JP4561691B2 - Communication method, information processing apparatus, and computer program - Google Patents

Description

  The present invention relates to a communication method and an information processing apparatus used in a P2P type network.

  In recent years, P2P (Peer To Peer) technology is often used when information processing apparatuses communicate with each other.

  In a client-server type network, the server performs centralized processing for device authentication. On the other hand, in a P2P type network, each information processing apparatus used as a node must perform device authentication of another information processing apparatus. For example, when a request for execution of processing is received from another information processing apparatus, device authentication of the other information processing apparatus must be performed.

As a method of authentication in a P2P type network, a method as described in Patent Document 1 has been proposed. According to the technique described in Patent Document 1, the node A confirms the validity of the proxy node B acting as a proxy for the node A, and then transfers the first message to which the secret information is added to the proxy node B. The proxy node B holds the secret information of the received first message and performs authentication with the node N using the secret information. Node B makes an access request to node N instead of node A.
JP-A-8-335208

  As described above, when an information processing apparatus used as a node of a P2P type network receives a request to execute a process from another information processing apparatus, the information processing apparatus must perform device authentication of the other information processing apparatus. However, of course, the processing related to the request must also be executed. Then, when a request is received from a number of other information processing apparatuses at one time, the device authentication and the processing related to the request must be performed, which places a heavy burden.

  However, the conventional method described in Patent Document 1 cannot reduce the burden on the information processing apparatus that has received a request to execute the process.

  The present invention has been made in view of such problems, and an object of the present invention is to reduce the load on an information processing apparatus used as a node of a P2P type network.

A communication method according to an aspect of the present invention is a communication method in a network constituted by three or more nodes, and the first node among the nodes constituting the network is data to be transmitted. The target data and the target data of the nodes constituting the network are associated with each other by associating the target data with node identification information for identifying the third node that determines the validity of the target data of the nodes constituting the network. Addressed to the second node that is the original transmission destination, and data identification information for identifying the target data is transmitted to the second node and the third node, and the second node In order to determine the validity of the target data received from the first node, the node identification information associated with the target data To said third node being requests by transmitting the data identification information of the object data, the third node, the data identification information and the second received from said first node If the data identification information received from the other node matches, the target data related to the data identification information is determined to be valid, and if not matched, the target data is determined to be invalid. The result is returned to the second node.

A communication method according to another aspect of the present invention is a communication method in a network constituted by three or more nodes, and a first node of the nodes constituting the network transmits data to be transmitted. And the node identification information for identifying the third node for determining the validity of the target data among the nodes constituting the network and the node identification information for identifying the third node of the nodes constituting the network. Proof data indicating that the first node itself is a legitimate member of the network, and data identification information for identifying the target data, transmitted to the second node that is the original destination of the target data Are associated with each other and transmitted to the third node, the data identification information is transmitted to the second node, and the second node is transmitted. The third node indicated in the node identification information associated with the target data so as to determine the validity of the target data received from the first node. Requesting by transmitting the data identification information of data, the third node being associated with the data identification information received from the second node, the proof received from the first node The validity of the target data related to the data identification information is determined based on the data, and the determination result is returned to the second node.

Preferably, the first node is a fourth node that is neither one of the second node and the third node among the nodes constituting the network. Get from the node.

  In the present invention, “the target data is valid” means that the target data has a certain reliability. For example, invalid data such as illegally created target data, altered target data, or expired target data cannot be said to be valid.

  According to the present invention, it is possible to reduce the load on an information processing apparatus used as a node of a P2P type network as compared with the conventional art.

  1 is a diagram illustrating an example of the overall configuration of the network 1, FIG. 2 is a diagram illustrating an example of a hardware configuration of the personal computer TR, FIG. 3 is a diagram illustrating an example of a functional configuration of the personal computer TR, and FIG. FIG. 4 is a diagram showing an example of the relationship between each node of the network 1.

  As shown in FIG. 1, the network 1 according to the present invention includes a plurality of segments SG (SG1, SG2,...) And a wide area communication line WNT. Each segment SG is provided with one or more personal computers TR, a hub DH, a router DR, and the like. The personal computer TR and the router DR are connected to a hub DH in the same segment SG by a twisted pair cable.

  Further, the routers DR of each segment SG are connected to each other via a wide area communication line WNT. Thereby, personal computers TR belonging to different segments SG can perform data communication. Each personal computer TR can also be connected to an external certificate authority (CA) server or the like. As the wide area communication line WNT, the Internet, a dedicated line, or a public line is used. In the segment SG, a modem, a terminal adapter, or a dial-up router may be used instead of the hub DH and the router DR.

  This network 1 is a network in the form of P2P (peer to peer), and these personal computers TR function as nodes. As a result, the personal computers TR share each other's resources (for example, hardware resources such as a CPU, hard disk, or printing unit, software resources such as applications, or information resources such as document data, music data, or image data). Can be shared.

  The network 1 is constructed in a company having a plurality of bases, for example. In this case, the segment SG is provided for each of these bases.

  As shown in FIG. 2, the personal computer TR includes a CPU 20a, a RAM 20b, a ROM 20c, a hard disk 20d, a communication interface 20e, an image interface 20f, an input / output interface 20g, and other various circuits or devices.

  The communication interface 20e is a NIC (Network Interface Card), and is connected to any port of the hub DH via a twisted pair cable. The image interface 20f is connected to a monitor and sends a video signal for displaying a screen to the monitor.

  The input / output interface 20g is connected to an input device such as a keyboard or a mouse or an external storage device such as a floppy disk drive or a CD-ROM drive. And the signal which shows the content of operation which the user performed with respect to the input device is input from an input device. Alternatively, data recorded on a recording medium such as a floppy disk or a CD-ROM is read by an external storage device and input. Alternatively, data to be written to the recording medium is output to the external storage device.

  The hard disk 20d includes a packet generation unit 201, a packet transmission unit 202, a data reception unit 203, a data analysis unit 204, a shared data operation unit 210, a device authentication processing unit 211, a message generation unit 212, a message confirmation as shown in FIG. Unit 213, message correction unit 214, missing data extraction unit 215, authentication request unit 216, message validity inquiry unit 217, connection table storage unit 2K1, shared data storage unit 2K2, device certificate storage unit 2K3, and key data storage unit A program and data for realizing a function such as 2K4 are stored. These programs and data are read into the RAM 20b as necessary, and the programs are executed by the CPU 20a.

  Each personal computer TR is given a node ID, an IP address, and a MAC address for identification with other personal computers TR. The node ID and IP address are given according to the rules of the network 1. The MAC address is an address fixedly given to the communication interface 20e of the personal computer TR.

  Further, these personal computers TR1, TR2,... Are virtually assumed to be arranged in a virtual space as shown in FIG. Then, as indicated by a dotted line, it is associated with at least one other personal computer TR in the vicinity in the virtual space. In addition, these associations allow all personal computers TR to be directly or indirectly related to each other. Note that “directly related” means that they are connected by a single dotted line in FIG. 4 (for example, the relationship between personal computer TR5 and personal computer TR6 in FIG. 4), and “indirectly”. "Related to" means that they are connected by two or more dotted lines and one or more nodes (for example, the relationship between personal computer TR1 and personal computer TR5 in FIG. 4). The two personal computers TR that are directly related to each other trust each other.

  The personal computer TR can transmit and receive data to and from another personal computer TR that is directly associated with the personal computer TR. Furthermore, data can be transmitted / received to / from other personal computers TR that are indirectly associated with each other via one or a plurality of personal computers TR between the two personal computers TR. Alternatively, the indirectly associated personal computers TR can be temporarily connected to each other by notifying each other of their MAC addresses or IP addresses, and data can be transmitted and received.

  FIG. 5 is a diagram illustrating an example of the connection table TL. Next, processing contents of each part of the personal computer TR shown in FIG. 3 will be described.

  The connection table storage unit 2K1 stores a connection table TL that stores node data DTN for each other personal computer TR directly associated with the personal computer TR itself. For example, each connection table storage unit 2K1 of the personal computers TR1, TR2, and TR3 stores connection tables TL1, TL2, and TL3 as shown in FIGS.

  The contents of these connection tables TL are created in advance by the administrator before the operation of the personal computer TR is started. Further, after the operation is started, the contents of the connection table TL are automatically updated in accordance with a change in association with the personal computer TR itself.

  The node data DTN indicates information such as a node ID, an IP address, and a MAC address for identifying the other personal computer TR.

  In addition, the connection table storage unit 2K1 stores node data DTN of the personal computer TR itself.

  The shared data storage unit 2K2 stores data shared with other personal computers TR (hereinafter referred to as “shared data”) in units of files.

  The device certificate storage unit 2K3 stores certificate data 6A of the personal computer TR's own device certificate issued by the certificate authority (CA). The key data storage unit 2K4 stores public key data 6B of a public key corresponding to the certificate data 6A of another personal computer TR. Further, secret key data 6C of a secret key that is paired with the public key of the personal computer TR itself is also stored.

  The packet generation unit 201 is shared data called from the shared data storage unit 2K2 by the shared data operation unit 210 described later, data generated by the device authentication processing unit 211 or the message generation unit 212, or missing data extraction unit 215. The data extracted by the above is packetized for transmission to another personal computer TR.

  The packet transmission unit 202 transmits the packet generated by the packet generation unit 201 to the destination device.

  The data reception unit 203 filters and receives packets addressed to the personal computer TR among the packets flowing through the communication line. Then, the original data is reproduced by integrating the received packets.

  The data analysis unit 204 extracts necessary information from the data received by the data reception unit 203 and analyzes the content thereof to determine the type of the data. Depending on the determination result, the shared data operation unit 210, the device authentication processing unit 211, the message generation unit 212, the message confirmation unit 213, the message correction unit 214, the missing data extraction unit 215, the message validity inquiry unit 217, or the like Performs predetermined processing based on the data. The processing content of each part will be described later in order.

  The shared data operation unit 210 relates to shared data stored in the shared data storage unit 2K2 of the personal computer TR itself based on a request from the user (local user) of the personal computer TR or another personal computer TR. Process.

  For example, when a local user inputs a command for opening shared data by an application such as a word processor or a spreadsheet, the shared data is loaded into the RAM 20b. Alternatively, shared data transmitted from another personal computer TR is stored in the shared data storage unit 2K2. Alternatively, when there is a request for shared data from another personal computer TR, the shared data is loaded into the RAM 20b in preparation for providing or distributing to the request source. Alternatively, shared data related to a keyword specified by a local user or another personal computer TR is searched.

  By the way, the personal computer TR plays a role of any one of the request node, the target node, the designated node, and the authentication node according to the content of the process to be executed by itself or the content of the request from the other personal computer TR. Fulfill.

  The “request node” is a node that requests other nodes (other personal computers TR) to perform processing. For example, the request node requests other nodes to perform various processing such as shared data search processing, shared data provision processing, shared data storage processing, image printing processing, or business processing. The “target node” is the requested node. When requesting the target node for processing, the request node transmits request data 7A including a message indicating the request content to the target node.

  The “authentication node” determines whether the requesting node is a legitimate device that can participate in the network 1. That is, device authentication of the request node is performed. The “designated node” confirms (verifies and determines) the validity of the request data 7A received by the target node.

  Returning to FIG. 3, the device authentication processing unit 211 or the message validity inquiry unit 217 operates as follows according to the role of the personal computer TR.

  When the personal computer TR plays the role of a request node, the message generation unit 212 and the authentication request unit 216 operate. When assuming the role of the target node, the message validity inquiry unit 217 operates. Further, the message correction unit 214 and the missing data extraction unit 215 may operate as necessary. When assuming the role of the authentication node, the device authentication processing unit 211 operates. When playing the role of the designated node, the message confirmation unit 213 operates. Further, the message correction unit 214 and the missing data extraction unit 215 may operate as necessary.

  FIG. 6 is a diagram for explaining the processing contents of the request node, the target node, the authentication node, and the designated node, and FIG. 7 is a diagram for explaining the processing for compensating for missing data.

  Here, the processing contents of the device authentication processing unit 211 or the message validity inquiry unit 217 among the units shown in FIG. 3 will be described in detail with reference to FIG.

  In FIG. 6, for example, the user gives an instruction to the personal computer TR2 to search for shared data having a file name including a character string designated by the user from among the shared data stored in the personal computer TR3. To do. Then, since it becomes necessary for the personal computer TR2 to make a search processing request to the personal computer TR3, the personal computer TR2 becomes a request node. On the other hand, the personal computer TR3 is the target node.

  In the personal computer TR2 that has become the request node, the authentication request unit 216 indicates that the personal computer TR2 itself should be authenticated, authentication information indicating its own identification information (node ID, IP address, or MAC address), password, and the like. Request data 8A is generated. The packet generator 201 packetizes the authentication request data 8A generated by the authentication request unit 216 and its own certificate data 6A stored in the device certificate storage unit 2K3. The packet transmission unit 202 transmits these packets to any node (personal computer TR) other than the personal computer TR3 that is the target node (# 101). Here, it is assumed that the data is transmitted to the personal computer TR1. As a result, the personal computer TR1 plays the role of an authentication node.

  In the personal computer TR1 serving as the authentication node, the data receiving unit 203 receives a packet transmitted from the personal computer TR2 to the personal computer TR1, and reproduces the certificate data 6A and the authentication request data 8A. Then, the data analysis unit 204 analyzes the types of these data, and gives a command to the device authentication processing unit 211 to execute processing based on the certificate data 6A and the authentication request data 8A.

  Then, the device authentication processing unit 211 performs device authentication of the personal computer TR2 by confirming the contents of the device certificate indicated in the certificate data 6A and the password indicated in the authentication request data 8A (# 102). . As a result, if it is determined that the personal computer TR2 is a valid device, text or binary ticket data 7B and designated node data 7C are generated (# 103).

  The ticket data 7B shows information for indicating that the personal computer TR2 is a member constituting the network 1 (that is, a member of a group of the network 1). For example, a group password that is a keyword that only members of the group can know is shown. An expiration date may be set for the group password.

  In the designated node data 7C, identification information (node ID, IP address, or MAC address) of the node responsible for the role of the designated node is shown. However, one of the nodes is selected from the nodes indicated in the connection table TL. That is, a node that the personal computer TR itself trusts is selected. As the designated node, a personal computer TR having the highest specifications such as a CPU may be selected, or a random number may be generated to select a personal computer TR at random.

  The packet generation unit 201 encrypts the generated ticket data 7B and designated node data 7C with the private key data 6C of the private key of the personal computer TR1, and then packetizes the packet data. Is sent to the personal computer TR2 (# 104).

  In the personal computer TR2 that is the request node, the data receiving unit 203 receives a packet transmitted from the personal computer TR1 to the personal computer TR2, and reproduces the ticket data 7B and the designated node data 7C. Then, the data analysis unit 204 analyzes the types of the data and gives a command to the message generation unit 212 to execute the process of the next step.

  Then, the message generator 212 generates the request data 7A as follows (# 105). A message indicating the contents of the request (hereinafter referred to as “request message”) is generated. Here, a request message indicating a command (command) to search for shared data having a file name including a character string designated by the user from among the shared data stored in the personal computer TR3 is generated. A message ID that is identification information for identifying the request message from other request messages generated in the past is issued. Then, the request data 7A is generated by combining the request message and message ID, the ticket data 7B received from the authentication node, that is, the personal computer TR1, and the designated node data 7C into one data. A hash value of the request message may be used as the message ID. As ticket data 7B and designated node data 7C, data that has been encrypted with private key data 6C of the private key of personal computer TR1 is used.

  The packet generation unit 201 packetizes the generated request data 7A, and the packet transmission unit 202 transmits them to the personal computer TR3 that is the target node (# 106). Further, the designated node data 7C received from the personal computer TR1 is decrypted with the public key data 6B of the public key of the personal computer TR1, and the request data 7A is transmitted also to the node indicated therein (# 107). Here, it is assumed that the personal computer TR4 is shown in the designated node data 7C. Therefore, the personal computer TR4 becomes the designated node. If the public key data 6B of the personal computer TR1 is not provided, it is obtained from the server of the certificate authority.

  In the personal computer TR4 that has become the designated node, the data receiving unit 203 receives a packet transmitted from the personal computer TR2 to the personal computer TR4 and reproduces the request data 7A.

  The data analysis unit 204 analyzes the type of the data, detects that the ticket data 7B and the designated node data 7C included in the request data 7A are encrypted, and generates the ticket data 7B and the designated node data 7C. That is, the ticket data 7B and the designated node data 7C are decrypted using the public key data 6B of the public key of the personal computer TR1. When it is detected that the designated node data 7C indicates itself, the message confirmation unit 213 is instructed to stand by in order to respond to an inquiry from the target node.

  Then, the message confirmation unit 213 confirms whether or not the information (for example, the group password) indicated in the ticket data 7B is legitimate, and if it is legitimate, the message indicated in the request data 7A. The ID is stored in a valid message table TM (not shown) (# 108). Then, it waits for an inquiry from the target node.

  On the other hand, in the personal computer TR3 that is the target node, the data receiving unit 203 receives a packet transmitted from the personal computer TR2 to the personal computer TR3, and reproduces the request data 7A.

  The data analysis unit 204 analyzes the type of the data, detects that the ticket data 7B and the designated node data 7C included in the request data 7A are encrypted, and generates the ticket data 7B and the designated node data 7C. That is, the ticket data 7B and the designated node data 7C are decrypted using the public key data 6B of the public key of the personal computer TR1. If it is detected that the node itself is not indicated in the designated node data 7C, it is determined that the node itself is not the designated node but the target node, and the message valid so as to perform processing related to confirmation of the request message indicated in the request data 7A. The sex inquiry unit 217 is instructed.

  Then, the message validity inquiry unit 217 generates an inquiry about the validity of the request message indicated in the request data 7A and inquiry data 7D indicating the message ID of the request message (# 109). The packet generation unit 201 packetizes the generated inquiry data 7D, and the packet transmission unit 202 transmits them to the personal computer TR4 that is the designated node (# 110).

  In the personal computer TR4, the data receiving unit 203 receives a packet transmitted from the personal computer TR3 to the personal computer TR4 and reproduces the inquiry data 7D. The data analysis unit 204 analyzes the type of the data and instructs the message confirmation unit 213 to respond to the inquiry data 7D.

  Then, the message confirmation unit 213 checks whether or not the message ID indicated in the inquiry data 7D is stored in the valid message table TM (# 111). If the process of step # 108 described above has not been completed, the check is made after the process is completed. Alternatively, the check may be attempted every predetermined time until the check can be performed. If the message ID is stored, it is determined that the request message related to the message ID is valid, and valid result data 7EA indicating that is generated (# 112). If not stored, invalid result data 7EB indicating that the request message is invalid is generated (# 112).

  The packet generation unit 201 packetizes the generated valid result data 7EA or invalid result data 7EB, and the packet transmission unit 202 transmits them to the personal computer TR3 that is the inquiry source (# 113). Note that the message ID is deleted from the valid message table TM after transmitting the valid result data 7EA or the invalid result data 7EB.

  When the personal computer TR3 receives the valid result data 7EA, the personal computer TR3 starts processing as usual according to the request message relating to the message ID indicated therein. Here, shared data having a file name including a character string designated by the user is searched from the shared data storage unit 2K2. On the other hand, when the invalid result data 7EB is received, it is determined that the request message is not reliable and invalid, and the processing based on the request message is stopped. Then, the execution result of the process based on the request message is notified to the personal computer TR2 (# 114).

  As described above, both the target node, that is, the personal computer TR3 and the designated node, that is, the personal computer TR4, receive the same request data 7A. However, either or both of the target node and the designated node may not be able to correctly receive a part of the request data 7A due to packet loss or the like. Therefore, the message correction unit 214 and the missing data extraction unit 215 of each of the target node and the designated node execute processing for compensating for it as follows (# 115).

  For example, as shown in FIG. 7, it is assumed that the request data 7A is transmitted from the request node to the designated node and the target node, but the data Pt1 as a part of the request message of the request data 7A has not arrived at the designated node.

  In this case, in the designated node, the message correction unit 214 generates the missing part request data 7F indicating that the data Pt1 is requested, and transmits the data to the target node. 202 is controlled. Then, in the target node, the missing data extraction unit 215 controls the packet generation unit 201 and the packet transmission unit 202 to extract the data Pt1 from the request data 7A and transmit it to the designated node.

  Then, in the designated node, the message correction unit 214 reproduces the request data 7A using the data Pt1 received from the target node.

  Alternatively, when the data Pt2 that is part of the request message of the request data 7A has not arrived at the target node, the message correction unit 214 generates the missing part request data 7F indicating that the data Pt2 is requested at the target node, The packet generation unit 201 and the packet transmission unit 202 are controlled to transmit this addressed to the designated node. Then, in the designated node, the missing data extraction unit 215 controls the packet generation unit 201 and the packet transmission unit 202 to extract the data Pt2 from the request data 7A and transmit it to the target node.

  Then, in the target node, the message correction unit 214 reproduces the request data 7A using the data Pt2 received from the designated node.

  8 and 9 are flowcharts for explaining an example of the overall processing flow of the personal computer TR.

  Next, the processing flow of the personal computer TR while participating in the network 1 will be described with reference to the flowcharts of FIGS.

  In FIG. 8, the personal computer TR waits for a command from the local user. When a local user gives a command for processing that requires access to another personal computer TR (target node) (Yes in # 11), the personal computer TR functions as a request node.

  That is, the authentication request data 8A is generated, and the authentication request data 8A and its own certificate data 6A are addressed to any other personal computer TR (that is, the authentication node) other than the target node in the network 1. To request the execution of device authentication and the issuance of ticket data 7B (# 12).

  If the device authentication of the personal computer TR is successful at the request destination, that is, the authentication node, and the personal computer TR can receive the ticket data 7B and the designated node data 7C (Yes in # 13), request processing related to the user's command. Request data 7A including the request message, message ID, ticket data 7B, and designated node data 7C is generated (# 14), and is transmitted to the request destination, that is, the target node (# 15). Further, the request data 7A is also transmitted to the node indicated by the designated node data 7C, that is, the designated node (# 16).

  On the other hand, when the device authentication fails in the authentication node and the personal computer TR cannot receive the ticket data 7B and the designated node data 7C (Yes in # 13), the process related to the user command is stopped ( # 17).

  When the personal computer TR receives the certificate data 6A and the authentication request data 8A from another personal computer TR (No in # 11, Yes in # 18), it functions as an authentication node.

  That is, device authentication of the other personal computer TR (request node) is performed based on the device certificate indicated in the received certificate data 6A and the password indicated in the authentication request data 8A (# 19).

  If the authentication is successful (Yes in # 20), ticket data 7B and designated node data 7C are generated (# 21) and returned to the requesting node (# 22). On the other hand, if the authentication fails (Yes in # 20), a message to that effect is returned to the requesting node (# 23).

  The personal computer TR receives the request data 7A from the other personal computer TR, and if it is indicated in the designated node data 7C included in the request data 7A (No in # 11, No in # 18, # 24, Yes and # 25, Yes), function as a designated node.

  That is, the validity of the request message indicated in the request data 7A is determined by verifying the group password indicated in the ticket data 7B included in the request data 7A (# 26). When it is determined that there is validity (Yes in # 27), the message ID indicated in the ticket data 7B is additionally registered in the valid message table TM (# 28). On the other hand, when it is determined that there is no validity (No in # 27), additional registration to the valid message table TM is not performed.

  Even when the personal computer TR receives inquiry data 7D relating to the validity of the request message from another personal computer TR (No in # 11, No in # 18, No in # 24, Yes in # 29), as a designated node Function. However, the following processing is performed here.

  It is checked whether or not the message ID indicated in the inquiry data 7D is registered in the valid message table TM (# 30). If registered (Yes in # 31), valid result data 7EA indicating that the request message is valid is transmitted to the other personal computer TR (target node) (# 32). On the other hand, if not registered (No in # 32), invalid result data 7EB indicating that the request message is invalid is transmitted (# 33).

  If personal computer TR receives request data 7A from another personal computer TR and does not indicate itself in designated node data 7C included in the request data 7A (No in # 11, No in # 18, # It functions as a target node.

  That is, inquiry data 7D for inquiring the validity of the request message included in the request data 7A is transmitted to the node (specified node) indicated by the specified node data 7C included in the request data 7A (# 34).

  If the valid result data 7EA has been received (Yes in # 35), the request message is trusted, and the processing related to the user command of the request node is started in accordance with the request message (# 36). On the other hand, when the invalid result data 7EB is received (No in # 35), the request from the request node is rejected (# 37). Then, the result of the processing is notified to the requesting node (# 38).

  While participating in the network 1, the personal computer TR appropriately executes the processes of steps # 11 to # 38.

  According to the present embodiment, the target node can cause the designated node to determine the validity of the request message by itself without performing the determination itself. Thereby, the processing load can be reduced as compared with the conventional case. This is particularly useful when request messages are received from many request nodes at a time. For example, it is useful when emergency messages are simultaneously received from the personal computers TR that control the surveillance camera in an emergency, there is a request for downloading predetermined data, or a request message is broadcast.

  The request message is valid even if the request node that is the source of the request message is turned off after the request message is transmitted, the processing is increased and busy, or a DoS (Denial of Service) attack occurs. The sex can be reliably determined.

  It is also useful when the physical distance between nodes is long. For example, in a telemedicine system between Japan and the United States, if one node is in Japan and the other node is in the United States, it takes time to communicate repeatedly between the two nodes. . Therefore, time can be saved by distributing a series of processing related to the request message as in the present invention.

  In the present embodiment, the authentication node that has received the device authentication request from the requesting node selects only one personal computer TR as the designated node, but a plurality of personal computers TR may be selected. The request node may select any one of the plurality of personal computers TR selected by the authentication node as the designated node. At this time, the personal computer TR having the fastest communication speed with the requesting node itself may be selected, or the personal computer TR having the highest specifications such as the CPU may be selected, or a random number is generated and randomly selected. May be elected.

  Alternatively, a plurality of personal computers TR may be selected as designated nodes. For example, when the request message relates to important processing, the target node may start processing of the request message when the valid result data 7EA is obtained from all of the plurality of designated nodes. Alternatively, when the communication environment is not good or when the node frequently leaves the network 1, processing of the request message is started when the valid result data 7EA is obtained from a predetermined ratio or a predetermined number of designated nodes. May be. Alternatively, the higher the importance of the processing related to the request message (for example, the higher the confidentiality of the information to be handled), the higher the predetermined ratio or the larger the predetermined number may be set.

  In the present embodiment, the designated node determines the validity of the request message based on the ticket data 7B attached to the request data 7A, but may determine based on other information. For example, when the message ID received from the request node matches the message ID received from the target node, it may be determined that the request message related to the message ID is valid. Alternatively, all or a part of the request messages received from the request node and the target node may be compared, and if both match, it may be determined that the request message is valid.

  When transmitting a plurality of request data 7A, the request node preferably transmits a predetermined number or less of request data 7A with a predetermined time interval in order to distribute traffic.

  When the link between the request node and the target node continues for a long time, the target node may ask the request node to re-verify. Then, the request node, the target node, the authentication node, and the designated node may execute the process described above with reference to FIG. 6 again.

  Alternatively, an error that occurred at the request node or the target node is detected, the severity value of the detected error is calculated based on a predetermined error function, accumulated, and if the accumulated value exceeds the predetermined value, the purpose is The node may ask the requesting node for revalidation.

  In the present embodiment, the network 1 constructed in a company has been described as an example. However, the present invention can be applied to a wider network such as the Internet. The present invention can also be applied when an information processing apparatus other than the personal computer TR (for example, an information processing apparatus such as a workstation, MFP, or printer) is a node.

  In addition, the configuration of the entire network 1 and personal computer TR or each part, processing contents, processing order, and the like can be changed as appropriate in accordance with the spirit of the present invention.

It is a figure which shows the example of the whole structure of a network. It is a figure which shows the example of the hardware constitutions of a personal computer. It is a figure which shows the example of a functional structure of a personal computer. It is a figure which shows the example of the relationship of each node of a network. It is a figure which shows the example of a connection table. It is a figure for demonstrating the processing content of a request node, a target node, an authentication node, and a designation | designated node. It is a figure for demonstrating the process for supplementing the missing data. It is a flowchart explaining the example of the flow of the whole process of a personal computer. It is a flowchart explaining the example of the flow of the whole process of a personal computer.

Explanation of symbols

1 network 202 packet transmission unit (object data transmission means, discrimination request means, reply means)
212 Message generator (object data transmission means)
213 Message confirmation unit (discriminating means, answering means)
217 Message validity inquiry section (discrimination request means)
7A Request data (purpose data, node identification information)
TR Personal computer (information processing equipment)

Claims (13)

A communication method in a network composed of three or more nodes,
The first node of the nodes constituting the network is
The network is configured by associating target data, which is target data to be transmitted, with node identification information for identifying a third node for determining the validity of the target data among nodes constituting the network. transmitted addressed to the second node which is the original destination of the object data of the nodes,
Transmitting data identification information for identifying the target data to the second node and the third node;
The second node is
In order to determine the validity of the target data received from the first node, the third node indicated in the node identification information associated with the target data Request by sending data identification information ,
The third node is
If the data identification information received from the first node matches the data identification information received from the second node, it is determined that the target data related to the data identification information is valid, and matches If not, determine that the target data is invalid,
Reply the discrimination result to the second node,
A communication method characterized by the above. A communication method in a network composed of three or more nodes,
The first node of the nodes constituting the network is
The network is configured by associating target data, which is target data to be transmitted, with node identification information for identifying a third node for determining the validity of the target data among nodes constituting the network. transmitted addressed to the second node which is the original destination of the object data of the nodes,
Transmitting the certification data indicating that the first node itself is a valid member of the network and the data identification information for identifying the target data to the third node in association with each other;
Sending the data identification information to the second node;
The second node is
In order to determine the validity of the target data received from the first node, the third node indicated in the node identification information associated with the target data Request by sending data identification information ,
The third node is
Based on the certification data received from the first node associated with the data identification information received from the second node, the validity of the target data related to the data identification information is determined,
Reply the discrimination result to the second node,
A communication method characterized by the above. The first node is
Obtaining the certification data for transmission to the third node from a fourth node that is not one of the second node and the third node of the nodes constituting the network;
The communication method according to claim 2 . A communication method in a network composed of three or more nodes,
The first node of the nodes constituting the network is
The network is configured by associating target data, which is target data to be transmitted, with node identification information for identifying a third node for determining the validity of the target data among nodes constituting the network. transmitted addressed to the second node which is the original destination of the object data of the nodes,
Sending the target data to the third node;
The second node is
Requesting the third node indicated in the node identification information associated with the target data to determine the validity of the target data received from the first node;
If a portion of the target data received from the first node is missing, request the third node to transmit the portion;
Repairing the target data based on a portion of the target data received from the third node;
If the third node requests to send a portion of the target data, send the portion to the third node;
The third node is
Determining the validity of the target data received by the second node;
Answer the discrimination result to the second node,
If a portion of the target data received from the first node is missing, request the second node to transmit the portion;
Repairing the target data based on a portion of the target data received from the second node;
When the second node requests to transmit a portion of the target data, the portion is transmitted to the second node;
A communication method characterized by the above. The target data includes a message for requesting the second node to execute a predetermined process,
The second node is
When receiving a response from the third node that the target data is valid, the predetermined process is executed based on the target data.
The communication method according to any one of claims 1 to 4. The second node is
A plurality of nodes constituting the network are regarded as the third node, and the data identification information is transmitted.
When receiving a response that the target data is valid from a predetermined number of the third nodes, the predetermined process is executed based on the target data.
The communication method according to claim 5. The second node is
The third node is randomly selected from the nodes constituting the network.
The communication method according to any one of claims 1 to 6. A source node that is used as one of the nodes of a P2P type network including three or more nodes and that transmits target data that is target data to be transmitted, and a destination node that is an original destination of the target data And an information processing apparatus that can function as a determination node for determining the validity of the target data ,
When the information processing apparatus functions as the transmission source node, the target data and node identification information for identifying the determination node that determines the validity of the target data are associated with each other and transmitted to the destination node And transmitting means for transmitting data identification information for identifying the target data to the determination node and the destination node ;
When the information processing apparatus functions as the destination node, the node identification information associated with the target data is determined so as to determine the validity of the target data received from the transmission source node. against determination node requests by transmitting the data identification information of the target data, and the request means,
When the information processing apparatus functions as the determination node, if the data identification information received from the transmission source node matches the data identification information received from the destination node, the data identification information Discriminating means for discriminating that the objective data is valid and discriminating that the objective data is invalid if they do not match ;
Reply means for replying the discrimination result by the discrimination means to the destination node;
An information processing apparatus comprising: A source node that is used as one of the nodes of a P2P type network including three or more nodes and that transmits target data that is target data to be transmitted, and a destination node that is an original destination of the target data And an information processing apparatus that can function as a determination node for determining the validity of the target data,
When the information processing apparatus functions as the transmission source node, the target data and node identification information for identifying the determination node that determines the validity of the target data are associated with each other and transmitted to the destination node Further, proof data indicating that the information processing apparatus itself is a valid member of the network and data identification information for identifying the target data are associated with each other and transmitted to the determination node, and Transmitting means for transmitting the data identification information to the destination node;
When the information processing apparatus functions as the destination node, the node identification information associated with the target data is determined so as to determine the validity of the target data received from the transmission source node. Requesting means for requesting the discrimination node by transmitting the data identification information of the target data;
When the information processing apparatus functions as the determination node, the data identification information is determined based on the certification data received from the transmission source node, which is associated with the data identification information received from the destination node. Determining means for determining the validity of the target data,
Reply means for replying the discrimination result by the discrimination means to the destination node;
An information processing apparatus comprising: A source node that is used as one of the nodes of a P2P type network including three or more nodes and that transmits target data that is target data to be transmitted, and a destination node that is an original destination of the target data And an information processing apparatus that can function as a determination node for determining the validity of the target data,
When the information processing apparatus functions as the transmission source node, the target data and node identification information for identifying the determination node that determines the validity of the target data are associated with each other and transmitted to the destination node And transmitting means for transmitting the target data to the determination node;
When the information processing apparatus functions as the destination node, the node identification information associated with the target data is determined so as to determine the validity of the target data received from the transmission source node. A discrimination request means for requesting the discrimination node;
First missing data requesting means for requesting the discrimination node to transmit the part when the part of the target data received from the transmission source node is missing;
First restoration means for restoring the target data received from the transmission source node based on a part of the target data received from the discrimination node;
A first missing data transmitting means for transmitting the portion to the determination node when the determination node requests to transmit a portion of the target data;
When the information processing apparatus functions as the determination node, a determination unit that determines the validity of the target data received by the destination node;
Reply means for replying the determination result to the destination node;
Second missing data requesting means for requesting the destination node to transmit the part when the part of the target data received from the source node is missing;
Second restoration means for restoring the target data received from the transmission source node based on a part of the target data received from the destination node;
Second missing data transmitting means for transmitting the part to the destination node when the destination node requests to transmit the part of the target data;
An information processing apparatus comprising: A source node that is used as one of the nodes of a P2P type network including three or more nodes and that transmits target data that is target data to be transmitted, and a destination node that is an original destination of the target data And a computer program used for a computer that can function as a determination node for determining the validity of the target data ,
On that computer,
When functioning as the source node, the target data and node identification information for identifying the determination node for determining the validity of the target data are associated with each other and transmitted to the destination node , and Causing the data identification information for identifying the target data to be transmitted to the determination node and the destination node ,
When functioning as the destination node , with respect to the determination node indicated in the node identification information associated with the target data so as to determine the validity of the target data received from the transmission source node , Execute the requested process by transmitting the data identification information of the target data ,
When functioning as the discrimination node, if the data identification information received from the transmission source node matches the data identification information received from the destination node, the target data related to the data identification information is valid. If it does not match , execute the process to determine that the target data is invalid ,
The determination result to execute the processing to respond to the destination node,
A computer program characterized by the above. A source node that is used as one of the nodes of a P2P type network including three or more nodes and that transmits target data that is target data to be transmitted, and a destination node that is an original destination of the target data And a computer program used for a computer that can function as a determination node for determining the validity of the target data,
On that computer,
When functioning as the transmission source node, the target data and node identification information for identifying the determination node for determining the validity of the target data are associated with each other and transmitted to the destination node. Proof data indicating that the computer itself is a legitimate member of the network and data identification information for identifying the target data are associated with each other and transmitted to the determination node, and the data identification information is further transmitted to the destination. Execute the process to send to the node,
When functioning as the destination node, with respect to the determination node indicated in the node identification information associated with the target data so as to determine the validity of the target data received from the transmission source node , Execute the requested process by transmitting the data identification information of the target data,
When functioning as the discriminating node, based on the proof data received from the transmission source node associated with the data identification information received from the destination node, the target data related to the data identification information Run the process to determine the effectiveness,
Causing the destination node to respond to the determination result,
A computer program characterized by the above. A source node that is used as one of the nodes of a P2P type network including three or more nodes and that transmits target data that is target data to be transmitted, and a destination node that is an original destination of the target data And a computer program used for a computer that can function as a determination node for determining the validity of the target data,
On that computer,
When functioning as the source node, the target data and node identification information for identifying the determination node for determining the validity of the target data are associated with each other and transmitted to the destination node, and Execute the process to send the target data to the discrimination node,
When functioning as the destination node, with respect to the determination node indicated in the node identification information associated with the target data so as to determine the validity of the target data received from the transmission source node Execute the requested process,
When a part of the target data received from the transmission source node is missing, processing for requesting the determination node to transmit the part, and the target data received from the determination node A process of repairing based on a part of the target data,
When the determination node is requested to transmit a part of the target data, a process of transmitting the part to the determination node is executed,
When functioning as the determination node, to execute the process of determining the validity of the target data received by the destination node,
A process of replying the determination result to the destination node;
When a part of the target data received from the transmission source node is missing, a process for requesting the destination node to transmit the part, and the target data received from the destination node A process of repairing based on a part of the target data,
When a request is made from the destination node to transmit a part of the target data, a process of transmitting the part to the destination node is executed.
A computer program characterized by the above.