JP2004165761A - Communication system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a communication system capable of strengthening the security for data communication and suppressing the facility introduction cost. <P>SOLUTION: In the communication system which is provided with a data center 2 having a firewall means connected to a plurality of user terminals 1 via a network and in which any user terminal 1 makes communication with other computers on a public Internet N via the firewall means FW of the data center 2, the network interconnecting the data center 2 and the user terminals 1 is a virtual private network wherein data are converted into a predetermined form on the public Internet and the data are mutually communicated. <P>COPYRIGHT: (C)2004,JPO

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to a communication system, and more particularly, to a communication system in which a user terminal performs data communication on a public Internet network via a data center firewall.
[0002]
[Prior art]
2. Description of the Related Art In recent years, with the spread of the Internet, businesses and services using the Internet are increasing at an accelerating rate, while problems such as "wiretapping" and "spoofing" have arisen. In order to prevent such a problem, it is extremely important to enhance communication security.
[0003]
Particularly, in a company having a plurality of users, a system using a dedicated line up to the entrance of the Internet, etc., so that a website on a public Internet network can be browsed while maintaining the security of communication (LAN) between user terminals is maintained. Had been built. FIG. 6 shows a specific example.
[0004]
As shown in FIG. 6, in consideration of security, it is desirable that the user terminal 100 and the management server 101 that manages the user terminal 100 access the public Internet network N110 via the data center 102 having the firewall FW102. Accordingly, the user terminals 100 connected via the intranet network N101 access the data center 102 (router R102) via the router R101 and the dedicated line 110 of the management server 101, and from there access via the firewall FW102 to the public Internet network. N110. Accordingly, an external attack and an unauthorized access to the intranet N101 can be prevented by the firewall FW102 of the data center 102 (or the Internet service provider (ISP)). In other words, the management server 101, that is, the user terminal 100 does not directly access the public Internet network N110, but only connects to the dedicated line 110 to the data center 102, thereby suppressing data eavesdropping and the like. It is possible to strengthen security.
[0005]
Further, by using a dedicated line for connection with the user terminal 1 or the like, it is possible to suppress the casual connection of the data center 102, which often manages important data, to the public Internet network. High data communication can be realized.
[0006]
Furthermore, for intranet communication between user terminals, that is, between user sites, sufficient security can be ensured by using a VPN over an IP network.
[0007]
On the other hand, as another means for performing the above-mentioned communication between user bases, as shown in Patent Document 1, a private network can be constructed on a public Internet network and used like a virtual dedicated line. VPN technology has been developed.
[0008]
[Patent Document 1]
JP 2002-208965 A
[Problems to be solved by the invention]
However, in any case, it is necessary to connect to the data center with a dedicated line or an IP-VPN network from the viewpoint of security. To achieve this, drawing a dedicated line or using an IP network is not possible. There is a problem that the line cost and the cost for constructing the intranet are high.
[0010]
[Object of the invention]
An object of the present invention is to provide a communication system capable of enhancing security when a user performs data communication in a public Internet network and suppressing the facility introduction cost.
[0011]
[Means for Solving the Problems]
Therefore, in the present invention, a data center having a firewall unit connected to a plurality of user terminals via a network is provided, and the user terminal communicates with another computer on the public Internet network via the firewall unit of the data center. A system for connecting a data center and a user terminal in a system is a virtual private network that performs data conversion in a predetermined format on a public Internet network and performs data communication with each other. I have.
[0012]
By adopting such a configuration, the security between the user terminal and the data center is enhanced by the virtual private network, despite being connected by the existing public Internet network. Then, an attack or an unauthorized access from another computer on the public Internet network can be suppressed by the firewall of the data center. Accordingly, security can be enhanced at low cost without laying a special line.
[0013]
The design and use of the virtual private network can be facilitated by using an IPsec scheme formulated by the Internet Engineering Task Force (IETF), which is a standardization organization for internetworking.
[0014]
The network connecting the data center and the user terminal is a public Internet network, and the data center and the user terminal communicate with each other at each connection point between the public Internet network and the data center and the user terminal. The same effect as described above can be obtained even if connection relay means for performing data conversion to perform communication by performing data conversion in a predetermined format at the time of performing the connection, and each connection relay means uses the IPsec method formulated by IETF. It is desirable to be an IPsec router that performs communication.
[0015]
Further, it is desirable that the data center serving as the gateway to the public Internet network be provided with a virus detecting means for detecting data having computer virus data registered in advance among data transmitted and received by the user terminal. In addition, there are other access restriction means for restricting the access of the user terminal when the website on the public Internet network accessed by the user terminal is a predetermined site, Content filtering means for restricting downloading of content data to be downloaded from a public terminal when the content data is determined to be inappropriate based on data stored in advance, and content of a website on a public Internet network accessed by a user terminal It is desirable to include a proxy means for temporarily storing the data, a communication log management means for storing the data communication status of the user terminal, and the like.
[0016]
As a result, in the data center, which is the gateway to the Internet network in the user terminal, it is possible to suppress transmission of virus data that may cause damage to the user and content data that is undesirable for the user to the user terminal. Thus, the spread of harmful data can be suppressed while further enhancing security. When the data center functions as a proxy, the efficiency of browsing the website by the user terminal can be improved.
[0017]
As described above, by collecting functions that improve problems that occur on the Internet in the data center, there is no need to prepare multiple computers to realize each function, and the service provider can easily operate it. In addition, the service receiving user can use the service at low introduction cost and running cost.
[0018]
BEST MODE FOR CARRYING OUT THE INVENTION
<First embodiment>
A first embodiment of the present invention will be described with reference to FIGS. FIG. 1 is a block diagram showing an outline of the system of the present invention. FIG. 2 is a functional block diagram showing details of the system configuration of the present invention. FIG. 3 is an explanatory diagram illustrating a data communication method. FIG. 4 is an explanatory diagram showing the operation of the system.
[0019]
(overall structure)
As shown in FIG. 1, the communication system according to the first embodiment of the present invention includes a data center 2 having a firewall unit FW connected to a plurality of user terminals 1 via a network N. This system communicates with other computers on the public Internet network via the firewall means FW of the center 2. That is, when the user terminal 1 accesses a website W or the like on the public Internet network N, the system is via the data center 2.
[0020]
In the present invention, in particular, the network N connecting the plurality of user terminals 1 and the data center 2 is also a public Internet network N on which various websites exist. This is a system that realizes enhancement of security between centers 2. Specifically, the system is characterized by the communication at the thick line portion (symbol B) in FIG. Hereinafter, this will be described in detail.
[0021]
(User terminal)
The user terminal 1 in the present invention is a computer operated by an employee in a predetermined company. These user terminals 1 are mutually connected to a company intranet (LAN), and form one user terminal group 1A. For example, it is assumed that the user terminal group 1A is a LAN constructed in the head office of a predetermined company, and that the user terminals 1B and 1C are LANs constructed in offices located in other areas. As described above, in the present invention, users located at multiple locations connect to the Internet network via one data center.
[0022]
In each of the user terminal groups 1A, 1B, and 1C, connection relay means for performing data conversion into a predetermined format and performing communication when the data center 2 and the user terminal 1 perform data communication with each other. The IPsec routers R1a, R1b, R1c (in FIG. 2, a VPN router) are provided. The IPsec routers R1a, R1b, R1c are routers that perform communication according to the IPsec scheme formulated by the IETF, and form an Internet VPN (virtual private network) by pairing with an IPsec router R2 provided in the data center 2 described later. Form. That is, the IPsec router R1a on the user terminal group 1A side and the IPsec router R2 on the data center 2 side are connected via the public Internet network N, respectively. In other words, IPsec routers R1a, R1b, R1c, and R2 are provided at each connection point between the public Internet network N, the user terminal 1, and the data center 2. By doing so, the Internet network N can be used like a virtual dedicated line.
[0023]
(Virtual private network)
Here, the virtual facility network will be described with reference to FIG. The virtual private network is a technology for constructing a private network on a shared network, or a technology for that purpose, and is so called because it can be used like a virtual dedicated line. The virtual private network is also called a VPN, taking the initials of Virtual Private Network. Then, by creating a virtual tunnel with a communication partner (tunneling), communication of a private address that cannot otherwise pass through the Internet can be performed via the public Internet network.
[0024]
For example, as shown in FIG. 3A, an IPsec router A2 for implementing the above-described VPN is provided at a connection point of one LAN (reference numeral A) including the terminal A1 to the public Internet network N. Similarly, an IPsec router B2 paired with the router A2 is provided at a connection point of the other LAN (reference numeral B) including the terminal B1 with the public Internet network N. Then, a virtual tunnel is formed (tunneling) by these routers, and security of data communication between the routers can be secured.
[0025]
At this time, there is a tunneling method as shown in FIGS. In the case of only the tunneling shown in (b), the data transmitted from the terminal A1 to the terminal B1 is transmitted by the router A2 with a header addressed to the router B2. Then, while passing through the public Internet network N, the data is handled as data from the router A2 to the router B2, and the received data is transmitted from the terminal A1 to the terminal B1 by the router B2 returning the data to the terminal B1. Can be realized. In the method shown in FIG. 3C, the data from the terminal A1 is encrypted including the header (From: A1, To: B1), and the router A2 attaches a header addressed to the router B2 to perform tunneling. This makes it possible to ensure the security of the data itself and to hide the information of the source and destination. In the method shown in FIG. 3D, only the data portion is encrypted without performing header conversion. In such a case, since the header is transmitted as it is, the data from the terminal A1 to the terminal B1 must be data that can pass through the Internet, so that the connection to the Internet is performed using the NAT function. As described above, there are several types of tunneling methods using VPN, and any of these methods may be used. In the present embodiment, the method shown in FIG. 3C is used.
[0026]
Then, in the VPN communication by the IPsec method, a logical connection called SA (Security Association) is established between a communication partner to be paired, such as setting of an encryption algorithm and key data. For example, in the present invention shown in FIG. 1, the communication partner to be paired corresponds to the data center R2 for each of the VPN routers R1a, R1b, R1c of the user terminal groups 1A, 1B, 1C. That is, R1a-R2, R1b-R2, and R1c-R3 are paired to form a VPN.
[0027]
Incidentally, IPsec is a function standardized as an IP-level encryption system in the Internet Engineering Task (IETF), which is a standardization group of internetworking.
[0028]
(Data center)
Next, the data center 2 will be described. The data center 2 mainly manages the company's server on behalf of the company entrusted to the company, serves as a gateway for connection to the public Internet network N, and functions to prevent eavesdropping, falsification, spoofing, etc. of data within the company. do. For this reason, the data center 2 is provided with a firewall FW at the entrance to the public Internet network.
[0029]
Further, as described above, the data center 2 and the user terminal 1 are connected via the public Internet N, and an IPsec router R2 is provided at a connection point between the data center 2 and the public Internet N. . As a result, the security between the user terminal 1 and the data center 2 can be enhanced despite the use of the public Internet network N, and the cost can be reduced as compared with the case where a dedicated line is constructed. Can be. In addition, the firewall FW of the data center 2 can prevent external attacks and unauthorized access to the in-house LAN including the user terminal 1, and can collect user terminals (groups) located at a plurality of bases. As a result, security can be enhanced in the data center 2, so that management efficiency can be improved.
[0030]
Here, the data center 2 is configured by one server computer, and may have the IPsec router R2 built therein or the firewall function FW incorporated therein. However, in the present embodiment, the data center 2 refers to an aggregate of a group of server computers, the IPsec router R2 is a single device, and the firewall FW and the like are configured by individual server computers.
[0031]
(motion)
Next, the operation of the system according to the present embodiment will be described with reference to FIG. In this figure, the symbol C indicates a group of user terminals 1A and 1B on the company side, and the symbol www indicates a group of websites on the public Internet N.
[0032]
First, a case where intranet communication is performed in a company will be described. When a predetermined user terminal 1 of the user terminal group 1A (for example, the head office) performs data communication with a predetermined user terminal 1 of another user terminal group 1B (for example, a business office), the IPsec router transmits the information. The packet is transmitted to the IPsec router R2 of the data center 2 in a tunneled state at R1a, and then transmitted to the IPsec router R1b installed in the user terminal group 1B as the transmission destination in the tunneled state. Then, the tunneling state is released by the router R1b and received by another user terminal 1 (see the arrow D1 in FIG. 4).
[0033]
When the user terminal 1 accesses a website on the public Internet network, information transmitted at that time is transmitted to the data center 2 through the public Internet network in a tunneled state (see arrow D2). Eavesdropping of data during that time is suppressed. Even if eavesdropping, the content is not recognized. The user terminal 1 can access the Internet network from the data center 2 and can browse various websites. Conversely, since the external computer on the public Internet network such as the website W is protected by the firewall FW of the data center 2 (see arrow D3), unauthorized access to the corporate LAN (code C) is suppressed. can do.
[0034]
By doing so, it is not necessary to lay a dedicated line between the user terminal 1 and the data center 2, and the security can be improved even when using the existing public Internet network, and the cost of the equipment can be reduced. Can be achieved.
[0035]
<Second embodiment>
Hereinafter, a second embodiment of the present invention will be described with reference to FIG. The communication system according to the second embodiment has substantially the same configuration as that of the first embodiment described above, but differs in that the data center 20 has the following functions. The configuration of the data center 20 of the present embodiment is shown in the block diagram of FIG. Incidentally, also in the present embodiment, the user is an employee of a company, and an example is shown in which a company that manages the employee uses the present system. However, the user is not limited to this.
[0036]
The data center 20 shown in FIG. 5 includes a virus detection unit 21 that detects data having computer virus data registered in advance among data transmitted and received by the user terminal 1. The virus detection means 21 may be a function provided in one server as the data center 20. When the data center 20 is regarded as one facility, it is connected to the IPsec router R2 or the firewall FW. Virus detection server computer 21 may be used. This allows the user terminal 1 to execute a virus check on data downloaded from the website W on the public Internet network and data such as e-mail received from another computer at the data center 20. Is transmitted to the user terminal 1 only. Therefore, the data center 20 serving as the gateway to the public Internet network performs a virus check, whereby the security of the entire company such as the user terminal 1 and the LAN can be enhanced in a lump.
[0037]
Further, the data center 20 is also provided with an access restricting means for restricting access of the user terminal 1 when a website on the public Internet network accessed by the user terminal 1 is a predetermined site. This access restriction unit may be a function in the data center 20 as in the case of the virus detection unit 21 or may be realized by a server computer. Such means stores in advance address information of a site for which access is prohibited (for example, a site that violates public order and morals), and checks the address when a user terminal 1 requests access to the site. When the address matches the stored address, connection to the site is prohibited. As a result, it is possible to suppress an employee from accessing an inappropriate site with a user terminal in a company, to suppress an adverse effect on the employee, and to improve work efficiency.
[0038]
The data center 20 restricts the download of the content when the user terminal 1 determines that the content data downloaded from the website W on the public Internet network is inappropriate based on predetermined data. A content filtering unit 22 is provided. The content filtering means 22 may also be a function in the data center 20, or may be realized by a server computer. The content filtering means 22 is, for example, a function for restricting download of an obscene image, and includes a color of an image which the user terminal 1 is going to download and a previously stored color data which is a reference for judging an obscene image. If the download image is determined to be an obscene image based on the above, it is not transmitted to the user terminal 1. This makes it possible to automatically restrict inappropriate site access by the user.
[0039]
Further, the data center 20 is provided with a proxy means 23 for temporarily storing the contents of a website on the public Internet network accessed by the user terminal. The proxy means 23 may also be a function in the data center 20, or may be realized by a server computer. The proxy means temporarily stores the content of the site previously downloaded by itself or another person in the data center 20, and then, when a request for downloading the content is received from the user terminal 1, the temporarily stored data is stored in the data center 20. Send. With such a cache function, it is possible to speed up the download of the content and improve the efficiency of browsing the website.
[0040]
Further, the data center 20 includes a communication log management unit 24 that stores the data communication status of the user terminal 1. The communication log management unit 23 may be a function in the data center 20 or may be realized by a server computer. The communication log management unit 23 stores, for example, the access time, the number of times of the user terminal 1, the URL of the access destination, and the like. In some cases, the communication log data storage device has a function of transmitting the stored communication log data to the terminal 1 of a person who manages an employee of a company as a user. As a result, communication management of the user of the company becomes easy, and the business can be speeded up.
[0041]
In this way, by collecting all functions in the data center, that is, functions that improve problems that occur on the public Internet network, there is no need to prepare multiple computers that realize each function, and the service provider can operate it. It will be easier. This also allows the service receiving side to receive the service at low cost.
[0042]
<Third embodiment>
Next, a third embodiment of the present invention will be described. In the third embodiment, the user terminal 1 is a general user, and the data center 20 is an Internet service provider (ISP) used when a general user browses a website. The functions of the user terminal 1 and the data center 20 are not different from those of the first and second embodiments.
[0043]
In this way, by using this system for general users, unauthorized access from the outside can be suppressed, and various functions such as content filtering, virus check, and proxy can be easily used by users. Data communication, such as browsing websites, can be performed with care.
[0044]
【The invention's effect】
Since the present invention is configured and functions as described above, according to this, when the user terminal accesses the public Internet network through the firewall means of the data center, as a network connecting the data center and the user terminal, A virtual private network that performs data conversion by performing data conversion on a public Internet network in a predetermined format and performs data communication with each other (for example, an IPsec system formulated by the Internet Engineering Task Force (IETF), a standardization organization for internetworking). , Security is enhanced between the user terminal and the data center despite being connected by the existing public Internet network, and the public Internet network is established by the data center firewall. Of it is possible to suppress the attack and unauthorized access from other computers, which makes it possible to achieve enhanced security at a low cost, it has an excellent effect unprecedented called.
[0045]
Also, if the data center serving as the gateway to the public Internet network is provided with a function to perform various processes on the data communicated by the user terminal, the security will be further enhanced and the user's soundness will be improved by filtering harmful data. And speeding up of communication can be realized. By providing these functions collectively in the data center, the service provider can easily operate the data center and can use the service with low introduction cost and running cost for the user receiving the service. .
[Brief description of the drawings]
FIG. 1 is a block diagram showing an outline of a system according to a first embodiment of the present invention.
FIG. 2 is a functional block diagram showing details of the system disclosed in FIG. 1;
FIG. 3A is an explanatory diagram of an IPsec system which is a data communication system used in the present invention. FIGS. 3B to 3D are diagrams showing a data structure to be transmitted.
FIG. 4 is an explanatory diagram showing an operation of the communication system according to the present invention.
FIG. 5 is a block diagram showing a configuration of a data center according to a second embodiment of the present invention.
FIG. 6 is a block diagram showing a configuration of a communication system in a conventional example.
[Explanation of symbols]
1 User terminal 2, 20 Data center 21 Virus detection means 22 Content filtering means 23 Proxy means 24 Communication log management means R1a, R1b, R1c, R2 Connection relay means (IPsec router)
N network (public Internet network)
FW firewall

Claims (9)

A system comprising a data center having a firewall connected to a plurality of user terminals via a network, wherein the user terminal communicates with another computer on a public Internet network through a firewall of the data center. ,
A communication system, wherein the network connecting the data center and the user terminal is a virtual private network that performs data conversion in a predetermined format on a public Internet network and performs data communication with each other. 2. The communication system according to claim 1, wherein the virtual private network is based on an IPsec scheme developed by an Internet Engineering Task Force (IETF), which is a standardization organization of internetworking. A system comprising a data center having a firewall connected to a plurality of user terminals via a network, wherein the user terminal communicates with another computer on a public Internet network through a firewall of the data center. ,
The network connecting the data center and the user terminal is a public Internet network,
When the data center and the user terminal perform data communication with each other at the connection points between the public Internet network and the data center and the user terminal, the data center and the user terminal perform data conversion to a predetermined format to perform communication. A communication system comprising connection relay means. 4. The communication system according to claim 3, wherein each of the connection relay units is an IPsec router that performs communication according to an IPsec scheme formulated by an IETF (Internet Engineering Task Force), which is a standardization organization of internetworking. 5. The data center according to claim 1, wherein the data center further comprises a virus detection unit for detecting data having computer virus data registered in advance among data transmitted and received by the user terminal. Communications system. The data center further comprises access restriction means for restricting access of the user terminal when a website on the public Internet network accessed by the user terminal is a predetermined site. The communication system according to 1, 2, 3, 4 or 5. The data center downloads the content when the user terminal determines that the content data downloaded from the website on the public Internet network is inappropriate for the user based on data stored in advance. 7. The communication system according to claim 1, further comprising a content filtering means for limiting. 7. The data center according to claim 1, further comprising proxy means for temporarily storing contents of a website on said public Internet network accessed by said user terminal. Or the communication system according to 7. 9. The communication system according to claim 1, wherein said data center includes communication log management means for storing a data communication status of said user terminal.

Images