JP2001345802A - Security method and terminal adapter device in internet connection - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a terminal adapter device for internet connection, with which security in the internet connection can be enhanced markedly in a long- time connection, such as in continuous connection. SOLUTION: This device is provided with a line-accommodating part 3 for providing an interface with a communication connecting party, terminal accommodating part 2 for accommodating a terminal, user information extracting part 4 for extracting a user ID and a password or the like, sent from the accommodated terminal at the time of the internet connection, IP address extracting part 5 for extracting an IP address assigned from the connecting party at connection time, communication time managing part 6 for managing communication time after the generation of a communication call, IP address managing part 7 for managing the IP address with respectively independent values on the terminal side and the line side, information storage part 8 for storing the information extracted by the user information extracting part 4 and the IP address extracting part 5, and control part 9.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

[0001] 1. Field of the Invention [0002] The present invention relates to a security method and a terminal adapter device for an Internet connection.

[0002]

2. Description of the Related Art Conventionally, in order to secure security in the Internet connection, it is necessary for a user to be conscious of avoiding a long-time connection, to introduce an expensive and complicated router, or to have specialized knowledge. Or build a firewall server to prevent unauthorized intrusion from outside. However, in routers and the like, IP (Internet)
In many cases, the IP address of the router is searched for, and the IP address of the terminal accommodated in the router is searched for by the remote setting command, and the terminal is illegally accessed. Was.

[0003] In addition, devices such as terminal adapters which are relatively inexpensive and do not need to be set have been indifferent in terms of security for Internet connection, but conventionally, IP addresses are ISP (Internet).
IS only when connecting to Service Provider)
Since the IP address is not assigned from P, the assigned IP address cannot be searched unless the connection is made for a long time, so that damage due to unauthorized intrusion rarely occurs.

[0004]

However, in recent years, when it has become possible to construct an always-on environment with a fixed charge such as a fixed connection service, a case is considered in which the connection state is maintained for a long time using the IP address assigned by the ISP. However, in such a case, there was no security provided by the terminal adapter.

[0005] It is an object of the present invention to provide a security method and a terminal adapter device for Internet connection that can significantly improve the security for Internet connection in long-time connection such as continuous connection.

[0006]

The features of the present invention are assigned by automatically disconnecting / reconnecting a line periodically or randomly without making the user aware when connecting to the Internet for a long time. It consists in forcibly refreshing the IP address. By doing so, it is possible to prevent the IP address from being searched for unauthorized entry, thereby enhancing security.

The disconnection / reconnection of the line is performed by a terminal adapter device. According to the present invention, a terminal adapter device used in an environment for performing Internet connection and data transfer includes a line accommodating unit for providing an interface with a communication connection partner, a terminal accommodating unit for accommodating a terminal such as a personal computer, and an Internet. A user information extracting unit for extracting a user ID, a password, and the like sent from the accommodation terminal at the time of connection, an IP address extracting unit for extracting an IP address assigned at the time of connection from a connection partner, and a communication time since a communication call was generated , An IP address management unit that manages IP addresses with independent values on the terminal side and the line side, and information that stores information extracted by the user information extraction unit and the IP address extraction unit. Storage unit, ISDN control, PPP (Point
and a control unit that controls the entire apparatus including control of the apparatus (to point protocol).

With this configuration, the user information (user ID and password) transmitted from the terminal when connected to the Internet is extracted by the user information extraction unit and stored in the information storage unit. After the connection, the Internet connection is subjected to PPP authentication. During this phase, IP address information assigned from the line connection destination is extracted by the IP address extraction unit, and stored in the information storage unit and the IP address management unit. And the IP address of the line side are separated and managed. An IP packet transmitted during communication always converts the terminal-side and line-side IP addresses managed by the IP address management unit. When the communication time continues and the communication time continuation is detected by the communication time management unit, the flow control of the terminal housed in the terminal housing unit is performed by the instruction of the control unit, and the data transmission from the terminal side is stopped, Disconnect the communication line. After disconnecting, the control unit performs re-transmission and re-establishes a communication call. Further, PPP authentication is performed by the control unit in the terminal adapter device. At this time, authentication is performed using the user ID and password stored in the information storage unit. Further, an IP address newly assigned from the line connection destination is extracted again by the IP address extraction unit and stored in the information storage unit and the IP address management unit. At this time, the IP address on the line side is reflected in the IP address management unit, and the IP address on the line side is reflected.
Update the P address to the new IP address, and
Reflect on the packet. The PPP authentication phase is complete,
After the IP address is updated, the control unit releases the flow control of the terminal accommodating unit and continues communication.

According to the configuration and operation of the present invention, a long time I
It is possible to prevent the P address from being fixed and to improve security.

[0010]

DESCRIPTION OF THE PREFERRED EMBODIMENTS FIG. 1 shows a configuration diagram of a terminal adapter device according to an embodiment of the present invention. The terminal adapter device 1 extracts a line accommodating unit 3 for providing an interface with a communication connection partner, a terminal accommodating unit 2 for accommodating a terminal such as a personal computer, and a user ID and a password sent from the accommodating terminal when connected to the Internet. A user information extracting unit 4, an IP address extracting unit 5 for extracting an IP address assigned at the time of connection from a connection partner, a communication time managing unit 6 for managing a communication time after a communication call is generated, and an IP address Address management unit 7 that manages the information on the terminal side and the line side with independent values, an information storage unit 8 that stores information extracted by the user information extraction unit 4 and the IP address extraction unit 5, an ISDN control, PPP
The control unit 9 controls the entire terminal adapter device including (Point to Point Protocol) control.

FIG. 2 is a more detailed block diagram of the control unit 9. A terminal accommodating unit I / F 10 having an interface with the terminal accommodating unit 2 and a terminal accommodating unit I centered on a central processing unit 19 for controlling the entire terminal adapter device.
A terminal control unit 11 for performing a terminal control protocol, signal line control, etc. through the / F, a line accommodating unit I / F 12 having an interface with the line accommodating unit 3, and a protocol for the ISDN line via the line accommodating unit I / F. And an ISDN protocol control unit 13 for performing disconnection / retransmission, etc.
PPP control unit 14 for controlling the PPP authentication procedure at the time of connection
An information storage unit I / F 15 having an interface with an information storage unit 8 for storing terminal information;
A communication time management unit I / F 16 having an interface with the communication time management unit 6 for notifying at a fixed time, and an IP address management having an interface with the IP address management unit 7 managing the IP addresses of the terminal side and the line side. Part I /
F17 and a memory 18 used for work and storage.

FIG. 3 shows a connection diagram of the terminal adapter device according to the present embodiment. FIG. 4 shows a basic sequence when connecting to the Internet. Hereinafter, the terminal adapter device is abbreviated as a TA device in the drawings.

As shown in FIG. 3, the terminal adapter device 1 of the present embodiment is connected to an ISP 24 connected to an ISD.
N terminal (INS Net (registered trademark) 64) 20 is connected, a personal computer is accommodated in terminal 22 by RS-232C interface, and the Internet is connected to PPP (Point).
to Point Protocol) connection, PP
P authentication procedure is PAP (Password Authore)
Consideration is made on the case where the authentication is carried out by using an authentication protocol.

The communication between the terminal, the terminal adapter device according to the embodiment, and the ISP will be described with reference to the sequence diagram of FIG.

The accommodation terminal uses the AT command to instruct the terminal adapter device 1 to connect to the Internet (AT dial). The terminal adapter device 1 transmits a call to the designated telephone number from the terminal through the ISDN line according to the connection instruction, and establishes an ISDN call (step 4).
01). When the terminal confirms that the communication call has been established, a PPP authentication procedure is started on the communication channel (steps 402 to 404). When the PPP authentication is completed, data communication is performed using an IP packet (step 405).

Next, FIG. 5 shows a sequence diagram describing the sequence diagram shown in FIG. 4 including the operation timing of the terminal adapter device of the present embodiment.

The terminal control unit 11 which has received the instruction to connect to the line from the terminal accommodated in the terminal accommodating unit 2 issues an instruction to the ISDN protocol control unit 13 and makes an ISDN call to the ISDN line accommodated in the line accommodating unit 3. Make a call. At this time,
The telephone number of the connection partner is extracted by the user information extraction unit 4 and stored in the information storage unit 8. Connection destination (IS
When the connection to P) is completed, the control unit 9 sends a connection (CONNECT) message to the terminal accommodation unit 2 and the IS
The completion of the connection of the DN line is clearly indicated to the terminal (step 501). When the communication time management unit 6 detects that the communication has been established, a counting operation is started to measure the communication time.

When the terminal recognizes that the line connection has been made, a request [LC
P (Link Control Protocol)
[Configure Request]. In the terminal adapter device, the link setting parameters are extracted and stored by the control unit 9 and used at the time of retransmission (step 502). After the link is established, the process proceeds to the authentication establishment phase, where the terminal transmits the user ID and password (step 510).

The user ID and password transmitted from the terminal in the PAP authentication phase are extracted by the user information extraction unit 4 and stored in the information storage unit 8 (step 51).
0). The user ID and password are held until a disconnection instruction (user's instruction) from the terminal is issued, and are used when disconnection / reconnection is a function of the terminal adapter device. If the user ID and the password are normal, the connection with the ISP is completed (step 503).

When the authentication phase is completed, the terminal establishes network control. The terminal first starts IPCP
(Internet Protocol Control
1Protocol) setting request and send IS
Require P to set IP address (IPCP
Config Request).

In the terminal adapter device, a similar IPCP setting request is transmitted to the ISP for the line. The ISP receives this request and sends it to the server (IS
P) and the IP address of the terminal are assigned and returned (step 511). In FIG. 7, the IP address assigned to the terminal by the ISP is 133.205.100.
100, the IP address assigned to the server is 1
33.205.100.1.

In the terminal adapter device, IPCP
Server and terminal IP addresses (133.205.10) in the Configure ACK (or NAK)
0.1 and 133.205.100.100)
The address is extracted by the address extraction unit 5 and stored in the IP address management unit 7 (step 511).

Further, the IP address management section 7 determines a locally generated IP address different from the assigned IP address, and notifies the terminal side of the IP address (step 512). That is, as for the IP address to be notified to the terminal, the IP address on the line side is temporarily terminated in the terminal adapter device, and the IP address management unit 7 locally generates the IP addresses of the terminal adapter device and the terminal and notifies the terminal. .

FIG. 7 shows the IP address of the terminal adapter device itself generated locally by the terminal adapter device as 192.168.1.1, and the IP address of the terminal generated locally as 192.168. 1.
Shown at 10. These local IP addresses are kept constant until a disconnection instruction (disconnection by the user's intention) is issued from the terminal side, and are not affected by line disconnection / reconnection.

In the example of FIG. 7, the terminal itself is 192.16.
8.1.10, the other party recognizes that it is 192.168.1.1, and the ISP server itself is 133.205.100.
1. The other party recognizes that it is 133.205.100.100. That is, the terminal adapter device is
Assuming that the P address is 192.168.1.1,
Assuming that the P address is 133.205.100.100,
Each is managed as an independent value.

With the above, the establishment phase of the network control ends, and a series of PPP establishment processing ends (step 504).

Thereafter, during the data communication, the IP packet data is exchanged between the terminal and the server. However, the source and destination IP addresses are always converted based on the information of the IP address management unit 7, and the communication is performed. It continues (steps 505 and 513). The conversion of the IP address is performed for all the IP packet data under communication. According to the management of the IP address shown in FIG. 7, when the packet is sent from the terminal to the terminal adapter device and from the terminal adapter device to the line, the IP address is converted, and conversely, from the line to the terminal adapter device and from the terminal adapter device to the terminal. The IP address is also converted when transmitting a packet. Specifically, when an IP packet is transmitted from the terminal to the terminal adapter device, the terminal adapter device rewrites the source of the transmitted IP packet to its own line-side IP packet and changes the destination to the server IP address. rewrite. Conversely, when an IP packet is transmitted from the server, the terminal adapter device rewrites the source of the transmitted IP packet to its own terminal-side IP packet and rewrites the destination to the terminal's IP address.

For example, in FIG. 7, when an IP packet is transmitted from the terminal, the terminal adapter rewrites the source to 133.205.100.100, rewrites the destination to 133.205.100.1. Send to Conversely, when an IP packet is transmitted from the server, the terminal adapter device rewrites the source to 192.168.1.1, rewrites the destination to 192.168.1.10, and transmits the terminal to the terminal.

Next, a sequence for disconnecting / reconnecting from the state of communication establishment will be described with reference to FIG.

When a communication disconnection period (disconnection / retransmission period) occurs in the communication time management unit 6 in a state where communication is established by exchanging IP packets (step 60).
1) Notifying the control unit 9 of the occurrence of the cutting cycle. The control unit 9, which has been notified of the disconnection cycle, monitors the timing at which the data (IP packet) flowing between the terminal accommodating unit 2 and the line accommodating unit 3 is temporarily interrupted. An instruction is issued to the control unit 11, and data transmission is stopped by the terminal accommodation unit 2 by flow control. This time R
In the present embodiment in which the terminal is connected in S-232C, the CS line is turned off, and transmission from the terminal side is stopped (step 612).

After the flow is stopped, the control unit 9 instructs the PPP control unit 14 to end the PPP session, and the PPP control unit 14 closes the PPP session (Terminate transmission) (step 60).
4). ISP requested to close PPP session
Server responds to the PPP session close (step 604).

After closing the PPP session by the PPP control unit 14, the control unit 9 instructs the ISDN protocol control unit 13 to disconnect the line, and
The SDN protocol control unit 13 disconnects the communication call on the ISDN line side (step 605).

After confirming the disconnection, the control unit 9 instructs the ISDN protocol control unit 13 to transmit again in order to perform retransmission. The ISDN protocol control unit 13 redials the destination telephone number stored in the information storage unit 8 (step 606). Once the connection with the ISP is completed,
The connection of the ISDN line is completed.

The control unit 9 notified of the completion of the line connection from the ISDN protocol control unit 13 instructs the PPP control unit 14 to start a PPP session. Upon receiving this instruction, the PPP control unit 14
(Link Control Protocol) is established (step 607), and in response to the establishment of the LCP (step 613), authentication is established. At this time,
The PAP authentication is completed using the user ID and the password stored in the information storage unit 8 (step 60).
8,614). After the authentication is established, the process proceeds to the establishment of the network control, and requests the ISP server to allocate an IP address (step 609). Since the ISP assigns a new IP address, the line-side IP address of the terminal adapter device is refreshed at this point. The newly assigned IP address is extracted by the IP address extraction unit 5, and the line-side IP address of the IP address management unit 7 is rewritten (step 615).

The PP completed up to this phase of the PPP
The P control unit 14 notifies the control unit 9 of the establishment of the PPP session, and the control unit 9 having received the notification instructs the terminal control unit 11 to release the data stop state by the flow control in the terminal accommodation unit 2 ( Step 616). In this example, CS
The line is turned on, and reception of data transmitted from the terminal is started. Thereafter, the same operation as in the communication state is performed, and the state of the refreshed IP address management unit 7 is reflected.
Transmission of the P packet continues (step 617).

As described above, the terminal adapter device comprises:
By periodically disconnecting / reconnecting the line, the ISP
By refreshing the IP address assigned from, it is possible to prevent the IP address from being searched and illegally invaded.

In this embodiment, line disconnection / reconnection is performed periodically, but may be performed randomly.

When the line is disconnected / reconnected by the terminal adapter device as described above, if the line is an ISDN line, the time required for disconnection / reconnection is about 10 seconds, and the user of the terminal needs to confirm that the line is connected. You are not aware that you have been disconnected.

In the above embodiment, the ISD
Although the N line has been described, the connection to a local area network (LAN) line may be considered by changing the line accommodating unit 3 and the ISDN protocol control unit 13.

At this time, DHCP (Dynamic H)
ost Configuration Protocol
In the system where the IP address is assigned according to 1), it becomes possible to periodically refresh the IP address assigned by DHCP, and the
The P address is searched for, and the probability of entry is significantly reduced.

In the above embodiment, the RS-232C is used as the terminal accommodating interface. However, the terminal accommodating unit 2 is provided with a USB (Universal Serial Bu
By implementing the protocol interface of s), USB can be used as an interface with the terminal.

[0042]

According to the present invention, in a long-time connection such as an always-on connection, the IP address always changes without being fixed, so that the security in the Internet connection can be remarkably increased. In addition to preventing intrusion from the outside, security can be easily secured with a terminal adapter at low cost even for a system that normally had to secure security by a firewall or the like.

Although the conversion of the IP address is realized by a router or the like, it is difficult to set the user and the like, and the usability is not good.

In the present invention, the extraction circuit does not make the user aware of the IP address and the user ID, and disconnection / reconnection is automatically performed, which is useful for improving operability.

[Brief description of the drawings]

FIG. 1 is a diagram showing a configuration of a terminal adapter device according to a first embodiment of the present invention.

FIG. 2 is a detailed diagram of a control unit of FIG.

FIG. 3 is a diagram showing connection of a terminal adapter device.

FIG. 4 is a diagram showing a basic sequence when connecting to the Internet.

5 is a diagram showing a sequence in which the sequence diagram shown in FIG. 4 is described including the operation timing of the terminal adapter device of the present invention.

FIG. 6 is a diagram showing a disconnection / reconnection sequence.

FIG. 7 is a diagram showing a conversion image of an IP address.

[Explanation of symbols]

 DESCRIPTION OF SYMBOLS 1 Terminal adapter apparatus 2 Terminal accommodating part 3 Line accommodating part 4 User information extraction part 5 IP address extraction part 6 Communication time management part 7 IP address management part 8 Information storage part 9 Control part 10 Terminal accommodation part I / F 11 Terminal control part 12 Line accommodating unit I / F 13 ISDN protocol control unit 14 PPP control unit 15 Information storage unit I / F 16 Communication time management unit I / F 17 IP address management unit I / F 18 Memory 19 Central processing unit 20 ISDN line 22 Terminal 24 ISP

Claims (17)

[Claims] When a user terminal is connected to a line by a terminal adapter device and connected to the Internet via a provider for a long time, the terminal adapter device disconnects / reconnects the line periodically or randomly. Thereby refreshing the IP address assigned by the provider to the terminal to prevent unauthorized entry into the terminal. 2. The terminal adapter device according to claim 2, wherein said terminal adapter device notifies said terminal adapter device of an IP address assigned to a terminal and an IP address assigned to a server of said provider. It generates its own IP address and the IP address of the terminal locally,
2. The security method according to claim 1, wherein an address is notified to the terminal. 3. The terminal adapter device uses the terminal IP address notified from the provider as a line-side IP address, and uses a locally generated IP address of the terminal adapter device notified to the terminal as a terminal-side IP address. 3. The security method according to claim 2, wherein the security is independently managed. 4. The terminal adapter device rewrites a source of an IP packet based on the terminal-side IP address and the line-side IP address when an IP packet is transmitted from the terminal or the server of the provider. 4. The security method according to claim 3, wherein the destination of the IP packet is rewritten to the destination IP address. 5. The security method according to claim 1, wherein when the line is disconnected by the terminal adapter device, the terminal stops transmitting an IP packet. 6. A terminal adapter device for connecting a user terminal to a line connected to an Internet provider, wherein the terminal adapter device has a function of periodically or randomly disconnecting / reconnecting the line. Terminal adapter device. 7. When the provider notifies the IP address assigned to the terminal and the IP address assigned to the server of the provider, the terminal adapter device determines the IP address of the terminal adapter device itself and the IP address assigned to the terminal. 7. The terminal adapter device for Internet connection according to claim 6, wherein an IP address of the terminal is generated locally, and the IP address is notified to the terminal. 8. Independently managing an IP address of the terminal notified from the provider as a line-side IP address, and an IP address of a locally generated terminal adapter device notified to the terminal as a terminal-side IP address. The terminal adapter device for Internet connection according to claim 7, wherein: 9. When an IP packet is transmitted from the terminal or the server of the provider, the terminal I side
Based on the P address and the line side IP address,
9. The terminal adapter device for Internet connection according to claim 8, wherein the source of the packet is rewritten and the destination of the IP packet is rewritten to the destination IP address. 10. When a line is disconnected, the terminal has I
The terminal adapter device for Internet connection according to any one of claims 6 to 9, wherein transmission of the P packet is stopped. 11. A terminal adapter device used in an environment in which data is transferred by connecting to the Internet, a line accommodating unit for providing an interface with a communication connection partner, a terminal accommodating unit for accommodating a terminal, and an accommodating unit for accommodating an Internet connection. A user information extracting unit for extracting user information sent from a terminal, an IP address extracting unit for extracting an IP address assigned at the time of connection from a connection partner, and a communication time management for managing a communication time after a communication call is generated An IP address management unit that manages the IP address on the terminal side and the line side with independent values; an information storage unit that stores information extracted by the user information extraction unit and the IP address extraction unit; A control unit for controlling the entire apparatus including control and PPP control. The adapter device. 12. The terminal adapter device according to claim 11, wherein said line is ISDN. 13. The terminal adapter device according to claim 11, wherein said line is a LAN. 14. The control unit comprises: a central processing unit for controlling the entire terminal adapter device; and a terminal accommodating unit I having an interface with the terminal accommodating unit.
/ F, a terminal control protocol through the terminal accommodating unit I / F,
A terminal control unit for performing signal line control, and a line accommodation unit I having an interface with the line accommodation unit
/ F, an ISDN protocol control unit for controlling a protocol of an ISDN line through the line accommodating unit I / F and performing disconnection / retransmission, a PPP control unit for controlling a PPP authentication procedure at the time of transmission / connection, and a terminal. An information storage unit I / F having an interface with the information storage unit for storing information; and a communication time management unit I / F having an interface with the communication time management unit for managing communication time and notifying at a fixed time.
And an IP address management unit I / F having an interface with the IP address management unit that manages the IP addresses of the terminal side and the line side, and a memory used for work and storage. Item 14. The terminal adapter device according to any one of Items 11 to 13. 15. An interface with the terminal is RS-2.
32. It is 32C or USB.
15. The terminal adapter device according to any one of items 14 to 14. 16. The terminal adapter device according to claim 11, wherein the user information transmitted from the terminal at the time of connection to the Internet is extracted by the user information extraction unit and stored in the information storage unit. Connection is performed by PPP authentication, and in this phase, IP address information assigned from the line connection destination is extracted by the IP address extraction unit, and stored in the information storage unit and the IP address management unit. The step of separating and managing the IP address of the terminal and the line side, and the step of constantly converting each of the terminal-side and line-side IP addresses managed by the IP address management section for the IP packet transmitted during communication; When the time continues and the communication time continuation is detected by the communication time management unit, Performing flow control of the terminal accommodated in the terminal accommodating unit, stopping data transmission from the terminal side, and disconnecting the communication line; and after disconnecting, the control unit performs retransmission and reestablishes a communication call. Performing a PPP authentication by the control unit based on the user information stored in the information storage unit, and again extracting an IP address newly assigned from a line connection destination by the IP address extraction unit, The storage unit and the IP address management unit store the IP address on the line side in the IP address management unit, update the IP address on the line side with a new IP address.
Reflecting the P packet, and after the PPP authentication phase is completed and the IP address is updated, the control unit releases the flow control of the terminal accommodating unit and continues the communication. Characteristic security method in Internet connection. 17. The security method according to claim 16, wherein the user information is a user ID and a password.