JP2005020668A - Network communication program and network communication card - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a card utilization communication system which can freely make a connection to an in-house LAN at a place enabling connecting environments to a wireless LAN and can retain sufficient security. <P>SOLUTION: The following processing is executed: processing for receiving an automatically added IP address and establishing an Internet connection when user information is transmitted from a terminal having a LAN card to a given Internet access point (hereinafter, referred to as an IAP), processing for requesting a specific server to make a connection to a managed LAN through the IAP, processing for transmitting encrypted user information to the server in response to a request from the server, the user information being different from information having been transmitted to the IAP, and processing for establishing a network connection after authenticating the server. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to a network communication program and a network communication card that connect to an in-house LAN through the Internet and can use the LAN outside the company in the same environment as in the office.
[0002]
[Prior art]
In an intra-company network called an intranet, a predetermined IP address (Internet Protocol Address) is set for each terminal device, and communication with a certain level of security is performed using user identification information and a password. . Even when a wireless LAN is employed, a LAN card is attached to each terminal device to construct a similar network (Patent Document 1).
[0003]
[Patent Document 1]
JP 2001-333107 A
[Problems to be solved by the invention]
By the way, the conventional techniques as described above have the following problems to be solved.
In recent years, services capable of broadband communication using a wireless LAN called hot spots have been started one after another at hotels, stations, restaurants, and the like. In this hot spot, broadband wireless communication becomes possible by installing a lent wireless LAN card in a computer carried by the user. Computers with built-in wireless LAN cards can be used as they are. The LAN card issues a connection request to the authentication server through the designated access point. The authentication server recognizes the LAN card and assigns an IP address through a certain authentication procedure. Thus, the portable personal computer owned by the user is connected to the network.
[0005]
If a person belonging to a company wants to connect to a network in the company outside the company such as a business trip destination, for example, a cellular phone network using PHS (Personal Handy-phone System) is used. However, there is a problem that the communication speed is 64 kilobytes, which is slower than the broadband and the communication fee is expensive. It is preferable to enable communication using broadband in the hot spot as described above.
[0006]
The present invention has been made paying attention to the above points, and the use of a card that can freely connect to an in-house LAN in a place where a connection environment to a wireless LAN network is provided and can maintain sufficient security. An object is to provide a communication system.
[0007]
[Means for Solving the Problems]
The present invention solves the above problems by the following configuration.
<Configuration 1>
When user identification information and personal identification information are transmitted from a terminal device equipped with a LAN card to an arbitrary Internet access point, an IP address automatically assigned is accepted and the Internet through the Internet access point is accepted. A process for establishing a connection, a process for requesting a connection to a LAN managed by the server through the Internet access point, and reading in the LAN card in advance according to a request from the server The process of transmitting the encrypted user identification information and password information recorded in the dedicated recording area to the server different from the one sent to the Internet access point, and the authentication process of the server, Establish a network connection through the LAN Network communication program and executes the process.
[0008]
This user connects to a LAN managed by a specific server and performs network communication. For this purpose, a LAN card is used. In the LAN card, encrypted user identification information and personal identification information are recorded in advance in a read-only recording area. The read-only recording area is an area where information can be read and written only by a specific information writing device, and information cannot be freely read and written at all times. The hardware configuration is arbitrary. Here, user identification information and personal identification information that can identify and authenticate the LAN card and its owner are written in encrypted form. Therefore, the secret of the user identification information and password information for LAN connection is protected. When connecting to a server via the Internet, a connection to an Internet access point is established in advance. At this time, user identification information and personal identification information obtained by contracting with a general service provider are used. Then log in to a specific server. At this time, login server identification information and personal identification information are requested from the server. Since the user identification information and the password information are encrypted and written in the LAN card, only the server can read them. After the server authentication process, an arbitrary communication process is allowed as a terminal device connected to the LAN.
[0009]
<Configuration 2>
In the network communication program according to Configuration 1, the LAN card stores a MAC address that identifies the LAN card. In the specific server, in addition to the encrypted user identification information and password information, A network communication program characterized in that the MAC address is registered as a condition for authentication processing.
[0010]
If authentication is performed only when the user identification information, the password information, and the MAC address match, only the terminal device using the LAN card can communicate. Therefore, security is further increased.
[0011]
<Configuration 3>
A read-only recording area that is read by a specific server through an Internet access point and used for authentication processing, and that records encrypted user identification information and personal identification information in a unique procedure. LAN card.
[0012]
The encrypted user identification information and personal identification information are recorded, for example, at addresses on the storage device and only known by the specific server. The unique procedure may be a procedure that cannot be read by the most basic method, and it is only necessary to shift the read start address.
[0013]
DETAILED DESCRIPTION OF THE INVENTION
Hereinafter, embodiments of the present invention will be described using specific examples.
FIG. 1 is a sequence chart showing a communication start procedure using the network communication card of the present invention.
A VPN (Virtual Private Network) server 11 is a server that manages connection to an in-house LAN. The access point server 12 is a server provided in a hot spot or the like. The terminal device 13 is used to connect to the in-house LAN via this hot spot and try to communicate. Before describing the sequence of FIG. 1, the configuration of the LAN card mounted on the terminal device and the configuration of the entire system will be described with reference to FIG.
[0014]
FIG. 2A is a block structure diagram of the LAN card 20 connected to the terminal device 13. FIG. 2B is an explanatory diagram of addresses used on the network.
The LAN card 20 stores user information 21 including encrypted user identification information and personal identification information. This is recorded at a predetermined address in a memory provided in the LAN card 20 as will be described later. The user identification information is a so-called user ID. This user ID is exclusively used for the in-house LAN. The password information is also a password used exclusively for the in-house LAN.
[0015]
In addition, a MAC address (Media Access Control address) 22 is stored in the LAN card 20. This is a unique address assigned to the LAN card at the time of manufacture. If this address is used, all LAN cards can be distinguished. That is, there is only one user who owns a LAN card having the same MAC address. Therefore, as long as the user who owns the LAN card 20 is a valid user, it can be used to identify the person. The network connection unit 23 is a part that performs an operation of setting an environment for connection to the wireless LAN through the antenna 24. The LAN card 20 is attached to a terminal device 13 composed of a mobile computer or the like.
[0016]
The terminal device 13 starts the connection with the wireless LAN by operating the communication control program 15 and further controls the connection with the in-house LAN through the Internet. As shown in FIG. 2B, on the Internet, the terminal device 13 performs communication using a global address that is a unique address (IP address) used on the Internet. On the other hand, the in-house LAN does not work on the Internet, but a predetermined private address that works in the in-house LAN is used for communication. This address is also a kind of IP address. In the VPN server 11, an address conversion table 30 is prepared, the correspondence between the private address and the global address of the terminal device 13 is held as information, and the terminal device 13 is as if it is a terminal device directly connected to the LAN. Make it work.
[0017]
FIG. 3 is an explanatory diagram illustrating a specific configuration example of the network.
As shown in FIG. 3, the VPN server 11 is connected to a network such as the Internet. The VPN server 11 controls communication between the various terminal devices 3, 4, 5 and the outside through a LAN 6 provided in the company. A server 12 at an access point provided in a hot spot or the like is connected to the Internet 1. The server 12 is connected to a large number of terminal devices using a wireless transmission / reception device 17. A LAN card 20 is attached to the terminal device 13. Wireless communication is performed using the antenna 18 of the wireless transmission / reception device 17 and the antenna 24 of the LAN card 20, and the terminal device 13 communicates with the access point server 12 wirelessly and is connected.
[0018]
In the above system, an environment in which, for example, a network card capable of wireless LAN can be used in the in-house LAN 6 (local area network) is prepared. It is assumed that the employee goes out with the network card 20 attached to his / her portable terminal device 13. At a hot spot outside the office, first, a user ID (U-ID) and a password (password information; PASS) are used to connect to the access point, access the server 12, and connect to the Internet 1. get permission. In the case of a hot spot that can be used free of charge, a user ID and a password are given on the spot. In the case of a hot spot for which a use contract has been made in advance, a user ID and a password are prepared on the user side.
[0019]
In FIG. 1, first, the terminal device 13 is activated in a hot spot, and a connection request is made to the access point server 12 in step S1. The access point server 12 makes an ID request to the terminal device 13 (step S2). The terminal device 13 transmits the prepared user ID and password to the access point server 12. This user ID and password need only be used for Internet connection via an access point. Thereafter, in step S4, connection to the Internet by the terminal device 13 is established.
[0020]
After establishing a connection to the Internet 1 in this way, a connection request is made to the corporate VPN server 11. The VPN is called a virtual private network, and constructs a virtual dedicated line using the Internet or a public line. Communication is performed by encryption processing. When a connection request from the network card 20 reaches the VPN server 11 through the Internet 1, an ID request for requesting a user ID is transmitted from the VPN server 11 in step S6. In step S7, the encrypted user ID (U-ID) and password (PASS) are transmitted from the network card to the VPN server. The VPN server 11 receives this content, performs authentication processing using pre-registered management data (step S8), and notifies the terminal device 13 of authentication (step S9).
[0021]
When the authentication process is completed, a connection between the LAN managed by the server and the terminal device 13 of the employee is established. Here, in the VPN server, a private address is set for the employee terminal device 13 (step S10). When the terminal device 13 is connected to the Internet, a global address is set. That is, a unique IP address effective on the Internet has already been set. On the other hand, in order to obtain the same operating environment as that connected to the in-house LAN, a private address that is an IP address unique to the in-house LAN is set. Since the function of this private address is not guaranteed on the Internet, the address conversion table 30 or the like may be prepared on the VPN server 11 side.
[0022]
Since this connection uses a broadband network connection system at a hot spot, a high-speed and comfortable communication environment can be set. Accordingly, in step S11 in FIG. 1, the employee terminal device can be connected to the in-house LAN in the same operating environment as in the office.
[0023]
FIG. 4 is an explanatory diagram showing a specific example of a system with higher security. FIG. 4A shows an authentication table 30 provided on the VPN server side. Here, data in which the user ID 31 of the employee, the password 32 and the MAC address 33 are associated in advance is stored. Record this data for all employees expected to connect from outside. The MAC address 33 is an address that identifies a LAN card. For example, if there are employees who share a LAN card, the same thing may be duplicated.
[0024]
In this example, the employee is requested to access by the combination of the user ID 31, the password 32, and the MAC address 33, and the authentication process is executed. The flowchart shown in FIG. 4B is for explaining the authentication process sent to the VPN server. First, when a use request is received from the user's terminal device in step S21, a reading procedure of the encrypted user ID and password written in the LAN card is acquired in step S22. This may be stored in a predetermined storage device of the VPN server.
[0025]
This procedure may be such that, for example, a read start address is designated or some special read procedure is stored in the memory. Of course, even if the data is simply read as it is by encryption, the user ID and the password are not immediately known to a third party. However, such a method is adopted in order to achieve higher security. In step S23, an encrypted user ID and password are acquired.
[0026]
Note that the VPN server reads the data in a predetermined area of the LAN card, but in reality, the VPN server requests the data recorded at a predetermined address and controls the LAN card. To do. A procedure is executed in which the communication program of the terminal device reads out the corresponding data and sends it to the VPN server. When the VPN server receives the user ID and the password, it decrypts the cipher using a program prepared in advance in step S24.
[0027]
Next, in step S25, the MAC address of the LAN card is acquired. This may be performed in the same procedure as that for acquiring the user ID and password. In step S26, identity verification is performed with reference to the authentication table 30 shown in FIG. Here, when authentication is established, the process proceeds from step S27 to step S28, and a private address is set in order to start communication. If not authenticated, error processing such as transmission of an error message is performed. After setting the private address, authentication notification is made in step S29. Thus, the state shown in step S11 of FIG. 1 is obtained, and the LAN can be freely used from the terminal device.
[0028]
Further, for example, the MAC address of the LAN card is used for the authentication process. The MAC address is an address unique to the LAN card, and user authentication can be further ensured by combining it with a user ID and password information. Also, if the encrypted user ID and the encrypted personal identification information are written in the ROM of the network card and read out by the VPN server, the login process with very high security becomes possible. In particular, if a write address is shifted by a predetermined amount or a complicated write procedure is determined in advance, a malicious third party can easily obtain an encrypted user ID and encrypted password information from a LAN card. Cannot read. Such an encryption password writing process on the card may be performed only by a specific terminal device.
[0029]
By using the LAN card as described above, you can use hotspots provided at various locations such as hotels, restaurants, airports, railway stations, etc. Is possible. In addition, it is possible to communicate through a so-called hot spot in the company using an in-company network of another company.
[0030]
In addition, said computer program may be comprised combining a respectively independent program module, and may be comprised by the program which integrated the whole. All or part of the processing controlled by the computer program may be configured by hardware having equivalent functions. Further, the above computer program may be used by being incorporated into an existing application program. The computer program for realizing the present invention as described above can be recorded on a computer-readable recording medium such as a CD-ROM and installed in any information processing apparatus for use. It can also be downloaded and used in the memory of any computer through the network.
[Brief description of the drawings]
FIG. 1 is a sequence chart showing a communication start procedure using a network communication card according to the present invention.
2A and 2B are diagrams showing configurations of a LAN card and the entire system, in which FIG. 2A is a block diagram of a LAN card connected to a terminal device, and FIG. 2B is an explanatory diagram of addresses used on a network;
FIG. 3 is an explanatory diagram illustrating a specific configuration example of a network.
4A and 4B are diagrams showing a specific example of a system with increased security, in which FIG. 4A is an explanatory diagram showing an authentication table provided on the VPN server side, and FIG. It is a flowchart of.
[Explanation of symbols]
DESCRIPTION OF SYMBOLS 11 VPN server 12 Access point server 13 Terminal device 15 Communication control program 17 Wireless transmission / reception apparatus 18, 24 Antenna 20 LAN card 21 User information 22 MAC address 23 Network connection part 30 Address conversion table 31 User ID
32 PIN 33 MAC address

Claims (3)

When user identification information and personal identification information are transmitted from a terminal device equipped with a LAN card to an arbitrary Internet access point, an IP address automatically assigned is accepted and the Internet through the Internet access point is accepted. Processing to establish a connection;
A process of requesting connection to a LAN managed by the server with respect to a specific server through the Internet access point;
In accordance with a request from the server, previously encrypted user identification information and password information recorded in a read-only recording area in the LAN card, which is different from the one sent to the Internet access point, Processing to send to the server;
A network communication program that executes a process of establishing a network connection through the LAN after an authentication process of the server. The network communication program according to claim 1,
The LAN card records a MAC address that identifies the LAN card, and the specific server registers the MAC address in addition to the encrypted user identification information and password information. As a condition for authentication processing. A read-only recording area that is read by a specific server through an Internet access point and used for authentication processing, and that records encrypted user identification information and personal identification information in a unique procedure. LAN card.

Images