JP2006050114A - Access control method to in-home network - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an access control method for attaining temporary access to an in-home network such as a household electric appliance network while protecting privacy and security or the like of a personal life. <P>SOLUTION: The access control method controls accesses of a plurality of IP phone terminals to the in-home network via an IP network and sets at least one of the IP phone terminals as a permission terminal for permitting the access to the in-home network. The permission terminal acquires terminal information for identifying an opposite IP phone terminal between IP phone communications and sets a designated IP phone terminal as a proxy terminal in accordance with the entry of designating at least one of the opposite IP phone terminals. When an access request is received from one of the IP phone terminals and the terminal is determined to be the proxy terminal, an access of the terminal to the in-home network is permitted. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention allows home access such as a home appliance network constituted by home appliances provided in the home or the like to permit access from the outside so that the home appliance can be operated from the outside. The present invention relates to an access control method for controlling access to a network.

  2. Description of the Related Art In recent years, a system has been realized in which home appliances are connected via a network and these home appliances can be operated remotely such as when away from home. The system disclosed in Patent Document 1 entitled “Remote Control Device” shows a configuration in which a state of a home device can be confirmed remotely and a user can be notified of a state change event. In addition, the system disclosed in Patent Document 2 entitled “Browser-based improved home network command and control” shows a configuration in which home devices can be controlled by a Web interface.

  In areas related to personal life such as home appliance networks in the home, it is natural that appropriate security must be prepared in preparation for unauthorized intrusion by a third party. Therefore, it is considered to install a GW server that prevents unauthorized access by requesting input of a login password or the like at an access node of such a network.

The convenience of being able to remotely access such a network in the home is not limited to simply accessing the network by a householder such as a householder or family member. For example, there is a request that a general contractor who performs maintenance, inspection, and repair of home appliances connected to a home appliance network from a remote location should temporarily access the network. It is also assumed that a remote child who does not live together wants to temporarily access the network for parental care.
JP 2001-326980 A Japanese translation of PCT publication No. 2002-509628

  However, authentication methods using login passwords, etc. require prior registration procedures and are cumbersome for temporary access, and if such registration is performed, there are no contractors who have completed operations such as maintenance or those who no longer need care. Thereafter, the network can be continuously accessed, and there is a possibility that protection of personal life such as privacy may not be sufficiently secured.

  The present invention has been made in view of such problems, and its purpose is to enable temporary access to a home network such as a home appliance network while protecting personal life such as privacy and security. It is to provide a control method.

  An access control method according to the present invention is an access control method for controlling access of a plurality of IP telephone terminals via an IP network to a home network, and at least one of the IP telephone terminals is transferred to the home network. A permitted terminal setting step for setting the permitted terminal as a permitted terminal for permitting access, and terminal information for identifying the partner IP telephone terminal during each IP telephone communication is acquired in the permitted terminal, and at least one of the partner IP telephone terminals is acquired. A proxy terminal setting step for setting the IP telephone terminal as a proxy terminal in response to an input for designating, and when there is an access request from any one of the IP telephone terminals, the one terminal is determined to be a proxy terminal A proxy terminal access permission step for permitting the one terminal to access the home network. And butterflies.

  According to the access control method of the present invention, there is provided an access control method for temporarily allowing access to a home network by using an IP telephone terminal of a specific partner who has made a call with an IP telephone terminal as its proxy terminal. Thus, while protecting personal life such as privacy and security, the proxy terminal can be temporarily accessed to a home network such as a home appliance network, and the convenience can be effectively exhibited.

Embodiments of the present invention will be described in detail with reference to the accompanying drawings.
<First embodiment>
FIG. 1 shows a first embodiment of the present invention, and shows an overall configuration including a SIP phone and a home network. Two SIP phones 10 a and 10 b that are IP telephone terminals are connected via a public SIP telephone network 20 and an IP network 21. The public SIP telephone network 20 and the IP network 21 are further connected to the home appliance network 30. As one operation mode in such a configuration, one user A uses the telephone using the SIP phone 10a, one home appliance repair company B uses the SIP phone 10b, and the home appliance network 30 is used. It is assumed that this is a home network in person A's private residence. The public SIP telephone network 20 is a network that provides an IP telephone service to general users including the user A and the home appliance repair company B by the SIP (Session Initiation Protocol, RFC3261) protocol. The IP network 21 is a data network that can be used by general users, such as the Internet. In this embodiment, the public SIP telephone network 20 and the IP network 21 are shown as different networks, but may be realized by one IP network.

  Each of the SIP phones 10a and 10b is a telephone terminal capable of making a telephone call by the SIP protocol, and may be in the form of a home PC or an IP telephone dedicated terminal, for example. In this figure, the internal functional configuration of the SIP phone 10a is shown in detail, but the SIP phone 10b also has the same functional configuration. The SIP phone 10a will be described as an example. The SIP phone 10a includes a SIP phone terminal unit 101, an access permission setting unit 102, a home appliance remote operation unit 103, and a home appliance GW cooperation unit 104.

  The SIP telephone terminal unit 101 has a function of performing IP telephone communication using another SIP phone such as the SIP phone 10b using the SIP protocol. The access permission setting unit 102 has a function of making a setting for enabling access to the home appliance network 30 for the other party who is currently talking based on an instruction input from the user. A function is provided that allows the home appliance GW 31 to make settings for permitting access to the home appliance network 30 of the other party currently in a call, by specifying setting information for identifying the other party who is currently calling through the unit 104 and giving permission. It should be noted that the user's instruction input means for permitting access may be any means that reflects the user's will, and is any means of button input, voice input by a specific keyword, and event detection by conversation voice recognition processing. good. The home appliance GW cooperation unit 104 transmits a setting information from the access permission setting unit 102 to the home appliance GW 31 and an instruction command for home appliance remote operation from the home appliance remote operation unit 103 to the home appliance GW 31 and the instruction command A response message to the home appliance remote control unit 103. The home appliance remote control unit 103 has a function of accessing each of the home appliances 32 and 33 in the home appliance network 30 via the home appliance GW cooperation unit 104 and the home appliance GW31. As an access means to each of the home appliances 32 and 33, for example, any means of input of a button provided in the SIP phone 10b, voice input by a specific keyword, or event detection by conversation voice recognition processing can be used. In addition, when the SIP phone 10b is realized by a normal PC, it is realized by an execution function corresponding to the access means provided by the home appliance device 32 or 33 included in the home appliance network 30, for example, Java (registered trademark) or the like. In the case of a dedicated application, the execution function may be provided, and in the case of a Web interface, a Web browser function may be provided.

  The home appliance network 30 is a home network and includes a home appliance GW 31, a home appliance device 32, and a home appliance device 33, which are connected by a LAN 39. Each of the home appliance device 32 and the home appliance device 33 is, for example, a device in which a network communication function is added to a normal home appliance. As an operation mode of the present embodiment, each of the home appliance device 32 and the home appliance device 33 may be a TV recording device or a refrigerator, for example. In the present embodiment, the SIP phone 10a is a permitted terminal that is authenticated for access to the home appliance network 30 based on identification information such as its IP address.

  The home appliance GW 31 has a gateway function for connecting the home appliance network 30 which is a local network and the external IP network 21, and a firewall function for authenticating access from the user himself and preventing unauthorized access by others. Have In the present embodiment, in particular, the home appliance GW 31 further includes an access control table 311. The access control table 311 is provided for performing access control that allows other terminals other than the user designated by the appropriate user to temporarily access the home appliance network 30. An operation interface for a client such as the SIP phone 10a or 10b can be realized by using a dedicated application or web interface software that can be implemented in a language such as Java (registered trademark), for example.

  FIG. 2 shows a setting example of the access control table shown in FIG. Here, the access control table 311 as an example includes “permission serial number”, “proxy terminal identification information”, “personal terminal identification information”, “access permission level” for each partner terminal to which access permission is given. Is included.

  The “permitted serial number” is a serial number assigned to each partner terminal to which access permission is granted, and is set as “0001 to 0004”. “Proxy terminal identification information” is terminal information for identifying a terminal to which access permission is given by the access control method according to the present invention. In this embodiment, it is identification information of the SIP phone 10b (see FIG. 1). The identification information is the IP address of the terminal and is set as “aaa.aaa.aaa.bbb”, for example, or a telephone number which is identification information as the IP phone of the terminal, for example “sip: + 81-1- “2345-6789@xxxx.co.jp” may be set. “Principal terminal identification information” is terminal information for identifying a terminal as a subject to which access is granted by the access control method according to the present invention. In this embodiment, it is identification information of the SIP phone 10a (see FIG. 1). As the identification information, a telephone number which is preferably identification information as an IP phone of the terminal, for example, “sip: +81-9-8765-4321@xxxx.co.jp” may be set. The identification information may be the IP address of the terminal, but is not preferable when the IP address may be changed dynamically. The “access permission level” sets how much access is permitted to the home appliance device 32 or 33 actually connected to the home appliance network 30 by the “permitted terminal”. For example, it may be possible to set a plurality of types of access levels such as whether to read only internal information of the home appliance device 32 or 33, or whether internal information is allowed to be rewritten and writable. Can be.

  Further, the access control table 311 may be configured such that the access permission expiration date can be set, for example, by specifying the elapsed time or date from the present time. Thereby, the access permission can be changed according to the passage of time.

  FIG. 3 shows a processing procedure for executing the access control method executed in the configuration shown in FIG. As a premise, a SIP phone 10b to be used as a proxy terminal by a user who has a SIP phone 10a who has access permission to the home appliance network 30 (see FIG. 1) in advance for repairing home appliances connected to the home appliance network 30. The operation of the present embodiment will be described by taking a case where a call is made with an external repair shop having

  First, the SIP phone 10a provides a SIP telephone call to the user (step S01), and the SIP phone 10b connected thereto provides the SIP telephone call to the repairer in response (step S02). Assuming an assumed scene, it is assumed that the user requests a repair request from a remote repairer via a network by negotiation with the repair service. Therefore, the user operates the SIP phone 10a to perform an instruction operation for permitting access to the home appliance network 30 by the repairer, that is, the operator of the SIP phone 10b. The instruction operation is generated in accordance with, for example, an operation such as pressing down an operation button of the SIP phone 10a by the user.

  In response to this permission instruction, the SIP phone 10a notifies the identification information using the partner terminal as a proxy terminal (step S03). Here, the identification information is information for specifying a terminal such as the IP address of the SIP phone 10b that is currently talking. In response to the notification of the identification information, the home appliance GW31 of the home appliance network 30 sets the identification information in the access control table 311 (step S04). In the setting of the access control table 311, “personal terminal identification information” for specifying the SIP 10 a owned by the user himself / herself and “proxy terminal identification information” for specifying the SIP 10 b are set. At this time, additional information such as “access permission level” can be set.

  At this point, the repairer receives a telephone call from the user and knows that he can access the home appliance network 30 on the user side. The means for notifying that access is possible may be based on conversation, or realized by a method of reflecting the notification from the home appliance GW linkage unit 104 of the SIP phone 10a to the home appliance remote control unit 103 of the SIP phone 10b on a screen or a buzzer. Also good. Therefore, the repair shop operates the access request to the home appliance network 30 for the SIP phone 10b. In response to the access request, the SIP phone 10b issues an access request as a proxy terminal to the home appliance GW31 of the home appliance network 30 (step S05). This access request is accepted by the home appliance remote control unit 103 of the SIP phone 10b and transmitted to the home appliance GW31 via the home appliance GW linkage unit 104.

  In response to the access request, the home appliance GW31 performs access authentication for the access request from the SIP phone 10b (step S06). As the access authentication, the home appliance GW 31 performs authentication by referring to the contents of the access control table 311 and recognizing the access permission of the SIP 10b from the “proxy terminal identification information” that identifies the SIP 10b.

  Based on this authentication, the SIP phone 10b accesses the home appliance network 30 using the home appliance GW31 as an access node (step S07). With this access, an operator of the SIP phone 10b, that is, a repairer, accesses the refrigerator 33 included in the home appliance network 30, grasps the failure state, confirms a part that needs to be replaced, and remotely if possible. Perform repairs.

  Next, the SIP phone 10b notifies the end of access to the SIP phone 10a (step S08). In response to the access end notification, the SIP phone 10a preferably sends a proxy terminal release notification to the home appliance GW31 after inquiring the user's judgment (step S09). In response to the cancellation notification, the home appliance GW31 cancels the previous access permission by deleting the identification information of the terminal, that is, the SIP phone 10b, from the access control table 311 (step S10). Thereafter, the home appliance network 30 can no longer be accessed from the SIP phone 10b.

  As described above, according to the access control method of the present invention, in the remote control service for home appliances, the home appliance owner does not need to perform operations such as user registration change, and can easily access only those who need it when necessary. Can be allowed. In addition, because the owner of the home appliance can determine whether or not it is necessary based on the situation at that time, the solution to the problem of excessive privacy infringement that can be considered with conventional remote control services for home appliances. it can.

As a modification, the SIP phone 10a may be realized by a mobile phone. In this case, even if the user is out of the office, the mobile phone can make a remote maintenance request for home appliances with the user's flexible judgment. In addition, the home appliance network 30 is not limited to a LAN, and may be a sensor network and provide a control and / or management function by the home appliance GW 31.
<Second embodiment>
FIG. 4 shows a second embodiment of the present invention, and shows the entire configuration including a SIP phone and a home network. In the second embodiment, access authentication is performed in the user's SIP phone 10a, and access to the home appliance network 30 from the other party's SIP phone 10b such as a repairer is made via a direct route as in the first embodiment. Unlike the case where it is performed, a configuration is illustrated that is performed via an indirect route via the user's SIP phone 10a.

  Two SIP phones 10 a and 10 b are connected via a public SIP telephone network 20 and an IP network 21. The public SIP telephone network 20 and the IP network 21 are further connected to the home appliance network 30. Each of the SIP phones 10a and 10b is a telephone terminal capable of making a telephone call according to the SIP protocol, and has the same function. The SIP phone 10a will be described as an example. The SIP phone 10a has the same functions as in the first embodiment, and includes a SIP phone terminal unit 101, an access permission setting unit 102, a home appliance remote control unit 103, and a home appliance GW. A linkage unit 104. The SIP phone 10a further includes a relay unit 105 connected to the home appliance GW cooperation unit 104. The relay unit 105 has a function of relaying access to the home appliance network 30 from an external SIP terminal, for example, the SIP phone 10b, and prevents unauthorized access by authenticating a counterpart terminal such as a repair company. it can.

  The home appliance network 30 is a home network and includes a home appliance GW 31, a home appliance device 32, and a home appliance device 33, which are connected by a LAN 39. The home appliance GW 31 has a gateway function that connects the home appliance network 30 that is a local network and the external IP network 21, and also has a firewall function that prevents unauthorized access from the outside. In the second embodiment, the home appliance GW 31 does not include the access permission table as in the first embodiment, and is configured to permit access only by appropriate users of the home appliance network 30.

  In the second embodiment described above, a terminal that makes temporary access, such as a repair company, is based on the user's authentication qualification via an indirect route via the user's terminal, that is, the SIP phone 10a. Can be accessed. Therefore, it is not necessary to provide the home appliance GW 31 with a special configuration that enables such temporary access. Therefore, the effect obtained by the first embodiment can be realized only by changing the configuration on the terminal side such as the SIP phone 10a or 10b on the basis of the existing home appliance network 30.

  As is clear from the above description of the plurality of embodiments, the access control method according to the present invention registers a user with the home appliance GW for temporary access from a repairer, maintenance staff, or a relative who does not live together. Without any further access, this can be prohibited as soon as it is no longer necessary. This is realized by using a method of temporarily allowing access to the home network by using the IP telephone terminal of a specific partner who has made a call with the IP telephone terminal as its proxy terminal. Thereby, the balance with the protection of the privacy of a personal life can be aimed at. In other words, the owner of the home appliance can easily grant access only to those who need it when necessary, and the process of negotiation with the other party who wants to allow access to determine whether or not permission is required Can be done.

  In addition, as a configuration for permitting access to the temporary proxy terminal, not only the method of acquiring the IP address of the partner terminal during the IP phone call, but as a modification, the partner is specified by the public key certificate of the partner terminal. You may implement the method to do. As a further modification, a configuration is also possible in which temporary authentication information such as the ID or encryption key of the counterpart terminal is generated to allow temporary access to the counterpart terminal. Moreover, you may implement | achieve this structure combining these several forms.

  The access control method according to the present invention is not limited to a home appliance network in which home appliances installed in a home are connected by means such as a LAN, and can be applied to a home network such as a normal personal computer network.

BRIEF DESCRIPTION OF THE DRAWINGS It is a block diagram which shows the 1st Example of this invention and shows the whole structure containing a SIP phone and a home network. It is explanatory drawing which shows the example of a setting of the access control table shown by FIG. It is a sequence diagram which shows the process sequence which performs the access control method performed in the structure shown by FIG. It is a block diagram which shows the 2nd Example of this invention and shows the whole structure containing a SIP phone and a home network.

Explanation of symbols

10a, 10b SIP phone 20 Public SIP telephone network 21 IP network 30 Home appliance network 31 Home appliance gateway (GW)
32, 33 Home appliances 39 LAN
DESCRIPTION OF SYMBOLS 101 SIP telephone terminal part 102 Access permission setting part 103 Home appliance remote control part 104 Home appliance gateway (GW) cooperation part 105 Relay part 311 Access control table

Claims (6)

An access control method for controlling access of a plurality of IP telephone terminals via an IP network to a home network,
A permission terminal setting step of setting at least one of the IP telephone terminals as a permission terminal that permits access to the home network;
In the permitted terminal, terminal information for identifying the other party IP telephone terminal is acquired during each IP telephone communication, and the IP telephone terminal is made a proxy terminal in response to an input designating at least one of the other party IP telephone terminals. Proxy terminal setting step to be set,
Proxy terminal access permission step for permitting access of the one terminal to the home network when it is determined that the one terminal is a proxy terminal when there is an access request from any one of the IP telephone terminals When,
An access control method comprising:   The said permission terminal further includes the step which cancels | releases the setting which makes this one terminal a proxy terminal according to the input which instruct | indicates cancellation of the setting with respect to one terminal of the said proxy terminals. The access control method according to 1.   3. The proxy terminal setting step is a step of acquiring at least one of an IP address, an IP telephone number, and a public key certificate of the other terminal as the terminal information. Access control method.   3. The access control method according to claim 1, wherein the proxy terminal access permission step is a step of permitting access through the direct route between the proxy terminal and the home network.   The access control method according to claim 1, wherein the proxy terminal access permission step is a step of permitting access through an indirect route from the proxy terminal to the home network via the permitted terminal. .   The access control method according to claim 1, wherein the home network includes at least one home appliance having a network communication function.

Images