Patent Description:
Information and communication technology (ICT) has remarkably progressed in recent years and devices connected to networks such as the Internet are not limited to such information processing apparatuses as conventional personal computers or smartphones but include various things. Such a technological trend is referred to as "Internet of Things (IoT)" and various technologies and services have been proposed and put into practical use. In the future, the world in which several billion people and ten billion or several trillion devices on the Earth are simultaneously connected is expected. In order to realize such a networked world, a simpler and safer solution that allows freer connection should be provided.

Normally over a network, data is communicated between devices by using a network address statically or dynamically allocated to each device. Typically, an Internet protocol (IP) address is adopted as such a network address.

In general, some IP addresses such as global addresses are uniquely set over the Internet and other IP addresses such as private addresses are allocated exclusively over a private network. There is also such a scheme as dynamically allocating an IP address based on a dynamic host configuration protocol (DHCP).

Thus, in setting an IP address, for data communication, attention is paid only to exclusively allocating IP addresses over the same network. Namely, the IP address is a network address arbitrarily set in accordance with a network of interest,.

For example, <CIT> (PTL <NUM>) discloses a configuration that reduces man-hours for setting an IP address. As another example, a <CIT> discloses a solution for selectively enforcing network security policy using group identifiers. As yet another example, a publication <CIT> discloses a Femtocell providing services to a user equipment and authenticating a user equipment registered in a first operating domain, when the user equipment requests the service provided by a second operating domain. As yet another example, a publication <CIT> discloses a solution for establishing trust in an email client, where it is determined from a stored list of trusted network addresses, whether the email client is trusted according to the email client's network address. Publication <CIT> discloses network address authentication of a server device.

As described above, a network address so far has served as identification information for identifying a destination, however, no reliability has been provided to such an address itself. Therefore, though data is communicated between devices by using the IP address, authentication processing or the like has been performed in a higher layer (for example, an application layer).

Therefore, in order to provide a service requiring various types of authentication processing, an application for performing authentication processing as the basis for the service should be provided in advance or each time, which has interfered with prevalence.

The present invention provides a solution to the problem as described above.

A network system according to one aspect of the present invention includes at least one server device and at least one terminal device that accesses any of the at least one server device. The terminal device authenticates a network address between the terminal device and any of the at least one server device and communicates data therewith. When the server device receives a request from the terminal device, the server device provides a service in accordance with the authenticated network address held by the terminal device that has issued the request.

Preferably, the server device identifies the terminal device that has issued the request, based only on the network address used in interaction with the terminal device through a network layer, without performing authentication processing in an application layer.

Preferably, the terminal device includes a first communication program directed to a data link layer, a second communication program directed to a transport layer and a network layer, and an address authentication program connected between the first communication program and the second communication program. The address authentication program authenticates, between the address authentication program and a destination device, the network address to be used for data transmission requested by the second communication program.

Preferably, the terminal device includes a communication function module that provides a communication function and a semiconductor device having the authenticated network address hard-coded thereon. The semiconductor device authenticates the network address between the semiconductor device and a destination device, by using the communication function module.

According to one form of the present invention, in providing a service adapted to a device or a user who uses the device, neither a special application nor an additional authentication procedure is necessary. Therefore, a response time period involved with provision of a service can be reduced.

An embodiment of the present invention will be described in detail with reference to the drawings. The same or corresponding elements in the drawings have the same reference characters allotted and description thereof will not be repeated.

According to the present embodiment, a service based on an authenticated network address and a platform for providing the service are provided. In a conventional network, there has been no technical concept of authentication of a network address itself and the network address has mainly been used only for establishing communication connection. Then, an authentication procedure has normally been performed by using an application for authentication. In contrast, since a network address itself is authenticated in the present embodiment, establishment of communication connection per se also serves as the authentication procedure and an additional authentication procedure or the like by using an application is not required.

Therefore, in providing a service adapted to a device or a user who uses the device, neither a special application nor an additional authentication procedure is required. Therefore, a response time period involved with provision of a service can be reduced.

A "network address" herein means identification information for uniquely identifying a device over some network and it is generally constituted of a character string including combination of characters, numerics, and/or signs. Though an Internet protocol (IP) address is assumed as a typical example of the network address, a lower-order address such as a media access control (MAC) address or a higher-order address such as a host name or a uniform resource locator (URL) managed by a domain name system (DNS) may be applicable. Regardless of a difference in network such as a global network and a private network, a protocol to be used can also arbitrarily be selected. A network address specific to an adopted protocol may be adopted as the network address.

When an IP address is typically adopted, the defined number of bits is different for each version. Under the currently established Internet protocol version <NUM> (IPv4), a <NUM>-bit address space is defined, and under the currently established Internet protocol version <NUM> (IPv6), a <NUM>-bit address space is defined. In the present embodiment, an IP address in conformity with IPv6 is mainly described as the network address.

An "authenticated network address" herein means a state that authenticity of the network address allocated to each device is guaranteed to a destination or a third party, that is, a state guaranteeing that a network address used by each device for data communication is not spoofed, by adopting a scheme as will be described later.

A "device" herein encompasses arbitrary things that can communicate data over a network. Typically, the device may be implemented as a single communication apparatus or may be implemented as a part of something or as being incorporated in something.

An overall configuration of a network system <NUM> according to the present embodiment will initially be described.

<FIG> is a schematic diagram showing an exemplary overall configuration of network system <NUM> according to the present embodiment. Referring to <FIG>, terminal devices <NUM>-<NUM>, <NUM>-<NUM>, <NUM>-<NUM>,. representing exemplary devices (which may also collectively be referred to as a "terminal device <NUM>" below) and server devices <NUM>-<NUM>, <NUM>-<NUM>, <NUM>-<NUM>,. representing other devices (which may also collectively be referred to as a "server device <NUM>" below) are connected to a network <NUM> such as the Internet.

For example, a smartphone or a portable telephone is assumed as terminal device <NUM>-<NUM> and terminal device <NUM>-<NUM> is connected to network <NUM> with a base station <NUM> provided by a mobile communication entity being interposed. For example, a tablet is assumed as terminal device <NUM>-<NUM>, and for example, a lap-top personal computer is assumed as terminal device <NUM>-<NUM>. Terminal devices <NUM>-<NUM> and <NUM>-<NUM> are connected to network <NUM>, for example, with an access point <NUM> being interposed.

Each of server devices <NUM>-<NUM>, <NUM>-<NUM>, <NUM>-<NUM>,. is a device that provides an arbitrary service. Each server device <NUM> provides a requested service by being accessed from any terminal device <NUM>.

Thus, network system <NUM> includes at least one server device <NUM> (a second device) and at least one terminal device <NUM> (a first device) that can access any of at least one server device <NUM>.

In network system <NUM> according to the present embodiment, server device <NUM> can obtain an authenticated network address of terminal device <NUM> which has accessed the server device. Similarly, terminal device <NUM> can obtain an authenticated network address of server device <NUM> that the terminal device has accessed.

Processing for mutually authenticating the network address is performed between terminal device <NUM> and server device <NUM>, and successful authentication of the network address allows start of data communication. Namely, terminal device <NUM> authenticates the network address between the terminal device and any of at least one server device and communicates data therewith. By adopting such a configuration for data communication, terminal device <NUM> and server device <NUM> can mutually obtain the authenticated network address of the destination.

For example, when server device <NUM> receives a request from terminal device <NUM>, it provides a service in accordance with the authenticated network address of terminal device <NUM> that has issued the request. Namely, server device <NUM> can provide a service in accordance with the obtained authenticated network address to terminal device <NUM> that has issued the request. An exemplary service in accordance with the network address will be described later. Since terminal device <NUM> can also obtain the authenticated network address of server device <NUM>, it can also transmits a specific command in accordance with destination server device <NUM>.

Thus, in network system <NUM> according to the present embodiment, the authenticated network address of each terminal device <NUM> can be obtained so that a service specific to each terminal device <NUM> can be provided without requiring an application for performing authentication processing. Since data communication between devices such as terminal device <NUM> and server device <NUM> means obtainment of the authenticated network address, a time period required for providing a service specific to terminal device <NUM> is also extremely short and waiting time until provision of a service can be shorter than in a configuration in which authentication processing is performed with the use of an application.

An exemplary configuration of a device for realizing authentication of a network address used in network system <NUM> according to the present embodiment will now be described. In order to realize authentication of a network address, for example, a hardware implementation and a software implementation are assumed. An exemplary implementation will be described below.

<FIG> is a schematic diagram showing an exemplary configuration of a terminal device 100A according to the present embodiment. Referring to <FIG>, terminal device 100A includes a processor <NUM>, a main memory <NUM>, a display <NUM>, an input unit <NUM>, a communication module <NUM>, and a secondary storage <NUM>.

Processor <NUM> is a processing entity that performs various types of processing in terminal device 100A. Processor <NUM> develops and executes a program or various instructions stored in secondary storage <NUM> on main memory <NUM>.

Main memory <NUM> is a volatile storage such as a dynamic random access memory (DRAM) or a static random access memory (SRAM). Secondary storage <NUM> is a non-volatile storage such as a flash memory or a hard disk. Secondary storage <NUM> stores an operating system (OS) <NUM> and one or more arbitrary applications <NUM>.

Display <NUM> is a component that presents a result of processing by processor <NUM> to the outside, and implemented, for example, by a liquid crystal display (LCD) or an organic electro-luminescence (EL) display.

Input unit <NUM> is a component that accepts an operation by a user and implemented, for example, by an arbitrary input apparatus such as a keyboard, a touch panel, or a mouse.

Communication module <NUM> is a main component that provides an authenticated network address and includes an address authentication chip <NUM>, a WiFi module <NUM>, and an LTE module <NUM>.

Address authentication chip <NUM> is a semiconductor device having an authenticated network address and information necessary for authentication hard-coded thereon, and authenticates a network address in communicating data with another device by means of WiFi module <NUM> and/or LTE module <NUM>.

More specifically, in data communication by means of WiFi module <NUM> or LTE module <NUM>, address authentication chip <NUM> performs processing for mutually authenticating, between the address authentication chip and another device, an authenticated network address provided in advance. Address authentication chip <NUM> thus authenticates a network address between the address authentication chip and a destination device, by means of a communication function module (WiFi module <NUM> and/or LTE module <NUM>). Circuitry which is resistant against tampering is preferably adopted as address authentication chip <NUM>.

WiFi module <NUM> and/or LTE module <NUM> provide(s) a function of the physical layer and the data link layer of the open systems interconnection (OSI) reference model. WiFi module <NUM> provides, as being connected to an antenna <NUM>, a wireless communication function in conformity with a wireless access scheme such as wireless local area network (LAN) or WiMAX. LTE module <NUM> provides, as being connected to an antenna <NUM>, a wireless communication function in conformity with a wireless access scheme such as long term evolution (LTE), wideband code division multiple access (W-CDMA), or CDMA2000.

Though communication module <NUM> including WiFi module <NUM> and/or LTE module <NUM> is exemplified for the sake of convenience of description, both of the modules do not necessarily have to be included. Any one module alone may be incorporated or one or more modules providing other communication functions may be incorporated. In that case, not only a wireless communication function but also a wired communication function may be provided as the communication function.

Communication module <NUM> thus includes a communication function module (WiFi module <NUM> and/or LTE module <NUM>) that provides the communication function and a semiconductor device (address authentication chip <NUM>) having an authenticated network address hard-coded thereon.

By adopting the hardware implementation as set forth above, the authenticated network address can be provided and obtained in terminal device 100A.

<FIG> is a schematic diagram showing an exemplary configuration of a terminal device 100B according to the present embodiment. Referring to (A) of <FIG>, terminal device 100B includes processor <NUM>, main memory <NUM>, display <NUM>, input unit <NUM>, secondary storage <NUM>, a WiFi module <NUM>, and an LTE module <NUM>.

Processor <NUM> is a processing entity that performs various types of processing in terminal device 100B. Processor <NUM> develops and executes a program or various instructions stored in secondary storage <NUM> on main memory <NUM>. Secondary storage <NUM> stores an address authentication program <NUM> and authentication management information <NUM> in addition to OS <NUM> and one or more arbitrary applications <NUM>.

WiFi module <NUM> and/or LTE module <NUM> provide(s) the function of the physical layer and the data link layer of the OSI reference model. WiFi module <NUM> provides, as being connected to an antenna <NUM>, the wireless communication function in conformity with a wireless access scheme such as wireless LAN or WiMAX. LTE module <NUM> provides, as being connected to an antenna <NUM>, a wireless communication function in conformity with a wireless access scheme such as LTE, W-CDMA, or CDMA2000.

Though the configuration including WiFi module <NUM> and/or LTE module <NUM> is exemplified for the sake of convenience of description, both of the modules do not necessarily have to be included. Any one module alone may be incorporated or one or more modules providing other communication functions may be incorporated. In that case, not only a wireless communication function but also a wired communication function may be provided as the communication function.

As a result of execution of address authentication program <NUM> in terminal device 100B, the authenticated network address is provided. A software configuration for providing an authenticated network address will be exemplified below.

<FIG> shows at (B) a schematic diagram for illustrating processing involved with data communication in terminal device 100B. As shown in (B) of <FIG>, WiFi module <NUM> and/or LTE module <NUM> providing the function of the physical layer realize(s) transmission/reception of a real signal (data) by means of a data link driver <NUM> (a function of a part of OS <NUM>).

Application <NUM> such as a web browser utilizes a TCP/IP socket <NUM> for data communication. TCP/IP socket <NUM> may be provided as a function of a part of OS <NUM>. Though <FIG> illustrates at (B) TCP/IP socket <NUM> by way of example, for example, a UDP/IP socket may be adopted.

TCP/IP socket <NUM> normally realizes data transmission and data reception to and from another device by internally transmitting/receiving data to/from data link driver <NUM>.

In contrast, in terminal device 100B according to the present embodiment, address authentication program <NUM> is arranged between TCP/IP socket <NUM> and data link driver <NUM>. Address authentication program <NUM> authenticates a network address allocated to each device mutually between the address authentication program and a destination device in a specific session, and only when authentication is successful, the address authentication program transmits and receives data in the specific session. By adopting such a scheme, from a point of view of application <NUM>, transparency can be maintained without being conscious about presence of address authentication program <NUM>. Namely, application <NUM> should only transmit a packet including necessary data, and can rely on and use a network address included in a header of a packet received from any device, as it is.

Address authentication program <NUM> mutually authenticates a network address between the address authentication program and another device based on information stored in authentication management information <NUM> prepared in advance in a secure manner. Authentication management information <NUM> includes not only a network address allocated to each device but also a code for ensuring that the network address is authentic (that is, authenticated). Address authentication program <NUM> mutually authenticates a network address by transmitting additional information included in authentication management information <NUM> to a destination, together with the network address defined in authentication management information <NUM>.

Without being limited to a destination device with which data is communicated, the address authentication program may authenticate a network address between the address authentication program and an external authentication server device or the like.

Thus, terminal device 100B includes a communication program (data link driver <NUM>) directed to the data link layer, a communication program (TCP/IP socket <NUM>) directed to the transport layer and the network layer, and address authentication program <NUM> connected between data link driver <NUM> and TCP/IP socket <NUM>.

Though <FIG> shows a configuration in which address authentication program <NUM> is logically arranged between layers of TCP/IP socket <NUM> and data link driver <NUM>, any implementation may be applicable without being limited as such, so long as address authentication program <NUM> can mutually authenticate a network address between the address authentication program and a destination.

For example, TCP/IP socket <NUM> and address authentication program <NUM> may be arranged logically in parallel, and TCP/IP socket <NUM> may be prevented from starting transmission and reception of a packet unless a network address is authenticated between address authentication program <NUM> and a destination device. In this case, once address authentication program <NUM> authenticates a network address, transmission/reception of data is thereafter continued between TCP/IP socket <NUM> and data link driver <NUM> and address authentication program <NUM> does not have to be involved with internal data transfer.

Since corresponding components among components of terminal device 100B are the same as those in terminal device 100A, detailed description will not be repeated.

By adopting the software implementation as set forth above, an authenticated network address can be provided to terminal device 100B.

Without being limited to the functional configuration involved with data communication shown in (B) of <FIG>, another implementation may be adopted. <FIG> is a schematic diagram showing another exemplary configuration of the terminal device according to the present embodiment.

In an exemplary implementation shown in (A) of <FIG>, above a general layered structure, that is, the physical layer and the data link layer (WiFi module <NUM> and/or LTE module <NUM>), data link driver <NUM> and TCP/IP socket <NUM> are sequentially arranged. Arbitrary application <NUM> uses TCP/IP socket <NUM> for data communication.

In the exemplary implementation shown in (A) of <FIG>, at the time of start of or during transmission/reception of data by TCP/IP socket <NUM> to/from a destination node, TCP/IP socket <NUM> asks address authentication program <NUM> to authenticate the destination. Address authentication program <NUM> determines, by performing authentication processing as described above, whether or not the destination is a reliable node or whether or not data transmitted/received to/from the destination has been tampered, and provides a result thereof to TCP/IP socket <NUM>. Basic processing by address authentication program <NUM> is similar to that by address authentication program <NUM> shown in (B) of <FIG> described above.

In the implementation as shown in (A) of <FIG>, TCP/IP socket <NUM> asks address authentication program <NUM> to perform necessary authentication processing. Therefore, from a point of view of application <NUM>, secure communication with the destination having the authenticated network address can be established by using the interface the same as in normal communication.

In an exemplary implementation shown in (B) of <FIG>, above the general layered structure, that is, the physical layer and the data link layer (WiFi module <NUM> and/or LTE module <NUM>), data link driver <NUM> and TCP/IP socket <NUM> are sequentially arranged. Arbitrary application <NUM> uses TCP/IP socket <NUM> for data communication and also interacts with address authentication program <NUM> for necessary authentication.

In the exemplary implementation shown in (B) of <FIG>, at the time of or during transmission/reception of data by application <NUM> to/from a destination node, application <NUM> asks address authentication program <NUM> to authenticate the destination. Address authentication program <NUM> transmits/receives data to/from TCP/IP socket <NUM> and determines, by performing authentication processing as described above, whether or not the destination is a reliable node or whether or not data transmitted/received to/from the destination has been tampered. Then, address authentication program <NUM> provides a result of authentication to application <NUM>. Basic processing by address authentication program <NUM> is the same as that by address authentication program <NUM> shown in (B) of <FIG> described above.

By adopting the implementation as shown in (B) of <FIG>, secure communication with the destination having the authenticated network address can be established without changing a structure of a communication layer such as data link driver <NUM> and TCP/IP socket <NUM>.

Exemplary interaction between devices such as terminal device <NUM> and server device <NUM> will now be described.

<FIG> is a schematic diagram for illustrating interaction between devices in network system <NUM> according to the present embodiment. <FIG> shows exemplary processing when data is transmitted/received between a device <NUM> and a device <NUM>.

Referring to <FIG>, device <NUM> and device <NUM> each includes a network authentication function (corresponding to address authentication chip <NUM> shown in <FIG> or address authentication program <NUM> shown in <FIG>). The network authentication function of each device performs processing for authenticating a network address. This authentication processing is basically performed in the network layer. When authentication processing is completed, the network authentication function of each device is used as a network address in transmission/reception of data by an application (application layer) executed in each device.

An application or a TCP/IP socket responsible for packet generation and packet reception may be notified of an authenticated network address.

By adopting the configuration as shown in <FIG>, a mutually authenticated network address can be used without special authentication processing being required on an application side.

An exemplary processing procedure in network system <NUM> according to the present embodiment will now be described.

<FIG> is a sequence diagram showing an exemplary processing procedure involved with provision of a service in network system <NUM> according to the present embodiment. <FIG> shows a processing procedure in a typical example where server device <NUM> provides a requested service in response to access from terminal device <NUM> to server device <NUM>.

Specifically, referring to <FIG>, initially, when a user performs some operation on application <NUM> (step S2), an access request from application <NUM> to server device <NUM> is transferred to the network authentication function (address authentication chip <NUM> shown in <FIG> or address authentication program <NUM> shown in <FIG>) (step S4). The network authentication function of terminal device <NUM> performs processing for mutual authentication of a network address between the network authentication function of terminal device <NUM> and the network authentication function (the function corresponding to address authentication chip <NUM> shown in <FIG> or address authentication program <NUM> shown in <FIG>) of server device <NUM> (step S6). When authentication processing is completed, terminal device <NUM> uses the authenticated network address to transfer the issued access request to server device <NUM> (step S8).

In server device <NUM>, the access request transmitted from terminal device <NUM> is received by the network authentication function, subjected to necessary processing, and transferred to the application (step S10). The application of server device <NUM> identifies the network address used for communication of data in the access request received from terminal device <NUM> (step S12) and determines a service to be provided in accordance with the identified network address (step S14).

Then, the application of server device <NUM> transmits the data in accordance with the determined service to terminal device <NUM> (step S16). This data is received by the network authentication function of server device <NUM>, subjected to necessary processing, and transmitted to terminal device <NUM> (step S18).

In terminal device <NUM>, the data transmitted from server device <NUM> is received by the network authentication function, subjected to necessary processing, and transferred to application <NUM> (step S20). Then, application <NUM> presents contents in accordance with the received data to the user (step S22).

In network system <NUM> according to the present embodiment, when server device <NUM> is accessed from terminal device <NUM>, it can provide a service specific to terminal device <NUM> without performing additional authentication processing, because the network address included in that access has been authenticated. Namely, server device <NUM> identifies terminal device <NUM> that has issued the request based only on the network address used in interaction with terminal device <NUM> in the network layer, without performing authentication processing in the application layer.

An exemplary service provided in network system <NUM> shown in <FIG> will now be described.

A web server is assumed as server device <NUM> and such a configuration as providing a specific web page in accordance with a network address of terminal device <NUM> which makes an access will initially be described by way of example.

<FIG> is a diagram for illustrating an exemplary application for providing a service by making use of network system <NUM> according to the present embodiment. <FIG> shows at (A) an exemplary network management table <NUM> held by server device <NUM>. In network management table <NUM>, initial screen information <NUM> representing an initial screen and preference information <NUM> representing preference are defined in association with a network address (IP address) <NUM> of terminal device <NUM> that made an access in the past or will make an access. Contents in network management table <NUM> may be updated manually by a user or by server device <NUM> in response to an operation by a user.

When server device <NUM> is accessed from terminal device <NUM>, the server device refers to network management table <NUM> with a network address provided to terminal device <NUM> serving as a key, and determines corresponding initial screen information <NUM> and preference information <NUM>. Then, server device <NUM> determines contents of a web page to be provided to terminal device <NUM> that has made an access, based on determined initial screen information <NUM> and preference information <NUM>.

<FIG> shows at (B) an exemplary web screen when server device <NUM> provides an on-line banking service by way of example. For example, in an exemplary web screen 220A presented on a display of terminal device <NUM> provided with an IP address <NUM>, buttons for basic account management such as "payment procedure," "check balance," and "transfer procedure" are arranged. In an exemplary web screen 220B presented on the display of terminal device <NUM> provided with an IP address <NUM>, buttons relating to foreign currency such as "buy foreign currency" and "sell foreign currency" are arranged together with a chart showing change over time of the exchange rate.

Such an initial screen can be determined, for example, by referring to initial screen information <NUM> in network management table <NUM>. Furthermore, by referring to preference information <NUM> in network management table <NUM>, not only the initial screen but also a service in accordance with preference can be provided for each terminal device <NUM> (that is, a user who operates terminal device <NUM>).

As set forth above, the initial screen and various service contents provided at the time of access to server device <NUM> can be customized based on the network address provided to terminal device <NUM>.

A use management server in a hotel or the like is assumed as server device <NUM> and such a configuration as using terminal device <NUM> as an electronic key (a certificate for use) will now be described by way of example.

<FIG> is a diagram for illustrating another exemplary application for providing a service by making use of network system <NUM> according to the present embodiment. <FIG> shows at (A) an exemplary use management table <NUM> held by server device <NUM>. Use management table <NUM> stores contents of booking made through a booking site (a room number <NUM> and an allowable period of stay <NUM>) in association with a network address <NUM> provided to terminal device <NUM> used for a booking operation.

Specifically, when a user operates his/her own terminal device <NUM> to make a booking of an accommodation through a booking site, server device <NUM> adds contents of booking to use management table <NUM> together with the network address provided to terminal device <NUM> used for booking of the accommodation.

As shown in (B) of <FIG>, a wireless communication unit <NUM> is arranged in front of each room of an accommodation <NUM>. When a user who stays in the accommodation comes closer to a booked room while carrying terminal device <NUM> used for making the booking of the accommodation, wireless communication unit <NUM> establishes wireless communication with terminal device <NUM>. Wireless communication between terminal device <NUM> and wireless communication unit <NUM> may be started automatically or in response to an explicit operation by the user.

Then, when the network address provided to terminal device <NUM> held by the user matches with any entry of network address <NUM> in use management table <NUM>, server device <NUM> unlocks a booked room based on corresponding room number <NUM> and allowable period of stay <NUM>.

Though <FIG> illustrates a configuration in which terminal device <NUM> is used as a key for each room of an accommodation such as a hotel as a typical example, the terminal device can be used as any certificate for use without being limited as such. For example, terminal device <NUM> itself can be used as an admission ticket for various facilities such as an amusement facility or various events such as concerts. Terminal device <NUM> itself can further also be used as a ticket for a train or an airplane.

As described above, in network system <NUM> according to the present embodiment, since the network address itself provided to terminal device <NUM> is authenticated, an application or the like for displaying a ticket is not required as in the existing technology, and barriers for prevalence of a system in which terminal device <NUM> itself is used as a certificate for use can be lowered.

As set forth above, terminal device <NUM> can readily be made use of as an arbitrary certificate for use based on a network address provided to terminal device <NUM>.

A configuration that realizes processing for authenticating a network address itself in a more multi-faceted manner will now be described. <FIG> is a diagram for illustrating exemplary filtering of a network address by making use of network system <NUM> according to the present embodiment. <FIG> shows an exemplary configuration in which address authentication program <NUM> is arranged in a third layer (the network layer) of the OSI reference model and TCP (or UDP) is arranged in a fourth layer (the transport layer) by way of example.

In <FIG>, authentication management information <NUM> is arranged as a configuration for realizing filtering. Authentication management information <NUM> may include a black list <NUM> and/or a white list <NUM>. Both of black list <NUM> and white list <NUM> do not have to be prepared and only any one of them may be prepared.

Black list <NUM> defines a network address from which access should be blocked and white list <NUM> defines a network address from which access should be permitted.

<FIG> shows at (A) an example in which a filtering function is implemented by address authentication program <NUM>. More specifically, when an authenticated network address of a destination matches with any entry defined in black list <NUM>, address authentication program <NUM> cuts off or prohibits communication with a destination (a black list node) having the authenticated network address. Namely, a packet from the black list node is blocked by address authentication program <NUM> and not given to application <NUM>.

Alternatively, only when the authenticated network address matches with any entry defined in white list <NUM>, address authentication program <NUM> allows communication with a destination (a white list node) having the authenticated network address. Namely, a packet from the white list node is given from address authentication program <NUM> to application <NUM>. Application <NUM> provides a service based on the network address itself authenticated by address authentication program <NUM> and the received packet.

<FIG> shows at (B) an example in which the filtering function is implemented by application <NUM>. More specifically, when application <NUM> receives a packet from address authentication program <NUM>, it determines whether or not a network address (authenticated by address authentication program <NUM>) of a sender of the packet matches with any entry in black list <NUM> or white list <NUM>.

When the network address of the sender of the received packet matches with any entry defined in black list <NUM>, application <NUM> blocks the packet. When the network address of the sender of the received packet matches with any entry defined in white list <NUM>, application <NUM> processes that packet and provides a requested service.

As set forth above, in addition to the function to authenticate the network address itself, by combining the filtering function using the black list/the white list, a more practical network system can be realized.

Though a network system including one or more terminal devices <NUM> and one or more server devices <NUM> is illustrated as an exemplary configuration that uses a network address authenticated between devices in the embodiment described above, the configuration is also applicable to data communication between terminal devices <NUM> or between server devices <NUM> without being limited as such. Without being limited to a framework such as terminal device <NUM> or server device <NUM>, the configuration is available for data communication between arbitrary devices.

According to the present embodiment, a service using an authenticated network address and a platform for providing that service are provided. Since the network address itself is authenticated, establishment of communication connection per se can also serve as an authentication procedure, and an additional authentication procedure using the application is not required. A variety of services suitable for IoT can thus be provided.

It should be understood that the embodiment disclosed herein is illustrative and non-restrictive in every respect. The scope of the present invention is defined by the terms of the claims rather than the description above.

Claim 1:
A network system (<NUM>) comprising:
at least one server device (<NUM>, <NUM>-<NUM>, <NUM>-<NUM>, <NUM>-<NUM>); and
a terminal device (<NUM>, <NUM>-<NUM>, <NUM>-<NUM>, <NUM>-<NUM>, 100A, 100B) configured to access any of the at least one server device, wherein
the terminal device is configured to authenticate a network address of any of the at least one server device and communicate data with the any of the at least one server device, and
when the server device receives a request from the terminal device, the server device provides a service in accordance with an authenticated network address of the terminal device that has issued the request, characterized in that
the terminal device comprises a first communication program (<NUM>; <NUM>) directed to a data link layer, a second communication program (<NUM>; <NUM>) directed to a transport layer and a network layer, and an address authentication program (<NUM>) connected between the first communication program and the second communication program, and
the address authentication program is adapted to authenticate, between the address authentication program and the server device, a network address of the server device to be used for data transmission requested by the second communication program.