CN1354937A

CN1354937A - System enabling user to select information networks and method thereof

Info

Publication number: CN1354937A
Application number: CN00808429.7A
Authority: CN
Inventors: 余鲲
Original assignee: Individual
Current assignee: Individual
Priority date: 1999-06-02
Filing date: 2000-04-30
Publication date: 2002-06-19
Anticipated expiration: 2020-04-30
Also published as: CN1174579C

Abstract

The present invention relates to a system and a method for selecting information networks by users; the system includes at least two information networks and user terminals, and also includes: a network selector connects to the user terminal to receive and transmit user parameters and requests for accessing a information network and control the user terminal; a safe exchange connectting between each network selector and information network judging if the user parameters and requests are legal, and permit accessing the required information network for the user according to the judgement results. The present invention can not only realize the selection of information network for users, but also can assure the safety of information networks.

Description

System enabling user to select information networks and method thereof

A kind of system and method technical field for realizing user to select information networks

The present invention relates to information network, the system and its corresponding method of selection mechanism and security mechanism more particularly, to information network.Background technology

Signified information network of the invention includes telephone network, cable TV network, data network, IP network, such as computer interconnected network, the broadband IP network based on dense wave division multiplexer（IP over DWDM), both can be the public information network interconnected or the dedicated network, area under one's jurisdiction network or the security network that are physically mutually isolated etc., these information networks.Area under one's jurisdiction network refers to region, division based on such as country, provinces and cities, district, small towns, or with industry, the mutual physically-isolated information network divided based on such as IT industries, metallurgy industry, financial instrument industry.

At present, telephone set, the television set of user will be connected with telephone network, cable TV network with computer interconnected network respectively with computer, and had no option once being connected, this situation causes information network supplier to monopolize, both the interests of user had been compromised, also preventing network provisioning, person prevents its service quality, economic benefit from rapid growth because monopolistic.

It is typically both at home and abroad decomposed information network provisioning person for the method that the person that breaks network provisioning monopolizes, but the monopolistic power of its local network is not abolished at all, and user is still not much the right to choose to information network.For example, China's regulation communication network and the management functions of cable TV network must not intersect in the recent period, this just makes the monopolistic trend for more having a reinforcing of local network again.

Now only with a state（Such as China）Telecommunication service be decomposed into fixation（Transmit network）, mobile, satellite and the bulk of paging four mode for, framework after this decomposition is not broken up monopoly really actually, but be changed into present four from past one monopolization and monopolize a side respectively, and whether move, satellite or paging will more or less rely on fixed this part.For example, playing IP phone on the Internet of satellite link networking, not only lead to Quality is talked about to be not so good as to use the Internet of ground optical fiber networking good, and it still will finally enter the telephone network part that this fixation is netted；Mobile communication is even more that can not depart from this fixed part, because landline telephone alreadys exceed 100,000,000 at present, and the user of mobile phone only 20,000,000, and it is final or to enter the telephone network part of fixed net；Paging is just even more so, and most of user is to play paging by landline telephone；Data communication is also pessimistic, and satellite link is not so good as ground optical fiber transmit capacity greatly after all at present, and time delay is also much larger than optical fiber.In other words fix this part and substantially still monopolize all.And almost also it is actively engaged in competition without new operator in terms of access network.

On the other hand, flourishing due to computer interconnected network so that the safety of the information in computer local network is seriously threatened.Originally be information resources share for convenience computer network into being used to the instrument that facilitates of steal information, and it is usually not detectable to steal process, leaves no trace.In computer local network the unsafe basic reason of information be it once after access computer interconnected network almost the moment in face of hacker.

To ensure the information security of computer network, usual way is that fire wall or proxy server are added between computer local network and computer interconnected network, is controlled by software approach from access of the computer interconnected network to computer local network.But, due to technology, this does not cause the computer for being connected into internet to exempt from the attack from internet.Therefore those valuable, secrecy information still cannot get safety assurance.

Another method is the method separated using physical network, that is, ensures that computer interconnected network is not connected with valuable, secrecy internal computer network on physical circuit.So intra-office will be carried out putting two computers on the cable wiring manufacture of two networks, desk, and this not only adds the cost of office information system, the also use to information system is made troubles；Although two computers can be with common display, keyboard etc., network is not saved, and if being further added by the computer network of several different security levels if desired, also unlikely some computers are put into a boxes.

Global economic integration causes government, enterprise and society need more cheap, information timely and accurately and its high-quality information service, and such information and service could be obtained only by breaking telecommunications monopolization under orderly market competition order.Therefore, telecommunications is both accomplished With information market open competition（Particularly local network is competed）Ensure information security again, oneself extremely attracts people's attention and urgent problem through turning into.The object of the invention

It is an object of the invention to provide a kind of system and method for realizing user to select information networks, user can be made to possess the right to choose to various information networks, form the general layout of information network market competition, the Information Security of computer network can be solved again and using the contradiction between the convenience of computer access information network, prevent hacker from illegally entering internal computer network from internet.Present invention general introduction

To achieve the above object, the invention provides a kind of system for realizing user to select information networks, including at least two information networks and user terminal, it is characterised in that：Also include：Network selector, its one end is connected with the user terminal, connects the request of some information network to receive and transmit customer parameter and user, and control the user terminal；

Security switch, is connected with the other end of each network selector, also mutual physical isolation between mutual physical isolation, the terminal side ports of the security switch between the network-side port of the security switch；The security switch carries out validity judgement to the customer parameter from the network selector and request, and according to judged result, agrees to or refuse to access some information network for asking to connect by user.

The described system for realizing user to select information networks, it is characterised in that：Also include family hub, be connected between the network selector and the security switch, the signal for the user terminal that the network selector is transmitted is combined or decomposed.

The described system for realizing user to select information networks, it is characterised in that：Also include layer connection hub, be connected between the family hub and the security switch, the plurality of family hub is integrated, and the signal of the family hub is multiplexed and relayed.

The described system for realizing user to select information networks, it is characterised in that：The user terminal be one of computer, telephone set, television set, two or all；The information network is The public information network of interconnection or the dedicated network being physically isolated, security network or area under one's jurisdiction network, the public information network include telephone network, TV network, data network,

IP network, broadband IP network.

The described system for realizing user to select information networks, it is characterised in that：The network selector is provided with radio frequency, RJ11 and/or RJ45 ports, to be connected with the user terminal；The network selector is to be connected with RJ45 interfaces with the security switch, and the connection is that described customer parameter, request and control information is transmitted with a pair of twisted-pair feeders in the undefined twisted-pair feeder of two couple in RJ45 interfaces.

The described system for realizing user to select information networks, it is characterised in that：The network selector is provided with radio frequency, RJ11 and/or RJ45 ports, to be connected with the user terminal；The network selector and the family hub are connected with RJ45 interfaces, the family hub is connected with RJ45 ports with the security switch again, and signal is transmitted with a pair of twisted-pair feeders in the undefined twisted-pair feeder of two couple in RJ45 ports between the network selector, the family hub and the security switch.

The described system for realizing user to select information networks, it is characterised in that：This layer joins hub-end side and network side is provided with RJ45 ports, this layer connection hub is that, come Transfer Parameters and signal, this pair of twisted-pair feeder is to cause security switch handover information network with the change of voltage with a pair of twisted-pair feeders in the undefined twisted-pair feeder of two couple in RJ45 ports.

The described system for realizing user to select information networks, it is characterised in that：Another pair twisted-pair feeder in the undefined twisted-pair feeder of two couple in the RJ45 ports is for network of answering the call.

The described system for realizing user to select information networks, it is characterised in that：Described connection line is come Transfer Parameters and signal with optical fiber, catv line or adsl line.

The described system for realizing user to select information networks, it is characterised in that：The security switch is connected with a certificate server, the security switch is existing subscriber's parameter to be stored in the certificate server to judge the legitimacy of active user, the security switch is that the computer local network and IP gateway corresponding with each information network is connected to by network side RJ45 ports, TV network prevention at radio-frequency port or light sending and receiving terminal, and passes through the computer The Wide Area Network interface of LAN and IP gateway is connected with each information network.

The described system for realizing information network security selection, it is characterised in that：The network selector carries the driver of IC-card, to read the user profile stored in user's ID card.

The described system for realizing user to select information networks, it is characterised in that：The security switch is with the driver for reading ic cards, with the management ID card of identifying system keeper, and the user profile that the security switch is set according to system manager on the security switch generates user's ID card.

The described system for realizing user to select information networks, it is characterised in that：In the customer parameter for passing to the security switch through network selector and being judged through the security switch, including user's Zhi Pattern information.

The described system for realizing user to select information networks, it is characterised in that：In the customer parameter for passing to the security switch through network selector and being judged through the security switch, include the image surface information of user.

The described system for realizing user to select information networks, it is characterised in that：The user terminal is diskless computer, and the computer local network being connected with security switch is assembled with the file server that is worked for diskless computer, has the operational data of operating system, system data and each user of each diskless computer in this document server.

The described system for realizing user to select information networks, it is characterised in that：The user terminal is to have disk computer, the network selector is one to have disk computer to be to make this have disk computer from information network with the working method of diskless computer to start the machine when accessing the information network with access to the validated user of an information network, and the local hard drive for making this and having disk computer is stopped.

The described system for realizing user to select information networks, it is characterised in that：The user terminal is read-only optical disc computer, and the read-only optical disc computer is, from read operation system on local read-only optical disc, and to start the machine, but the data read and write are all on the computer local network connected.

The described system for realizing information network security selection, it is characterised in that：The user terminal is computer, and the network selector is placed in inside the Ji Bi machines, the face of the network selector Plate turns into the part of the register face or united two into one with CD drive or floppy disk.

The described system for realizing user to select information networks, it is characterised in that：The user terminal is telephone set, and the telephone set is switched by network selector, security switch between multiple telephone networks.

The described system for realizing user to select information networks, it is characterised in that：The user terminal is television set, and the television set is switched by network selector, security switch between multiple TV networks.

The described system for realizing user to select information networks, it is characterised in that：The user terminal is computer, and the computer must restart when user changes the selection to information network from the network selector connected every time, refresh internal memory, re-attached to the information network newly selected.

Present invention also offers a kind of system for realizing user to select information networks, including at least two information networks and user terminal, it is characterised in that：Also include：Network selector, is connected between the user terminal and information network, connects the request of some information network to receive and transmit customer parameter and user, and control the user terminal.

Invention further provides a kind of method for realizing user to select information networks, it is characterised in that：Comprise the following steps：

(1) network selector is received and transmits customer parameter and selects to connect the request of some information network with user, and user terminal is controlled；

(2) security switch response comes from the request of some information network of user's selection connection of network selector, and the legitimacy asked according to customer parameter the user judges；

(3) according to judged result, the request that user connects some information network is agreed to or refused to security switch.

The described method for realizing user to select information networks, it is characterised in that：The step（1) it is further comprising the steps of：

A, network selector read user's ID card, key, know user identity, judge subscriber terminal equipment type, and formation includes user identity, using security network, area under one's jurisdiction net Customer parameter including the authority of network or dedicated network level of confidentiality, type of user terminal；

B, the request for receiving user to select information networks, include the numbering and connection approach of the information network of user's selection；

The customer parameter and user's request are passed to security switch by c.

The described method for realizing information network security selection, it is characterised in that：The step（2) following steps are also included：

D, judge whether the user accesses security network, area under one's jurisdiction network or dedicated network；If whether e, user access the security network, area under one's jurisdiction network or dedicated network, then judge the user with access to the information network；

If f, user are with access to the information network, then judge whether terminal device used in user has the stored hard disk of guarantor or internal memory.

The described method for realizing information network security selection, it is characterised in that：The step（3) following steps are also included：

If g, the user do not access the security network, area under one's jurisdiction network or dedicated network, public information network is connected for user；

If h, user have no right to use the security network, area under one's jurisdiction network or dedicated network, refusal connects the information network；

If i, user are with access to the security network, area under one's jurisdiction network or dedicated network, and user terminal used in user does not protect stored hard disk or internal memory, then connects the information network that the user asks access by user；

If user is with access to the security network, area under one's jurisdiction network or dedicated network, but user terminal has the stored hard disk of guarantor or internal memory, then security switch connects the information network on the premise of user stops its hard disk operational and refreshes internal memory with network selector for user.

The described method for realizing user to select information networks, it is characterised in that：Family hub is connected between the network selector and the security switch, the signal for the user terminal that the network selector is transmitted is combined or decomposed.

The described method for realizing user to select information networks, it is characterised in that：Layer connection hub is connected between the family hub and the security switch, by the plurality of family hub collection Into getting up, and signal is multiplexed and relayed.

The described method for realizing user to select information networks, it is characterised in that：Connection between the network selector, family hub, layer connection hub, security switch transmits signal with a pair of twisted-pair feeders in the undefined twisted-pair feeder of two couple in RJ45 ports.

The described method for realizing user to select information networks, it is characterised in that：Another pair twisted-pair feeder in the undefined twisted-pair feeder of two couple in the RJ45 ports is for accessing telephone network.

The described method for realizing user to select information networks, it is characterised in that：In the customer parameter for passing to the security switch through network selector and being judged through the security switch, include the finger print information of user.

The described method for realizing user to select information networks, it is characterised in that：In the customer parameter for passing to the security switch through network selector and being judged through the security switch, include the image surface information of user.

The described method for realizing user to select information networks, it is characterised in that：The user terminal be one of computer, telephone set, television set, two or all；The information network is the public information network interconnected or the dedicated network, security network or the area under one's jurisdiction network that are physically isolated, and the public information network includes telephone network, TV network, data network, IP network and broadband IP network.

The described method for realizing user to select information networks, it is characterised in that：The user terminal is telephone set, and the telephone set is switched by network selector, security switch between multiple telephone networks.

The described method for realizing user to select information networks, it is characterised in that：The user terminal is television set, and the television set is switched by network selector, security switch between multiple TV networks.Industrial applicibility

Employ after the above method and system, the system and method for realizing user to select information networks of the invention, make user by manipulating network selector and distal end secure exchange on hand Mutual cooperation relation between machine, you can realize user's unrestricted choice information network and ensure selected network not by other network attacks so as to the hope that ensures information security, so as to obtain following economic benefit and social benefit：

1st, user is made to possess right to choose, break the monopolization of information network, not only so that information network company reduces price because of market competition, user is set to be benefited, and because market competition excites the potentiality of information network company, so as to improve its economic benefit, final result is to promote society common progressive.

2nd, it can not only ensure that the hacker on computer interconnected network has no chance to attack the information on the information network of concerning security matters, the number and their scope of activities of the information network using concerning security matters can also be limited, reduce the difficulty of public security organ clear up a criminal case, thus improve information network information security degree and people to the degree of belief of information network.

3rd, the present invention allows the classification number of information network level of confidentiality arbitrarily to increase and decrease, therefore it to be applicable not only to size of the organization little, security requirements are not high, only need to two physically-isolated information networks just mechanism much of that, apply also for that trans-regional, transnational, headcount is more, operation flow is complicated, information security of computer network sensitiveness is strong, level of confidentiality gets thin mechanism, especially government bodies, trans-corporation etc..

4th, the system is because reducing the soft and hardware equipment of network terminal computer, amount of calculation is shifted to central server, centralized calculation and distribution are calculated into flexibly coordinated management, computer is entered after family can be as using simple and convenient phone, it is not necessary to which abundant professional knowledge is with regard to that can safeguard the normal operation of computer.Meanwhile, the system makes full use of the various superiority of existing telephone network, cable TV network and computer network rather than tries to replace them, accomplishes to make the best use of everything.The brief description of accompanying drawing

Below, further detailed description is done to a kind of system and method for realizing user to select information networks of the present invention with reference to the drawings and specific embodiments.

Fig. 1 is the configuration figure of the network selector of the present invention.

Fig. 2 is the configuration figure of the security switch of the present invention. Fig. 3 is the configuration figure of the RJ45 Plus interfaces of the present invention.

Fig. 4 is that the layer of the present invention joins the configuration figure of hub.

Fig. 5 is the configuration figure of the family hub of the present invention.

Fig. 6 is the system schematic for realizing user to select information networks of the present invention.

Fig. 6 a are the configuration figures when present invention is directed to only two information networks.

Fig. 7 is the schematic diagram of the refinement of the home/office room network of the present invention.

Fig. 8 is the flow chart of the method realized that information network can be not only chosen but also do not attacked of the present invention.

Fig. 8 a are the network selector of the present invention and the workflow diagram of security switch.

Fig. 9 be the present invention system in network selector in software flow pattern.

Figure 10 be the present invention system in security switch in software flow pattern.The preferred embodiment of the present invention

As shown in fig. 6, be the system for realizing user to select information networks, including three parts, one is end user's network 51;Two be public information network 52;Three be security network 53, area under one's jurisdiction network 56 or dedicated network 54.End user's network 51 includes：User terminal, security switch 58, layer connection hub 59, network selector 60 (Fig. 1), family hub 61 (Fig. 5), certificate server 62, and with the computer local network LAN53 corresponding to information network,, LAN54 LAN56 ', LAN523,, LAN524 ', end user's network is general in same building thing（Such as Fig. 6 residential building/office building 63);Public information network 52 includes telephone network 521, cable TV network 522, data network 523, broadband IP network 524.In the present invention, same type of information network can be with more than one, so corresponding computer local network is more than one（As shown in Figure 6）.

The user terminal can be the user terminal of telephone set 572, television set 573, computer 571 or other forms.

Wherein, network selector 60, as shown in Figure 7, one end is respectively connected with above-mentioned telephone set 572, television set 573 or/and computer 571, for receiving customer parameter, the request that user connects some information network is received and transmits, network selector 60 is also to the calculating The hard disk of machine 571 is controlled.Network selector 60 can also be provided with camera 574.Family hub 61, the other end of network selector 60 is connected with the terminal side interface of family hub 61, and the network-side port of family hub 61 is connected with one layer of connection hub 59.The family hub 61 is the signal of different user terminals to be combined or be decomposed.

Layer connection hub 59, is connected between the security switch 58 of family hub 61 and one, the purpose is to which more family hubs 61 are integrated, and plays a part of signal multiplexing and relaying to family hub 61.

Security switch 58, side（End side）It is connected with family hub 61 or layer connection hub 59, opposite side（Network side）With the local network corresponding to the telephone network 521 or cable TV network 522 in various information networks, data network 523, broadband IP network 524（Including LAN53, LAN54, LAN56, LAN523, LAN524, Telephony Access and CATV, wherein Telephony Access and CATV are not done in Fig. 6 clearly indicates）It is connected.It is physically-isolated between the port of end side, is also physically-isolated between the port of network side.Security switch 58 is according to the customer parameter from end side network selector 60 and request, user is judged using the legitimacy of the information network, and according to judged result, agree to or refuse by the connected computer 571 of the network selector 60, television set 573, the access network side of telephone set 572 some information network.

Above-mentioned security switch 58 can be according to the increase of customer volume, several security switch are connected together, form the network in an a small range, for sake of convenience, in the present invention, the network of this small range is only regarded as a security switch, because as the network of a small range is with the function that this security switch is realized.

In the present invention, overall constitute of telephone set 572, television set 573, computer 571 and the network selector 60 being attached thereto and family hub 61 is referred to as home/office room network 631.

Network selector 60 in the present invention has RJ11, radio frequency and/or RJ45 ports, to be connected with each telephone set 572, television set 573 and/or computer 571, network selector 60 and family hub 61 are connected with RJ45, family hub 61 again and layer join hub 59 with RJ45 interfaces connect, layer join hub 59 again with RJ45 finally with security switch 58 Connection.These connections all transmit described customer parameter, request and control information to security switch 58 with a pair of twisted-pair feeders in the undefined twisted-pair feeder of two couple in RJ45 interfaces, and security switch 58 is connected to the computer local network corresponding with various information networks by its network-side port（LAN53, LAN54, LAN56, LAN523, LAN524 ') and IP gateway 66, then connected by both WAN ports with various information networks.

Because two pairs of twisted-pair feeders that RJ45 standards are defined are used for the transmission of the various agreements and network data of Ethernet, so the present invention uses a pair of twisted-pair feeders in two further pairs（Such as Fig. 3) use the authority information of network level of confidentiality to transmit user identity and user.Tl, Τ 2 represents any pair in two pairs of twisted-pair feeders undefined in RJ45 in Fig. 3, Τ 3, Τ 4 are another pairs, Τ 3, Τ 4 are exclusively used in connecting telephone wire, and it is schematical that it, which is indicated in the 4th core, the 5th core, the 7th core and the 8th core,.Tl, Τ 2 pressure difference can be+5V ,+12V ,+24V, -5V, -12V or -24V, the change of pressure difference represents that the information network that user terminal is accessed changes, so user to select information networks is not the change by IP addresses, but realized by the switching of physical circuit, so as to ensure not accusing each other between information network, the information on network is set to have safety assurance.

So, the definition of each core is respectively：

1-data send "+"

2-data send "-"

3-data receiver "+"

4 one levels of confidentiality, proof of identification etc. send "+"

5--level of confidentiality, proof of identification etc. send "-"

6-data receiver "-"

7th, 8--be used for access public phone network

Why T3, Τ 4 is used to access telephone network, is to be not desired to a speech communication and data communication is tied too tight, i.e., user carries out many coal body communications in unrestricted choice computer network（Including IP phone）When, him is not limited selects the public phone network 521 of competitive type.But the department for possessing sensitive information, while the terminal of user is accessed security network 53 by network selector 60, will prevent T3, Τ 4 and public phone network 521 connection. The RJ45 so defined is called RJ45 Plus by the present invention₀Therefore, the terminal side ports 601 and network-side port 602 of network selector 60 are all RJ45 Plus, the terminal side ports 581 of security switch 58 are RJ45 Plus, the network-side port 582 of security switch 58 is RJ45, and the both sides port 591,592 of layer connection hub 59 is all RJ45 Plus.

When network selector 60 with a distance from security switch 58 from being no more than 100 meters, layer connection hub 59 can be save.

When only two physically-isolated Ethernets, and its interface is when all having drawn in same room with them, can omit layer connection hub 59 and security switch 58.

When network selector 60 is from a distance from security switch 58 more than 100 meters, adsl line or catv line can be used.

When needing the speed of Ethernet more than 100Mbps, optical fiber 586 or other broadband transmission techniques and equipment replacement can be used, and decomposite one of channel as transmission customer parameter and the control channel of control information.

Above-mentioned computer 572 can be diskless computer or have disk computer, read-only optical disc computer or graphic terminal.

The network selector 60 of connection television set 573 is used to select cable TV network 522 and video on demand, and the network selector 60 is downloaded the program inventory of TV station and is shown on the screen of television set 573, and program interested is then selected by user.

Above-mentioned so-called diskless computer, refer to the system disk for itself both not guided the machine equipment to start, user's hard disk of data is not deposited, but there is the computer of internal memory and central processing unit (CPU), and motherboard, mainframe box, display, keyboard etc. yet.The diskless computer can only read the operating system of the relevant computer in file server to local memory with internetwork connection mode as described above by Ethernet, then start relevant equipment from local memory again.

For there is a disk computer, coupled network selector 60 makes it from network and starts the machine with the working method of diskless computer, and makes local hard drive be stopped.Read-only optical disc computer allows computer from read operation system on local read-only optical disc, starts this Network selector 60 also carries the driver of IC-card, for reading the user profile stored in user's ID card 64.Security switch 58 is with the driver for reading IC-card, the management ID card to make security switch identifying system keeper, generates user's ID card.

The numbering that network selector 60 is set according to user learns the network to be connected of user.Because network selector contains card reader, so, network selector 60 has the function of the information on the user's ID card 64 read in insertion card reader, when being not inserted into user's ID card 64, network selector 60 sets numbering as 0 automatically, represent network selector 60 connected telephone set 572, television set 573, computer 571 access default setting public information network 52.Especially, when each user changes the selection to information network on the network selector 60 that computer 571 is connected, it will all cause the restarting of computer 571 and reconnect to new information network.

The network selector 60 and security switch 58 also can be according to the finger print information or image surface information of user when user selects a certain information network to the user identity legitimacy judge.

Network selector 60 may also be placed in inside computer 571, so that the panel of the network selector 60 turns into the part of the panel of computer 571 or integrated with CD drive or floppy disk, its network number shows that 604, network number select button 603, network number ACK button 605 can also be attached on the panel of CD drive or floppy disk, and draws on the T1 and T2 of RJ45 interfaces of two information lines to the T1 and T2 (referring to Fig. 3) of the RJ45 interfaces of Ethernet card or on mainboard.The benefit of this design is to save the energy, and aspect is used, and reduces floor space.

The network selector 60 for connecting telephone set 572 can also be built into behind the RJ11 ports of Subscriber Line Concentrator 61, the network selector 60 selects corresponding information network by recognizing the dialing tone of telephone set 572.

Security switch 58 ensures what is be mutually isolated between dedicated network 54, security network 53, area under one's jurisdiction network 56 and public information network 52.Security switch 58 also contains card reader, and only system manager can just hold the management card of security switch, and only system manager just has the right to safeguard security switch 58.System manager is set on security switch 58 The information such as the level of confidentiality authority of each user, and generate user's ID card 64 for each user.The network side only one of which RJ45 Plus ports 592 of above-mentioned layer connection hub 59 and a prevention at radio-frequency port 593, its end side only one of which prevention at radio-frequency port 594 and multiple RJ45 Plus ports 591, the layer joins hub 59 without IC-card, and the effect of layer connection hub 59 is the access number that extends one's service.

The system of the present invention will adopt traditional tree-shaped wire structures, computer 571, television set 573, telephone set 572 are on leaf position, end side RJ45 Plus ports 601, RJ11 ports or the prevention at radio-frequency port 611 of respective network selector 60 (Fig. 1) are accessed, then is accessed by network side RJ45 Plus ports 602 or prevention at radio-frequency port 612 on a family hub 61（Fig. 5), one or more family hubs 61 are connected to the terminal side ports 591 that layer joins hub 59, home/office room network 631 (Fig. 7) is formed in 594 (Fig. 4), the home/office room network 631 joins the terminal side ports of the access security switch 58 of network-side port 592 (Fig. 2) of hub 59 from floor again, and be all to use 3 classes of the invention from network selector 60 to the line standard of the terminal side ports of security switch 58, category 5 twisted pair RJ45 Plus (Fig. 3) or optical fiber 586, cable television copper cable 581.Security switch 58 passes through the local network corresponding to network side RJ45 ports 583, cable TV network side ports 582 or light sending and receiving terminal 584,585 and various information networks again, these information networks both can be the public information network 52 interconnected or the dedicated network 54 or security network 53 being physically segregated etc..The computer local network being connected with security switch 58（LAN53, LAN54, LAN56, LAN523 LAN524 ' etc.）It is assembled with having the startup program of each diskless computer and the system data and operational data of each user in the file server worked for diskless computer, file server, name server, W servers, ftp server etc. is also equipped with addition.

At present, many users are by two physically-isolated Ethernet comprehensive wirings of computer 571 to same room with them, one is connected to internet 526, another is connected to security network 53 or dedicated network 54, to such case only need to network selector 60 for user selection by diskless computer（Or had disk computer by the control of network selector 60）Corresponding information network is accessed, without using security switch 58 and layer connection hub 59. If but the port of two networks of diskless computer distance is farther out, needing to access security switch

58, see Fig. 6 a.

Above-mentioned each information network being easily selected by a user, particularly public information network 52 is in race condition due to that can be easily selected by a user.

The present invention realizes that the method for user to select information networks is：User sets the numbering for the information network to be connected on network selector 60；The user's ID card 64 of the inspection Check insertions of network selector 60 and the user's face image obtained from camera, so as to know the parameters such as user identity, network level of confidentiality access right and network numbering, and these parameters are sent to security switch 58 by RJ45 Plus Tl, Τ 2 in the lump as the request to security switch 58;If network selector 60 does not find user's ID card 64, network numbering is automatically set to 0, it is meant that the user only accesses public information network 52;Security switch 58 is received after request by RJ45 Plus Tl, Τ 2, according to parameters such as the user ciphers and face-image having stored in certificate server 62, check whether user is validated user, whether Internet access its want access information network, it is that user connects the information network to be accessed after confirmed.According to the difference of user's level of confidentiality, only checking user's ID card can be selected, user's ID card and fingerprint or user's ID card, fingerprint and image surface three all certifications is either verified.The flow chart of this method is shown in Fig. 8 a.Idiographic flow is as follows：

Receive customer parameter and request；

Response user connects the request of some information network, and user validation is judged according to the customer parameter；

According to judged result, the request that user connects some information network is agreed to or refused；The customer parameter, including：User identity, face-image, key, user accesses the authority of described information network level of confidentiality, the numbering and access path of the current required information network accessed of user, whether require to start local computer from described information network, whether system disk is had, if be read-only optical disc computer or graphic terminal etc.；

User validation is judged, including：Judge the user whether access and whether Internet access security network 53, area under one's jurisdiction network 56 or dedicated network 54;

If the user does not access security network 53, area under one's jurisdiction network 56 or dedicated network 54, Then public information network 52 is connected for user;

If the user accesses security network 53, area under one's jurisdiction network 56 or dedicated network 54, judge the user whether with access to the information network；If having no right, refusal connects the security network 53, area under one's jurisdiction network 56 or dedicated network 54;

If the user is with access to the security network 53, area under one's jurisdiction network 56 or dedicated network 54, then judge whether LUT used in user has the stored hard disk of guarantor or internal memory, if so, connecting the information network on the premise of stopping hard disk operational and/or refreshing internal memory；If no, being switched on the information network；

Connect after information network, also provide the service of described information network.

For computer 571, often change an information network, computer 571 will be powered back up, refresh internal memory and other dynamic memories, if necessary will be in a short period of time, such as 1 second, refresh several times, to ensure to enter during other information network without the information in previous information network；File server is confirmed after user's request, sends the bootstrap of diskless computer, and diskless computer starts accordingly, and user is keyed in after the user name and password, into normal operating conditions.Television set 573 and telephone set 572 are (if without memory）It can wouldn't make safety inspection.

Fig. 8 is the flow chart for the method realized that information network can be not only chosen but also do not attacked, and the flow is described further below.

Step A1 obtains user identity, key, user accesses the authority of a certain information network, the current information network number to be accessed of user, whether require to start local computer from some information network, whether the parameters such as data disks is had, subsequently into step A2, if it is diskless computer that A2, which judges, then enter A3, otherwise it is exactly disk computer, into Bl, if at this moment there is disk computer not access public information network 52, then network selector 60 makes hard disc of computer to work during the visit in B2 steps, mean that this has disk computer also equally will start and run with diskless computer, it is transferred to A3, if step A3 judges that user is illegal, then C1 steps are alerted, stop user using, and remind user to change parameter, once user has changed parameter C2 steps and has moved back to Al, if step A3 judges that user is legal, then circuit is connected into A4 steps for user and normally run, until customer parameter hair Raw to change, A5 steps are return to step Al.

Fig. 8 function is to cooperate what is realized by the software in network selector 60 and security switch 58.The major function of network selector 60 is exactly to have a related parameter for what security switch 58 provided user, and is ready to stop disabled user using specific information network.The major function of security switch 58 is the legitimacy for judging user, is that validated user connects the information network.It is further described with reference to Fig. 9 and Figure 10.

In fig .9, step 11 is whether network selector 60 judges connected computer 571 from locally initiating.Step 12 is that network selector 60 assert that computer 571 has system disk, to ensure information security, network selector 60 will not allow computer 571 to access security network 53, dedicated network 54 or area under one's jurisdiction network 56, but allow it to access public information network 52, so setting network network numbering is 0 to step 14 by force.Step 13 shows that the computer 571 is diskless computer, its Internet access each security network 53, area under one's jurisdiction network 56 or dedicated network 54, but it is required that user inserts identification card 64, so that network selector 60 obtains subscriber identity information, the information network numbering selected in conjunction with user in step 15, is sent to security switch 58 by RJ45 Plus Tl, Τ 2 in the lump in step 17.Step 16 judges if the network number of user's selection is that 1 to 7 (classification of this network is schematical）, and if having local hard drive, then start from network, and during the security network 53, area under one's jurisdiction network 56 or dedicated network 54 is accessed cut-out local hard disk power supply.It can so prevent the information by security network 53, area under one's jurisdiction network 56 or dedicated network 54 to be unloaded on the hard disk of the computer, otherwise, be possible to divulge a secret when the computer accesses other information network again.If network selector 60 is not received by user's ID card 64, network numbering is automatically set to 0, it is meant that the user only accesses public information network 52, here it is step 14.Step 18 waits security switch 58 to reply the legitimacy of the user, if the conclusion is that illegal advance to step 19, and stops this time connection networking.Step 20 be network selector watch quietly user whether change of status or network number, whether user is changed, if not using family instead, whether active user will change connected information network, there is any one to change and just reach 21 and 17, loop back.

In Fig. 10, step 41 is Tl, the Τ 2 of security switch 58 by RJ45 Plus Wait the request from network selector 60, when not asking, circular wait, when having request, into step 42, at this moment must be that network numbering or user identity change, if user identity changes, but the current information network of Internet access, then connect the information network to be accessed for active user, here it is step 43,46,47, are then return to 41 waits；If user identity changes, but haves no right to access current secret network 53, area under one's jurisdiction network 56 or dedicated network 54, then into step 45, terminate and connect and reported an error to network selector 60.If user identity does not change, that is to change network numbering certainly, step 44 is if user has permission to access the security network 53, area under one's jurisdiction network 56 or dedicated network 54, step 48 notifies current file server to retain working site, the file server of corresponding information network is connected to according to user identity, network number etc., step 41 is returned to.

Due to public information network 52, security network 53, area under one's jurisdiction network 56 or the mutual physical isolation of dedicated network 54, the data between them will not be read mutually, especially, remaining information network can not be attacked from computer interconnected network 526.Diskless computer access information network just automatically becomes a part for the computer network, due to without hard disk, data can not be preserved in the machine, and when having disk computer access security network 53, area under one's jurisdiction network 56 or dedicated network 54, hard disk does not work, so computer will not reveal the information of original information network because it is exited when an information network accesses another information network again, so as to ensure the information security of information network.

When user switches between different information networks, the webserver automatically retains the operation scene of user, is continued to run with during to switch back again.

We might as well more intuitively examine the process for realizing this method closely.When the process equivalent to having there is several not connected information networks in front of the user, user plugs in the Network plug of a computer in interleaving for each information network as needed.

Why diskless computer is used, exactly in order to not reveal information from the computer of user.Why network selector 60 and security switch 58 are used, be in order to extend the length of the hand of plug, while reducing the cost of wiring and construction.

The system and method for realizing user to select information networks of the present invention, it can be many to make the telephone network 521 in information network, cable TV network 522, data network 523 It is individual.Telephone network 521 is scheduled on the line of demarcation of end user's network 51 on the Wide Area Network interface for the gateway 66 being connected with security switch 58（Fig. 6), so telephone network only needs to that Fiber To The Building or roadside, without being directly entered family, end user can exercise right to choose by network selector 60, the telephone network 521 or cable TV network 522 of selection oneself satisfaction provide service for oneself, competition so as to cause between communication network, between cable TV network, between telephone network and cable TV network, the monopolization of local network is also broken therewith.

The system of end user's network 51 of the present invention can alleviate the load of present local network, reduce the complexity of local network, improve the concentration degree of information network.End user specifies the network to be connected by network selector 60, and realizes that above-mentioned telephone network 521 can also be expanded to communication network, so as to form the situation of comprehensive Telecom Competition to information network selection with the help of security switch 58.

At this moment, user makes a phone call to be following situation：User picks up the telephone, press counterpart telephone number, the display screen on network selector 60 that telephone set 572 is connected shows multiple telephone network titles, and each telephone network completes unit price, the speech quality grade forecast value needed for this time conversing, etc., user can select some network on network selector 60 accordingly, and help to connect by security switch 58, detect the cost performance of other communication networks at any time in communication process, thus switch to more satisfying network.User can also specify the network using certain IXC, and require that the network for the local exchange carrier that it chooses itself with connects sequence automatically.Similarly, other dial-up services can make user select satisfied network at any time.

The acquisition of carrier grade service quality is that its circuit switched technology ensures that user monopolizes the channel of one end-to-endly.According to the system and method for the present invention, end user's network 51 is in fact a computer local network expanded, at least ensure user from its computer to the bandwidth that 10Mbps is monopolized security switch, telephone network 521, cable TV network 522 and computer network beyond security switch 58 do not have any change.One speech channel is 64Kbps, not compressed TV signal, and a channel only takes up 6Mbps, and the handling capacity of current linear speed multi-layer switches can reach more than 20Gbps, can support More than 3000 television sets are requested from a TV station simultaneously, and more than 3,000,000 telephone sets are taken on the telephone simultaneously, or more than 20,000 computers carry out network calculations simultaneously.The system and method for the present invention are no by force to do telephone network, TV network and computer network so-called " integration of three networks ", but continue with the advantage of each network, so, when user needs to make a phone call, security switch 58 of the invention can help user to connect traditional telephone network.

In the present invention, also can be integrated television set, visual telephone set and computer community network selector, the network selector controls selection of the combination to cable TV network 522, computer network and videophone network respectively provided with three sets of select buttons.Under the assistance of security switch 58, computer network completes the up order of catv on demand, and cable TV network completes the downstream signal of video on demand, plays on combination, or after being changed by D/A, the viewing video on demand program on existing simulated television.Because of the selection mechanism of information network, this video on demand is using telephone network and the uplink capacity of computer network, without carrying out bidirectional rebuilding to cable TV network 522.In addition, up channel can also be completed by mobile radio network or wireless fixed network.

Claims

Claims

1st, a kind of system for realizing user to select information networks, including at least two information networks and user terminal, it is characterised in that：Also include：

Network selector, its one end is connected with the user terminal, connects the request of some information network to receive and transmit customer parameter and user, and control the user terminal；

Security switch, is connected with the other end of each network selector, also mutual physical isolation between mutual physical isolation, the terminal side ports of the security switch between the network-side port of the security switch；The security switch carries out validity judgement to the customer parameter from the network selector and request, and according to judged result, agrees to or refuse to access some information network for asking to connect by user.

2nd, the system for realizing user to select information networks as described in claim 1, it is characterised in that：Also include family hub, be connected between the network selector and the security switch, the signal for the user terminal that the network selector is transmitted is combined or decomposed.

3rd, the system for realizing user to select information networks as described in claim 2, it is characterised in that：Also include layer connection hub, be connected between the family hub and the security switch, the plurality of family hub is integrated, and the signal of the family hub is multiplexed and relayed.

4th, the system for realizing user to select information networks as described in claim 1 or 2 or 3, it is characterised in that：The user terminal be one of computer, telephone set, television set, two or all；The information network is the public information network interconnected or the dedicated network, security network or the area under one's jurisdiction network that are physically isolated, and the public information network includes telephone network, TV network, data network, IP network, broadband IP network.

5th, the system for realizing user to select information networks as described in claim 1, it is characterised in that：The network selector is provided with radio frequency, RJ11 and/or RJ45 ports, to be connected with the user terminal；The network selector is to be connected with RJ45 interfaces with the security switch, and the connection is transmitted with a pair of twisted-pair feeders in the undefined twisted-pair feeder of two couple in RJ45 interfaces Described customer parameter, request and control information.

6th, the system for realizing user to select information networks as described in claim 2, it is characterised in that：The network selector is provided with radio frequency, RJ11 and/or RJ45 ports, to be connected with the user terminal；The network selector and the family hub are connected with RJ45 interfaces, the family hub is connected with RJ45 ports with the security switch again, and signal is transmitted with a pair of twisted-pair feeders in the undefined twisted-pair feeder of two couple in J45 ports between the network selector, the family hub and the security switch.

7th, the system for realizing user to select information networks as described in right wants 3, it is characterised in that：This layer joins hub-end side and network side is provided with RJ45 ports, this layer connection hub is that, come Transfer Parameters and signal, this pair of twisted-pair feeder is to cause security switch handover information network with the change of voltage with a pair of twisted-pair feeders in the undefined twisted-pair feeder of two couple in RJ45 ports.

8th, the system for realizing user to select information networks as described in claim 5 or 6 or 7, it is characterised in that：Another pair twisted-pair feeder in the undefined twisted-pair feeder of two couple in the RJ45 ports is for network of answering the call.

9th, the system for realizing user to select information networks as described in claim 5 or 6 or 7, it is characterised in that：Described connection line is come Transfer Parameters and signal with optical fiber, catv line or adsl line.

10th, the system for realizing user to select information networks as described in claim 5 or 6 or 7, it is characterised in that：The security switch is connected with a certificate server, the security switch be be stored in the certificate server oneself have customer parameter and judge the legitimacy of active user, the security switch is that the computer local network and IP gateway corresponding with each information network is connected to by network side RJ45 ports, TV network prevention at radio-frequency port or light sending and receiving terminal, and is connected by the Wide Area Network interface of the computer local network and IP gateway with each information network.

11st, the system for realizing information network security selection as described in claim 1 or 2 or 3, it is characterised in that：The network selector carries the driver of IC cards, to read the user profile stored in user's ID card. 12nd, the system for realizing user to select information networks as described in claim 11, it is characterised in that：The security switch is with the driver for reading IC cards, with the management ID card of identifying system keeper, and the user profile that the security switch is set according to system manager on the security switch generates user's ID card.

13rd, the system as claimed in claim 1 for realizing user to select information networks, it is characterised in that：In the customer parameter for passing to the security switch through network selector and being judged through the security switch, include the finger print information of user.

14th, the system as claimed in claim 1 for realizing user to select information networks, it is characterised in that：In the customer parameter for passing to the security switch through network selector and being judged through the security switch, include the image surface information of user.

15th, the system for realizing user to select information networks as described in claim 1 or 2 or 3, it is characterised in that：The user terminal is diskless computer, and the computer local network being connected with security switch is assembled with the file server that is worked for diskless computer, has the operational data of operating system, system data and each user of each diskless computer in this document server.

16th, the system for realizing user to select information networks as described in claim 1 or 2 or 3, it is characterised in that：The user terminal is to have disk computer, the network selector is one to have disk computer to be to make this have disk computer from information network with the working method of diskless computer to start the machine when accessing the information network with access to the validated user of an information network, and the local hard drive for making this and having disk computer is stopped.

17th, the system for realizing user to select information networks as described in claim 1 or 2 or 3, it is characterised in that：The user terminal is read-only optical disc computer, and the read-only optical disc computer is, from read operation system on local read-only optical disc, and to start the machine, but the data read and write are all on the computer local network connected.

18th, the system as claimed in claim 1 for realizing information network security selection, it is characterised in that：The user terminal is computer, and the network selector is placed in the computer-internal, and the panel of the network selector turns into the part of the register face or united two into one with CD drive or floppy disk. 19th, the system for realizing user to select information networks as described in claim 1 or 2 or 3, it is characterised in that：The user terminal is telephone set, and the telephone set is switched by network selector, security switch between multiple telephone networks.

20th, the system for realizing user to select information networks as described in claim 1 or 2 or 3, it is characterised in that：The user terminal is television set, and the television set is switched by network selector, security switch between multiple TV networks.

21st, the system for realizing user to select information networks as described in claim 1 or 2 or 3, it is characterised in that：The user terminal is computer, and the computer must restart when user changes the selection to information network from the network selector connected every time, refresh internal memory, re-attached to the information network newly selected.

22nd, a kind of system for realizing user to select information networks, including at least two information networks and user terminal, it is characterised in that：Also include：Network selector, is connected between the user terminal and information network, connects the request of some information network to receive and transmit customer parameter and user, and control the user terminal.

23rd, a kind of method for realizing user to select information networks, it is characterised in that：Comprise the following steps：

(1) network selector is received and transmits customer parameter and selects to connect the request of some information network with user, and user terminal is controlled；

(2) security switch response comes from the request of some information network of user's selection connection of network selector, and the legitimacy asked according to customer parameter the user judges；

(3) according to judged result, the request that user connects some information network is agreed to or refused to security switch.

24th, the method for realizing user to select information networks as described in claim 23, it is characterised in that：The step（1) it is further comprising the steps of：

A, network selector read user's ID card, key, know user identity, judge subscriber terminal equipment type, and formed including user identity, use the customer parameter including security network, the authority of area under one's jurisdiction network or dedicated network level of confidentiality, type of user terminal； B, the request for receiving user to select information networks, include the numbering and connection approach of the information network of user's selection；

The customer parameter and user's request are passed to security switch by C.

25th, the method as claimed in claim 23 for realizing information network security selection, it is characterised in that：The step（2) following steps are also included：

D, judge whether the user accesses security network, area under one's jurisdiction network or dedicated network；If e, user access the security network, area under one's jurisdiction network or dedicated network, then judge the user whether with access to the information network-,

If f, user are with access to the information network, then judge whether terminal device used in user has the stored hard disk of guarantor or internal memory.

26th, the method as claimed in claim 25 for realizing information network security selection, it is characterised in that：The step（3) following steps are also included：

If g, the user do not access the security network, area under one's jurisdiction network or dedicated network, public information network is connected for user；

If h, user have no right to use the security network, area under one's jurisdiction network or dedicated network, refusal connects the information network；

If i, user are with access to the security network, area under one's jurisdiction network or dedicated network, and user terminal used in user does not protect stored hard disk or internal memory, then connects the information network that the user asks access by user；

If user is with access to the security network, area under one's jurisdiction network or dedicated network, but user terminal has the stored hard disk of guarantor or internal memory, then security switch connects the information network on the premise of user stops its hard disk operational and refreshes internal memory with network selector for user.

27th, the method as claimed in claim 23 for realizing user to select information networks, it is characterised in that：Family hub is connected between the network selector and the security switch, the signal for the user terminal that the network selector is transmitted is combined or decomposed.

28th, the method as claimed in claim 27 for realizing user to select information networks, it is characterised in that：Layer connection hub is connected between the family hub and the security switch, should Multiple family hubs are integrated, and signal is multiplexed and relayed.

29th, the method as claimed in claim 28 for realizing user to select information networks, it is characterised in that：Connection between the network selector, family hub, layer connection hub, security switch transmits signal with a pair of twisted-pair feeders in the undefined twisted-pair feeder of two couple in RJ45 ports.

30th, the method as claimed in claim 29 for realizing user to select information networks, it is characterised in that：Another pair twisted-pair feeder in the undefined twisted-pair feeder of two couple in the RJ45 ports is for accessing telephone network.

31st, the method as claimed in claim 23 for realizing user to select information networks, it is characterised in that：In the customer parameter for passing to the security switch through network selector and being judged through the security switch, include the finger print information of user.

32nd, the method as claimed in claim 23 for realizing user to select information networks, it is characterised in that：In the customer parameter for passing to the security switch through network selector and being judged through the security switch, include the image surface information of user.

33rd, the method as claimed in claim 23 for realizing user to select information networks, it is characterised in that：The user terminal be one of computer, telephone set, television set, two or all；The information network is the public information network interconnected or the dedicated network, security network or the area under one's jurisdiction network that are physically isolated, and the public information network includes telephone network, TV network, data network, IP network and broadband IP network.

34th, the method as claimed in claim 23 for realizing user to select information networks, it is characterised in that：The user terminal is telephone set, and the telephone set is switched by network selector, security switch between multiple telephone networks.

35th, the method as claimed in claim 23 for realizing user to select information networks, it is characterised in that：The user terminal is television set, and the television set is switched by network selector, security switch between multiple TV networks.