JP2006042208A - COMMUNICATION DEVICE AND COMMUNICATION SYSTEM HAVING AUTHENTICATION FUNCTION - Google Patents

Abstract

PROBLEM TO BE SOLVED: To integrate information necessary for authentication of common information without introducing a dedicated device such as an authentication server when integrating two independent networks in which an authentication relationship has already been established between communication devices. Provide a communication device that automatically configures settings.
One representative device is arbitrarily selected from each of first and second networks, and new common information is set. The representative devices of both networks exchange common information used between communication devices that have already established an authentication relationship in each network. The representative devices of both networks distribute the common information exchanged with the partner representative device to the communication devices constituting each network.
[Selection] Figure 5

Description

  The present invention relates to a communication device and a communication system having an authentication function, and more specifically, when integrating two independent networks composed of a plurality of communication devices having an authentication relationship with each other. The present invention relates to a communication device that newly establishes an authentication relationship, a communication device that automatically exchanges information necessary for authentication, and a communication system that includes a plurality of communication devices.

  In recent years, the IP (Internet Protocol) network centering on the Internet has rapidly expanded, and various home appliances such as AV devices, surveillance cameras, and IP telephones tend to be connected to the IP network in addition to PCs. In addition, there is an increasing momentum for providing communication services between home appliances by setting up an IP network in the home. However, with the expansion of these networks, threats such as unauthorized intrusion due to impersonation and the like are also increasing. Therefore, when communicating between home appliances via an IP network, it is necessary to deal with threats such as unauthorized intrusion.

  As one of security technologies for protecting a network from these threats, device authentication for confirming that a communication partner device is a valid device is used. Device authentication is often performed by devices that communicate with each other to confirm the presence of common information known only by the devices (hereinafter referred to as common information). For a network consisting of multiple communication devices, when two independent networks that have already established an authentication relationship using device authentication between each communication device are integrated into one network, a new authentication relationship will be created at the time of integration. It is necessary to secretly set common information between established communication devices. Conventionally, such common information is manually input by the user for each communication device, which complicates the work during network integration. In particular, when the number of communication devices is large, the work of setting common information has become more complicated.

  As a system for setting common information without manual input at the time of network integration, a system in which authentication servers included in each network exchange common information (secret key) has been disclosed (for example, Patent Literature) 1). FIG. 24 is a diagram illustrating an example of an authentication system in which secret keys are exchanged between conventional authentication servers. In FIG. 24, an authentication server 1007 and an authentication server 1008 are connected to each other to form one network, and jointly manage the secret keys of the communication devices 1001 to 1004. Assume that an authentication server 1009 (network of the authentication server 1009) that manages the secret keys of the communication device 1005 and the communication device 1006 is newly connected (integrated) to this network.

In this case, the authentication server 1007 or the authentication server 1008 detects the connection of the new authentication server 1009 and notifies the authentication server 1009 of its own address. The authentication server 1009 stores the notified address as the address of the authentication server that cooperates with each other. Through this work, the authentication server 1009 becomes a member of an authentication server group that performs authentication in cooperation with each other in the integrated network. Thereafter, the authentication servers 1007 to 1009 exchange secret keys between the authentication servers so that the secret keys of the authentication servers have the same contents. That is, the authentication servers 1007 to 1009 store the secret keys of all the communication devices (in this example, the communication devices 1001 to 1006) belonging to the network after integration. Thereby, for example, the communication device 1006 connected to the authentication server 1009 can perform authentication using the secret key with the communication device 1002 connected to the authentication server 1007.
JP 2003-337801 A

  However, in the conventional authentication system, an authentication server that manages the secret key of the communication device to which it belongs must be installed on the network, and the cost of installing the authentication server, specialized knowledge to manage the authentication server, etc. is required. Therefore, the conventional authentication system is not suitable for introduction into a relatively small network such as a home network.

  Therefore, an object of the present invention is to automatically set the information necessary for authentication such as common information without introducing a dedicated device such as an authentication server when integrating networks, and It is providing the communication system comprised from a communication apparatus.

  The present invention is directed to a communication device that newly establishes an authentication relationship with another communication device that constitutes a counterpart network by network integration. And in order to achieve the said objective, the communication apparatus of this invention is provided with a memory | storage part, a setting part, a transmission part, a receiving part, and a control part. The storage unit stores common information necessary for authentication with other communication devices having an authentication relationship on the own network and device-specific identification information in association with each other. New common information necessary for authentication with the representative device of the partner network is input to the setting unit. The transmission unit transmits the common information and identification information stored in the storage unit to the representative device. The receiving unit receives, from the representative device, common information necessary for authentication with other communication devices constituting the counterpart network and device-specific identification information corresponding to the common information. The control unit stores the new common information and the common information and identification information received by the reception unit in the storage unit and transmits them to other communication devices that constitute the network.

  Further, the common information stored in the storage unit includes request common information used when requesting authentication from another communication device and confirmation common information used when confirming an authentication request from another communication device. Also good.

  Preferably, the storage unit has an area for storing a new flag corresponding to the common information. The control unit can set a new flag when storing the new common information and the common information and identification information received by the receiving unit in the storage unit.

  In addition, an instruction to divide the network may be input to the setting unit. In that case, the control unit deletes, from the storage unit, the common information and the identification information for which the new flag is set for other communication devices configuring the network in response to the network division instruction received via the setting unit. And deletes the common information and the identification information for which the new flag is set from its own storage unit.

  Preferably, when the control unit receives an instruction to divide the network via the receiving unit, the control unit deletes the common information and the identification information for which the new flag is set from the storage unit.

  Each process performed by the storage unit, the setting unit, the transmission unit, the reception unit, and the control unit of the communication device described above is a method for newly establishing an authentication relationship with another communication device that constitutes a counterpart network that provides a series of processing procedures. Can also be understood. That is, new common information necessary for authentication with the representative device of the partner network is input, and common information necessary for authentication with other communication devices constituting the own network stored in advance and device-specific identification information To the representative device, received from the representative device common information necessary for authentication with other communication devices that make up the partner network, and device-specific identification information corresponding to the common information, and received new common information and In this method, the common information and the identification information are stored, and the new common information and the received common information and the identification information are transmitted to other communication devices constituting the local network.

  Preferably, a method for newly establishing an authentication relationship with another communication device constituting the partner network is provided in the form of a program for causing the communication device to execute a series of processing procedures. This program may be stored in a computer-readable storage medium.

  The present invention is also directed to a communication system in which an authentication relationship is newly established with another communication device constituting the partner network by integrating the own network composed of a plurality of communication devices and the partner network. In order to achieve the above object, a communication system according to the present invention includes a main device that is one of a plurality of communication devices constituting the own network, and a sub device that is a communication device other than the main device constituting the own network. It is composed of

  The main device includes a first storage unit, a setting unit, a transmission unit, a first reception unit, and a first control unit. The first storage unit stores common information necessary for authentication with other communication devices having an authentication relationship on the own network and device-specific identification information in association with each other. New common information necessary for authentication with the representative device of the partner network is input to the setting unit. The transmission unit transmits the common information and identification information stored in the first storage unit to the representative device. The first receiving unit receives, from the representative device, common information necessary for authentication with other communication devices constituting the partner network and device-specific identification information corresponding to the common information. The first control unit stores the new common information and the common information and identification information received by the first receiving unit in the first storage unit and transmits them to other communication devices constituting the own network. To do.

  The sub device includes a second storage unit, a second reception unit, and a second control unit. The second storage unit stores common information necessary for authentication with other communication devices having an authentication relationship on the own network and device-specific identification information in association with each other. The second receiving unit receives information transmitted by the first control unit. The second control unit stores information received by the second receiving unit in the second storage unit.

  As described above, according to the present invention, it is possible to automatically set information (common information) necessary for establishing a new authentication relationship with a communication device belonging to a partner network at the time of network integration. it can. Therefore, it is possible to establish a new authentication relationship with a communication device belonging to the partner network without manually setting common information or introducing a dedicated device such as an authentication server in the integrated network. . Further, by making the common information used when requesting authentication different from the common information used when confirming authentication, it is possible to perform device authentication with higher safety.

  Before describing the communication device provided by the present invention, a network configuration to which the communication device of the present invention is applied will be described first. FIG. 1 is a diagram illustrating a network configuration to which a communication device of the present invention is applied. In FIG. 1, the first network includes a plurality of communication devices 11 to 1M connected to the network. The second network includes a plurality of communication devices 21 to 2N connected to the network. However, M and N are arbitrary integers of 2 or more. As a premise of the present invention, it is assumed that the communication devices 11 to 1M in the first network have an authentication relationship with all the communication devices in the same network. It is also assumed that the communication devices 21 to 2N in the second network have an authentication relationship with all the communication devices in the same network.

(First embodiment)
FIG. 2 is a diagram for explaining an authentication relationship which is a premise in the first embodiment. In FIG. 2A, it is assumed that the first network has already established an authentication relationship using the common information a12 between the communication device 11 and the communication device 12. Also in the second network, it is assumed that an authentication relationship using the common information b22 has already been established between the communication device 21 and the communication device 22. Here, the common information is information known only to communication devices that mutually perform device authentication. Specifically, an individual password or a secret key is used as the common information.

In FIG. 2B, the first network further includes a communication device 13. Also in this case, it is assumed that the communication device 13 establishes an authentication relationship using the common information a13 with the communication device 11 and the communication device 12. Similarly, in the second network, it is assumed that the communication device 23 establishes an authentication relationship using the common information b23 with the communication device 21 and the communication device 22.
Similarly, when the first network and the second network include four or more communication devices, it is assumed that the authentication relationship is established among all the communication devices. For example, even when the communication device 14 is added to the first network, the communication device 14 establishes an authentication relationship using the common information a14 with the communication devices 11 to 13. Although FIG. 2 shows the case where the number of communication devices constituting the first network and the second network is the same, the number of communication devices constituting each other's network may be different.

  FIG. 3 is a diagram illustrating a configuration of the communication device 11 according to the first embodiment. In FIG. 3, the communication device 11 includes a storage unit 111, a setting unit 112, a control unit 113, a transmission / reception unit 114, an authentication confirmation unit 115, and an authentication request unit 116. The storage unit 111 stores an authentication table in which information used for device authentication is set. The setting unit 112 inputs various information to the control unit 113. Specifically, the setting unit 112 is an input interface such as a keyboard. The control unit 113 controls various operations performed by the communication device. The transmission / reception unit 114 transmits / receives various information to / from other communication devices via the network. The authentication confirmation unit 115 confirms an authentication request received from another communication device. The authentication request part 116 requests | requires authentication with respect to another communication apparatus. The communication devices 12 to 1M and the communication devices 21 to 2N have the same configuration as the communication device 11.

  FIG. 4 is a diagram illustrating an example of an authentication table stored in the storage unit 111. In FIG. 4, the authentication table includes identification information, common information, and attribute information. The identification information is information for uniquely identifying a communication device on the network. Specifically, as the identification information, a so-called network address such as an IP address or a MAC address, a device name, a number set for each device, or the like is used. The common information is information that is known only to communication devices that perform mutual device authentication as described above. The attribute information is information indicating the attribute of the communication device. As the attribute of the communication device, for example, “cooking device” is set if the communication device is a microwave oven, and “audio device” is set if the communication device is an audio player. Note that the attribute information is not essential information and can be set only when necessary.

  FIG. 5 is a diagram for explaining an image of network integration. In FIG. 5, when integrating the first network and the second network, representative devices representing the respective networks are arbitrarily selected. Here, the communication device 12 (hereinafter referred to as representative device 12) is selected as the representative device in the first network, and the communication device 22 (hereinafter referred to as representative device 22) is selected as the representative device in the second network. To do. New common information x used when device authentication is performed between the representative devices and identification information of the representative device of the partner network are input to the representative device of each network (see FIG. 6). In the following description, the representative device of the partner network is specifically abbreviated as the partner representative device.

  Next, operations performed by each communication device during network integration will be described with reference to FIGS. FIG. 7 is a sequence diagram illustrating an operation of the representative device 12 according to the first embodiment during network integration. FIG. 8 is a diagram illustrating an example of information stored in the representative device 12 after network integration. FIG. 9 is a diagram illustrating an example of information stored in the representative device 22 after network integration. FIG. 10 is a sequence diagram illustrating the operation of the communication device 11 that has received the network addition message. FIG. 11 is a diagram illustrating an example of information stored in the communication device 11 after network integration.

  With reference to FIG. 7, the new common information x and the identification information of the counterpart representative device 22 are input to the representative device 12 (step S11). When the new common information x and the identification information of the counterpart representative device 22 are input, the representative device 12 determines whether to accept the counterpart representative device 22 (step S12). This determination can be made using attribute information. For example, the representative device 12 accepts the partner representative device 22 when the attribute information set in the partner representative device 22 is the same as the attribute information set in itself. It is assumed that the representative device 12 can omit the determination (step S12) as to whether or not to accept the counterpart representative device 22.

  When the representative device 12 determines to accept the partner representative device 22, the representative device 12 stores the new common information x and the identification information of the partner representative device 22 in association with each other (step S13). That is, the identification information of the partner representative device 22 and the new common information x are added to the authentication table stored in the representative device 12 (see the symbol R13 in FIG. 8). On the other hand, if the representative device 12 determines that the partner representative device 22 is not accepted, the network integration process ends.

  The representative device 12 refers to the authentication table stored in itself (FIG. 8), and identifies the identification information of the communication devices (communication devices 11, 13-1M) that have already established the authentication relationship in the first network. It is transmitted to the partner representative device 22 as a “network representative message” (step S14). Since the partner representative device 22 performs the same operation, the representative device 12 communicates with the communication device (communication devices 21 and 23) that has already established an authentication relationship in the second network from the partner representative device 22. ˜2N) is received as a “network representative message” (step S15).

  Upon receiving the “network representative message” from the partner representative device 22, the representative device 12 stores the new common information x in association with the identification information received by the message (step S16). That is, identification information of communication devices (communication devices 21, 23 to 2N) belonging to the second network and new common information x are added to the authentication table stored in the representative device 12 (reference numerals in FIG. 8). See R16).

  After that, the representative device 12 refers to the authentication table (FIG. 9) stored in itself, and uses the identification information and common information (see reference numerals R13 and R16 in FIG. 8) added after the network integration to “network addition message”. "" To the communication device (communication devices 11, 13-1M) already established in the local network (step S17).

  Note that, also in the second network, the representative device 22 performs the same operation as in steps S11 to S17 described above. That is, the identification information stored in the representative device 22 (FIG. 9) is added with the identification information of the communication devices (communication devices 11, 13 to 1M) belonging to the first network and the new common information x ( (Refer to information surrounded by a broken line in FIG. 9).

  Next, the operation of the communication device 11 that has received the “network addition message” will be described with reference to FIG. In FIG. 10, the communication device 11 receives a “network addition message” from the representative device 12 (step S21). The communication device 11 stores the identification information notified by the “network addition message” and the new common information x in association with each other (step S22). That is, identification information and new common information x of the communication devices (communication devices 21, 23 to 2N) belonging to the second network are added to the authentication table (FIG. 11) stored in the communication device 11 (FIG. 11). 11 (see information surrounded by a broken line in FIG. 11). The operations of the communication devices 13 to 1M in the first network and the communication devices 21 and 23 to 2N in the second network are the same as the operation of the communication device 11 described above.

  Through the operation steps described above, in the network after integration, the communication device according to the first embodiment can establish a new authentication relationship with the communication device belonging to the partner network. FIG. 12 is a diagram illustrating an example of an authentication relationship that is established after network integration between communication devices according to the first embodiment. In FIG. 12, the communication devices 11 to 13 establish a new authentication relationship using the common information x with the communication devices 21 to 23, respectively, by network integration. In FIG. 12, communication devices that have already established an authentication relationship before network integration are indicated by broken-line arrows, and communication devices that have newly established an authentication relationship after network integration are indicated by solid-line arrows.

Next, detailed operation of device authentication performed by the communication device according to the first embodiment in the integrated network will be described. Here, a case where a communication service with device authentication is performed between the communication device 12 and the communication device 22 will be described. However, it is assumed that the communication device 12 requests authentication and the authentication device 22 performs confirmation.
The communication device 12 performs device authentication with the communication device 22 before starting a communication service with the communication device 22. Specifically, the communication device 12 reads the common information corresponding to the communication device 22 from the authentication table (FIG. 8) stored therein, and the authentication information based on the authentication key using at least a part of the read common information. Is generated. The communication device 12 may further generate authentication information using an indefinite value called NANCE notified from the communication device 22. It is assumed that the procedure for generating the authentication information is determined in advance with the communication device 22. The communication device 12 transmits the generated authentication information to the communication device 22 as an authentication request message.

  When the communication device 22 receives the authentication request message from the communication device 12, the communication device 22 reads the common information corresponding to the communication device 12 from the authentication table (FIG. 9) stored therein, and the authentication information for inspection based on the read common information. Is generated. The procedure for generating the authentication information for inspection is the same as the procedure for creating the authentication information performed by the communication device 12, and follows a procedure determined in advance with the communication device 12. The communication device 22 compares the authentication information requested by the authentication request message with the authentication information for inspection, and confirms that the communication device 12 is correct if they match.

  Note that the communication device 12 and the communication device 22 generate an encryption key based on at least a part of the common information corresponding to the identification information of the partner communication device when transmitting any message, and use this encryption key. It is also assumed that the message can be encrypted. At this time, it is also possible to encrypt only a part of the message.

Note that the communication device according to the first embodiment may have a function of automatically deleting, from the authentication table (that is, dividing the network), information related to a communication device that has newly established an authentication relationship by network integration or the like. . In this case, the authentication table (FIG. 13) stored in the storage unit further includes a new flag. The new flag is a flag indicating information related to a communication device in which an authentication relationship is newly established by network integration or the like. The control unit sets the new flag to “ON” when adding the common information regarding the communication device with which the authentication relationship is newly established to the authentication table.
In the network after integration, an instruction to divide the network can be requested to any communication device. Here, the operation of the communication device when the network is divided will be described using the configuration of the communication device 11 (see FIG. 3). A request for dividing the network (division request) is input to the communication device 11 via the setting unit 112. Upon receiving the division request, the communication device 11 transmits a division request message to each communication device connected to the integrated network. Thereafter, the communication device 11 deletes information related to the communication device whose new flag is “ON” from the authentication table stored by itself. In addition, the communication device that has received the division request message deletes information regarding the communication device whose new flag is “ON” from the authentication table stored in the storage unit.

  As described above, according to the communication device according to the first embodiment of the present invention, information necessary for establishing a new authentication relationship with the communication device belonging to the partner network at the time of network integration (common) Information) can be set automatically. Therefore, it is possible to establish a new authentication relationship with a communication device belonging to the partner network without manually setting common information or introducing a dedicated device such as an authentication server in the integrated network. .

(Second Embodiment)
The authentication relationship which is a premise in the second embodiment will be described with reference to FIGS. FIG. 14 is a diagram for explaining an authentication relationship that is a premise in the second embodiment. FIG. 15 is a diagram illustrating an example of information stored in the communication device 11 of FIG. FIG. 16 is a diagram illustrating an example of information stored in the communication device 12 of FIG. FIG. 17 is a diagram illustrating an example of information stored in the communication device 13 of FIG.
The communication device according to the second embodiment is used when the communication device according to the first embodiment uses the common information (hereinafter referred to as request common information) used when requesting authentication and the authentication is confirmed. Whereas the common information (hereinafter referred to as confirmation common information) is the same information, different information is used for the request common information and the confirmation common information. That is, the communication device according to the second embodiment stores both the authentication request table in which the request common information is set and the authentication confirmation table in which the check common information is set in the storage unit (see FIGS. 15 to 17). .

In FIG. 14, when the communication device 13 requests authentication from the communication device 11 (r11), the communication device 13 refers to the authentication request table (FIG. 17) stored therein and sets the communication device 11 Presented common information a13 is presented to the communication device 11 to request authentication. When the communication device 11 is presented with the common information a13 from the communication device 13, the communication device 11 refers to the authentication confirmation table (FIG. 15) stored therein and confirms the common information a13 set for the communication device 13. Authenticate with
Further, when the communication device 13 requests authentication from the communication device 12 (r12), the communication device 13 is set for the communication device 12 with reference to the authentication request table (FIG. 17) stored therein. Common information a13 is presented to the communication device 12 to request authentication. When the common information a13 is presented from the communication device 13, the communication device 12 confirms the authentication by referring to the authentication confirmation table (FIG. 16) stored therein.

Next, operations performed by each communication device during network integration in the second embodiment will be described with reference to FIGS.
FIG. 18 is a sequence diagram illustrating an operation during network integration of the representative device 12 according to the second embodiment. FIG. 19 is a diagram illustrating an example of information stored in the representative device 12 according to the second embodiment after network integration. FIG. 20 is a diagram illustrating an example of information stored in the representative device 22 according to the second embodiment after network integration. FIG. 21 is a sequence diagram illustrating an operation of the communication device 11 according to the second embodiment that has received the network addition message. FIG. 22 is a diagram illustrating an example of information stored in the communication device 11 according to the second embodiment after network integration.

  Referring to FIG. 18, in the second embodiment, the operations from step S11 to step S12 are the same as those in the first embodiment. When the representative device 12 determines to accept the partner representative device 22, the new common information x and the identification information of the partner representative device 22 are associated with each other and stored in the authentication request table and the authentication confirmation table (step S33). That is, the identification information of the partner representative device 22 and the new common information x are added to the authentication request table and the authentication confirmation table stored in the representative device 12 (see reference numeral R33 in FIG. 19). On the other hand, if the representative device 12 determines that the partner representative device 22 is not accepted, the network integration process ends.

  The representative device 12 refers to the authentication request table stored in itself (FIG. 19), and the identification information and common information of the communication devices (communication devices 11, 13 to 1M) in which the authentication relationship has been established before the network integration. Is transmitted as a “network representative message” to the partner representative device 22 (step S34). Since the partner representative device 22 performs the same operation, the representative device 12 communicates with the communication device (communication devices 21 and 23) that has already established an authentication relationship in the second network from the partner representative device 22. (2N) are received as “network representative message” (step S35).

  When the representative device 12 receives the “network representative message” from the counterpart representative device 22, the representative device 12 stores the identification information and common information received in the message in the authentication confirmation table (step S36). In addition, the communication device 12 stores the new common information x in association with the identification information received by the message in the authentication request table (step S37). That is, the identification information and common information of the communication devices (communication devices 21, 23-2N) belonging to the second network are added to the authentication request table and the authentication confirmation table stored in the communication device 12 (in FIG. 19). (See symbols R36 and R37).

  After that, the representative device 12 refers to the authentication confirmation table stored in itself (FIG. 19), identifies the identification information added after the network integration, and common information corresponding to the identification information (refer to reference numerals R33 and R36 in FIG. 19). ) Is transmitted as a “network addition message” to the communication devices (communication devices 11, 13-1M) that have already established the authentication relationship in the local network (step S38).

  Note that, also in the second network, the representative device 22 performs the same operation as in steps S33 to S38 described above. That is, identification information and common information of communication devices (for example, communication devices 11 and 13 to 1M) belonging to the first network are added to the authentication request table and the authentication confirmation table stored in the representative device 22 (see FIG. 20 (see information enclosed in broken lines at 20).

  Next, the operation of the communication device 11 that has received the “network addition message” will be described with reference to FIG. In FIG. 21, the communication device 11 receives a “network addition message” from the representative device 12 (step S41). The communication device 11 stores the identification information and common information received by the “network addition message” in the authentication confirmation table (step S42). The communication device 11 stores the identification information received by the message in the authentication request table in association with the common information (common information a12) already stored in the authentication request table (step S43). That is, identification information and common information of the communication devices (communication devices 21, 23 to 2N) belonging to the second network are added to the authentication request table and the authentication confirmation table stored in the communication device 11 (in FIG. 22). See the information enclosed in a dashed line).

  Through the operation steps described above, in the network after integration, the communication device according to the second embodiment can establish a new authentication relationship with the communication device belonging to the partner network. FIG. 23 is a diagram illustrating an example of an authentication relationship that is established after network integration between communication devices according to the second embodiment. In FIG. 23, the communication devices 11 to 13 establish a new authentication relationship using predetermined common information with the communication devices 21 to 23, respectively, by network integration. Communication devices that have already established an authentication relationship before network integration are indicated by broken arrows, and communication devices that have newly established an authentication relationship after network integration are indicated by solid arrows.

  As described above, according to the communication device according to the second embodiment of the present invention, the same effect as that of the communication device according to the first embodiment can be obtained. Further, by making the common information used when requesting authentication different from the common information used when confirming authentication, it is possible to perform device authentication with higher safety.

  The communication device of the present invention is suitable for integrating networks that have already established an authentication relationship, and automatically sets common information used for device authentication to a communication device that establishes a new authentication relationship. It is effective in some cases.

The figure explaining the network structure to which the communication apparatus of this invention is applied The figure explaining the authentication relation used as a premise in a 1st embodiment The figure which shows the structure of the communication apparatus 11 which concerns on 1st Embodiment. The figure which shows an example of the authentication table memorize | stored in the memory | storage part 111. Diagram explaining the image of network integration The figure which shows the structure of each representative apparatus in a 1st network and a 2nd network The sequence diagram which shows the operation | movement at the time of network integration of the representative apparatus 12 which concerns on 1st Embodiment. The figure which shows an example of the information which the representative apparatus 12 after network integration memorize | stores The figure which shows an example of the information which the representative apparatus 22 after network integration memorize | stores The sequence diagram which shows operation | movement of the communication apparatus 11 which received the network addition message The figure which shows an example of the information which the communication apparatus 11 after network integration memorize | stores The figure which shows an example of the authentication relationship formed after network integration between the communication apparatuses which concern on 1st Embodiment. The figure which shows an example of an authentication table provided with a new flag The figure explaining the authentication relation used as a premise in 2nd Embodiment The figure which shows an example of the information which the communication apparatus 11 of FIG. 14 memorize | stores The figure which shows an example of the information which the communication apparatus 12 of FIG. 14 memorize | stores The figure which shows an example of the information which the communication apparatus 13 of FIG. 14 memorize | stores The sequence diagram which shows the operation | movement at the time of network integration of the representative apparatus 12 which concerns on 2nd Embodiment The figure which shows an example of the information which the representative apparatus 12 which concerns on 2nd Embodiment after network integration memorize | stores The figure which shows an example of the information which the representative apparatus 22 which concerns on 2nd Embodiment after network integration memorize | stores The sequence diagram which shows operation | movement of the communication apparatus 11 which concerns on 2nd Embodiment which received the network addition message. The figure which shows an example of the information which the communication apparatus 11 which concerns on 2nd Embodiment after network integration memorize | stores The figure which shows an example of the authentication relationship formed after network integration between the communication apparatuses which concern on 2nd Embodiment. The figure which shows an example of the authentication system in which the conventional authentication servers exchange a secret key

Explanation of symbols

11 to 1M, 21 to 2N Communication device 111 Storage unit 112 Setting unit 113 Control unit 114 Transmission / reception unit 115 Authentication confirmation unit 116 Authentication request unit 1001 to 1006 Communication device 1007 to 1009 Authentication server

Claims (8)

A communication device that establishes an authentication relationship with another communication device constituting the partner network by integrating the network,
A storage unit that stores common information necessary for authentication with other communication devices that are in an authentication relationship on the local network and device-specific identification information in association with each other;
A setting unit for inputting new common information necessary for authentication with the representative device of the partner network;
A transmission unit that transmits the common information and identification information stored in the storage unit to the representative device;
A receiving unit that receives from the representative device common information necessary for authentication with other communication devices constituting the counterpart network, and device-specific identification information corresponding to the common information;
A control unit that stores the new common information and the common information and identification information received by the receiving unit in the storage unit and transmits them to another communication device that configures the own network. Communication equipment.   The common information stored in the storage unit includes request common information used when requesting authentication from another communication device, and confirmation common information used when confirming an authentication request from another communication device. The communication device according to claim 1, wherein: The storage unit has an area for storing a new flag corresponding to the common information,
The control unit sets the new flag when storing the new common information and the common information and identification information received by the receiving unit in the storage unit. 2. The communication device according to any one of 2. An instruction to divide the network is input to the setting unit,
In response to a network division instruction received via the setting unit, the control unit stores the common information and identification information in which the new flag is set for other communication devices configuring the network. The communication device according to claim 3, wherein the communication device instructs to delete the common information and the identification information for which the new flag is set from the storage unit of the communication device.   The control unit, when receiving an instruction to divide a network through the reception unit, deletes the common information and identification information in which the new flag is set from the storage unit. The communication device described in 1. It is a method performed by a communication device in order to establish a new authentication relationship with another communication device constituting the partner network by network integration,
A step of inputting new common information necessary for authentication with the representative device of the partner network;
Transmitting pre-stored common information necessary for authentication with other communication devices constituting the own network and device-specific identification information to the representative device;
Receiving, from the representative device, common information necessary for authentication with other communication devices constituting the counterpart network, and device-specific identification information corresponding to the common information;
Storing the new common information and the common information and identification information received in the receiving step;
Transmitting the new common information and the common information and identification information received in the receiving step to another communication device constituting the local network. A program executed by a communication device in order to establish a new authentication relationship with another communication device constituting the partner network by network integration,
A step of inputting new common information necessary for authentication with the representative device of the partner network;
Transmitting pre-stored common information necessary for authentication with other communication devices constituting the own network and device-specific identification information to the representative device;
Receiving, from the representative device, common information necessary for authentication with other communication devices constituting the counterpart network, and device-specific identification information corresponding to the common information;
Storing the new common information and the common information and identification information received in the receiving step;
A program for executing the new common information and the step of transmitting the common information and the identification information received in the receiving step to another communication device constituting the own network. A communication system that establishes a new authentication relationship with another communication device that constitutes the partner network by integrating the own network composed of a plurality of communication devices and the partner network,
The main device, which is one of a plurality of communication devices that make up its own network,
A first storage unit that stores common information necessary for authentication with other communication devices that are in an authentication relationship on the local network and device-specific identification information in association with each other;
A setting unit for inputting new common information necessary for authentication with the representative device of the partner network;
A transmission unit that transmits the common information and identification information stored in the first storage unit to the representative device;
A first receiving unit that receives, from the representative device, common information necessary for authentication with another communication device constituting the counterpart network, and device-specific identification information corresponding to the common information;
The new common information and the common information and identification information received by the first receiving unit are stored in the first storage unit, and are transmitted to other communication devices constituting the local network. A control unit,
A sub device that is a communication device other than the main device constituting the own network is
A second storage unit that stores common information necessary for authentication with other communication devices that are in an authentication relationship on the local network and device-specific identification information in association with each other;
A second receiver for receiving information transmitted by the first controller;
A communication system comprising: a second control unit that stores information received by the second reception unit in the second storage unit.

Images