JP4415527B2 - Communication terminal, communication establishment program, and communication system - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention provides a communication terminal and a communication terminal for constructing a VPN (virtual private network) and transmitting / receiving communication data by performing authentication processing and encryption processing compliant with, for example, IPSec (IP (Internet Protocol) security protocol) Communication establishment program, communication Related to communication systems.
[0002]
[Prior art]
In recent years, as a client-server system, a VPN path is established between a client terminal and an authentication server by implementing a protocol compliant with IPSec, and the client terminal and the application server are connected via the authentication server. Are known. Such a system is disclosed in, for example, JP-A-2002-44141.
[0003]
An example of such a conventional communication system is shown in FIG. In this communication system, the client terminal 101, the authentication server 102, and the application server 103 are connected via a communication line, thereby realizing communication between the application processing unit 111 of the client terminal 101 and the application server 103. Yes. Further, in this communication system, the client terminal 101 and the authentication server 102 implement IP (Internet Protocol), and a VPN path 104 corresponding to mobile IP and IPSec conforming to RFC (Request For Comments) 2002 to RFC2005. Has the ability to build.
[0004]
When the client terminal 101 in such a communication system activates the authentication client processing unit 112 and establishes the VPN path 104 with the authentication server 102, when the input device 113 is operated by the user, the activation information acquisition unit In 121, a logon screen is presented to the user to prompt for input of a password or the like. Then, when the user inputs a password, the authentication client processing unit 112 is activated, and the network information file 131 and the authentication information file 132 held in the information file management unit 114 are authenticated according to a preset file path. Read by the network information acquisition unit 122.
[0005]
In this communication system, an authentication process is performed between the authentication processing unit 123 and the authentication processing unit 141 of the authentication server 102 using the network information file 131 and the authentication information file 132, and the key exchange processing unit 124 and the authentication server Key exchange is performed with the key exchange processing unit 142 of 102. Thereby, between the communication processing unit 125 of the client terminal 101 and the communication processing unit 143 of the authentication server 102, an IP packet having the destination address as the IP address of the application server 103 is encrypted, and the encrypted data is used for IPSec. The VPN path 104 is constructed by creating a packet and performing communication using a packet encapsulated by adding an IP header.
[0006]
In such a communication system, data communication with high confidentiality and high reliability is realized between the authentication client processing unit 112 and the authentication server 102.
[0007]
[Problems to be solved by the invention]
However, in the conventional communication system, the authentication client processing unit 112 is activated by the input device 113, that is, the activation is determined only from the password for manually inputting the logon to the authentication client processing unit 112, and the network Since the information file 131, the authentication information file 132, and the file path are stored in the client terminal 101, there is a risk that if the password is leaked, the password is leaked and unauthorized communication is performed. It was.
[0008]
Accordingly, the present invention has been proposed in view of the above-described circumstances, and a communication terminal and a communication terminal that can secure a logon process at the time of starting the terminal and can build a highly reliable system for security. Communication establishment program, communication The purpose is to provide a communication system.
[0009]
[Means for Solving the Problems]
In order to solve the above-described problem, in the communication terminal according to the present invention, information input for reading and inputting at least unique information for each user from information necessary for authentication processing with an authentication server from a recording medium owned by the user Means and an information file constituting means constituting an information file for authentication necessary for authentication processing and a communication information file used for communication with the authentication server, using the information inputted by the information input means, and the information Communicating with the authentication server with reference to the communication information file configured by the file configuration means, performing authentication processing with the authentication server with reference to the authentication information file, Communication processing means for establishing communication with the authentication server; , Further comprising common information storage means for storing common authentication information and common communication information used for different unique information stored in recording media possessed by different users, wherein the common authentication information is , Information necessary for authentication processing including identification information for distinguishing the authentication server, the communication common information is information used to enable communication with the authentication server, and the information input means includes: , A password for determining the legitimacy of communication use, authentication specific information used when performing authentication processing with the authentication server, and communication specific information used when performing communication processing with the authentication server Is read out from the recording medium and input, and the information file constituting unit, when the validity of communication use is determined from the password input by the information input unit, An authentication information file is configured using the authentication unique information input by the information input means and the authentication common information stored in the common information storage means, and the communication unique information input by the information input means A communication information file using the communication common information stored in the common information storage means .
[0011]
In order to solve the above problem, in the communication establishment program according to the present invention, Computer Read and input at least user-specific information from the recording media owned by the user, among the information required for authentication processing with the authentication server Information input means, When at least specific information for each user is read out and input, the input information is used to configure an authentication information file necessary for authentication processing and a communication information file used for communication with the authentication server. Function as a file organization An information file configuration program; Computer Communication with the authentication server by referring to the communication information file, authentication processing with the authentication server with reference to the authentication information file, and communication with the authentication server Establish Function as communication processing means A communication processing program, Computer Authentication common information and communication common information used in common for different unique information stored in recording media owned by different users, Information input means Is stored in a readable recording medium, and the common information for authentication is information necessary for authentication processing including identification information for distinguishing the authentication server, and the common information for communication is the information with the authentication server. Information used to enable communication, The information input means is A password for determining the legitimacy of communication use, authentication specific information used when performing authentication processing with the authentication server, and communication specific information used when performing communication processing with the authentication server Read from the recording medium and input, The information file configuration means is the information file configuration means. When the validity of communication use is determined from the entered password, In the above information file configuration means Enter the unique information for authentication the above While configuring the authentication information file using the authentication common information, With the above information input means Enter the unique information for communication the above A communication information file is configured using the communication common information.
[0013]
The communication establishment program according to the present invention uses the input information when reading and inputting at least the unique information for each user out of the information necessary for the authentication process with the authentication server from the recording medium owned by the user, An information file that configures an authentication information file necessary for authentication processing and a communication information file used for communication with the authentication server;
Communication with the authentication server by referring to the communication information file, authentication processing with the authentication server with reference to the authentication information file, and communication with the authentication server Communication processing program to establish Authentication common information and communication common information used in common for different unique information stored in recording media held by different users are stored in a recording medium readable by the information file configuration program. The common information for authentication is information necessary for authentication processing including identification information for distinguishing the authentication server, and the common information for communication is used to enable communication with the authentication server. The information file configuration program includes a password for determining the validity of communication use, authentication unique information used for authentication processing with the authentication server, and communication with the authentication server. When the communication-specific information used for processing is read from the recording medium and input, and the validity of communication is determined from the input password, The authentication unique information and the common authentication information stored in the common information storage means constitute an authentication information file, and the communication unique information and the common information storage input by the information input means A communication information file is configured using the communication common information stored in the means Is. The communication system according to the present invention has an authentication server that performs authentication processing between a plurality of communication terminals and establishes communication between the application server and the communication terminal according to the result of the authentication processing, and the user has Of the information necessary for the authentication process with the authentication server from the recording medium, at least unique information for each user is read out and input, and using the input information, an authentication information file required for the authentication process and the authentication server Configure a communication information file to be used for communication, communicate with the authentication server with reference to the communication information file, and authenticate with the authentication server with reference to the authentication information file A communication terminal for processing The communication terminal further includes common information storage means for storing authentication common information and communication common information used in common for different unique information stored in recording media owned by different users, Common information for authentication is information necessary for authentication processing including identification information for distinguishing the authentication server, and the common information for communication is information used to enable communication with the authentication server, The above information input means is a password for determining the validity of communication use, unique information for authentication used when performing authentication processing with the authentication server, and used when performing communication processing with the authentication server. Specific information for communication to be read from the recording medium and input, and the information file configuration means determines the validity of communication use from the password input by the information input means. In this case, an authentication information file is configured using the authentication specific information input by the information input means and the authentication common information stored in the common information storage means, and input by the information input means. A communication information file is formed using the communication specific information and the communication common information stored in the common information storage means. Is.
[0014]
DETAILED DESCRIPTION OF THE INVENTION
Hereinafter, embodiments of the present invention will be described with reference to the drawings.
[0015]
The present invention is applied to a communication system configured as shown in FIG. 1, for example.
[0016]
[Configuration of communication system]
In this communication system, for example, a communication terminal 1, an authentication server 2, and an application server 3 configured by a personal computer are connected via a communication line. In this communication system, a VPN path 4 compliant with mobile IP and IPSec is established between the communication terminal 1 and the authentication server 2, and application data is transferred between the communication terminal 1 and the application server 3 via the authentication server 2. To transmit.
[0017]
Between the communication terminal 1 and the application server 3, a router having an external agent function (not shown) and a router having a home agent function are arranged. These routers manage the C / OIP address that is the destination IP address of the communication terminal 1 and the home IP address of the communication terminal 1, and relay application data between the communication terminal 1 and the application server 3. . Thereby, even when the communication terminal 1 moves, communication with the application server 3 connected to the home network is realized.
[0018]
The communication terminal 1 includes an IC card reader 21 having an IC card attaching / detaching mechanism into which an IC (Integrated Circuit) card 10 which is a portable recording medium held by a user is inserted. In this example, the case where the IC card 10 is used as a portable recording medium will be described. However, the present invention is not limited to this. For example, a CD-R (Compact Disc-Recordable), an FD (Floppy Disk), and a PDA having a recording function. (Personal Digital Assistant) may be connected.
[0019]
This IC card 10 has a built-in storage mechanism constituted by an IC. The IC card 10 stores at least OS logon information, an authentication client logon password, network information, and authentication information for logging on to the OS (Operation System) of the communication terminal 1. In this example, the unique network information stored in the IC card 10 is home IP address information or the like. Further, the authentication information stored in the IC card 10 is an authenticator used when performing an authentication process between the communication terminal 1 and the authentication server 2.
[0020]
The IC card reader 21 reads the contents when the IC card 10 is mounted by the user. The IC card reader 21 outputs OS logon information to the logon IC card reading unit 22. This OS logon information is read from the IC card reader 21 by the logon IC card reading unit 22 and sent to the logon unit 23. When the OS logon information is sent, the logon unit 23 prompts the user to input the OS password using a display unit (not shown) and the like, and starts the OS according to the input password. Thereby, the IC card monitoring unit 24 is activated by the OS.
[0021]
At this time, in the communication terminal 1, when the logon to the OS is completed and the OS is activated, the IC card monitoring unit 24 is activated by activating an IC card monitoring program stored in a recording medium (not shown).
[0022]
The IC card monitoring unit 24 includes an IC card reading unit 31, an information file configuration unit 32, and an activation unit 33 as its functions. The authentication client logon password information, home IP address information, and authentication information read and input by the IC card reader 21 are sent to the IC card monitoring unit 24. When these pieces of information are sent, the IC card reading unit 31 reads the communication common information and the authentication common information stored in the network common information storage unit 25 in advance, together with the read information, the authentication client logon password information, The home IP address information and authentication information are sent to the information file configuration unit 32.
[0023]
The common information for communication and the common information for authentication are information used in common for different unique information stored in the IC card 10 held by different users. The communication common information and the authentication common information are preset information. For example, authentication server identification information for distinguishing the authentication server 2, parameters related to packet processing, parameters related to mobile IP, such as ISAKMP (internet security association key management) and parameters relating to cryptographic communication protocols such as IPSec. Such common information is generated in advance by user input.
[0024]
The information file configuration unit 32 reconfigures the network information file 41 necessary for communication between the communication terminal 1, the authentication server 2, and the application server 3 using information from the IC card reading unit 31 and the network common information storage unit 25. At the same time, the authentication information file 42 necessary for the authentication process with the authentication server 2 is reconfigured.
[0025]
The network information file 41 and the authentication information file 42 are sent to the information file management unit 26 and are held and managed by the information file management unit 26. The path information of the network information file 41 and the authentication information file 42 is created by the information file configuration unit 32 and sent to the temporary storage unit 27.
[0026]
Further, the information file configuration unit 32 performs a process of sending the authentication client logon password sent via the IC card reading unit 31 to the temporary storage unit 27. When the reconfiguration of the network information file 41 and the authentication information file 42 is completed in the information file configuration unit 32 and the authentication client logon password and the path information are stored in the temporary storage unit 27, the activation unit 33 performs the authentication client 28. Start up. At this time, the activation unit 33 causes the OS to activate the authentication client 28 by requesting the OS to activate the authentication client 28.
[0027]
The authentication client 28 includes a startup information acquisition unit 51, an authentication / network information acquisition unit 52, an authentication processing unit 53, a key exchange processing unit 54, and a communication processing unit 55 as functions thereof. The authentication client 28 is configured with a function realized by a communication establishment program that establishes communication between the communication terminal 1, the authentication server 2, and the application server 3 by performing an authentication process.
[0028]
In response to the activation request from the activation unit 33, the activation information acquisition unit 51 reads the authentication client logon password stored in the temporary storage unit 27, and determines the validity of the read authentication client logon password, thereby using communication. Determine the legitimacy of When it is determined that the authentication client logon password is valid, the activation information acquisition unit 51 reads the path information from the temporary storage unit 27 and sends it to the authentication / network information acquisition unit 52 to execute the subsequent processing.
[0029]
In addition, the activation information acquisition unit 51 detects that the authentication client logon password and the pass information are sent directly from the IC card monitoring unit 24 as well as the case where the authentication client 28 is activated in response to the activation request by the activation unit 33. Then, the authentication client 28 may be activated by reading the authentication client logon password.
[0030]
On the other hand, when the input device 29 is manually operated and the authentication client logon password is input, the activation information acquisition unit 51 determines the validity in the same manner, and determines the default path information when it is determined to be valid. Is sent to the authentication / network information acquisition unit 52. In this case, the IC card monitoring unit 24 due to the insertion of the IC card 10 does not start, and the network information file 41 and the authentication information file 42 held in the information file management unit 26 are used without reconfiguration. The subsequent processing is executed.
[0031]
When the path information is sent, the authentication / network information acquisition unit 52 accesses the information file management unit 26 based on the path information, reads the network information file 41 and the authentication information file 42, and performs the authentication processing unit 53 and the key exchange process. To the communication unit 55 and the communication processing unit 55.
[0032]
The authentication processing unit 53 realizes a mobile IP environment between the communication terminal 1 and the authentication server 2 by performing processing based on mobile IP conforming to RFC (Request For Comments) 2002 to RFC2005. At this time, the authentication processing unit 53 transmits a registration request packet to the authentication processing unit 61 of the authentication server 2 using the authenticator and the home IP address stored in the IC card 10 as the unique information. By receiving the registration response packet from the authentication server 2, the authentication processing with the authentication processing unit 61 of the authentication server 2 is performed.
[0033]
As a result of such authentication processing, when communication via the authentication server 2 is permitted by the authentication processing unit 61, the key exchange processing unit 54 performs key exchange processing with the key exchange processing unit 62 of the authentication server 2. To do. At this time, the key exchange processing unit 54 performs processing compliant with RFC2401 to RFC2410, etc., and acquires an encryption key for encrypting and decrypting data. As a result of such a key exchange process, the VPN path 4 is established between the communication terminal 1 and the authentication server 2 by successfully acquiring the encryption key and the decryption key.
[0034]
The communication processing unit 55 performs packet communication with the authentication server 2 during the above-described authentication processing and key exchange processing, and transmission of application data with the application server 3.
[0035]
When the application data created by the application processing unit 30 is transmitted to the application server 3, the application data created by the application processing unit 30 is stored in the data area 72 by the OS as shown in FIG. The IP header information area 71 is added to the head of the data area 72 to create an IP packet. At this time, the OS stores the server IP address, which is the IP address of the application server 3, in the destination address area 82 and further stores the home IP address in the source address area 81. Next, the communication processing unit 55 encrypts the IP packet sent from the OS using the encryption key acquired by the key exchange process, and creates encrypted data.
[0036]
Next, the communication processing unit 55 stores the encrypted data in the data area 74 and adds an IPSec header area 73 to the head of the encrypted data to create an IPSec packet. At this time, the communication processing unit 55 acquires the server IP address, which is the IP address of the authentication server 2, from the authentication information file 42 and stores it in the destination address area 84, and further stores the home IP address in the source address area 83. .
[0037]
Next, the communication processing unit 55 stores the IPSec packet in the data area 76 and encapsulates the IP packet by adding an IPinIP header area 75 to the head thereof to create an IPinIP packet. At this time, the communication processing unit 55 stores the server IP address, which is the IP address of the authentication server 2, in the destination address area 86, and further stores the C / OIP address (case of IP address) by the manual input or the like in the source address area 85. To store.
[0038]
In the communication system, the communication processing unit 55 creates an IPinIP packet in this way, and transmits application data to and from the application server 3 via the VPN path 4. In contrast, the communication processing unit 63 of the authentication server 2 uses the C / OIP address stored in the source address area 85 and the home IP address stored in the source address area 83 of the source address area 83 to communicate with the communication terminal 1. It is determined that the IPinIP packet has been transmitted, the encapsulation is released, the encrypted data is decrypted, the IP packet is restored, and transmitted to the application server 3.
[0039]
On the other hand, when the authentication server 2 receives an IP packet in which the destination address area 82 is the home IP address of the communication terminal 1 and the transmission source address area 81 is the IP address of the application server 3, the authentication server 2 first transmits the transmission source. The IP address of the authentication server 2 is stored in the address area 83, the home IP address of the communication terminal 1 is stored in the destination address area 84, and the application data in the data area 72 is encrypted to create an IPSec packet. Next, the communication processing unit 63 creates an IPinIP packet in which the IP address of the authentication server 2 is stored in the source address area 85 and the C / OIP address of the communication terminal 1 is stored in the destination address area 86 and is transmitted to the communication terminal 1. .
[0040]
In the communication terminal 1 described above, user-specific unique information that is a part of the information constituting the network information file 41 and the authentication information file 42 is stored in the IC card 10 and stored in the IC card 10. In the above description, the network information file 41 and the authentication information file 42 are reconfigured using the unique information and the common information stored in the network common information storage unit 25. However, the present invention is not limited to this. May be stored in the IC card 10. In such a case, the communication terminal 1 reconstructs the network information file 41 and the authentication information file 42 using only the information read from the IC card 10.
[0041]
According to such a communication terminal 1, since all information for reconfiguring the network information file 41 and the authentication information file 42 is stored in the IC card 10, it is compared with the case where only the unique information is recorded in the IC card 10. Security level can be improved.
[0042]
[Communication establishment process by communication terminal 1]
Next, communication establishment processing that is performed when communication is started by the communication terminal 1 in the communication system described above will be described with reference to the flowchart of FIG. In the following description, a case where only unique information is stored in the IC card 10 and common information is stored in the network common information storage unit 25 will be described.
[0043]
The communication terminal 1 starts processing from step S1 onward in response to the insertion of the IC card 10 into the IC card reader 21, and proceeds to step S2 when OS logon information is sent to the logon unit 23.
[0044]
In step S2, the password entry screen prompting the OS password input is presented to the user by the logon unit 23, and the process proceeds to step S3. If no valid password is entered, the screen display of step S2 is maintained. If a valid password is entered, the process proceeds to step S4.
[0045]
In step S4, after recognizing that a valid password has been input by the logon unit 23, the OS is started and logged in, the process proceeds to step S5, and an IC card monitoring program (application) is started, and the process proceeds to step S6. Proceed with the process.
[0046]
In step S <b> 6, the IC card monitoring unit 24 determines whether or not the communication terminal 1 has been normally terminated when used last time. That is, the IC card monitoring unit 24 determines whether or not the authentication client logon password and pass information read from the IC card 10 and stored in the temporary storage unit 27 at the end of the previous use of the communication terminal 1 have been deleted. If the authentication client logon password and the path information have not been deleted normally and have ended abnormally, the process proceeds to step S7. If the authentication client logon password and pass information have been deleted normally, the process proceeds to step S8. As a result, the unique information in the previously inserted IC card 10 is made unusable for the current use.
[0047]
In step S7, the authentication client logon password and the pass information that are still stored in temporary storage unit 27 are deleted, and the process proceeds to step S8. Thereby, the IC card monitoring unit 24 excludes the third party's accessibility to the unique information stored in the IC card 10 used last time.
[0048]
In step S8, the user-specific authentication client logon password, home IP address information, and authentication information stored in the IC card 10 from the IC card reader 21 are acquired by the IC card reading unit 31 and sent to the information file configuration unit 32. The process proceeds to step S9.
[0049]
In step S9, the information file configuration unit 32 reconfigures the network information file 41 and the authentication information file 42 using the unique information from the IC card reading unit 31 and the common information stored in the network common information storage unit 25. Then, in step S10, the authentication client logon password and the path information are stored in the temporary storage unit 27 in response to the reconfiguration of the network information file 41 and the authentication information file 42. The process proceeds to S11.
[0050]
In step S11, the activation unit 33 activates the authentication client 28 and proceeds to step S12. The activation information acquisition unit 51 determines whether the current activation is manual activation or the IC card monitoring unit 24 is activated. Determine whether to start automatically. At this time, the activation information acquisition unit 51 determines whether or not an activation request is generated by the activation unit 33 when determining automatic activation, or the temporary storage unit 27 stores the authentication client activation logon password and the path information in the temporary storage unit 27. It is determined whether or not it is stored. If the activation information acquisition unit 51 determines that the activation is automatic, the process proceeds to step S13, the authentication / network information acquisition unit 52 acquires the authentication client logon password and path information from the temporary storage unit 27, and step S17. Proceed with the process.
[0051]
On the other hand, if the activation information acquisition unit 51 determines that the activation is manual, the process proceeds to step S14, the activation information acquisition unit 51 presents the password input screen to the user, and the process proceeds to step S15. If the authentication client logon password has been entered, the process proceeds to step S16. In step S16, path information for acquiring the preset default network information file 41 and authentication information file 42 is acquired by the authentication / network information acquisition unit 52, and the process proceeds to step S17.
[0052]
In step S17, the authentication / network information acquisition unit 52 acquires the network information file 41 and the authentication information file 42 from the information file management unit 26 based on the path information acquired in step S13 or step S16, and the network information and authentication. The information is sent to the authentication processing unit 53, the key exchange processing unit 54, and the communication processing unit 55, and the process proceeds to step S18.
[0053]
In step S18, the authentication processing unit 53 performs authentication processing with the authentication server 2 using the authentication information. In step S19, the authentication processing unit 53 determines whether the authentication server 2 is authenticated as a result of the authentication processing. If not authenticated, the process proceeds to step S20, an error process is performed, and the process is terminated. On the other hand, if authenticated by the authentication server 2, the process proceeds to step S21.
[0054]
In step S21, the key exchange processing unit 54 performs key exchange processing with the authentication server 2 and proceeds to step S22. When it is determined that the key exchange has not been successful, the process proceeds to step S23 to perform error processing. The process ends. On the other hand, if the key exchange process with the authentication server 2 is successful, the process proceeds to step S24.
[0055]
In step S24, communication with the application server 3 that has established the VPN path 4 is established by the authentication process in step S18 and the key exchange process in step S21. In step S25, the communication processing unit 55 performs communication as shown in FIG. Encrypted communication by IPinIP packet is started.
[0056]
When the OS issues a logoff command for terminating the encrypted communication via the VPN path 4, the process of step S31 in FIG. 4 is started, and the information file configuration unit 32 of the IC card monitoring unit 24 performs network processing. The information file management unit 26 is controlled to delete the information file 41 and the authentication information file 42, and the process proceeds to step S32.
[0057]
In step S32, the information file configuration unit 32 deletes the authentication client logon password and path information stored in the temporary storage unit 27, proceeds to step S33, logs off from the OS, and ends the process.
[0058]
[Other communication establishment process by communication terminal 1]
Next, another communication establishment process performed when communication is started by the communication terminal 1 in the communication system described above will be described with reference to the flowchart of FIG. The same processes as those described above are denoted by the same reference numerals, and detailed description thereof is omitted.
[0059]
In this communication establishment process, after the IC card monitoring unit 24 is activated, the processes in steps S8 to S11 are performed without performing the processes in steps S6 and S7, and step S41 subsequent to step S17 after being automatically activated. The authentication / network information acquisition unit 52 deletes the network information file 41 and the authentication information file 42, and the process proceeds to step S42.
[0060]
In step S42, the authentication client logon password and the path information stored in step S10 are deleted by temporary storage unit 27, and the process proceeds to step S18.
[0061]
[Effect of the embodiment]
As described above in detail, according to the communication system according to the present embodiment, when the unique information for each user is read from the IC card 10 and input, the network information file 41 and the authentication information file 42 are reconfigured. Since communication between the communication terminal 1 and the authentication server 2 is established, the authentication client 28 may be activated only when the IC card 10 is inserted without activation of the authentication client 28 due to password leakage. In addition, the logon process when the communication terminal 1 is activated can be made safe, and a highly reliable system for security can be constructed.
[0062]
Further, according to this communication system, common information is stored in the network common information storage unit 25 in advance, and when the IC card 10 is inserted, the network information file 41 and the authentication information are used using the common information and the unique information. Since the file 42 is reconfigured, the amount of information recorded on the IC card 10 can be reduced and the memory consumption of the IC card 10 can be suppressed.
[0063]
Further, according to this communication system, when the IC card 10 is inserted, the IC card monitoring unit 24 is activated to establish communication with the authentication server 2 using the unique information of the IC card 10, and the input device 29 operates. Since the communication server 1 establishes communication with the authentication server 2 using the unique information in the communication terminal 1, the default operation can be performed even when the IC card 10 is not inserted, and the operation flexibility is ensured. can do.
[0064]
Furthermore, according to this communication system, after the authentication client logon password is recorded on the IC card 10 and the network information file 41 and the authentication information file 42 are reconstructed, the path information and the authentication client logon password are temporarily stored. Since the authentication processing is performed by storing the data in the memory 27, the IC card monitoring program and the authentication processing program can be easily separated. Therefore, according to this communication system, the program change of the existing authentication client 28 can be reduced, and the above-described processing by the IC card monitoring unit 24 can be added.
[0065]
Furthermore, according to this communication system, the authentication client 28 detects that the authentication client logon password and the pass information are directly sent from the activation unit 33 and performs the authentication process, so that it is not stored in the temporary storage unit 27. , Security for unique information can be further improved.
[0066]
Furthermore, according to this communication system, the authentication client logon password and the pass information stored in the temporary storage unit 27 are deleted by the authentication client 28 or the IC card monitoring unit 24, so that the network information file 41 and the authentication information are deleted after the communication is completed. It is possible to prevent leakage of the unique information stored in the IC card 10 by storing the information file 42 as it is.
[0067]
[Other Embodiments of Communication System]
Next, another embodiment of the communication system will be described. Note that parts similar to those in the above-described embodiment are denoted by the same reference numerals, and detailed description thereof is omitted.
[0068]
As shown in FIG. 6, in the communication system described above, when authentication server identification information for identifying the authentication server 2 connected to the communication terminal 1 is stored in the IC card 10, the communication terminal 1 uses the authentication server as authentication information. The identification information is read and the authentication information file 42 is reconstructed. Thereby, according to this communication system, the connection with the application server 3 can be established through the authentication server 2 designated by the user regardless of the setting of the communication terminal 1. Further, according to this communication system, the connection destination of the communication terminal 1 can be different for each IC card 10, and the connection destination of the communication terminal 1 can be limited by inserting the IC card 10.
[0069]
On the other hand, in other communication systems, as shown in FIG. 7, there are authentication servers 2A, 2B, and 2C that can establish communication with the communication terminal 1, and different applications are provided in the authentication servers 2A, 2B, and 2C, respectively. When the servers 3A, 3B, and 3C are connected, a plurality of authentication server A identification information, authentication server B identification information, and authentication server C identification information are stored in the IC card 10. Here, each of the application servers 3A, 3B, and 3C corresponds to a plurality of applications used in the application processing unit 30 of the communication terminal 1, and for example, uses thereof are different.
[0070]
When this IC card 10 is inserted, the communication terminal 1 is connected to a plurality of authentication servers 2 so that a plurality of authentication server A identification information, authentication server B identification information, and authentication server C identification are provided. The information file configuration unit 32 reconstructs the authentication information file 42 including information.
[0071]
When performing the authentication process, the authentication processing unit 53 performs an authentication server selection input display for prompting selection of the authentication server 2 to be connected, and selects the authentication server 2 that performs the authentication process in accordance with a command from the input device 29. The authentication processing unit 53 is connected to the application server 3 by prompting selection of the application server 3 that requests establishment of communication or an application to be used after communication is established when prompting selection of the authentication server 2 to be connected. The authentication server 2 may be selected.
[0072]
According to such a communication system, since a plurality of pieces of authentication server identification information are stored in a single IC card 10, for example, only the application server 3 that the user desires to connect is selected from the plurality of authentication servers 2. Can be specified, and convenience for the user can be improved.
[0073]
As shown in FIG. 8, a communication system 1A, a communication terminal 1B, and a communication terminal 1C are connected to a single authentication server 2, and the authentication server 2 is further connected to a plurality of application servers 3A. When the application server 3B and the application server 3C are connected, the authentication server 2 controls access to each communication terminal 1.
[0074]
This authentication server 2 holds a table associating authentication client identification information for identifying the authentication client 28 corresponding to each communication terminal 1 as shown in FIG. 9 and an access level indicating the level of access permission. . As shown in FIG. 10, this access permission level indicates access permission / denial for each of the application server 3A, application server 3B, and application server 3C corresponding to each access level (1 to 3). When the authentication processing unit 61 of the authentication server 2 receives a registration request from the authentication processing unit 53 of the communication terminal 1 and information indicating the connection destination application server 3, the authentication processing unit 61 refers to the authentication client identification information from the table of FIG. The accelerator level is recognized, and the access permission / denial for the access level is recognized from the table of FIG.
[0075]
If the authentication processing unit 61 of the authentication server 2 determines that access is permitted, the authentication process proceeds directly. If it is determined that access is not permitted, the authentication processing unit 61 notifies the communication terminal 1 to that effect.
[0076]
According to such a communication system, access permission / non-permission for each application server 3 is determined for each authentication client 28 of each communication terminal 1, so that access control to each application server 3 of the communication terminal 1 is performed. Can do.
[0077]
The above-described embodiment is an example of the present invention. For this reason, the present invention is not limited to the above-described embodiment, and various modifications can be made depending on the design and the like as long as the technical idea according to the present invention is not deviated from this embodiment. Of course, it is possible to change.
[0080]
【The invention's effect】
According to the communication terminal according to claim 1, when a recording medium is inserted by a user, the authentication information file and the communication information file are configured by reading out the unique information for each user and communicating with the authentication server. Therefore, authentication processing is not performed due to leakage of passwords, etc., and authentication processing can be performed only when a recording medium is inserted. , It is possible to build a highly reliable system for security. According to the communication terminal of the first aspect, the authentication common information and the communication common information are stored in advance, and the stored common information, the authentication unique information and the communication unique information input from the recording medium are used. Since the authentication information file and the communication information file are configured, the amount of information recorded on the recording medium can be reduced, and the memory consumption of the recording medium can be suppressed.
[0081]
According to the communication terminal of the second aspect, the key exchange process is performed with the authentication server by the communication processing means, and the encryption process is performed according to the result of the key exchange process. It is possible to perform the authentication process and the key exchange process only when it is inserted, making it possible to build a highly reliable system for security while making the logon process at startup safe.
[0082]
According to the communication terminal of the third aspect, when the home address is read from the recording medium and input as the unique information, the communication information file is configured using the home address. Communication processing using an address can be performed, and a logon process at startup can be made safe, and a highly reliable system for security can be constructed.
[0083]
According to the communication terminal of the fourth aspect, when the password, the authentication unique information, the communication unique information, the authentication common information, and the communication common information are read out and input from the recording medium, the information file constituting unit performs authentication. Since the information file and the communication information file are generated, the security level can be improved as compared with the case where only the unique information is recorded on the recording medium.
[0084]
According to the communication terminal of the fifth aspect, the communication processing means reads the authentication information file and the communication information file held in the file management means and performs the authentication processing in response to an instruction from the information file configuration means. Therefore, even when a recording medium is not inserted, the default operation can be performed, and operational flexibility can be ensured.
[0085]
According to the communication terminal according to claim 6, when the password for determining the validity of communication use is input as the specific information, the authentication information file and the communication information file are configured by the information file configuration unit. Since the password, the authentication information file, and the path information about the communication information file are stored in the temporary storage means and the authentication processing by the communication processing means is started, the authentication processing is performed with the program constituting the information file. Separation from the program can be facilitated, and the design change of the program that performs the existing authentication process can be reduced.
[0086]
According to the communication terminal according to claim 7, since the password and the path information stored in the temporary storage means are deleted by the communication processing means after the authentication process is completed, the communication information file and It is possible to prevent leakage of the unique information stored in the portable recording medium by storing the authentication information file as it is.
[0087]
According to the communication terminal of claim 8, since the authentication information file and the communication information file stored in the temporary storage unit are deleted by the information file configuration unit after the authentication processing of the communication processing unit is completed. It is possible to prevent the communication information file and the authentication information file from being stored as they are after the communication is finished and leaking the unique information stored in the portable recording medium.
[0088]
According to the communication terminal according to claim 9, when the password for determining the validity of communication use is input as the specific information, the path information about the password, the authentication information file, and the communication information file is configured as an information file. Since the authentication process is started by sending from the means to the communication processing means, it is not necessary to temporarily store the password and path information, and security can be improved.
[0089]
According to the communication terminal of the tenth aspect, when the authentication server identification information is read from the recording medium and input, the connection is restricted to the authentication server specified by the authentication server identification information and the authentication process is performed to establish communication. Therefore, the connection with the application server can be established through the authentication server specified by the user regardless of the existing setting, and the connection destination of the communication terminal can be different for each recording medium. The connection destination of the communication terminal can be restricted by inserting the recording medium.
According to the communication terminal according to claim 11, when a plurality of authentication server identification information for identifying each authentication server corresponding to each application server is read from the recording medium and inputted, each authentication specified by each authentication server identification information Since authentication processing is established with the server to establish communication with the application server selected by the user, it is possible to connect from multiple authentication servers simply by letting the user select the application server that he wants to connect to. The destination can be designated, and the convenience for the user can be improved.
[0104]
According to the communication establishment program according to claim 12, when at least specific information for each user is read out and input from information necessary for authentication processing with the authentication server from the recording medium held by the user, the input information is To communicate with the authentication server by referring to the communication information file and the information file configuration program constituting the communication information file used for communication with the authentication server and the authentication information file necessary for the authentication process. The authentication processing file is configured with a communication processing program that establishes communication with the authentication server by referring to the authentication information file and performing authentication processing with the authentication server. The authentication process can be performed only when a recording medium is inserted without making it happen, making the logon process at startup safe. Both can be constructed reliable system for security. According to the communication establishment program according to claim 12, the authentication common information and the communication common information are stored in advance, and the stored common information, the authentication unique information and the communication unique information input from the recording medium are stored. Since the authentication information file and the communication information file are used, the amount of information recorded on the recording medium can be reduced, and the memory consumption of the recording medium can be suppressed.
According to the communication system according to claim 13, an authentication server that performs authentication processing between a plurality of communication terminals and establishes communication between the application server and the communication terminal according to the result of the authentication processing, and a user Among the information necessary for authentication processing with the authentication server from the recording medium possessed by the user, at least unique information for each user is read out and input, and using the input information, an authentication information file and authentication server required for authentication processing Configure a communication information file to be used for communication with the server, communicate with the authentication server by referring to the communication information file, and perform authentication processing with the authentication server by referring to the authentication information file Because it consists of a communication terminal, authentication processing is not performed at the communication terminal due to leakage of passwords, etc., and authentication processing is performed only when a recording medium is inserted. It can, together with the safe logon process at startup, it is possible to increase the reliability of security. According to the communication system of the thirteenth aspect, the authentication common information and the communication common information are stored in advance, and the stored common information, the authentication specific information and the communication specific information input from the recording medium are used. Since the authentication information file and the communication information file are configured, the amount of information recorded on the recording medium can be reduced, and the memory consumption of the recording medium can be suppressed.
[0106]
According to the communication system of the fourteenth aspect, a relationship between the access permission level and information necessary for the authentication process is set in advance in the authentication server, and the access permission level is referred to the application server of each communication terminal. Therefore, access permission / non-permission for each application server is determined for each communication terminal, so that access control of each communication terminal to each application server can be performed.
According to the communication system of the fifteenth aspect, the home address is stored as the unique information for each user in the recording medium, and the authentication server presets the relationship between the access permission level and the home address, and sets the home address as the home address. Accordingly, since access to the application server of the communication terminal is restricted, it is possible to control access to each application server of the communication terminal.
[Brief description of the drawings]
FIG. 1 is a functional block diagram showing a configuration of a communication system and a communication terminal to which the present invention is applied.
FIG. 2 is a diagram for explaining packet creation processing by a communication processing unit of a communication terminal and a communication processing unit of an authentication server.
FIG. 3 is a flowchart showing a processing procedure from the insertion of an IC card to the start of encrypted communication in communication establishment processing by a communication terminal to which the present invention is applied.
FIG. 4 is a flowchart showing a processing procedure for ending encrypted communication in communication establishment processing by a communication terminal to which the present invention is applied.
FIG. 5 is a flowchart showing another processing procedure from the insertion of an IC card to the start of encrypted communication in communication establishment processing by a communication terminal to which the present invention is applied.
FIG. 6 is a block diagram for explaining another embodiment of a communication system to which the present invention is applied.
FIG. 7 is a block diagram for explaining still another embodiment of a communication system to which the present invention is applied.
FIG. 8 is a block diagram for explaining still another embodiment of a communication system to which the present invention is applied.
FIG. 9 is a diagram for explaining a table in which authentication client identification information held in an authentication server is associated with an access level.
FIG. 10 is a diagram for describing a table indicating each access level held in the authentication server and access permission / denial for each application server;
FIG. 11 is a block diagram showing a conventional communication system.
[Explanation of symbols]
1 Communication terminal
2 Authentication server
3 Application server
4 VPN path
10 IC card
21 IC card reader
22 IC card reader for logon
23 Logon Department
24 IC card monitoring unit
25 Network common information storage
26 Information File Management Department
27 Temporary storage
28 Authentication client
29 Input device
30 Application processing section
31 IC card reader
32 Information file component
33 Starter
41 Network information file
42 Authentication information file
51 Startup information acquisition unit
52 Authentication / Network Information Acquisition Department
53 Authentication processing part
54 Key exchange processing part
55 Communication processor
61 Authentication processing part
62 Key exchange processing part
63 Communication processing unit
71 IP header information area
72, 74, 76 Data area
73 IPSec header area
75 IPinIP header area
81, 83, 85 Source address area
82, 84, 86 Destination address area

Claims (15)

Information input means for reading and inputting at least user-specific information from information necessary for authentication processing with the authentication server from the recording medium held by the user;
Using the information input by the information input means, an information file constituting means for constituting an information file for authentication necessary for authentication processing and a communication information file used for communication with the authentication server;
Communicating with the authentication server with reference to the communication information file configured by the information file configuration means, and performing authentication processing with the authentication server with reference to the authentication information file a communication processing means for establishing a communication between the authentication server,
Common information storage means for storing common authentication information and common communication information used in common with respect to different unique information stored in recording media held by different users, and the common authentication information, Information necessary for authentication processing including identification information for distinguishing the authentication server, the communication common information is information used to enable communication with the authentication server,
The above information input means is a password for determining the validity of communication use, unique information for authentication used when performing authentication processing with the authentication server, and used when performing communication processing with the authentication server. Read and input the unique information for communication from the recording medium,
When the validity of communication use is determined from the password input by the information input unit, the information file configuration unit is stored in the authentication specific information input by the information input unit and the common information storage unit. The authentication information file is configured using the authentication common information and the communication common information input by the information input means and the communication common information stored in the common information storage means are used for communication. A communication terminal comprising an information file .   2. The communication processing means further comprises key exchange means for performing a key exchange process with the authentication server based on an authentication process result and performing an encryption process according to the result of the key exchange process. The communication terminal described in 1. The information input means reads and inputs a home address as the specific information from the recording medium,
2. The communication terminal according to claim 1, wherein the information file configuring unit configures a communication information file using a home address input by the information input unit. The above information input means is a password for determining the validity of communication use, unique information for authentication used when performing authentication processing with the authentication server, and used when performing communication processing with the authentication server. Specific information for communication, common information for authentication and common information for communication that are common to each communication terminal are read from the recording medium and input, and the common information for authentication and the common information for communication are different by different users. It is information used in common for different unique information stored in the recording medium possessed, the authentication common information is information necessary for authentication processing including identification information for distinguishing the authentication server, The communication common information is information used to enable communication with the authentication server,
2. The communication terminal according to claim 1, wherein the information file configuration unit generates an authentication information file and a communication information file from the information input by the information input unit. A file management means for holding and managing at least the authentication information file and the communication information file created in the information file configuration means;
2. The communication processing unit reads out an authentication information file and a communication information file held in the file management unit and performs an authentication process in response to an instruction from the information file configuration unit. The communication terminal described in 1. The information input means inputs a password for determining the validity of communication use as the specific information,
In response to the configuration of the authentication information file and the communication information file, the information file configuration unit obtains the password input by the information input unit, the path information about the authentication information file and the communication information file. Memorize it in temporary storage means,
The said communication processing means reads the said password and pass information, and starts the authentication process in a communication terminal, when a password and pass information are input into the said temporary storage means , The authentication process in a communication terminal is started. Communication terminal. The communication terminal according to claim 6 , wherein the communication processing unit deletes the password and the pass information stored in the temporary storage unit after the end of the authentication process in the communication terminal. The information file arrangement unit, according to claim, characterized in that erasing the authentication information file and the communication information file stored in the temporary storage means after completion of the authentication process in the communication in the terminal of the communication processing means 6 The communication terminal described in 1. The information input means inputs a password for determining the validity of communication use as the specific information,
In response to the configuration of the authentication information file and the communication information file, the information file configuration unit obtains the password input by the information input unit, the path information about the authentication information file and the communication information file. , Sent to the communication processing means,
The communication processing means, a communication terminal according to claim 1, characterized in that to start the authentication process in response to the information file structure means or Rapa Seward and path information is input. The information input means reads out and inputs authentication server identification information for identifying an authentication server that performs authentication processing with the communication processing means,
2. The communication terminal according to claim 1, wherein the communication processing means establishes communication by connecting to an authentication server specified by the authentication server identification information input by the information input means and performing authentication processing. . The information input means reads and inputs a plurality of authentication server identification information for identifying each authentication server corresponding to each application server that establishes communication by authentication processing in the communication processing means,
The communication processing means establishes communication with the application server selected by the user by performing authentication processing with each authentication server specified by each authentication server identification information input by the information input means. The communication terminal according to claim 1, wherein: The communication establishment program
Information input means for reading and inputting at least user-specific information out of information necessary for authentication processing with the authentication server from a recording medium owned by the user , when at least user-specific information is read and input An information file configuration program that functions as a file configuration unit that configures an authentication information file necessary for authentication processing and a communication information file used for communication with the authentication server, using the input information;
The computer communicates with the authentication server with reference to the communication information file, performs authentication processing with the authentication server with reference to the authentication information file, and communicates with the authentication server. A communication processing program that functions as a communication processing means for establishing communication between
The computer stores authentication common information and communication common information used in common for different unique information stored in recording media held by different users in a recording medium readable by the information input means. The common information for authentication is information necessary for authentication processing including identification information for distinguishing the authentication server, and the common information for communication is used to enable communication with the authentication server. Information,
The above information input means is a password for determining the validity of communication use, unique information for authentication used when performing authentication processing with the authentication server, and used when performing communication processing with the authentication server. The communication specific information to be read from the recording medium and input,
It said information file configuration means, when the validity of the communication usage from the password input at the information file configuration unit determines, and said information authentication unique information input at the file structure means and the authentication common information together constitute the authentication information file using a communication establishing program characterized by configuring the communication information file by using the entered unique information and the communication common information communication by said information input means. An authentication server that performs authentication processing between a plurality of communication terminals and establishes communication between the application server and the communication terminal according to the result of the authentication processing;
Among the information necessary for the authentication process with the authentication server from the recording medium possessed by the user, at least the unique information for each user is read out and input, and using the input information, an authentication information file required for the authentication process, and A communication information file used for communication with the authentication server is configured, communication is performed with the authentication server with reference to the communication information file, and with the authentication server with reference to the authentication information file. and a communication terminal that performs authentication processing with,
The communication terminal further comprises common information storage means for storing authentication common information and communication common information used in common for different unique information stored in recording media held by different users, and the authentication Common information is information necessary for authentication processing including identification information for distinguishing the authentication server, and the communication common information is information used to enable communication with the authentication server,
The above information input means is a password for determining the validity of communication use, unique information for authentication used when performing authentication processing with the authentication server, and used when performing communication processing with the authentication server. Read and input the unique information for communication from the recording medium,
When the validity of communication use is determined from the password input by the information input unit, the information file configuration unit is stored in the authentication specific information input by the information input unit and the common information storage unit. The authentication information file is configured using the authentication common information and the communication common information input by the information input means and the communication common information stored in the common information storage means are used for communication. A communication system characterized by comprising an information file . The authentication server sets in advance a relationship between an access permission level indicating the degree of access permission with the application server and information necessary for authentication processing, and records the information in the recording medium during authentication processing with the communication terminal. 14. The communication system according to claim 13 , wherein information necessary for the authentication processing is acquired and access to the application server of each communication terminal is restricted with reference to the access permission level. The recording medium stores a home address as unique information for each user,
The communication system according to claim 13 , wherein the authentication server presets a relationship between the access permission level and the home address.

Images