manufactured, or may be a certificate obtained from a server or the like. The terminal 20 may obtain the certificate from a server or the like when it becomes a client of a new service (for example, when a new function is installed in the terminal 20).

[0052] The certificate may be, for example, a node operational credential (NOC) or a device attestation certificate (DAC), which are certificates in the Matter standard, a standard for smart homes. The NOC or DAC may be issued by one or more companies authenticating the device.

[0053] Terminal 20 is connected to be able to communicate with air conditioner 30, television 40, or refrigerator 50 via network device 10. If terminal 20 holds a valid certificate, it is expected that terminal 20 will use communication via network device 10 to control air conditioner 30, television 40, or refrigerator 50, which are IoT home appliances.

[0054] The air conditioner 30 is an air conditioner that adjusts the temperature or humidity of a space. The air conditioner 30 may correspond to a device connected to the network device 10. The air conditioner 30 can change its operating state (on or off) or its operating mode (cooling mode, heating mode, dehumidification mode, etc.) according to control by the terminal 20 via the network device 10, for example.

[0055] The television 40 is a television receiver that displays video content. The television 40 may be a device connected to the network device 10. The television 40 can download and display video content under the control of the terminal 20 via the network device 10, for example.

[0056] Refrigerator 50 is a device that refrigerates food. Refrigerator 50 may be a device connected to network device 10. Refrigerator 50 can share images of the interior of the refrigerator with terminal 20, for example, under the control of terminal 20 via network device 10.

[0057] A device connected to the network device 10 (i.e., the air conditioner 30, the television 40, or the refrigerator 50) may possess a certificate that certifies that it has been authenticated by a certification authority. The certificate is similar to the certificate that the terminal 20 may possess.

[0058] For example, suppose that terminal 20 and air conditioner 30 have certificates of the same type (e.g., type A), and television 40 and refrigerator 50 have certificates of the same type (e.g., type B). In Fig. 1, one or more devices that have certificates of the same type are shown enclosed in dashed lines.

[0059] FIG. 2 is a block diagram showing the configuration of the network device 10 according to this embodiment.

[0060] 2, the network device 10 includes a WAN (Wide Area Network) communication unit 11, a LAN (Local Area Network) communication unit 12, a transfer unit 13, a DHCP (Dynamic Host Configuration Protocol) function unit 14, a DNS (Domain Name System) function unit 15, an acquisition unit 16, a management unit 17, and a setting unit 18. Some or all of the function units included in the network device 10 are realized by a processor (e.g., a CPU (Central Processing Unit)) included in the network device 10 executing a predetermined program using a memory.

[0061] The WAN communication unit 11 is a communication interface connected to the network N. The WAN communication unit 11 is a communication interface for a line (optical fiber, etc.) of an internet service provider's network, a line (3G, 4G, 5G, etc.) of a mobile communication system, etc.

[0062] The LAN communication unit 12 is a communication interface connected to a device. The LAN communication unit 12 may include one or more wired communication interfaces (e.g., Ethernet (registered trademark), etc., the same applies hereinafter), one or more wireless communication interfaces (e.g., Wi-Fi (registered trademark), etc., the same applies hereinafter), or both of the above communication interfaces. The wired communication interface has a physical port to which a communication cable (also simply referred to as a cable) is connected. The wireless communication interface has a communication antenna and a wireless circuit.

[0063] The LAN communication unit 12 transfers frames received from a device connected to the LAN communication unit 12 to another device connected to the LAN communication unit 12 according to the destination of the frame. The LAN communication unit 12 has one or more segments. A segment is the range within which a frame is transferred. That is, the LAN communication unit 12 transfers frames between devices belonging to the same segment. On the other hand, the LAN communication unit 12 may or may not transfer frames between devices belonging to different segments, and controls this using a transfer control table. The setting unit 18 controls which segment a device belongs to. In FIG. 2, two segments are shown as an example of one or more segments.

[0064] Specifically, the segment may be realized by a Virtual Local Area Network (VLAN) or may be realized by a segment in Software Defined Networking (SDN).

[0065] A default segment may be included in the one or more segments of the LAN communication unit 12. The default segment is a segment that is set in the initial state of the network device 10, and may be a segment to which devices that do not have certificates are connected.

[0066] The forwarding unit 13 forwards a frame received by the WAN communication unit 11 from the network N to the LAN communication unit 12 according to the destination of the frame. The forwarding unit 13 also forwards a frame received by the LAN communication unit 12 from a device connected to the LAN communication unit 12 to the WAN communication unit 11 according to the destination of the frame.

[0067] The DHCP function unit 14 dynamically sets network setting information for devices connected to the LAN communication unit 12. Specifically, the DHCP function unit 14 transmits network setting information to be set for devices connected to the LAN communication unit 12, thereby enabling the devices to communicate with the network N via the network device 10. The network setting information can be transmitted by DHCP, for example. Note that instead of the DHCP function unit 14, a dynamic network setting method using another method may be used.

[0068] The DNS function unit 15 provides DNS functions to devices connected to the network device 10. Specifically, in response to a DNS query (i.e., a query for domain name resolution) from a device connected to the LAN communication unit 12, the DNS function unit 15 responds with an IP address corresponding to the domain name. For DNS resolution, the DNS function unit 15 queries a higher-level DNS server, temporarily stores the query results, and can use the stored query results to respond to DNS queries from devices.

[0069] The acquisition unit 16 acquires a certificate held by a device attempting to connect to the LAN communication unit 12 (i.e., a device attempting to connect to a home network) from the device. The certificate held by the device is one of multiple types of certificates. The multiple types of certificates may include, for example, NOCs or DACs issued by one or more companies. The certificate type is predetermined corresponding to the certification authority that authenticated the device. In other words, different certificate types may mean that the certification authorities (which may also be called issuing authorities) that issued the certificates are different.

[0070] The acquisition unit 16 can acquire the certificate by transmitting request information for the certificate to a device attempting to connect to the LAN communication unit 12 and receiving the certificate transmitted by the device in response to the request information. The LAN communication unit 12 can transmit the request information for the certificate when the DHCP function unit 14 receives request information for an IP address, for example.

[0071] The acquisition unit 16 can also acquire revocation information indicating the revocation of a certificate. The revocation information is, for example, a CRL (Certificate Revocation List). The acquisition unit 16 acquires the revocation information of a certificate held by a device from a certificate authority that issued the certificate. The acquisition unit 16 inquires of the certificate authority that issued the certificate held by the device whether or not the certificate has revocation information, and if the certificate has revocation information, acquires the certificate's revocation information in response to the inquiry. The acquisition of the revocation information can be performed using, for example, OCSP (Online Certificate Status Protocol).

[0072] The management unit 17 manages device certificates. Specifically, the management unit 17 identifies the type of the device certificate acquired by the acquisition unit 16 and stores the certificate. Identifying the certificate type includes identifying which of multiple types the certificate type is. The management unit 17 also stores revocation information for the device certificate acquired by the acquisition unit 16. The management unit 17 corresponds to an identification unit that identifies the type of the device certificate acquired by the acquisition unit 16.

[0073] The setting unit 18 performs settings related to the connection of the device to the network device 10. When the acquisition unit 16 acquires a certificate from a device attempting to connect to the LAN communication unit 12, the setting unit 18 executes a setting process (also referred to as a first setting process) for connecting the device to the network device 10 so that the device belongs to a segment associated with the type of the certificate. As the first setting process, the setting unit 18 determines a segment to which the device will belong and transmits response information to the device, assigning an address corresponding to the determined segment. This allows the setting unit 18 to perform settings for connecting the device to the network device 10 so that the device belongs to the first segment.

[0074] The setting unit 18 has a setting table (see FIG. 6, which will be described later) that includes connection information such as an IP address, a subnet mask, and a default gateway for the setting process. The setting unit 18 can execute the setting process by referring to the setting table.

[0075] Specifically, when one device (also referred to as a first device) attempts to connect to the network device 10 (in other words, the LAN communication unit 12), the network device 10 operates as follows.

[0076] That is, the acquisition unit 16 acquires a first certificate from a first device that is attempting to connect to the network device 10 (in other words, the LAN communication unit 12) and that holds a certificate (also called a first certificate) of one type (also called a first type).

[0077] In this case, the management unit 17 identifies the first type, which is the type of the first certificate acquired by the acquisition unit 16.

[0078] Then, the setting unit 18 executes a setting process (also called a first setting process) to connect the first device to the network device 10 so that the first device belongs to a segment (also called a first segment) among one or more segments of the LAN communication unit 12 that is associated with the first type identified by the acquisition unit 16.

[0079] Furthermore, when a first device is connected to the network device 10 (in other words, the LAN communication unit 12), and a device (also referred to as a second device) that holds a certificate (also referred to as a second certificate) of a type (also referred to as a second type) different from the first type attempts to connect to the network device 10, the network device 10 operates as follows.

[0080] That is, the acquisition unit 16 acquires the second certificate from the second device.

[0081] In this case, the management unit 17 identifies the second type, which is the type of the second certificate acquired by the acquisition unit 16 .

[0082] Then, the setting unit 18 executes a setting process (also referred to as a second setting process) for connecting the second device to the network device 10 so that the second device belongs to a second segment associated with the second type identified by the management unit 17, among one or more segments of the LAN communication unit 12. Note that the second segment is different from the first segment.

[0083] In addition, if the management unit 17 determines that the device does not hold any of the multiple types of certificates, the setting unit 18 can execute a setting process (also called a third setting process) to connect the device to the network device 10 so that the device belongs to the default segment.

[0084] Furthermore, when the acquisition unit 16 acquires revocation information of a certificate or a certification authority, the setting unit 18 restricts connections with devices that hold the certificate indicated in the revocation information or the certificate issued by the certification authority indicated in the revocation information. Connection restrictions will be described in detail later.

[0085] FIG. 3 is a block diagram showing the configuration of the terminal 20 according to this embodiment.

[0086] 3, the terminal 20 includes a communication unit 21, an operation unit 22, a display unit 23, a device control unit 24, a key management unit 25, an acquisition unit 26, and a management unit 27. Some or all of the functional units included in the terminal 20 are realized by a processor (e.g., a CPU (Central Processing Unit)) included in the network device 10 executing a predetermined program using a memory.

[0087] The communication unit 21 is a communication interface connected to the LAN communication unit 12 of the network device 10. The communication unit 21 may be a wired communication interface or a wireless communication interface.

[0088] The operation unit 22 accepts user operations. The operations accepted by the operation unit 22 may be, for example, operations on an IoT home appliance such as the air conditioner 30 that is the control target of the terminal 20. The operation unit 22 may be, for example, a touch panel portion of a touch panel display.

[0089] The display unit 23 displays information as an image. The information displayed as an image by the display unit 23 may be, for example, information indicating the operating state of an IoT home appliance such as the air conditioner 30 that is the control target of the terminal 20, or information guiding how to operate the IoT home appliance such as the air conditioner 30. The display unit 23 may be, for example, the display portion of a touch panel display.

[0090] The device control unit 24 executes a process for controlling other devices. The device to be controlled by the device control unit 24 is, for example, an air conditioner 30, and this case will be used as an example in the following description.

[0091] The device control unit 24 receives authentication as a device that controls the air conditioner 30 by transmitting a certificate held by the device to the device authentication unit 34 of the air conditioner 30 to be controlled. The device control unit 24 can then transmit control information for controlling the operation of the air conditioner 30 to the device linkage unit 33. For example, the control information may be control information for switching the operating state of the air conditioner 30 on or off, or for switching the operating mode between cooling mode, heating mode, and dehumidification mode. The control information is set based on a user operation received by the operation unit 22, and transmitted to the air conditioner 30.

[0092] The key management unit 25 holds and manages the key (more specifically, the private key) of the terminal 20. The key of the terminal 20 managed by the key management unit 25 can be used when the terminal 20 and the air conditioner 30 perform encrypted communication.

[0093] The acquisition unit 26 acquires the certificate of its own device, the terminal 20. The acquisition unit 26 can also acquire revocation information of the certificate of its own device, the terminal 20, or revocation information of the certification authority that issued the certificate.

[0094] The management unit 27 manages the certificates acquired by the acquisition unit 26. The management unit 27 can also manage the revocation information acquired by the acquisition unit 26.

[0095] FIG. 4 is a block diagram showing the configuration of the air conditioner 30 according to this embodiment.

[0096] 4, the air conditioner 30 includes a communication unit 31, an air conditioning function unit 32, a device linkage unit 33, a device authentication unit 34, a key management unit 35, an acquisition unit 36, and a management unit 37. Some or all of the functional units included in the air conditioner 30 are realized by a processor (e.g., a CPU (Central Processing Unit)) included in the network device 10 executing a predetermined program using a memory.

[0097] The communication unit 31 is a communication interface connected to the LAN communication unit 12 of the network device 10. The communication unit 31 may be a wired communication interface or a wireless communication interface.

[0098] The air conditioning function unit 32 has a function of adjusting the temperature or humidity of the space in which the air conditioner 30 is installed. The air conditioning function unit 32 draws air from the space in which the air conditioner 30 is installed using a fan or the like, changes the temperature or humidity of the drawn-in air so that it approaches a set temperature or humidity, and discharges the air into the space.

[0099] The device linking unit 33 performs linking processing with other devices (e.g., terminal 20). Specifically, the device linking unit 33 authenticates other devices that attempt to control the air conditioner 30. The device linking unit 33 also receives control information for the air conditioner 30 from other devices authenticated by the device linking unit 33, and controls the operation of the air conditioning function unit 32 in accordance with the received control information. The device linking unit 33 also transmits information related to the air conditioner 30 to other devices. The information related to the air conditioner 30 may include information related to the operation of the air conditioning function unit 32 controlled as described above.

[0100] The device authentication unit 34 acquires a certificate held by another device that is attempting to control the air conditioner 30, and authenticates the other device using the acquired certificate. The certificate may be a certificate that proves that the other device is authenticated as a device that controls the air conditioner 30.

[0101] The key management unit 35 holds and manages the key (more specifically, the private key) of its own device, the air conditioner 30. The key of the air conditioner 30 managed by the key management unit 35 can be used when the air conditioner 30 performs encrypted communication with another device that attempts to control the air conditioner 30.

[0102] The acquisition unit 36 ​​acquires the certificate of its own device, the air conditioner 30. The acquisition unit 36 ​​can also acquire revocation information of the certificate of its own device, the air conditioner 30, or revocation information of the certification authority that issued the certificate.

[0103] The management unit 37 manages the certificates acquired by the acquisition unit 36. The management unit 37 can also manage the revocation information acquired by the acquisition unit 36.

[0104] Television 40 and refrigerator 50 have the same configuration as air conditioner 30. Television 40 has a functional unit that acquires and displays video content instead of air conditioning functional unit 32 of air conditioner 30. Refrigerator 50 has a functional unit that adjusts the temperature inside the refrigerator and controls a camera that captures images of the inside of the refrigerator instead of air conditioning functional unit 32 of air conditioner 30.

[0105] FIG. 5 is an explanatory diagram showing the device certificate 60 in this embodiment.

[0106] The device certificate 60 is an example of a certificate held by a device. The device certificate 60 is a certificate that certifies that the device has been authenticated by a certificate authority and includes identification information unique to the device.

[0107] The device certificate 60 includes a version 61 , an issuer 62 , a validity period start time 63 , a validity period end time 64 , a device ID 65 , and a signature 66 .

[0108] The version 61 is information indicating the version of the device certificate 60 .

[0109] The issuer 62 is identification information indicating the issuer that issued the device certificate 60. The issuer 62 can also be said to be identification information indicating the certificate authority that authenticated the device and issued the device certificate 60.

[0110] The validity period start time 63 is information indicating the start time of the validity period of the device certificate 60 .

[0111] The expiration date 64 of the validity period is information indicating the expiration date of the validity period of the device certificate 60 .

[0112] The device ID 65 is identification information that can uniquely identify a device that is certified to be authenticated by the device certificate 60. The device ID 65 can be, for example, a number that is unique to the device (for example, the serial number or physical address of the device).

[0113] The signature 66 is a digital signature of the issuer (in other words, the certificate authority) that issued the device certificate 60 .

[0114] 6 is an explanatory diagram showing a setting table in this embodiment. The setting table shown in FIG. 6 can be used when the setting unit 18 executes a setting process for connecting a device to the network device 10.

[0115] 6 shows certificate types A and B. It also shows the case where a device does not possess a certificate. Note that the certificate type is predetermined, for example, according to the certificate authority that issued the certificate. Here, as an example, a description will be given assuming that a certificate of type A is issued by certificate authority A, and a certificate of type B is issued by certificate authority B.

[0116] For example, "No certificate" is associated with the default segment, and is associated with the setting information "IP address: 192.168.0.xxx Subnet mask: 255.255.255.0 Default gateway: 192.168.0.1".

[0117] When a device that does not possess a certificate attempts to connect to the network device 10, the setting unit 18 sets the IP address, subnet mask, and default gateway contained in the setting information to the device, thereby allowing the device to connect to the network device 10 so that it belongs to the default segment.

[0118] Also, for example, certificate type A is associated with segment X, and is associated with the setting information "IP address: 192.168.10.xxx Subnet mask: 255.255.255.0 Default gateway: 192.168.10.1".

[0119] When a device holding a type A certificate attempts to connect to the network device 10, the setting unit 18 sets the IP address, subnet mask, and default gateway contained in the setting information to the device, thereby allowing the device to connect to the network device 10 so that it belongs to segment X.

[0120] The processing of the network device 10 having the above configuration will be described.

[0121] 7 is a first flow diagram showing a method for setting up the network device 10 according to the present embodiment. As an example, FIG. 7 shows a method for setting up the network device 10 when a terminal 20 attempts to connect to the network device 10.

[0122] In step S101, the DHCP function unit 14 determines whether or not it has received a request for network settings from the terminal 20 attempting to connect to the network device 10. If it is determined that it has received the request for network settings (Yes in step S101), it proceeds to step S102, and if it has not received the request (No in step S101), it executes step S101 again. In other words, the DHCP function unit 14 waits in step S101 until it receives the request for network settings.

[0123] In step S102 , the acquisition unit 16 transmits certificate request information to the terminal 20 .

[0124] In step S103, the acquisition unit 16 determines whether or not a certificate has been received from the terminal 20. The received certificate may be the certificate sent by the terminal 20 in response to the request information sent in step S102. If it is determined that a certificate has been received (Yes in step S103), the process proceeds to step S104; if not (No in step S103), step S103 is executed again. In other words, the acquisition unit 16 waits in step S103 until a certificate is received. If a certificate has been received, the acquisition unit 16 provides the received certificate to the management unit 17.

[0125] In step S103, the management unit 17 can determine that the terminal 20 does not possess a certificate. Specifically, the management unit 17 may determine whether a predetermined time has elapsed since the request information was transmitted in step S102. This is because if the acquisition unit 16 does not receive a certificate even after a predetermined time has elapsed since the request information was transmitted in step S102, it is highly likely that the terminal 20 does not possess a certificate. In addition, in step S103, the management unit 17 may determine whether the acquisition unit 16 has received information from the terminal 20 indicating that the terminal 20 does not possess a certificate. Even if the acquisition unit 16 has not received a certificate from the terminal 20, the management unit 17 may determine that the terminal 20 does not possess a certificate and proceed to step S104 if it determines that a predetermined time has elapsed since the transmission of the request information or if it determines that the acquisition unit 16 has received information from the terminal 20 indicating that the terminal 20 does not possess a certificate. In this way, the setting unit 18 can perform setting processing for a terminal 20 that does not possess a certificate.

[0126] In step S104, the management unit 17 identifies the type of the certificate received by the acquisition unit 16 in step S103.

[0127] In step S105, the setting unit 18 executes a setting process to connect the terminal 20. The setting process is a setting process to connect the terminal 20 so that the terminal 20 belongs to a segment associated with the certificate type. Details of the setting process are shown in FIG. 8.

[0128] 8 is a second flowchart showing the method for setting the network device 10 according to this embodiment. The process shown in FIG. 8 is a detailed process included in the setting process in step S105.

[0129] In step S201, the setting unit 18 determines whether or not a segment associated with the type of the certificate of the terminal 20 received in step S103 already exists in the LAN communication unit 12. The association between the type of the certificate of the terminal 20 and the segment is shown in a setting table (see FIG. 6 ), and the setting unit 18 can determine the segment to which the terminal 20 should belong by referring to the setting table. If it is determined that the segment already exists in the LAN communication unit 12 (Yes in step S201), the process proceeds to step S203; if not (No in step S201), the process proceeds to step S202.

[0130] If the acquiring unit 16 determines in step S103 that the terminal 20 does not possess a certificate, the terminal 20 is associated with a default segment. In this case, it is determined that a default segment already exists (Yes in step S201), and the process proceeds to step S203.

[0131] In step S202 , the setting unit 18 generates a segment associated with the type of the certificate of the terminal 20 in the LAN communication unit 12 .

[0132] In step S203, the setting unit 18 acquires setting information of the terminal 20. The setting information of the terminal 20 is setting information for connecting the terminal 20 to the network device 10 so that the terminal 20 belongs to a segment associated with the type of the certificate of the terminal 20. At this time, the setting unit 18 uses a setting table (see FIG. 6 ) to acquire setting information associated with the type of the certificate of the terminal 20 as the setting information of the terminal 20.

[0133] In step S204, the setting unit 18 transmits response information including the setting information acquired in step S203 to the terminal 20. It is assumed that the transmitted response information is received by the terminal 20, and the setting information included in the response information is set in the terminal 20.

[0134] In addition, when the terminal 20 is connected to the network device 10 via a cable and a segment for each physical port is used, the setting unit 18 sets the physical port to which the cable is connected to belong to the above-mentioned segment.

[0135] Fig. 9 is a first sequence diagram showing the operation of communication system 1 in this embodiment. The sequence diagram shown in Fig. 9 shows the operation of communication system 1 when terminal 20 connects to network device 10. It is assumed that terminal 20 holds a type A certificate issued by certificate authority A. Note that the same processes as those shown in Figs. 7 and 8 are denoted by the same reference numerals, and detailed description thereof will be omitted.

[0136] In step S301, the terminal 20 transmits a request for network settings to the network device 10. The network device 10 receives the transmitted request for network settings (step S101), and transmits a request for a certificate to the terminal 20 (step S102).

[0137] In step S302, the terminal 20 receives the certificate request information sent from the network device 10.

[0138] In step S303, the terminal 20 transmits a type A certificate to the network device 10 in response to the request information received in step S302. The network device 10 receives the transmitted type A certificate (step S103) and executes a setting process to connect the terminal 20 to the network device 10. In this setting process, the network device 10 executes the setting process so that the terminal 20 belongs to segment X, which is associated with the certificate type A in the setting table (see FIG. 6). The network device 10 also transmits response information to the terminal 20, which includes the setting information associated with the certificate type A in the setting table (see FIG. 6). The terminal 20 sets the setting information included in the transmitted response information in the communication unit 21, thereby becoming communicatively connected to the network device 10.

[0139] FIG. 10 is a second sequence diagram showing the operation of the communication system 1 in this embodiment.

[0140] The sequence diagram shown in Fig. 10 illustrates the operation of the communication system 1 when the air conditioner 30 connects to the network device 10. The air conditioner 30 holds a type A certificate issued by the certificate authority A. Note that the same processes as those shown in Figs. 7 and 8 are denoted by the same reference numerals, and detailed explanations thereof will be omitted.

[0141] The processing executed by the network device 10 is the same as in Fig. 9. The processing executed by the air conditioner 30 (steps S311 to S314) is the same as the processing executed by the terminal 20 in Fig. 9 (steps S301 to S304). As a result, the network device 10 executes a setting process so that the air conditioner 30 belongs to segment X associated with certificate type A, thereby connecting the air conditioner 30 to the network device 10 so that they can communicate with each other.

[0142] Through the above process, the network device 10 is connected to the air conditioner 30 so that the air conditioner 30 belongs to one or more segments associated with the certificate type A.

[0143] As shown in FIG. 1, if terminal 20 and air conditioner 30 have type A certificates and television 40 and refrigerator 50 have type B certificates, network device 10 is connected to terminal 20 and air conditioner 30 so that terminal 20 and air conditioner 30 belong to the same segment (e.g., segment X), and is also connected to television 40 and refrigerator 50 so that television 40 and refrigerator 50 belong to the same segment (e.g., segment Y).

[0144] The following describes frame transfer by the LAN communication unit 12.

[0145] As described above, the LAN communication unit 12 transfers frames between devices belonging to the same segment, but may or may not transfer frames between devices belonging to different segments. The LAN communication unit 12 controls whether or not to transfer frames using a transfer table (described later).

[0146] Here, we will explain the transfer of frames between devices belonging to different segments by the LAN communication unit 12. The permission or denial of frame transfer between devices belonging to different segments by the LAN communication unit 12 can be controlled in accordance with predetermined transfer control information. We will explain a transfer control table, which is an example of transfer control information.

[0147] FIG. 11 is an explanatory diagram showing a transfer control table for controlling frame transfer by the network device 10 in this embodiment.

[0148] The forwarding table shown in FIG. 11 includes entries indicating the source and destination of a frame and whether forwarding of a frame with that source and destination is permitted (marked "OK") or denied (marked "NG").

[0149] For example, the forwarding table may indicate that forwarding of frames between segments other than the default segment (specifically, segments X and Y) is denied, that forwarding of frames from the default segment to segments other than the default segment is denied, and that forwarding of frames from segments other than the default segment is permitted to the default segment.

[0150] Specifically, the forwarding table indicates that forwarding of frames whose source is segment X and whose destination is segment Y is to be denied. It also indicates that forwarding of frames whose source is segment X and whose destination is the default segment is to be permitted. Other frames are also as shown in FIG. 11.

[0151] The entries included in the forwarding table are not limited to those described above, and entries other than those described above may also be included.

[0152] When the LAN communication unit 12 receives a frame and the segment to which the destination of the received frame belongs is different from the segment in which the frame was received, the LAN communication unit 12 can refer to the transfer control table shown in Figure 11 to determine whether to allow the transfer of the frame or to deny the transfer (in other words, not to transfer).

[0153] When the LAN communication unit 12 determines to permit the transfer of a frame, it transfers the frame by sending it to the destination of the frame. On the other hand, when the LAN communication unit 12 determines to deny the transfer of the frame, it does not send the frame (in other words, it prohibits transmission). Note that when the LAN communication unit 12 determines to deny the transfer of the frame, it may send a frame including an error message indicating that the transfer of the frame has been denied to the sender of the frame.

[0154] By controlling the transfer of frames as described above, the LAN communication unit 12 can control whether to permit or deny the transfer of operation instructions between devices connected to the LAN communication unit 12 .

[0155] 12 is a first sequence diagram showing the operation instruction transfer operation of communication system 1 in this embodiment. Fig. 12 shows a case where terminal 20 connected to network device 10 so as to belong to segment X transmits a frame including an operation instruction to air conditioner 30 also connected to network device 10 so as to belong to segment X.

[0156] Specifically, in step S401, the terminal 20 transmits a frame containing an operation instruction addressed to the air conditioner 30. The network device 10 receives the transmitted frame containing the operation instruction.

[0157] In step S402, the network device 10 determines that the frame containing the operation instruction received in step S401 has a source and destination of segment X, and therefore permits the transfer of the frame.

[0158] In step S403, the network device 10 transfers the frame containing the operation instruction received in step S401 by transmitting it to the air conditioner 30. The air conditioner 30 receives the transmitted frame. As a result, the air conditioner 30 can obtain the operation instruction contained in the frame transmitted by the terminal 20 and can operate in accordance with the operation instruction.

[0159] 13 is a second sequence diagram showing the operation instruction transfer operation of communication system 1 in this embodiment. Fig. 13 shows a case where television 40, which is connected to network device 10 so as to belong to segment Y, transmits a frame including an operation instruction to air conditioner 30, which is connected to network device 10 so as to belong to segment X.

[0160] Specifically, in step S411, the television 40 transmits a frame containing an operation instruction addressed to the air conditioner 30. The network device 10 receives the transmitted frame containing the operation instruction.

[0161] In step S412, since the source of the frame containing the operation instruction received in step S411 is segment Y and the destination is segment X, the network device 10 determines to reject the transfer of the frame.

[0162] In step S413, the network device 10 does not transmit the frame containing the operation instruction received in step S411 to the air conditioner 30; in other words, it prohibits transfer. As a result, the air conditioner 30 does not receive the operation instruction transmitted by the television 40 and therefore does not operate in accordance with the operation instruction. In this case, the network device 10 may transmit a frame containing an error message to the television 40, which is the source of the frame containing the operation instruction.

[0163] In this way, the network device 10 can permit frame transfer between devices that hold the same type of certificate, or frame transfer from a device that holds either of the certificates to a device that does not hold a certificate, while prohibiting the transfer of other frames. This allows the network device 10 to suppress security attacks that may be made between devices that hold different types of certificates, while enabling operations between devices that hold the same type of certificate, or operations from a device that holds either of the certificates to a device that does not hold a certificate. In this way, the network device 10 can suppress security attacks in the home network.

[0164] The following describes processing using revocation information.

[0165] As described above, when the acquisition unit 16 acquires revocation information for a certificate or a certification authority, the setting unit 18 restricts connections with devices that hold the certificate indicated in the revocation information or the certificate issued by the certification authority indicated in the revocation information. Restricting device connections involves, for example, setting the device to be excluded from the segment to which the device belonged. More specifically, restricting device connections involves changing connection settings to move the device from the segment to which the device belonged to a default segment. The process of changing the connection settings is described below.

[0166] 14 is a first flow diagram showing the processing performed by the network device 10 according to this embodiment when revocation information is acquired. When the network device 10 acquires a CRL indicating the revocation of a certificate authority, the network device 10 changes the connection settings so that devices holding device certificates issued by the revoked certificate authority belong to the default segment.

[0167] In step S501, the network device 10 obtains a CRL indicating the revocation of the certificate authority.

[0168] In step S502, the setting unit 18 determines whether or not a device holding a device certificate issued by a revoked certificate authority, which is indicated in the CRL acquired in step S501, is connected to the LAN communication unit 12. If it is determined that the device is connected to the LAN communication unit 12 (Yes in step S502), the process proceeds to step S503; if not (No in step S502), the process ends.

[0169] In step S503, the setting unit 18 sets the LAN communication unit 12 so that the device holding the device certificate issued by the revoked certificate authority indicated in the CRL acquired in step S501 belongs to the default segment.

[0170] In step S504, the setting unit 18 determines whether or not any other device belongs to the segment to which the device holding the device certificate issued by the revoked certificate authority indicated in the CRL acquired in step S501 belonged. If it is determined that any other device belongs to the segment (Yes in step S504), the series of processes shown in Fig. 14 ends; if not (No in step S504), the process proceeds to step S505.

[0171] In step S505, the setting unit 18 deletes the segment to which the device holding the device certificate issued by the revoked certificate authority, which is indicated in the CRL acquired in step S501, belonged.

[0172] 15 is a second flowchart showing the processing performed by the network device 10 according to the present embodiment when revocation information is acquired. When the network device 10 acquires a CRL indicating the revocation of a device certificate, the network device 10 changes the connection settings so that the device having the revoked device certificate belongs to the default segment.

[0173] In step S511, the network device 10 obtains a CRL indicating whether the device certificate has been revoked.

[0174] In step S512, the setting unit 18 determines whether or not a device holding an expired device certificate indicated in the CRL acquired in step S511 is connected to the LAN communication unit 12. If it is determined that the device is connected to the LAN communication unit 12 (Yes in step S512), the process proceeds to step S513; otherwise (No in step S512), the process ends the series of processes shown in FIG.

[0175] In step S513, the setting unit 18 sets the device holding the revoked device certificate indicated in the CRL acquired in step S511 to belong to the default segment.

[0176] In step S514, the setting unit 18 determines whether or not any other devices belong to the segment to which the device holding the revoked device certificate indicated in the CRL acquired in step S511 belonged. If it is determined that any other devices belong to the segment (Yes in step S514), the series of processes shown in Fig. 15 is terminated; if not (No in step S514), the process proceeds to step S515.

[0177] In step S515, the setting unit 18 deletes the segment to which the device holding the revoked device certificate, which is indicated in the CRL acquired in step S511, belonged.

[0178] Another example of the setting table will be specifically described below.

[0179] 16 is an explanatory diagram showing another example of a setting table in this embodiment. The setting table shown in FIG. 16 can be used when the setting unit 18 executes a setting process for connecting a device to the network device 10.

[0180] The setting table shown in Fig. 16 is similar to the setting table shown in Fig. 7 except that the setting information includes a VLAN ID. The following describes the differences between the setting table shown in Fig. 16 and the setting table shown in Fig. 7.

[0181] In the setting table shown in FIG. 16, for example, "No certificate" is associated with the default segment, and is associated with the setting information "IP address: 192.168.0.xxx Subnet mask: 255.255.255.0 Default gateway: 192.168.0.1 VLAN: 10."

[0182] When a device that does not possess a certificate attempts to connect to the network device 10, the setting unit 18 sets the IP address, subnet mask, default gateway, and VLAN ID contained in the setting information to the device, thereby allowing the device to connect to the network device 10 so that it belongs to the default segment.

[0183] Also, for example, certificate type A is associated with segment X, and is associated with the setting information "IP address: 192.168.10.xxx Subnet mask: 255.255.255.0 Default gateway: 192.168.10.1 VLAN: 11."

[0184] When a device holding a type A certificate attempts to connect to the network device 10, the setting unit 18 sets the IP address, subnet mask, default gateway, and VLAN ID contained in the setting information to the device, thereby allowing the device to connect to the network device 10 so that it belongs to segment X.

[0185] In this way, the network device 10 can suppress security attacks in a home network.

[0186] Second Embodiment In this embodiment, another configuration example of a network device that suppresses security attacks in a home network will be described. The network device of this embodiment uses a client certificate in addition to a device certificate to set the segment to which the device belongs.

[0187] 17 is an explanatory diagram showing a client certificate 70 in this embodiment. The client certificate 70 is an example of a certificate held by a device. The client certificate 70 is authentication performed by a service provider that provides a service to the device as a certification authority, and is a certificate that proves that the device has been authenticated as a client of the service, and is a certificate that includes identification information unique to the client.

[0188] The client certificate 70 includes a version 71, an issuer 72, a start date and time of validity 73, an end date and time of validity 74, a client ID 75, and a signature 76.

[0189] The version 71 is identification information indicating the version of the client certificate 70 .

[0190] The issuer 72 is information indicating the issuer that issued the client certificate 70. The issuer 72 can also be said to be information indicating the certificate authority that issued the client certificate 70 by authenticating the device.

[0191] The validity period start time 73 is information indicating the start time of the validity period of the client certificate 70 .

[0192] The validity period end date 74 is information indicating the expiration date of the validity period of the client certificate 70 .

[0193] The client ID 75 is identification information that can uniquely identify a device as a client that is certified to be authenticated by the client certificate 70. The client ID 75 can be, for example, a number that is unique to the device (for example, the serial number or physical address of the device).

[0194] The signature 76 is a digital signature of the issuer (in other words, the certificate authority) that issued the client certificate 70 .

[0195] When a device attempts to connect to the network device 10 of this embodiment, the method of setting up the network device 10 is the same as that in the first embodiment.

[0196] The following describes processing using certificate and certificate authority revocation information.

[0197] In this embodiment, the setting unit 18 of the network device 10 restricts the connection of the device by, for example, excluding the device from the segment to which the device belonged. More specifically, restricting the connection of the device may include changing the connection-related settings so as to move the device from the segment to which the device belonged to a default segment, and severing the connection with the device. This will be described in detail below.

[0198] 18 is a first flow diagram showing the processing performed by network device 10 in this embodiment when revocation information is acquired. When network device 10 acquires a CRL indicating the revocation of a certificate authority, if the certificate is a device certificate, network device 10 changes connection settings so that devices holding device certificates issued by the revoked certificate authority belong to the default segment. Furthermore, if the certificate is a client certificate, network device 10 changes connection settings so that devices holding client certificates issued by the revoked certificate authority are disconnected. The processing shown in FIG. 18 may be executed instead of the processing shown in FIG. 14.

[0199] In step S601, the network device 10 obtains a CRL indicating the revocation of the certificate authority.

[0200] In step S602, the setting unit 18 determines whether a device holding a certificate issued by a revoked certificate authority, which is indicated in the CRL acquired in step S601, is connected to the LAN communication unit 12. The certificate may be a device certificate or a client certificate. If it is determined that the device is connected to the LAN communication unit 12 (Yes in step S602), the process proceeds to step S603; if not (No in step S602), the process ends.

[0201] In step S603, the setting unit 18 determines whether the certificate issued by the revoked certificate authority indicated in the CRL acquired in step S601 is a device certificate. If the revoked certificate is a device certificate (Yes in step S603), the process proceeds to step S604. If not (in other words, if the revoked certificate is a client certificate) (No in step S603), the process proceeds to step S611.

[0202] In step S604, the setting unit 18 sets the LAN communication unit 12 so that the device holding the device certificate issued by the revoked certificate authority indicated in the CRL acquired in step S601 belongs to the default segment.

[0203] In step S611, the setting unit 18 sets the LAN communication unit 12 to disconnect the connection of the device that holds the device certificate issued by the revoked certificate authority indicated in the CRL acquired in step S601.

[0204] In step S605, the setting unit 18 determines whether or not any other device belongs to the segment to which the device holding the certificate issued by the revoked certificate authority indicated in the CRL acquired in step S601 belonged. If it is determined that any other device belongs to the segment (Yes in step S605), the series of processes shown in Fig. 18 ends; if not (No in step S605), the process proceeds to step S606.

[0205] In step S606, the setting unit 18 deletes the segment to which the device holding the certificate issued by the revoked certificate authority, which is indicated in the CRL acquired in step S601, belonged.

[0206] 19 is a second flow diagram showing the processing performed by network device 10 in this embodiment when revocation information is acquired. When network device 10 acquires a CRL indicating the revocation of a certificate, if the certificate is a device certificate, network device 10 changes connection settings so that the device holding the revoked device certificate belongs to the default segment. Furthermore, if the certificate is a client certificate, network device 10 changes connection settings so that the connection with the device holding the revoked client certificate is terminated. The processing shown in FIG. 19 may be executed instead of the processing shown in FIG. 15.

[0207] In step S621, the network device 10 obtains a CRL indicating the revocation of the certificate.

[0208] In step S622, the setting unit 18 determines whether or not a device holding a revoked certificate indicated in the CRL acquired in step S621 is connected to the LAN communication unit 12. If it is determined that the device is connected to the LAN communication unit 12 (Yes in step S622), the process proceeds to step S623; otherwise (No in step S622), the process ends.

[0209] In step S623, the setting unit 18 determines whether the revoked certificate indicated in the CRL acquired in step S621 is a device certificate. If the revoked certificate is a device certificate (Yes in step S623), the process proceeds to step S624. If not (in other words, if the revoked certificate is a client certificate) (No in step S623), the process proceeds to step S631.

[0210] In step S624, the setting unit 18 sets the device holding the revoked device certificate indicated in the CRL acquired in step S621 to belong to the default segment.

[0211] In step S631, the setting unit 18 sets the LAN communication unit 12 to disconnect devices that hold certificates issued by revoked certificate authorities indicated in the CRL acquired in step S621.

[0212] In step S625, the setting unit 18 determines whether or not any other devices belong to the segment to which the device holding the revoked certificate, indicated in the CRL acquired in step S621, belonged. If it is determined that any other devices belong to the segment (Yes in step S625), the series of processes shown in Fig. 19 is terminated; otherwise (No in step S625), the process proceeds to step S626.

[0213] In step S626, the setting unit 18 deletes the segment to which the device holding the revoked device certificate, which is indicated in the CRL acquired in step S621, belonged.

[0214] In this way, the network device 10 can suppress security attacks in a home network.

[0215] Third Embodiment In this embodiment, another configuration example of a network device that suppresses security attacks in a home network will be described.

[0216] FIG. 20 is a schematic diagram showing the configuration of a communication system 2 according to this embodiment.

[0217] 20 is a home network, similar to the communication system 1 in FIG. 1, and includes a network device 10, a terminal 20, an air conditioner 30, a television 40, and a refrigerator 50.

[0218] Here, it is assumed that terminal 20 and air conditioner 30 have certificates of type A, terminal 20 and television 40 have certificates of type B, and refrigerator 50 has a certificate of type C. In Fig. 20, one or more devices that have a certificate of the same type are shown enclosed in a dashed frame.

[0219] 21 is an explanatory diagram showing a setting table in this embodiment. The setting table shown in FIG. 21 can be used when the setting unit 18 executes a setting process for connecting a device to the network device 10.

[0220] 21 shows types A, B, and C as certificate types. It also shows the case where a device does not possess a certificate. As in the first embodiment, the certificate type is predetermined corresponding to, for example, the certificate authority that issued the certificate, and certificates of types A, B, and C may have been issued by certificate authorities A, B, and C, respectively. Here, possession of both a certificate of type A and a certificate of type B is treated as possession of a certificate of types AB. Here, type AB is a different type from both type A and type B.

[0221] The certificate type AB is associated with the segment XY, and is associated with the setting information “IP address: 192.168.110.xxx Subnet mask: 255.255.255.0 Default gateway: 192.168.110.1.” The segment XY is different from both the segments X and Y.

[0222] When a device holding a certificate of type AB attempts to connect to the network device 10, the setting unit 18 sets the IP address, subnet mask, and default gateway contained in the setting information to the device, thereby allowing the device to connect to the network device 10 so that it belongs to segment XY.

[0223] FIG. 22 is an explanatory diagram showing a transfer control table for controlling frame transfer by the network device 10 in this embodiment.

[0224] The forwarding table shown in Fig. 22, like Fig. 11, includes entries indicating the source and destination of a frame and whether forwarding of a frame having that source and destination is permitted (indicated as "OK") or denied (indicated as "NG"). Fig. 22 shows the portion of the forwarding table entries relating to segment XY. The forwarding table may further include the entries shown in Fig. 11.

[0225] 22 specifically indicates that forwarding of frames whose source is segment XY and whose destination is segment X, segment Y, or the default segment is permitted, and that forwarding of frames whose source is the default segment and whose destination is segment XY is denied.

[0226] In this way, even when a device holds multiple certificates, the network device 10 can permit frame transfer between devices holding the same type of certificate, or frame transfer from a device holding one of the certificates to a device that does not hold a certificate, while prohibiting the transfer of other frames. This allows the network device 10 to suppress security attacks that may be made between devices holding certificates of different types, while enabling operations between devices holding the same type of certificate, or operations from a device holding one of the certificates to a device that does not hold a certificate. In this way, the network device 10 can suppress security attacks in a home network.

[0227] In each of the above embodiments, each component may be configured with dedicated hardware, or may be realized by executing a software program suitable for each component. Each component may be realized by a program execution unit such as a CPU or processor reading and executing a software program recorded on a recording medium such as a hard disk or semiconductor memory. Here, the software that realizes the network devices and the like in each of the above embodiments is a program such as the following.

[0228] In other words, this program causes a computer to execute a configuration method for a network device that forwards frames in a home network, the configuration method comprising: acquiring a first certificate from a first device that is to connect to the network device and that holds a first certificate of one of a plurality of types; identifying a first type that is the type of the acquired first certificate; and performing a first configuration process to connect the first device to the network device so that the first device belongs to a first segment that is associated with the identified first type among one or more segments that are one or more forwarding ranges of the frames by the network device, each of the one or more segments corresponding to a certificate type.

[0229] While the network devices and the like according to one or more aspects have been described above based on the embodiments, the present invention is not limited to these embodiments. As long as they do not deviate from the spirit of the present invention, various modifications conceivable by those skilled in the art to the present embodiments and configurations constructed by combining components of different embodiments may also be included within the scope of one or more aspects.

[0230] The present invention can be used in network devices that make up a home network.

[0231] 1, 2 Communication system 10 Network device 11 WAN communication unit 12 LAN communication unit 13 Transfer unit 14 DHCP function unit 15 DNS function unit 16, 26, 36 Acquisition unit 17, 27, 37 Management unit 18 Setting unit 20 Terminal 21, 31 Communication unit 22 Operation unit 23 Display unit 24 Device control unit 25, 35 Key management unit 30 Air conditioner 32 Air conditioning function unit 33 Device linkage unit 34 Device authentication unit 40 Television 50 Refrigerator 60 Device certificate 61, 71 Version 62, 72 Issuer 63, 73 Start time of validity period 64, 74 End time of validity period 65 Device ID 66, 76 Signature 70 Client certificate 75 Client ID N Network

Claims

1. A configuration method for a network device that forwards frames in a home network, comprising the steps of: acquiring a first certificate from a first device that wishes to connect to the network device, the first device holding a first certificate of one of a plurality of types; identifying a first type which is a type of the acquired first certificate; and executing a first configuration process for connecting the first device to the network device so that the first device belongs to a first segment associated with the identified first type among one or more segments which are one or more forwarding ranges of the frames by the network device, each of the one or more segments corresponding to a certificate type.

2. The setting method according to claim 1, further comprising the steps of: acquiring a second certificate from a second device which is to be connected to the network device and which holds a second certificate of a type different from the first type among the plurality of types; identifying a second type which is the type of the acquired second certificate; and executing a second setting process which connects the second device to the network device so that the second device belongs to a second segment which is associated with the identified second type among the one or more segments and which is different from the first segment.

3. The setting method according to claim 1, wherein obtaining the first type of certificate includes obtaining the first certificate from the first device when request information for an address to be used for communication in the home network is received from the first device, and the first setting process includes transmitting response information to the first device that assigns an address corresponding to the first segment, thereby setting the first device to be connected to the network device so that the first device belongs to the first segment.

4. The setting method according to claim 1, wherein the type of the first certificate is predetermined in accordance with the certificate authority that authenticated the first device.

5. The setting method according to claim 4, wherein the first certificate is a certificate that proves that the first device has been authenticated by the certification authority and that contains identification information unique to the first device.

6. The setting method described in claim 4, wherein the first certificate is an authentication made by a service provider providing a service to the first device as the certification authority, a certificate proving that the first device has been authenticated as a client of the service, and a certificate including identification information unique to the client.

7. The setting method according to any one of claims 1 to 6, further comprising: acquiring revocation information indicating that the first certificate acquired from the first device has been revoked; and, when the revocation information is acquired, configuring the first device to be excluded from the first segment.

8. The setting method described in claim 7, wherein the type of the first certificate is predetermined corresponding to a certification authority that has authenticated the first device, and the revocation information is revocation information indicating that a certificate that includes identification information unique to the first device and certifies that the first device has been authenticated by the certification authority has been revoked.

9. The setting method according to claim 7, wherein the type of the first certificate is predetermined corresponding to a certification authority that has authenticated the first device, and the revocation information is revocation information indicating that a certificate that proves that the first device has been authenticated as a client of the service has expired, the authentication being made by a service provider that provides a service to the first device as the certification authority.

10. The setting method according to any one of claims 1 to 6, further comprising: acquiring revocation information indicating that a certificate of a certification authority that issued the first certificate acquired from the first device has expired; and, when the revocation information is acquired, configuring the first device to be excluded from the first segment.

11. The setting method according to any one of claims 1 to 6, further comprising: determining that the first device does not hold any of the plurality of types of certificates; and executing a third setting process for connecting the first device to the network device so that the first device belongs to a default segment among the one or more segments.

12. A network device that transfers frames in a home network, comprising: an acquisition unit that acquires a first certificate from a first device that wishes to connect to the network device, the first certificate being one of a plurality of types; an identification unit that identifies a first type that is the type of the first certificate acquired by the acquisition unit; and a setting unit that executes a first setting process to connect the first device to the network device so that the first device belongs to a first segment associated with the first type identified by the identification unit, among one or more segments that are one or more forwarding ranges of the frames by the network device, each of the one or more segments corresponding to a certificate type.

13. A communication system comprising: a network device according to claim 12; and a first device which is to connect to said network device.

Images