Patent Application
20060143295
The present invention relates generally to networking, and more particularly, to the networking of devices using a Universal Plug and Play (hereinafter “UPnP”) architecture, such that a mobile station outside of a UPnP network can communicate with devices within the UPnP network.
Universal Plug and Play (UPnP) is a network architecture that enables the peer-to-peer network connectivity of devices including personal computers (PCs), intelligent machines, appliances, wireless devices, and the like. UPnP allows peripheral devices from a wide range of vendors to discover and connect to other devices over a zero-configuration, “invisible” network. Once connected, any two devices in the network are capable of communicating with one another under the command of a control device in the UPnP network.
According to the UPnP architecture, a UPnP device dynamically joins a network, obtains an IP address, announces its name to the network, conveys its capabilities upon request, and learns about the presence and capabilities of other UPnP devices in the network. UPnP leverages Internet components, including IP, TCP, UDP, HTTP, and XML to enable seamless proximity networking. UPnP networks are quite versatile and can communicate via any media including both wireline and wireless communications. In addition, UPnP devices that use any programming language on any operating system (OS) can communicate with other UPnP devices via the UPnP network.
UPnP is used primarily in homes, small businesses and commercial buildings. Using UPnP technology, devices can be controlled remotely, digital data in the form of audio, video, or still images can be transferred between devices, and information can be shared between devices, just to name a few applications. For example, using UPnP technology, music files can be accessed from various devices in a home without regard to where the files are stored.
In order to function properly, multi-vendor collaboration is necessary for establishing standard Device Control Protocols (DCPs). To that end, the UPnP Forum was established. The UPnP Forum consists of over 720 vendors committed to overseeing the establishment of UPnP specifications, protocols, etc. Members of the UPnP Forum define and publish UPnP device and service descriptions in order to create the means to easily connect devices and simplify the implementation of networks.
A drawback of the UPnP architecture is that it is limited to the networking of UPnP devices that are in close proximity of each other, e.g., in a home or an office building. While current technology enables a user to access these devices from remote locations, access is limited to merely communicating using basic HTTP-protocols or via a browser launched by a remote device. For example, consider the scenario in which a person attending a party at a friend's home wishes to play a song that the friend does not have, but that the visitor has saved on a media server in his home UPnP network. Under the current technology, the visitor would first have to download the music from his media server onto his mobile phone and then stream the music from his mobile phone over the remote UPnP network located at the friend's home to the friend's stereo. While effective, this approach requires significant user interaction and may have security concerns because of the unsecure communication established between the mobile station and the home UPnP network.
While it may be more efficient to allow the friend's stereo in the remote UPnP network to communicate directly with the media server in the home UPnP network, there currently exists no known means for linking the two UPnP networks so that the devices in the remote UPnP network can be accessed as if they were part of the home UPnP network, and vice versa. In terms of the foregoing example, current technology does not allow the visitor to stream the music directly from his home media server to his friend's home stereo. A need, therefore, exists for technology that will enable the linking of two UPnP networks, i.e., a remote UPnP network and a home UPnP network, such that the devices in one are available to the devices in the other, as if they were part of one UPnP network.
Establishing a remote connection with a UPnP network raises certain security concerns. These concerns are increased when multiple UPnP networks are configured to communicate with one another. For example, because of the potential for signals to be altered during transmission, one may have security concerns regarding the integrity of messages being transmitted. In addition, a concern may arise with regard to the illegitimate accessing of the UPnP network. A need, therefore, exists for a secure communication link to the UPnP network from a device outside the UPnP network and further between two UPnP networks.
A further drawback of the current UPnP technology is the requirement that each device that wishes to join or communicate with a UPnP network be capable of communicating via UPnP commands. While many devices can do this, some cannot and therefore cannot participate in UPnP networks. A need, therefore, exists for isolating UPnP technology from a device, while enabling that device to nonetheless join and communicate with a UPnP network.
Generally described, embodiments of the present invention provide an improvement over the known prior art by providing the technology by which UPnP devices in a local UPnP network can become visible to a remote UPnP network, and vice versa. Embodiments of the present invention further provide an improved technique for accessing a home UPnP network from a remote location such as via a secure communication link. In addition, other embodiments of the present invention provide for isolating UPnP technology from devices connected to and communicating with a UPnP network.
In one aspect of the present invention a system is provided for linking two UPnP networks that are remotely located, such as a home UPnP network and a visited UPnP network. According to this embodiment, the UPnP devices in the home UPnP network are able to communicate with the UPnP devices in the visited UPnP network, and vice versa, via a mobile station and a home network gateway. The mobile station is, at least temporarily, visiting the visited UPnP network, and is in communication with the UPnP devices in the visited UPnP network. By contrast, the home network gateway is in communication with and in partial control of the UPnP devices in the home UPnP network. By communicating with the home network gateway, therefore, the mobile station is able to provide a communication link between the devices in the two UPnP networks.
According to this embodiment, the mobile station and the home network gateway communicate with each other according to Web Services (“WS”) protocol. By contrast, the UPnP devices in the home UPnP network communicate with each other, and with the home network gateway using UPnP commands. Similarly, the UPnP devices in the visited UPnP network communicate with each other and with the mobile station using UPnP commands. The mobile station and the home network gateway, therefore, convert between WS messages and UPnP commands in order to facilitate communication between the UPnP devices in the two networks.
In another aspect of the present invention, a system is provided for communicating with a UPnP network from a remote location over a secure channel. According to this embodiment, a web proxy gateway is configured as an entry point to a UPnP network for communications from a mobile station. As in the previous embodiment, the mobile station and the web proxy gateway communicate according to WS protocol, while the UPnP devices in the UPnP network communicate with each other and with the web proxy gateway using UPnP commands. Accordingly, the web proxy gateway converts between WS messages and UPnP commands. In addition, the web proxy gateway authenticates and authorizes messages received from the mobile station that are intended for at least one UPnP device in the UPnP network. In one embodiment the mobile station and the web proxy gateway communicate via messages encrypted with shared secret keys.
In one embodiment of the present invention after converting the WS messages received from the mobile station into UPnP commands, the web proxy gateway further encrypts the UPnP commands prior to communicating them to the UPnP device for which they were intended. In one embodiment, the web proxy gateway uses a private encryption key allocated to it from a dedicated security device in the UPnP network to encrypt the UPnP command. In this embodiment, the UPnP device that receives the UPnP command will then use the web proxy gateway's public encryption key to decrypt the UPnP command and verify that it was in fact the web proxy gateway that communicated the UPnP command to it.
An advantage of at least one embodiment of the present invention is that a mobile station can communicate with a UPnP network without possessing the UPnP technology necessary to communicate via UPnP commands. According to one embodiment, a network gateway is provided for enabling communication with a UPnP network for a mobile station that lacks UPnP technology. Specifically, in one embodiment of the present invention a mobile station that is operating only a thin application void of UPnP technology can communicate with the UPnP devices in a UPnP network by communicating with a network gateway according to WS protocol. The network gateway, which is in communication with and partial control of the UPnP devices in the UPnP network, is able to convert the WS messages received from the mobile station into UPnP commands for communicating to at least one UPnP devices in the UPnP network.
Other objects, features, and advantages of the present invention will become apparent upon reading the detailed description of the preferred embodiments of the invention below taken in conjunction with the drawings and the appended claims.
Having thus described the invention in general terms, reference will now be made to the accompanying drawings, which are not necessarily drawn to scale, and wherein:
The present inventions now will be described more fully hereinafter with reference to the accompanying drawings, in which some, but not all embodiments of the inventions are shown. Indeed, these inventions may be embodied in many different forms and should not be construed as limited to the embodiments set forth herein; rather, these embodiments are provided so that this disclosure will satisfy applicable legal requirements. Like numbers refer to like elements throughout.
The systems and methods of the present invention support communication with a UPnP network from a remote location, either from a mobile station or from UPnP devices in a remote UPnP network. One embodiment of the present invention provides a system in which the devices in a first UPnP network, such as a home UPnP network, become visible to a second UPnP network, such as a remote UPnP network, through a mobile station that is at least temporarily part of the second UPnP network. It will be understood by those of skill in the art that the devices in a UPnP network can include, but are not limited to, personal computers, laptop computers, gaming systems, televisions, stereos, cameras, appliances, other consumer electronic and computer products, and the like. It will further be understood that the term “mobile station” can refer to a mobile phone, pager, handheld data terminal, personal data assistant (PDA), or other handheld mobile electronic device capable of wireless communication.
As shown in
As shown in more detail in
In addition, in one embodiment, the home network gateway 112 also possesses rendering functionality. In other words, the home network gateway 112 is able to produce graphic images on a media output device, such as a video display or printer, located in either the home or remote UPnP network 110, 120. For example, in the instance where a user wishes to stream audiovisual (AV) media from a local media server in the home UPnP network 110 to a media output device in the remote UPnP network 120, the home network gateway 112 first begins a rendering session with the local media server during which it receives the media data from the local media server. The home network gateway 112 then transmits the media data to the appropriate output device in the remote UPnP network 120 via the mobile station 122. In one embodiment, the home network gateway 112 transmits the media data as a standard HTTP or Real-Time Protocol (RTP) file, rather than as a WS message.
The home network gateway 112 may be located in the Internet Gateway Device (IGD), which may be a standalone device located either outside of or in the UPnP network. Alternatively, the home network gateway 112 may be embedded in one of the other UPnP devices in the network 114, such as a personal computer.
The mobile station 122, shown in
It is understood that the processing device 208, such as a processor, controller or other computing device, includes the circuitry required for implementing the video, audio, and logic functions of the mobile station and is capable of executing application programs for implementing the functionality discussed above. For example, the processing device may be comprised of a digital signal processor device, a microprocessor device, and various analog to digital converters, digital to analog converters, and other support circuits. The control and signal processing functions of the mobile device are allocated between these devices according to their respective capabilities. The processing device 208 thus also includes the functionality to convolutionally encode and interleave message and data prior to modulation and transmission. The processing device can additionally include an internal voice coder (VC) 208A, and may include an internal data modem (DM) 208B. Further, the processing device 208 may include the functionality to operate one or more software applications, which may be stored in memory. For example, the controller may be capable of operating a connectivity program, such as a conventional Web browser. The connectivity program may then allow the mobile station to transmit and receive Web content, such as according to HTTP and/or the Wireless Application Protocol (WAP), for example.
The mobile station may also comprise a user interface such as including a conventional earphone or speaker 210, a ringer 212, a microphone 214, a display 216, all of which are coupled to the controller 208. The user input interface, which allows the mobile device to receive data, can comprise any of a number of devices allowing the mobile device to receive data, such as a keypad 218, a touch display (not shown), a microphone 214, or other input device. In embodiments including a keypad, the keypad can include the conventional numeric (0-9) and related keys (#, *), and other keys used for operating the mobile station and may include a full set of alphanumeric keys or set of keys that may be activated to provide a full set of alphanumeric keys. Although not shown, the mobile station may include a battery, such as a vibrating battery pack, for powering the various circuits that are required to operate the mobile station, as well as optionally providing mechanical vibration as a detectable output.
The mobile station can also include memory, such as a subscriber identity module (SIM) 220, a removable user identity module (R-UIM) (not shown), or the like, which typically stores information elements related to a mobile subscriber. In addition to the SIM, the mobile device can include other memory. In this regard, the mobile station can include volatile memory 222, as well as other non-volatile memory 224, which can be embedded and/or may be removable. For example, the other non-volatile memory may be embedded or removable multimedia memory cards (MMCs), Memory Sticks as manufactured by Sony Corporation, EEPROM, flash memory, hard disk, or the like. The memory can store any of a number of pieces or amount of information and data used by the mobile device to implement the functions of the mobile station. For example, the memory can store an identifier, such as an international mobile equipment identification (IMEI) code, international mobile subscriber identification (IMSI) code, mobile device integrated services digital network (MSISDN) code, or the like, capable of uniquely identifying the mobile device. The memory can also store content. The memory may, for example, store computer program code for an application and other computer programs. For example, in one embodiment of the present invention, the memory may store computer program code for enabling the mobile station to communicate with a home network gateway of a home UPnP network in order to identify UPnP devices in the home UPnP network, to communicate with devices in a remote UPnP network in order to announce the home UPnP devices to the remote UPnP network, and to support communications between home and remote UPnP devices.
To illustrate, recall the scenario where a person attends a party at a friend's home and wishes to play a song that the friend does not have, but that the visitor has saved on a media server in his home UPnP network. According to an embodiment of the present invention, the visitor would first use his mobile station, e.g., his cell phone, to transmit a UPnP command to the UPnP network located at his friend's home, indicating the cell phone's presence in the friend's UPnP network and requesting information about the other devices in the network. Once the cell phone has established communication with the devices in the friend's UPnP network, the visitor would then use his cell phone to send a WS message to the home network gateway connected to his home UPnP network. The home network gateway would then begin a UPnP service discovery sequence and return to the cell phone the identities and capabilities of the devices in the home UPnP network. The cell phone could then create new, identical UPnP devices and announce each new UPnP device to the friend's UPnP network. A UPnP device in the friend's UPnP network, such as a stereo or PC, would then be able to communicate directly with the media server in the home UPnP network via the cell phone and the home network gateway in order broadcast songs stored in the media server. This system provides an advantage over the current technology, wherein the visitor would be required to download the music onto his cell phone and then stream the music over his friend's UPnP network to the friend's stereo or PC, because it is more efficient and requires less user interaction.
Second, the web proxy gateway 512 provides the necessary conversions between the UPnP commands with which the UPnP devices 114 communicate in the home UPnP network 110 and the WS messages transmitted to and from the remote mobile station 122, similar to the functionality of the home network gateway 112 described above. To that end, the web proxy gateway 512 includes at least one processing device 608 that supports or provides a WS interface 630 for receiving and transmitting messages via WS protocols, a UPnP interface 640 for transmitting and receiving UPnP commands, and a WS/UPnP converter 650 for converting between the two. In another, alternative embodiment of the present invention, the web proxy gateway 512 acts as a UPnP proxy wherein UPnP messages, rather than WS messages, are sent directly from the mobile station 122 to the UPnP device 114 in the home UPnP network 110 through the web proxy gateway 512, which acts as a relay over the VPN connection.
Third, the web proxy gateway 512 acts as a secure gateway to the home UPnP network 110. Specifically, the web proxy gateway 512 includes a message authentication module 660, generally also embodied by the processing device 608, that performs message authentication and authorization. The web proxy gateway 512 may provide the authentication and authorization in various manners. In one embodiment, the messages are transmitted between the mobile station 122 and the web proxy gateway 512 in accordance with shared secret, i.e., encrypted in accordance with a key maintained by both the mobile station 122 and the web proxy gateway 512. Alternatively, the mobile station 122 and the web proxy gateway 412 may utilize other security mechanisms, such as that defined by the Liberty specifications provided by the Liberty Alliance (www.projectliberty.org), with the web proxy gateway 512 providing Liberty proxy functionality, or a mobile operator authentication procedure based on Authentication and Key Agreement (AKA). Finally, the web proxy gateway 512 also acts as a Control Point wherein it receives UPnP announcements from all of the UPnP devices 114 in the home UPnP network 110 and maps them into a Web page that can be accessed by the user from an external network.
In order to further secure the communication within the home UPnP network 110, in one embodiment of the present invention a security mechanism, such as one based on public key infrastructure (PKI), is also implemented locally in the home UPnP network 110. PKI is a cryptographic system wherein a pair of keys is used for encryption. Specifically, a public key encrypts data, while a private key is used to decrypt it. For digital signals, however, the process is reversed: the sender uses the private key to encrypt the signal, which is then decrypted by the receiver using the public key. According to one embodiment, a dedicated UPnP device 518, such as a gateway, PC or secure console, may provide this security mechanism. This dedicated security device 518 will be announced as security services to the home UPnP network 110 and will generate server certificates for the other devices in the home UPnP network 114, typically automatically following the announcement. The security device 518 may provide these certificates to the UPnP devices, or, in the alternative, it may keep the certificates and make them available to the UPnP devices upon request. In one embodiment, in order to securely communicate within the home UPnP network, a first device in the home UPnP network 114 will request the certificate of a second device with which it desires to communicate from either the security device 518 or the second device itself. The first device can then query the security device to determine whether the certificate is valid. In response, the second device may also request and verify the validity of the first device's certificate. Alternatively, each UPnP device 114 in the home UPnP network 110 may provide the other devices in the network with its certificate initially, rather than waiting until a desire to communicate arises, in order to enable future communication between the devices.
For example, in an embodiment where the security mechanism used is PKI, and the signals being transmitted are digital, a dedicated security device 518 may provide each UPnP device in the home UPnP network 114 with a server certificate containing both a public and a private encryption key. Each UPnP device 114 distributes its public key to the UPnP devices in the home UPnP network 114 with which it wishes to communicate. The UPnP device 114 then uses it private key to encrypt a message and transmit it to another UPnP device 114 in the network. The UPnP device 114 receiving the message can then use the public key previously received from the transmitting UPnP device 114 to decrypt the message and verify that the message was truly sent by the transmitter. In one embodiment of the present invention, the web proxy gateway 512 is the transmitting UPnP device. According to this embodiment, a message encryption module 670 of the web proxy gateway 512, which is generally embodied by computer program code stored by memory and executed by the processing device 608, encrypts the UPnP command corresponding to a WS message received from the mobile station 122 using the web proxy gateway's 512 private key prior to transmitting the UPnP command to a UPnP device in the home UPnP network 114. The receiving UPnP device can then use the web proxy gateway's 512 public key to decrypt the UPnP command and verify that it was the web proxy gateway 512 that sent it.
In another embodiment of the present invention, the certificates are self-generated by each UPnP device, rather than by a dedicated security device. This embodiment utilizes a security feature that is currently embodied in UPnP technology. Current UPnP technology includes the distribution of a secret token to each UPnP device when a user purchases it. The user then uses the secret token to generate a password for accessing the device. According to one embodiment of the present invention, this UPnP security feature is used to create the home PKI, whereby each UPnP device automatically generates its own certificate using the secret token at the moment the user installs the device and configures access rights to it. In one embodiment, each UPnP device distributes its certificate to the other devices in the UPnP network. Alternatively, in another embodiment, a dedicated security device in the UPnP network collects the certificates and makes them available for validation to the devices that wish to interact.
By permitting a mobile station 122 to communicate with UPnP devices in a home UPnP network 114 via WS, it is no longer necessary for the mobile station 122 to possess UPnP functionality. The mobile station 122 need not be capable of communicating via UPnP commands. In contrast to the embodiments discussed above, wherein the mobile station 122 was used to link two UPnP networks 110, 120, which required that the mobile station 122 possess both UPnP and gateway functionality, in the situations in which a mobile station 122 is communicating directly with the devices in one UPnP network via WS, the mobile station 122 employed can operate using only a thin application that does not include UPnP technology. It need not possess either UPnP or gateway functionality. This provides the advantage of allowing more versatile devices to communicate with a UPnP network. It further eliminates the risks inherent with incorporating UPnP technology, which may be owned and/or controlled by others, in the mobile stations.
Many modifications and other embodiments of the inventions set forth herein will come to mind to one skilled in the art to which these inventions pertain having the benefit of the teachings presented in the foregoing descriptions and the associated drawings. Therefore, it is to be understood that the inventions are not to be limited to the specific embodiments disclosed and that modifications and other embodiments are intended to be included within the scope of the appended claims. Although specific terms are employed herein, they are used in a generic and descriptive sense only and not for purposes of limitation.
