Secured TCP/IP communication system for devices and private networks connected to the internet

• US 7,418,511 B2
• Filed: 09/10/2003
• Issued: 08/26/2008
• Est. Priority Date: 09/27/2002
• Status: Active Grant

• Current Assignee: Panasonic Intellectual Property Corporation of America (Panasonic Holdings Corporation)
• Original Assignee: Matsushita Electric Industrial Company Limited (Panasonic Holdings Corporation)
• Inventors: Takechi, Hideaki, Hamai, Shinji, Kato, Naonori, Yamamura, Toshiki, Takeda, Hidetoshi, Kunihira, Tadashi
• Primary Examiner(s): Pwu; Jeffrey
• Assistant Examiner(s): Ali; Farhad
• Application Number:
  US10/498,826
• Publication Number:
  US 20050015584A1
• Time in Patent Office: 1,812 Days
• Field of Search: 709/225, 709/227, 709/229, 709/245, 709/230
• US Class Current: 709/229
• CPC Class Codes: H04L 2101/663 Transport layer addresses, e.g. aspects of transmission control protocol [TCP] or user datagram protocol [UDP] ports
• CPC Class Codes: H04L 61/00 Network arrangements, protocols or services for addressing or naming
• CPC Class Codes: H04L 61/2528 Translation at a proxy
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/14 Session management for real-time applications in data packet communications networks H04L65/1066
• CPC Class Codes: H04L 69/16 Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
• CPC Class Codes: H04L 69/163 In-band adaptation of TCP data exchange; In-band control procedures

Abstract

A communication system includes a device and a server connected to the Internet, which transfers communications between the device and a terminal connectable to the Internet via the server. The device periodically transmits a notice packet to the server. The server transmits a connection request packet to the device in reply to the notice packet when a transfer to the device is requested from the terminal. The device transmits a TCP connection request to the server when receiving the connection request packet from the server. The server accepts the TCP connection request transmitted from the device to the server in reply to the connection request packet, to establish the TCP connection. Thus, the server transfers communications between the terminal and the device on the TCP connection after the TCP connection is established.

Claims

1. A server connected to the Internet which transfers communications between at least one device connected to the Internet and at least one terminal connectable to the Internet, wherein the server

receives a periodic notice packet which is a connectionless UDP/IP packet from the device, the periodic notice packet including information on an address related to the device,

stores or updates address information of the device based on the information included in the received periodic notice packet,

transmits a connection request packet which is a connectionless UDP/IP packet to the device in reply to the periodic notice packet using the stored address information of the device if transfer to the device is requested from the terminal,

accepts a TCP connection request transmitted from the device to the server in reply to the connection request packet, and

transfers communications between the terminal and the device on the TCP connection after the TCP connection is established.

2. The server according to claim 1, wherein the server receives from the terminal a transfer request to the device with an HTTP request including a device ID, and

for transferring the communications between the terminal and the device, the server transfers the HTTP request from the terminal on the TCP connection extended by the device, and transfers to the terminal the HTTP response received from the device through the TCP connection.

3. The server according to claim 1, wherein the server receives a plurality of transfer requests from at least one terminal, the server

generates individual session identifiers when a plurality of transfer requests are made from the terminal to the device, and transmits the generated session identifiers to the device by the connection request packet,

establishes the TCP connection by accepting the TCP connection request sent from the device to the server in reply to the connection request packet, receives the session identifier sent from the device on the established TCP connection, makes the received session identifier correspond to the TCP connection thereby to make a plurality of TCP connections correspond to a plurality of connection requests from the terminal, and

only when the terminal requests connection by designating the session identifier and the TCP connection corresponding to the designated session identifier has been already established, transfers the communication from the terminal on the established TCP connection, thereby transferring the communication contents in parallel in each session identifier.

4. The server according to claim 1, wherein the server includes a storage section for storing a final access time of each of the plurality of devices,

when receiving a periodic notice packet from the device, the server updates the final access time by a reception time, and

when transfer to the device is requested from the terminal, the server rejects the connection request if the difference between the final access time of the device and a present time is more than a specified period, or transmits the connection request packet to the device in reply to the periodic notice packet if the difference is not more than the specified period.

5. The server according to claim 1, wherein the server includes a storage section for storing a final access time of each of the plurality of devices,

the server transmits maximum access acknowledge period information preliminarily to the device,

when receiving a periodic notice packet from the device, updates the final access time by a reception time of the notice packet, and

when transfer to the device is requested from the terminal, the server rejects the connection request if the difference between the final access time of the device and a present time is more than the value indicated by the maximum access acknowledge period information, or transmits the connection request packet to the device in reply to the periodic notice packet if the difference is not more than the value indicated by the maximum access acknowledge period information.

6. The server according to claim 1, wherein the server includes a cipher communication section that stores a server certificate, encrypts and decrypts the communications,

when transferring confidential information between the terminal and the device, the server transmits the server certificate preliminarily to the terminal,

when transferring the confidential information from the terminal to the device through the TCP connection established by the device, the server receives encrypted confidential information from the terminal, decrypts the received information by the cipher communication section, and then encrypts the decrypted information by the cipher communication section to transmit to the device, and

when transferring the confidential information from the device to the terminal through the TCP connection established by the device, the server receives encrypted confidential information from the device, decrypts the received information by the cipher communication section, and encrypts the decrypted information by the cipher communication section to transmit to the terminal.

7. The server according to claim 1, wherein the server includes a cipher communication section that stores a server certificate, encrypts and decrypts the communications,

when transferring confidential information between the terminal and the device, the server transmits the server certificate preliminarily to the terminal and the device, respectively,

when transferring the confidential information from the terminal to the device through the TCP connection established by the device, the server receives encrypted confidential information from the terminal, decrypts the received information by the cipher communication section, and then encrypts the decrypted information by the cipher communication section to transmit the encrypted information to the device, and

when transferring the confidential information from the device to the terminal through the TCP connection established by the device, the server receives encrypted confidential information from the device, decrypts the received information by the cipher communication section, and encrypts the decrypted information by the cipher communication section to transmit to the terminal.

8. A computer readable recording medium which stores programs enabling a programmable apparatus to operate as the server according to claim 1.

9. A device connected to the Internet for communicating with a server connected to the Internet, wherein the device

transmits a notice packet which is a connectionless UDP/IP packet periodically to the server,

transmits a TCP connection request to the server when receiving a connection request packet which is transmitted in reply to the notice packet from the server, the connection request packet being a connectionless UDP/IP packet, and

communicates with the server on the TCP connection after the TCP connection is established.

10. The device according to claim 9, wherein the device receives an HTTP request from the server, and transmits an HTTP response to the server for communicating with the server on the TCP connection.

11. The device according to claim 10, wherein the device includes a Web server module and a transfer module,

the Web server module receives an HTTP request from the transfer module, and returns an HTTP response, and

the transfer module transmits a TCP connection request to the server to establish the TCP connection when receiving the connection request packet from the server, receives an HTTP request from the server on the TCP connection to transfer to the Web server, and receives an HTTP response from the Web server to transfer to the server on the TCP connection.

12. The device according to claim 9, wherein the device establishes the TCP connection with the server when receiving a connection request packet accompanied by a session identifier from the server, transmits the session identifier to the server on the established TCP connection, and communicates with the server on the TCP connection after the TCP connection is established.

13. The device according to claim 9, wherein the device receives beforehand maximum access acknowledge period information from the server to store the information in the device, and transmits a notice packet periodically in a shorter period than the period indicated by the maximum access acknowledge period information.

14. The device according to claim 9, wherein the device includes a cipher communication section that encrypts and decrypts communications, and the device encrypts confidential information by the cipher communication section and conducts transmission or reception of the confidential information with the server on the established TCP connection.

15. The device according to claim 9, wherein the device includes a section that verifies the server certificate and a cipher communication section that encrypts and decrypts communications,

the device receives a server certificate from the server to verify the certificate, and if the certificate is authentic, subsequently the device encrypts confidential information by the cipher communication section, thus to conduct transmission or reception of the confidential information with the server on the established TCP connection.

16. A computer readable recording medium which stores programs enabling a programmable apparatus to operate as the device according to claim 9.

17. A communication system comprising at least one device and a server those connected to the Internet, the system transferring communications between the at least one device and at least one terminal connectable to the Internet via the server, wherein

the device transmits a notice packet which is a connectionless UDP/IP packet periodically to the server, the notice packet including information on an address related to the device, and stores or updates address information of the device based on the information included in the notice packet received from the device,

the server transmits a connection request packet which is a connectionless UDP/IP packet to the device in reply to the notice packet using the stored address information of the device when transfer to the device is requested from the terminal,

the device transmits a TCP connection request to the server when receiving the connection request packet from the server, and

the server accepts the TCP connection request transmitted from the device to the server in reply to the connection request packet, thus to establish the TCP connection,

and the server transfers communications between the terminal and the device on the TCP connection after the TCP connection is established.

18. The communication system according to claim 17, wherein

the terminal requests the transfer to the device by transmitting an HTTP request including a device ID to the server,

the server transfers the HTTP request from the terminal onto the TCP connection extended from the device when transferring communications between the terminal and the device,

the device processes the transferred HTTP request, and returns a corresponding HTTP response to the server on the TCP connection, and

the server transfers the HTTP response to the terminal.

19. The communication system according to claim 17, wherein

the server is operable to receive a plurality of transfer requests from the at least one terminal,

when a plurality of transfer requests are made from the terminal to the device, the server generates a respective session identifier unique to each transfer request to notify the device of the session identifier by the connection request packet,

the device establishes the TCP connection to the server to transmit the session identifier to the server on the established TCP connection when receiving a connection request packet accompanied by the session identifier from the server, and communicates with the server on the TCP connection after the TCP connection is established,

the server establishes the TCP connection by accepting the TCP connection request sent to the server from the device in reply to the connection request packet, receives the session identifier sent from the device on the TCP connection, makes the received session identifier correspond to the TCP connection, and makes a plurality of TCP connections correspond to a plurality of connection requests from the terminal, and

only when the terminal requests connection by designating the session identifier and the TCP connection corresponding to the designated session identifier has been already established, the server transfers the communication from the terminal on the established TCP connection, and transfers contents of the communication in parallel in each session identifier.

20. The communication system according to claim 17, wherein

the server includes a data storage section that stores a final access time of each device in a plurality of devices,

the server transmits maximum access acknowledge period information beforehand to the device,

the device receives the maximum access acknowledge period information and stores the received maximum access acknowledge period information, and transmits a notice packet periodically in a shorter period than the period indicated by the maximum access acknowledge period information,

when receiving the notice packet from the device, the server updates the final access time by a reception time, and

when transfer to the device is requested from the terminal, the server rejects the connection request if the difference between the final access time of the device and a present time is over a specified period, or transmits the connection request packet to the device in reply to the notice packet if the difference is within the specified period.

21. The communication system of claim 17, wherein

the server includes a first cipher communication section that holds a server certificate, and encrypts and decrypts communications,

the terminal includes a verification section that verifies the server certificate and a second cipher communication section that encrypts and decrypts communications,

the device includes a third cipher communication section that encrypts and decrypts communications,

the server transmits beforehand the server certificate to the terminal when transferring confidential information between the terminal and the device,

the terminal validates the server certificate, and if the certificate is authentic, encrypts the confidential information by the second cipher communication section, thereby conducting transmission or reception of the confidential information with the server,

the device encrypts the confidential information by the third cipher communication section on the established TCP connection, thereby conducting transmission or reception of the confidential information with the server,

when transferring the confidential information from the terminal to the device through the established TCP connection, the server receives encrypted confidential information from the terminal, decrypts the received information by the first cipher communication section, and encrypts the decrypted information by the first cipher communication section to transmit the encrypted information to the device, and

when transferring the confidential information from the device to the terminal through the TCP connection established by the device, the server receives encrypted confidential information from the device, decrypts the received information by the first cipher communication section, and encrypts the decrypted information by the first cipher communication section to transmit the encrypted information to the terminal.

22. The communication system according to claim 17, wherein

the server includes a first cipher communication section that stores a server certificate, and encrypts and decrypts the communications,

the terminal includes a verification section that verifies the server certificate and a second cipher communication section that encrypts and decrypts the communications,

the device includes a verification section that verifies the server certificate and a third cipher communication section that encrypts and decrypts the communications,

the server transmits beforehand the server certificate to the terminal and the device individually when transferring confidential information between the terminal and the device,

the terminal validates the server certificate, and if the certificate is authentic, then the terminal encrypts the confidential information by the second cipher communication section, thereby conducting transmission and reception of confidential information with the server,

the device validates the server certificate, and if the certificate is authentic, then the device encrypts the confidential information by the third cipher communication section on the TCP connection, thereby conducting transmission and reception of confidential information with the server,

when transferring the confidential information from the terminal to the device through the TCP connection established by the device, the server receives encrypted confidential information from the terminal, decrypts the received information by the first cipher communication section, and encrypts the decrypted information by the first cipher communication section to transmit the encrypted information to the device, and

when transferring the confidential information from the device to the terminal through the TCP connection established by the device, the server receives encrypted confidential information from the device, decrypts the received information by the first cipher communication section, and encrypts the decrypted information by the first cipher communication section to transmit the encrypted information to the terminal.

23. A server connected to the Internet for transferring communications between at least one device connected to the Internet, and at least one terminal connectable to the Internet, the server includes a storage section that stores a final access time in each device in a plurality of devices,

the server receives first and second notice packets which are connectionless UDP/IP packets periodically from the device, the first and second notice packets including information on an address related to the device,

the server stores or updates address information of the device based on the information included in the received notice packet,

when receiving the first notice packet from the device, the server updates the final access time by a reception time, but not update the final access time when receiving the second notice packet from the device,

when transfer to the device is requested from the terminal, the server rejects the connection request if the difference between the final access time of the device and a present time is over a specified period, and transmits a connection request packet which is a connectionless UDP/IP packet to the device in reply to the first and second notice packets if the difference is within the specified period, and

the server accepts a TCP connection request transmitted from the device to the server in reply to the connection request packet,

and the server transfers communications between the terminal and the device on the TCP connection after the TCP connection is established.

24. A computer readable recording medium which stores programs enabling a programmable apparatus to operate as the server according to claim 23.

25. A device connected to the Internet for communicating with a server connected to the Internet,

the device transmits a first and a second notice packet which are connectionless UDP/IP packets periodically to the server, the transmission period of the first notice packet being longer than the transmission period of the second notice packet, and

the device transmits a TCP connection request to the server when receiving a connection request packet which is transmitted in reply to the notice packet from the server, the connection request packet being a connectionless UDP/IP packet,

and the device communicates with the server on the TCP connection after the TCP connection is established.

26. A computer readable recording medium which stores programs enabling a programmable apparatus to operate as the device according to claim 25.

27. A communication system comprising at least one device and a server those connected to the Internet, the system transferring communications between the at least one device and at least one terminal connectable to the Internet via the server, wherein

the server includes storage section that stores a final access time in each device in a plurality of devices,

the device transmits first and second notice packets which are connectionless UDP/IP packets periodically to the server, the transmission period of the first notice packet being longer than that of the second notice packet, the first and second notice packets including information on an address related to the device,

the server receives the first and second notice packets from the device, and stores or updates address information of the device based on the information included in the received notice packet,

when receiving the first notice packet from the device, the server updates the final access time by a reception time, but the server does not update the final access time when receiving the second notice packet from the device,

when transfer to the device is requested from the terminal, the server rejects the connection request if the difference between the final access time of the device and a present time is over a specified period, and transmits a connection request packet which is a connectionless UDP/IP packet to the device in reply to the first and second notice packets if the difference is within the specified period,

the device transmits a TCP connection request to the server when receiving the connection request packet from the server, and

the server accepts a TCP connection request transmitted from the device to the server in reply to the connection request packet, thus to establish the TCP connection,

and the server transfers communications between the terminal and the device on the TCP connection after the TCP connection is established.