CN1863195B - Home network system and method with secure registration function - Google Patents

Abstract

The invention is a home network system and method with safe registering function, and the home network system comprises home network gateway, server with safe function and safe identification module able to be separated from home devices, where the safe identification module is connected through safe identification module interface with the home devices, which are interconnected through home intranet, the home intranet is connected through the home gateway with extranet, and the access to the home devices need to be processed by the server with safe function by safe authentication and authorization means. And the system and method implement automatic configuration of home network safe access right limit, convenient for a domestic user, especially a user short of computer safe management skills, to manage. And the invention can make external units with needs flexibly manage specific devices.

Description

Home network system and method with secure registration function

technical field

The invention relates to a home network system, in particular to a home network system with a safe registration function.

The invention also relates to a working method of the home network system with the security registration function.

Background technique

The home network in the prior art is a new concept representing home informatization, and it is a network system that provides intelligent services in an all-round way. It refers to a system that connects various electrical equipment and electrical subsystems through a certain transmission medium inside the home, realizes resource sharing internally, and can exchange information externally through gateways and external networks. The main functions of home network are security service, communication service, energy management, automatic control and so on.

Security in a home network is a very important aspect. Security in a home network involves three levels. The first is the security mechanism of digital media content in the home. Active encryption security mechanisms or passive digital watermark security technologies can be used. It is to realize the security protection and copyright mechanism of home media content; the second is the security mechanism of home network equipment and terminal equipment itself, which mainly involves the authentication of home equipment, which can accept authorized mobile equipment to the home network and reject unauthorized access. Authorized device access; the third level of security is to implement the security mechanism of the entire home network. The home network uses a unified home gateway device to access the external network. It is necessary to implement a security mechanism such as a firewall on the home gateway to ensure that the home network The information of the network and the external network is isolated to protect the privacy of the family. At the same time, the access control of the family equipment is restricted according to different user rights. Because families have strong individual characteristics, each family has different needs for home network security.

The home network security mentioned later mainly involves the third level among the three levels of home network security mentioned above.

As shown in Figure 1, it is a schematic structural diagram of a home network system in the prior art. The devices in the family can be interconnected through the home network to share information, and the user can control the home devices in the home network; The devices in the home network can access the external network; the external devices can also access the devices in the home network through the home gateway, and control the devices in the home network.

In this home network system, secure access to devices in the home network is realized through a home gateway. By configuring in the home gateway and setting user permissions, users need to pass security measures such as home gateway authentication and authorization when accessing devices. Legal users can access devices within their permissions and perform operations on devices that comply with permissions. The patent number is JP2003230184, the Japanese patent titled "appliance control system and method there for using mobile communication terminal, and home gateway", and the patent number is US2004078573, named remote access The US patents of the system, method and program "Remote access system, remote access method, and remote access program" all adopt this method.

Some other improvement methods mainly consider increasing the level of security, or subdividing the functions of the equipment, they use a dedicated security server outside the home gateway to deal with security issues, or add a firewall function on the home gateway, and the home gateway Some internal interconnection functions are placed on a dedicated home server, such as the application number CN03109684, the Chinese patent titled "Home Network System with Safety Protection Function and Its Working Method", application number CN02144081, titled "Network Information Home Appliance Remote Control and security authentication device and method" Chinese patent, the patent number is US2003065791, the title is "System and method for remote accessing a home server while preserving end-to- The US patents on "end security" are all like this.

The existing home network system and its security method can basically deal with the problem of authorized access to the home network under normal circumstances. However, the security measures in these systems all need to be manually configured on the home gateway or security server, which is inconvenient for many families.

At present, many home users do not have the skills in computer use. It is not only inconvenient but also error-prone to ask them to configure security by themselves; The network will also cause users to have doubts; in this way, due to human factors, security issues cannot be well resolved.

Moreover, in the home network, there are some devices, such as the three-meter copying system, rental mode set-top boxes, etc., that really need to be remotely controlled or maintained by an external unit through the home gateway, and corresponding permissions need to be set for them; these access permissions Setting is cumbersome and inconvenient for some home users, and if these external units are set on the home gateway or security server, it will involve sensitive security issues such as family privacy.

Therefore, related to the home network security problem, the prior art still has defects, and needs to be improved and developed.

Contents of the invention

The purpose of the present invention is to provide a home network system and method with a secure registration function, aiming at the above defects of the prior art, to provide a home network system and a method with a secure registration function to facilitate the management of security access rights in the home network .

Technical scheme of the present invention is as follows:

A home network system with a security registration function, which is connected to an external network, wherein the home network system includes a home gateway, a server with a security function, an internal network composed of home equipment, and a security identification that can be separated from the home equipment module;

The security identification module is connected to the home equipment through the security identification module interface, the home equipment is interconnected through the home internal network, the home internal network is connected to the external network through the home gateway, and the access to the home equipment needs to be authenticated by a server with a security function. Authorization and other security measures;

The home device has an automatic registration function with a server with a security function in the home network. After connecting to the home internal network, the home device can automatically register with the server with a security function in the home network, including security information. The registration of related information and safety information follows the family device safety registration agreement;

The smart device with a specific function in the home device is provided with a security identification module interface, connected to the security identification module, reads the information stored in the security identification module and registers with a server with security functions, and according to the settings in the security identification module, the family The device can also exchange information with a designated server of a specific external unit;

The home device security registration protocol is used for home devices to register with a server with a security function, and runs on the home device and the server with a security function. The protocol ensures that the server sets different home device access rights for different users according to the registration information. .

In the system described above, the security identification module is connected to the home device with corresponding functions through the security identification module interface, and two types of information are stored in the security identification module: one is used to communicate with a specific external unit, including a specific external unit User identification information and business information related to the network; another type is used for home network management, which is the internal security registration information of the home network related to a specific external unit.

A working method of a home network system with a security registration function, comprising the following steps:

a) The server with security functions is provided to the user's family members by setting the default administrator group authority through a simple method, and has the management and control authority to the family's internal equipment;

b) The home device registers its own control form and security identification information to a server with a security function through automatic registration, and the server with a security function processes the registration information; through the security registration protocol of the home device, the default administrator group has The control authority of the device; the home device in the home network that lacks the registered security function is perceived by the server with the security function through device discovery, and the server with the security function enables the default administrator group to have the control authority of the device;

c) The security identification module is related to a specific external unit, and the security identification information is set by the specific external unit and provided to home users for use on home devices with corresponding functions;

d) After the security identification module is connected to the home device, the home device reads the settings in the security identification module through the interface of the security identification module, and performs a new registration with the server with security functions according to the security registration protocol of the home device. The server runs the home device security registration protocol to process the registration, and according to the registration content, a new management user is added and has corresponding access rights to the registered device.

The method described above, wherein the method further includes: home users perform security settings on a server with security functions, which is suitable for home users with security management skills, and the authority modification of registered external units is restricted, triggering Events that send notifications to specific external units.

The above method, wherein, the method further includes: when accessing the home device from within the home network, the server with the security function performs user security authentication according to the security registration information.

The method, wherein the method further includes: when accessing the device from outside the home network, the home gateway transfers the access to a server with a security function, and the server with a security function performs security authentication according to the security registration information .

The above method, wherein, the method further includes: the home device connected with the security identification module can exchange information related to the device with a designated external server according to settings.

A home network system and method with a security registration function provided by the present invention can realize automatic configuration of home network security access rights by adopting the system and method of the present invention, which is convenient for home users, especially those who lack computer security management skills User management: By adopting the security identification module and its related methods, it is possible for external units to manage specific equipment flexibly, and to avoid security-sensitive issues caused by external units directly operating the user's home security equipment; in addition, it can By replacing the security identification modules of different external units, the jurisdiction of the home device can be simply changed to a different external unit without changing the corresponding home device or making special settings for the home device.

Description of drawings

FIG. 1 is a schematic diagram of a system structure of a prior art home network;

Fig. 2 is a schematic diagram of the architecture of the home network system provided by the present invention.

Detailed ways

The technical solutions and beneficial effects of the present invention will be apparent through the detailed description of the preferred embodiments of the present invention in conjunction with the accompanying drawings.

A new home network system with security registration function of the present invention, as shown in Figure 2, the system includes an external network, a home gateway, a server with security functions, an internal network composed of home devices, and a Separate security identity module. Among them, the security identification module is connected to the home equipment through the security identification module interface, the home equipment is interconnected through the home internal network, the home internal network is connected to the external network through the home gateway, and the access to the home equipment needs to be authenticated by a server with security functions. Authorization and other security measures.

The basic functions of the home equipment can be household appliances, home entertainment equipment, home appliance control equipment, household computing equipment, etc., and have the function of automatic registration with a server with a security function in the home network. After connecting to the home network, the home The device can automatically register device-associated information including security information with a server with security functions in the home internal network, and the registration of security information follows the security registration protocol for home devices. These devices also include some intelligent devices with specific functions, which can be connected to the security identification module through the interface of the security identification module, read the information stored in the security identification module and register with the server with security functions, according to the settings in the security identification module, The home device can also exchange information with a designated server of a specific external unit; the home device here has dual identities, firstly it is a member of the home network, and at the same time it is a member of the specific external unit network.

The above-mentioned home device security registration protocol is used for home devices to register with a server with security functions, and runs on both the home device and the server. Set different access permissions for home devices.

The security identification module is connected to the home equipment with corresponding functions through the security identification module interface, and realizes the functions related to the user identification together with the home equipment. Corresponding to the dual identities of home devices, there are two types of information stored in the security identification module: one is used to communicate with specific external units, including user identification information and business information related to the network of specific external units, which can be read by home devices After being acquired, it is used for identification, security processing, and service provision when communicating with a specific external unit; the other type is used for home network management, which is the internal security registration information of the home network related to a specific external unit, which can be stored with a corresponding Functional home devices read and automatically register with servers with security functions.

The security identification module interface provides an interface between the security identification module and home devices with corresponding functions. All such home devices in the home network follow this interface to connect to the security identification module and exchange information with the security identification module. General functions such as security identification information reading, processing, communication, registration, etc. are implemented on home devices, while information related to specific external units is stored in the security identification module. Through the interface of the security identification module, home devices and security identification are realized. Separation of module functions. This interface can also be used to connect the security identification module with a type of special equipment, which is used by a specific external unit to write security identification information and business information related to a specific external unit to the security identification module.

The server with security functions has security functions such as security authentication and authorization and device registration service functions, and can provide relevant users with corresponding levels of access rights to the device according to the registration of home devices, and thus control the access to specific devices. Access.

The home gateway provides connection control between the home internal network and the external network, and it can transfer external access to a server with security functions in the home network, and the security server controls the security of the access.

A kind of working method of the home network system with safe registration function of the present invention, its step description is as follows:

1. For servers with security functions, the user can set the default administrator group authority through a simple method, and provide it to the user's family members, who have the management and control authority over the family's internal devices; Members set different management permissions for family devices;

2. Through automatic registration, the home device registers its own control form, security identification and other information to the server with security functions, and the server processes the registration information; through the home device security registration protocol, the default administrator group has control over the device Permissions; some special home devices in the home network that lack registration security functions can be perceived by the server through device discovery, and the server enables the default administrator group to have control rights to the device;

3. The security identification module is related to a specific external unit, and the security identification information can be set by a specific external unit, and then provided to home users for use on home devices with corresponding functions;

4. After the security identification module is connected to the home device, the home device reads the settings in the security identification module through the interface of the security identification module, and performs a new registration with the server with security functions according to the security registration protocol of the home device, and the server runs the home device Secure registration protocol to handle the registration, according to the registration content, add a new management user, who has the corresponding access rights to the registered device;

4. Home users can make other security settings on servers with security functions. This function is suitable for home users with security management skills, but the modification of permissions for specific external units that have been registered is restricted, for example, it will trigger a specific external unit. The event that the unit sends a notification to.

5. When accessing the device from within the home network, the server with security functions performs user security authentication according to the security registration information;

6. When accessing the device from outside the home network, the home gateway transfers the access to a server with security functions, and the server performs security authentication according to the security registration information;

7. The home device connected with the security identification module can exchange information related to the device with the designated external server according to the settings.

As shown in FIG. 2, it is a structural diagram of the home network system provided by the present invention. As shown in the figure, the home network system with security registration function of the present invention mainly includes a home internal network, home devices A1-An, a security identification module connected to the home devices, a server with security functions, and a home gateway. A console connected to the home network is schematically shown in the figure, which mainly embodies the control function and is convenient for illustration. Home mobile control terminal.

In Fig. 2, home devices include household appliances, home entertainment equipment, home appliance control equipment, household computing equipment, etc., where A1 and A2 are smart home devices with security identification module interfaces, and the security identification module can be connected to it for use. Others such as A3-An may or may not have a security identification module interface. Home devices are interconnected through the home network and exchange information; home devices can be configured and controlled on the console. Home devices register security and other information with a server with security functions, and the server determines access rights to various home devices based on the registration. The home internal network is connected to the external network through the home gateway, and access to home devices from inside or outside the home needs to be processed by a server with security functions for security authentication, authorization, and other security means.

The working method of the home network system with secure registration is divided into the following stages:

In the first stage, the user sets the default management user group permissions on the server with security functions for use by family members.

In the second stage, a specific external unit writes the security identification information into the security identification module, and the home user connects it to the home device with the interface of the security identification module for use.

The third stage is home device registration. Each home device connected to the home network obtains information about servers with security functions, such as server addresses, through settings or server-specific message broadcasts. The relevant information of the home device itself is registered to the server with security functions. Through the home device security registration protocol, the server sets the control authority of the device to the default user group; the home device that lacks the registration function is detected by the server through automatic device discovery, and the server will The control authority of the device is set to the default user group; the home device connected to the security identification module registers the information in the security identification module to the server with security functions, and through the security registration protocol of the home device, the server adds a new user, and the control authority of the device Set to new users for specific external organizations.

The fourth stage is the access to the device. The family accesses the designated home device, and the access is authenticated by the server with security functions. The access operation with permission is allowed and the access operation with insufficient permission is denied; the family accesses external resources through the home gateway. ; Access from the outside is first transferred to the home network through the home gateway, and the server with security functions performs security authentication on the access, allowing access operations with permissions and denying access operations with insufficient permissions.

The fifth stage is the control and operation of home devices. Legal users from inside or outside the home obtain operation rights to the home devices and perform operations related to specific devices such as control and configuration.

The sixth stage is mainly for devices with security identification module interfaces. According to the settings, such devices can actively communicate with designated external servers to exchange information related to the device.

The interface of the security identification module mentioned in the third stage and its working process are described below.

The security identification module stores the information set by a specific external unit, mainly including: 1. The management user name used for secure registration within the home network and the access rights regulations for the device; 2. Used to communicate with the designated external server Server information, security identification information, security authentication information, etc. required for information interaction; 3. Business-related information associated with specific device categories.

The security identification module interface is between the security identification module and the corresponding home equipment, including physical, electrical transmission, operation logic, security and other features.

After the security identification module is connected to the home device, according to the interface regulations of the security identification module, the home device detects the security identification module, and the security identification module is activated, thereby triggering the initialization of the security identification module.

During the initialization of the security identification module, the home device reads the information stored in the security identification module through the interface of the security identification module. According to the preset security registration management user name in the read information and the access rights to the device, start the registration to the server with security functions inside the home network; after the registration is completed, according to the read information, used and specified The information and business information required by the external server for information exchange, and start the information exchange with the external server.

Operations such as reading, updating and adding information on the security identification module can be performed on the interface of the security identification module. In these operations, the home device issues an operation command, and the security identification module checks the validity of the command according to the received command, and executes it if it is legal, otherwise rejects it.

The home device security registration protocol involved in the third phase is described as follows.

After the home device obtains the address information of the server, it starts secure registration, sends a registration request, establishes a communication connection with the server, and encapsulates the registration-related management user name, local device identifier, user operation authority and other information in the transmission format stipulated in the registration agreement, and sends to the server.

A registry daemon runs on a server with security features. After receiving the registration request, establish a connection with the home device. For the received registration information, first check the correctness, completeness and legality. If it passes, check the registered users and permissions on the server, and update the user permissions. If the device is registered as a new management user, and the original management user related to the device is empty or only includes the default management group users, just add new users and permissions; if the device is registered as a new management user and the device-related If the original management users include non-default management group users, you need to delete the original non-default management group users on the server, and then add new users and permissions.

After the device security registration information is processed on the server, the processing result message is organized and sent to the registered home device. The home device processes the result according to the registration information, if it fails, it will resend, or give an error alarm; if it succeeds, it will perform other operations.

Home devices can also be deregistered when necessary by setting specific function keys, etc. The de-registration process is also done through the Family Device Secure Registration Protocol, resulting in deletion of the device-related user registration on the server.

The home device access control process involved in the fourth stage is described as follows.

1. Access from the external network is transferred to a server with security functions through the home gateway, and the server performs security authentication, such as requiring input of user name, password, etc.; access from the home internal network is directly authenticated by the server.

2. The server with security functions obtains the security authentication information provided by the user, and checks against the registration information on the server.

3. If the legality check is passed, the server allows the access control operation, otherwise the access is denied.

4. The accessing user issues instructions to operate the specified home equipment, and perform operations such as information acquisition, control, and configuration.

The present invention can realize the automatic configuration of home network security access rights through the above technical scheme, which is convenient for the management of home users, especially users who lack computer security management skills; Flexible management of specific devices avoids security-sensitive issues caused by external units directly operating users' home security devices; in addition, by replacing the security identification modules of different external units, the jurisdiction of home devices can be simply changed to Different external units, without the need to replace the corresponding home equipment or make special settings for the home equipment.

It should be understood that the above description of the preferred embodiments is more specific, and should not be construed as limiting the scope of patent protection of the present invention, and the scope of patent protection of the present invention should be determined by the appended claims.

Claims (7)

1. domestic network system with safety registration function, it connects external network, it is characterized in that described domestic network system comprises home gateway, has the server of safety function, the internal network that is made of household equipment and the secure ID module that can separate with described household equipment;

Described secure ID module is connected with described household equipment by the secure ID module interface, described household equipment is by household internal network interconnection, the household internal network is connected with external network by home gateway, need carry out the processing of Certificate Authority security means through described server with safety function to the visit of described household equipment;

Described household equipment has described automatic registering functional with server of safety function in home network, after being connected on the household internal network, described household equipment can comprise the device association information of security information from the server registration that has safety function described in the trend household internal network, and the household equipment secure registration protocol is followed in the registration of security information;

The specific function smart machine is provided with described secure ID module interface in the described household equipment, be connected with described secure ID module, read the information of described secure ID module memory storage and to described server registration with safety function, according to the setting in the secure ID module, described household equipment can with the given server exchange message of specific outside unit;

Described household equipment secure registration protocol is used for described household equipment to described server registration with safety function, operate on described household equipment and the described server with safety function, this agreement guarantees that described server with safety function is that different users sets different household equipment access rights according to log-on message.

2. system according to claim 1, it is characterized in that, described secure ID module is connected with the household equipment with corresponding function by the secure ID module interface, in the secure ID module stores two category informations are arranged: a class is used for communicating by letter with specific outside unit, comprises user totem information and business information that specific outside unit network is relevant; The another kind of family network management that is used for is the home network internal security log-on message relevant with specific outside unit.

3. method of work with domestic network system of safety registration function, it may further comprise the steps:

A) server with safety function is provided with default management person by the user by straightforward procedure and organizes authority, offers the subscriber household member and uses, and has the management control right limit to household internal equipment;

B) household equipment is by automatically registration, and oneself control list, secure ID information is registered to the server with safety function, described server process log-on message with safety function; By the household equipment secure registration protocol, make default management person organize the control authority that has this equipment; The household equipment that lacks the registration security function in the home network, by the server institute perception that device discovery is had safety function, the server with safety function makes default management person organize the control authority that has this equipment;

C) the secure ID module is relevant with specific outside unit, sets secure ID information by specific outside unit, offers the domestic consumer and uses having on the household equipment of corresponding function;

D) after the secure ID module is connected on the household equipment, household equipment reads setting in the secure ID module by the secure ID module interface, carry out new registration according to the household equipment secure registration protocol to server with safety function, server operation household equipment secure registration protocol with safety function is handled registration, according to registration content, increase new leading subscriber, have corresponding access rights this device registration.

4. method according to claim 3, it is characterized in that, described method also comprises: the domestic consumer carries out security settings having on the server of safety function, be applicable to the domestic consumer who has safety management technical ability, the authority of the outside unit that registered revised being restricted, trigger and send the incident of notice for specific outside unit.

5. method according to claim 3 is characterized in that, described method also comprises: when when home network inside conducts interviews to household equipment, the server with safety function carries out user safety authentication according to secure registration information.

6. method according to claim 3, it is characterized in that, described method also comprises: when from home network external reference equipment, home gateway is transferred to the server with safety function to visit, carries out safety certification by the server with safety function according to secure registration information.

7. method according to claim 3 is characterized in that, described method also comprises: the household equipment that is connected with security identity module can exchange with the external server of appointment and this device-dependent information according to setting.

Images