JP2000090048A - Security information update system and record medium - Google Patents

Abstract

PROBLEM TO BE SOLVED: To decide whether or not security information held currently by a mobile client is the latest and to always insure cipher communication. SOLUTION: This security information update system is a security information update system for a network where a client can move, holds the latest security information. This system is also provided with an information management server 1 transmitting the update information of security information to a mobile client 2. The mobile client 2 is provided with an update information storing means 22 which stores the update information of security information and also has a download processing part 24 which stores security information, and compares 23 received update information from the information management server with the update information of an update information storing means 22, and downloads the latest security information from the information management server when the security information stored in itself is not the latest.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a security information updating system and a recording medium, and a security information updating system and a recording medium having a feature of updating security information of a mobile client in an NCG system or the like.

[0002]

2. Description of the Related Art With the recent development of communication technology and miniaturization of computers, a system called NCG (Network Cryptogate) has been developed in which a client can easily move from one network to another network.

FIG. 3 is a diagram showing an example of an NCG system. In this system, public lines, networks, etc. 51
, Three networks A, B, and C are provided. Each of the networks A, B, and C has
The NCG servers 52A, 52B, 52C and the clients A1, A2, B1, B2, B3, C1, C2 belong respectively.

[0004] For example, the client A1 uses the network A as a home network and the NCG server 52A as its home agent. This client A
When the client 1 wants to communicate with the client B1, it is usually necessary to add the IP addresses of the own device and the other device and send it to the network A.

Here, for example, when the client A1 is a portable personal computer or the like, the user of the client A1
There is a case where the user carries the personal computer and goes to a place where the network C is located to perform work. At this time, client A
1 performs communication and the like by receiving a new IP address from the administrator of the network C.

[0006] After moving, the client A1 contacts its own home agent (the NCG server 52A),
It registers that it is connected to the network C. This registration allows not only the client A1 but also all other clients to communicate without being aware of the movement of the client A1. For example, client B1
When performing communication with the client A1, if the IP address is transmitted to the network A, the NCG server 52
A obtains this packet and transfers it to the client A1 on the network C.

[0007] Thus, the presence of the home agent allows each client to communicate without being aware of its movement. Incidentally, the communication via the NCG server 52 is basically an encrypted communication.

FIG. 4 is a diagram showing a configuration example of a data packet used in the NCG system. Client B above
Although the transmission from 1 to the client A1 has been described omitting the encryption part, the case of transmission from the client A1 to the client B1 including the encryption part will now be described.

First, client A on network C
1 creates and transmits a packet 60 as shown in FIG. Here, the other-client-destined packet unit 61 is a transmission body for the client B1, and this portion is encrypted. Further, an NCG server header 62 is added as a header of the encrypted packet portion 61.
The packet 60 is first transmitted to the NCG server 52B, where the header 62 is removed, and the encrypted bucket section 61 is decrypted and delivered to the client B1.

In the communication using the NCG as described above, FIG.
To the home network and send the NCG
The packet is decrypted by the server 52 and the packet is delivered to the intended communication partner. When the client is moving, the home agent performs the transfer, and the NCG server of the moving destination performs the decryption.

In order to realize such an encrypted communication, each client holds security information (including key information, SA information, etc.) such as an encryption method used by an NCG server or the like, and always stores this information. Need to update to the latest one.

For example, when a new network is constructed and a new NCG server is installed in the network, or when an encryption method or a parameter for encrypted communication of a certain NCG server is changed, the information is obtained. There is a need. In the NCG system, an information management server 53 that manages security information of each NCG server 52 and a client is provided in preparation for such a case.

Therefore, the mobile client communicates using the security information acquired before the mobile client performs the encrypted communication at the destination, but transmits the security information from the information management server 53 when the information is old and cannot be connected. to download.

[0014]

However, the mobile client is not always connected to the network, and is not connected to the network while moving. Accordingly, during this time, the security information managed by the information management server 53 is updated, and even if the information management server 53 notifies each client or the like of the update, the moving client cannot know the fact.

Therefore, for example, in the above case, when the encryption communication system of the NCG server 52B is changed while the client A1 is moving, the connection cannot be made because the security information of the client A1 is old.

The present invention has been made in view of such circumstances, and makes it possible to determine whether or not the security information currently held by a mobile client is the latest one, and to always ensure encrypted communication. It is an object to provide a security information updating system and a recording medium.

[0017]

Means for Solving the Problems To solve the above problems, the invention corresponding to claim 1 has been made for a security information updating system used in a network system configured to be able to move a client between networks. It is.

First, an information management server is provided,
The latest security information used in the network system is held, and updated information on the security information is transmitted to the mobile client.

On the other hand, in the mobile client, security information used in the network system is stored in the security information storage means, and update information on the security information stored in the security information storage means is stored in the update information storage means. .

The update information receiving means of the client receives the update information from the information management server, and compares the received update information with the update information stored in the update information storage means. As a result of this comparison, if the security information held by itself is not the latest one, the update information reception processing unit notifies the download processing unit of the fact.

Then, when the notification is received,
The latest security information is downloaded from the information management server by the download processing means. Therefore, even if the mobile client moves from one network to another network, and even if there is a period during which the connection to the network is disconnected, it is appropriately determined whether or not the security information currently held by the mobile client is the latest. Judgment and encrypted communication can always be ensured.

According to a second aspect of the present invention, there is provided a recording medium storing a program for controlling a mobile client according to the first aspect of the present invention. If the recording medium according to the present invention is set in a computer and its program is read, the computer functions as a mobile client according to the first aspect of the present invention.

[0023]

Embodiments of the present invention will be described below. The security information updating system of the present embodiment is applied to the NCG system as shown in FIG. 3 described in the related art, and FIG. 1 shows only the information management server and a certain mobile client in the present embodiment. .

FIG. 1 is a configuration diagram showing an example of a security information updating system according to an embodiment of the present invention. The information management server 1 and the mobile client 2 shown in FIG.
It belongs to the CG system, and has the same functions as those of the system of FIG. 3 and also has the following configuration corresponding to the function of the present embodiment.

First, the information management server 1 stores the latest security information in the security information file 11 and holds update information (version information and the like) of the security information in the update information file 12. Also,
Upon receiving a request from the mobile client 2, the security information is extracted from the security information file 11,
A download processing unit 13 for sending to the public network 3 and an update information transmission processing unit 14 are further provided.

The security information in the update information file 12 includes a public key, SA information, gateway information, and the like for each mobile client. The update information transmission processing unit E is a processing unit that transmits update information to the mobile client based on the update time of the security information.
This update information notification is performed, for example, at regular intervals.

The mobile client 2 is a mobile computer such as a portable personal computer, and stores a security information file 21 storing security information previously downloaded from the information management server 1 and update information corresponding to the security information. Update information file 2
2. Update information reception processing unit 23, download processing unit 24
And an encrypted communication processing unit 25.

Upon receiving the update information from the information management server 1, the update information reception processing unit 23 compares the received update information with the update information in the update information file 22, and determines whether the security information needs to be updated. It is determined, and when it is determined that the update is required, the download processing unit 24 is notified to that effect.

Upon receiving the notification from the update information reception processing unit 23, the download processing unit 24 requests the download processing unit 13 of the information management server 1 to transmit the latest security information. The update information is stored in the update information file 22 while being stored in the file 21.

The encrypted communication processing unit 25 performs encrypted communication using the security information stored in the security information file 21. The public network 3 has a different form depending on the destination, and may be a general telephone line or a frame relay network, but is a network that can transfer at least IP packets.

Next, the operation of the security information updating system according to the embodiment of the present invention configured as described above will be described. FIG. 2 is a flowchart showing the operation of the mobile client in the security information updating system of the present embodiment.

The mobile client 2 can communicate with at least its own home agent, and the information management server 1 is connected via the home agent or directly.
Can communicate with

In the information management server 1, when the security information file 11 is updated, update information is created from the updated date and time, and the update information file 12 is updated. Further, the update information transmission processing unit 14 of the information management server 1
After that, the update information is transmitted to all the mobile clients 2 in the moving state at regular intervals.

In the mobile client 2, the update information reception processing unit 23 reads the update information of the security information of the mobile client 2 from the update information file 22 (ST1).

The latest update information from the information management server 1 is received by the update information reception processing unit 23 of the mobile client 2 (ST2), and is compared with the update information of the security information currently owned by the mobile client 2. (ST
3).

As a result of this comparison, if it is determined that the security information on the information management server 1 is newer than the security information owned by itself (ST
3), the information processing server 1 by the download processing unit 24
The latest security information above is downloaded (ST
4).

On the other hand, if it is determined that the security information owned by itself is the latest one (ST
3) Wait for update information reception, and return to step ST2. As described above, the security information updating system according to the embodiment of the present invention notifies update information from the information management server 1 and compares the received update information with the update information owned by the mobile client 2. Since the latest security information is always held based on the comparison result, even if the client is a mobile client, the connectivity with other clients and servers can always be ensured.

That is, since the mobile client 2 is not always connected to the network, it is not possible to download the file when the security information file 11 is updated. It can be downloaded reliably.

Further, for example, the update information transmission processing unit 14 of the information management server 1 may be configured to immediately notify the mobile client newly connected to the network of the update information. In this case, the update information can be obtained when the client connects to the network at the destination, and the latest information can be obtained immediately.

The present invention is not limited to the above embodiments, but can be variously modified without departing from the scope of the invention. The method described in the embodiment may be a program (software means) that can be executed by a computer (computer), for example, a magnetic disk (floppy disk, hard disk, etc.), an optical disk (CD-ROM, DVD, etc.), semiconductor It can also be stored in a storage medium such as a memory or transmitted and distributed via a communication medium. The program stored on the medium side includes a setting program for causing the computer to execute software means (including not only an execution program but also a table and a data structure) to be executed in the computer. A computer that realizes the present apparatus reads a program recorded in a storage medium, and in some cases, constructs software means by using a setting program, and executes the above-described processing by controlling the operation of the software means.

[0041]

As described above in detail, according to the present invention, it is possible to determine whether or not the security information currently possessed by a mobile client is the latest one, and to always secure encrypted communication. A recording medium can be provided.

[Brief description of the drawings]

FIG. 1 is a configuration diagram showing an example of a security information update system according to an embodiment of the present invention.

FIG. 2 is an exemplary flowchart showing the operation of the mobile client in the security information updating system of the embodiment.

FIG. 3 is a diagram showing an example of an NCG system.

FIG. 4 is a diagram showing a configuration example of a data packet used in the NCG system.

[Explanation of symbols]

 DESCRIPTION OF SYMBOLS 1 ... Information management server 2 ... Mobile client 3 ... Public network 11 ... Security information file 12 ... Update information file 13 ... Download processing part 14 ... Update information transmission processing part 21 ... Security information file 22 ... Update information file 23 ... Update information reception Processing unit 24: Download processing unit 25: Encrypted communication processing unit

──────────────────────────────────────────────────続 き Continued on the front page (51) Int.Cl. ⁷ Identification symbol FI Theme coat ゛ (Reference) H04L 12/56 H04L 11/20 102Z

Claims (2)

[Claims] 1. A security information update system used in a network system configured to allow a client to move between networks, the security information update system holding the latest security information used in the network system and updating the security information. An information management server for transmitting information to a mobile client, the mobile client comprising: a security information storage unit that holds security information used in the network system; and a security information storage unit that stores the security information stored in the security information storage unit. Update information storage means for storing update information; receiving update information from the information management server; comparing the received update information with update information stored in the update information storage means; Update information reception processing means for outputting the fact that the security information is not the latest, and when the security information is notified from the update information reception processing means that the security information is not the latest, Security information updating system comprising: download processing means for downloading security information. 2. A program for controlling a mobile client in a security information updating system used in a network system configured to be able to move a client between networks, the security information storage holding security information used in the network system. Means, update information storage means for storing update information about security information stored in the security information storage means, and receiving update information about the latest security information from an information management server for managing security information. Update information reception processing means for comparing the received update information with the update information stored in the update information storage means, and outputting if the security information held by the self information is not the latest one, Processing hand Self security information from within when notified not current, the computer-readable recording medium storing a program for causing a computer to function as the download processing means for downloading the latest security information from the information management server.