JP2005286534A - Private communication system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a private communication system for solving difficulty in contact between users and preventing an access by unauthorized people. <P>SOLUTION: The private communication system comprises: mobile wireless terminals 11 each being loadable with an IC card 30; a plurality of private access points 12 for the mobile wireless terminals 11; a relay server 13 for connecting the private access points to the Internet 20, a server group including an authentication server 14 connected to the Internet 20, and a plurality of servers 15, 16, 17. The authentication server 14 discriminates the access qualification of users on the basis of a personal authentication ID read from electronic mail received from the mobile wireless terminals 11 and an ID of the relay server 13 for relaying the electronic mail to permit access to the server group from the mobile wireless terminals 11. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention relates to a private communication system, and more particularly to a private communication system that can prevent unauthorized access from the outside.

  In a large hospital, university, factory, etc., a dedicated communication system is used. As shown in FIG. 5, in a conventional private communication system, an external communication line 41 is connected to a terminal device 44 such as an extension telephone or a computer via one or more exchanges 42 and a private communication line 43. . Each user belonging to the organization who operates on the premises communicates with an external terminal device 45 connected to the communication line 41 outside the premises using the terminal device 44 dedicated to the user or an arbitrary terminal device 44 ( M4) or another terminal device 44 connected to the local communication line 43 can be communicated (M5).

  In a private communication system, a terminal device 44 such as an extension telephone or a desktop computer is generally used in a fixed manner. Each user belonging to the organization can use the terminal device 44 such as an extension telephone closest to the current position of the user even when the user is in a conference room or the like and is not in his / her seat. However, when another user wants to contact the user and the current position is unknown, it is difficult to contact.

  If a wireless communication terminal is lent to each user belonging to an organization instead of a fixed extension telephone, data can be transmitted / received in addition to telephone conversation, thereby improving business efficiency. For example, Patent Document 1 describes a configuration in which a wireless LAN and a wired network are connected by an access point in a patient management system in a hospital and a portable wireless terminal is connected to a server in the hospital. According to this method, each user belonging to the organization can access the network at any location on the premises, and the problem of difficulty in communication in the conventional premises communication system is solved. Here, the holder of the portable wireless terminal receives personal authentication as to whether he / she has access authority by the authentication server every time he / she accesses.

Patent Document 2 describes a configuration including a terminal device that connects the Internet and a wireless LAN with a wireless LAN base station and can access the wireless LAN base station. A PPPoE server is connected to the wireless LAN as connection control means, and an authentication server is connected as authentication means. The terminal device connected to the wireless LAN base station accesses the Internet using PPPoE on the wireless LAN by accessing the PPPoE server and performing access authentication and network configuration. As a result, the terminal device can access the Internet via a high-speed wireless LAN even outdoors or at a destination.
JP 2003-318913 A JP 2003-60651 A

  According to the systems described in Patent Document 1 and Patent Document 2, an authentication server is used for personal authentication, and access by unqualified persons can be eliminated. However, in recent years, there are an increasing number of cases in which personal IDs are frequently stolen and unqualified persons pass through the qualification determination by the authentication server and enter the business server. In this case, there are many cases in which business secret business information is stolen by an unqualified person, or necessary business information is falsified to hinder business.

  In view of the above, the present invention solves problems such as difficulty in contacting a person in charge in a local communication system, and prevents unauthorized persons from accessing a business server or falsifying data in a business server. An object of the present invention is to provide a local communication system that can be used.

  In order to achieve the above object, a private communication system according to the present invention includes a storage medium for storing predetermined data including personal authentication data, a data reading unit for reading the predetermined data from the storage medium, and an external device. A terminal device having at least wireless communication means for transmitting and receiving data between, a data relay means for bidirectionally relaying data between the wireless communication means and the communication line of the terminal device, and connected to the communication line, An authentication server that determines whether the personal authentication data received from the terminal device via the data relay means and the path of the communication line are correct, and, based on the determination, an authentication server that approves / denies access qualification by the terminal device; At least one service connected to the communication line and permitting access by a terminal device whose access qualification is approved by the authentication server. Characterized in that it comprises a server group including a server.

  According to the on-site communication system of the present invention, the problem of difficulty in communication between users can be solved by possessing a portable wireless terminal, and the authentication server can access the server group based on the personal authentication data and the correctness of the communication path. Since the presence or absence of the qualification is determined, it is possible to prevent a situation where an unqualified person who cannot use a specific communication path on the premises accesses the server group.

  Here, in the preferred on-site communication system of the present invention, the authentication server determines whether or not the route of the communication line is correct depending on whether or not the received data includes information indicating that the data has passed through the data relay unit. In this case, access by an unqualified person can be prevented more effectively.

  The communication line is the Internet, the storage medium further stores a personal IP address, and the server group uses the personal IP address to access a terminal device whose access qualification is approved by the authentication server. It is also a preferable aspect of the present invention to include a data server that permits the above. By using the Internet, the versatility of the wireless terminal device is enhanced.

  The storage medium further stores a personal mail address, and the server group includes a mail server that permits a terminal device whose access qualification is approved by the authentication server to access the Internet using the personal mail address. Inclusion is also a preferred embodiment of the present invention. In this case, the versatility of the wireless terminal device is further improved.

  The terminal device has voice data collecting means for collecting voice data, and the server group has a function of an IP phone using a specific phone number for a terminal device whose access qualification is approved by the authentication server. It is also a preferred aspect of the present invention to include an additional telephone server. In this case, the versatility of the terminal device is further improved.

   Hereinafter, the present invention will be described in more detail based on preferred embodiments of the present invention with reference to the drawings. FIG. 1 shows a configuration of a private communication system according to an embodiment of the present invention. In this system, each user belonging to an organization has a portable wireless terminal 11 to which an IC card (storage medium) 30 can be attached. The portable wireless terminal 11 is connected to the relay server 13 via access points 12 arranged at a plurality of locations on the premises, and is connected to the Internet 20 via the relay server 13. Connected to the Internet 20 are an authentication server 14 belonging to the local communication system 10 and a server group including a data server 15, a mail server 16, a telephone server 17, and the like.

  As shown in FIG. 2, the portable wireless terminal 11 has an IC card slot 31 into which an IC card 30 for storing a personal authentication ID necessary for personal authentication can be inserted. is there. The IC card 30 is lent to each individual belonging to the organization, and the IC card 30 stores a personal authentication ID, a personal IP address, and a personal mail address of each individual. The portable wireless terminal 11 reads information from a voice input / output means (not shown), an LCD device 32 for displaying data on a screen, a key input means 33, and an IC card inserted in an IC card slot. Means (not shown) and wireless communication means (not shown).

  As shown in FIG. 3, the access point 12 is connected to the portable wireless terminal 11 via a wireless communication line 22 and is connected to the relay server 13 via a local wired communication line 21. The relay server 13 has a function as a relay station in the local communication system. The access point 12, the relay server 13, and the wired communication line 21 constitute a data relay unit for connecting the mobile wireless terminal 11 to the Internet 20. The relay server 13 has a specific ID (address) on the Internet, and has a function of adding its own ID to an e-mail received from the portable wireless terminal 11 and transferring it to the authentication server 14.

  The authentication server 14 can communicate with the portable wireless terminal 11 via the relay server 13 and the Internet 20. When the ID of the relay server 14 is added to the e-mail (M1) received from the mobile wireless terminal 11, the authentication server 14 accesses the mobile wireless terminal 11 using a preset regular route. It has a function of recognizing that it is a portable wireless terminal and notifying the portable wireless terminal 11 of access permission to each server in the server group. At the same time, it has a function of transmitting the IP address of the portable wireless terminal 11 and the ID of the relay server 14 to a server group including the data server 15, the mail server 16, and the telephone server 17. As a result, notification is given to permit access from the portable wireless terminal having a specific IP address via the relay server 14.

  When accessing the system using the wireless portable wireless terminal 11, the user first attaches the IC card 30 storing information necessary for personal authentication to the portable wireless terminal 11. The portable wireless terminal 11 uses technology such as mobile IPv6 to connect the portable wireless terminal 11 to the Internet. The portable wireless terminal 11 transmits an e-mail to the authentication server 14 after connecting to the Internet (M1). Note that the communication method is not limited to e-mail, and any communication method that can determine the communication path on the receiving side may be used.

  Next, the authentication server 14 uses the data server 15 based on the personal authentication ID information included in the e-mail sent from the portable wireless terminal 11 and the e-mail transmission path information added to the e-mail. It is determined whether an individual who is qualified to access a server group including the mail server 16 and the telephone server 17 is accessing from an authorized place. In this determination, the authentication server 14 checks the server that the portable wireless terminal 11 has passed when connected to the Internet, and the ID (or address) of the server closest to the portable wireless terminal 11 on the Internet 20. ) And personal identification ID information in the IC card 30 attached to the portable wireless terminal 11. Note that this determination may further include device information of the portable wireless terminal.

  The authentication server 14 notifies the server group including the data server 15, the mail server 16, and the telephone server (M2) when it is confirmed that an individual who has access qualification is accessing from an authorized place. ) Requests the data server 15 and the mail server 16 to make settings so that the portable wireless terminal 11 can access the data in the data server 15 and the mail server 16. Requests to be used as an IP phone.

  The data server 15, the mail server 16, and the telephone server 17 are portable wireless devices that pass through a server (relay server) having a specified personal authentication ID and a specific ID based on a notification from the authentication server. An access request from the terminal 11 is accepted. As shown in FIG. 4, the data server 15, the mail server 16, and the telephone server 17 notify the mobile wireless terminal 11 that is permitted access that access to each server is permitted (M3). . The portable wireless terminal 11 receives this access permission notification from the data server 15, the mail server 16, the telephone server 17, and the like, and activates a browser and a function as a telephone.

  In the private communication system according to the present embodiment, the portable wireless terminal 11 is adopted between the users who have the portable wireless terminal 11 by adopting the above configuration and combining the Internet technology such as IPv6 and the wireless communication technology. As long as it is operating, communication is possible. In addition, it is possible to communicate with a user who has a portable wireless terminal from the local communication system. Further, since the authentication server 14 does not permit access to the server group other than the portable wireless terminal 11 that communicates via the relay server 13, it is difficult for an external unqualified person to enter the local communication system. To.

  Although the present invention has been described based on the preferred embodiment, the on-site communication system of the present invention is not limited to the configuration of the above-described embodiment. Modifications and changes are also included in the scope of the present invention. For example, the communication line is not limited to the Internet.

  In addition, although an example in which the access point to the relay server are on-premises communication lines has been shown, the present invention is not limited thereto, and the Internet or the like may be used. In this case, the relay server can be accessed from the outside, but the authentication server may determine the route through the access point. Alternatively, by determining the route based on the server ID closest to the access point, the accessibility of unqualified persons may be greatly limited. Further, the IP address and the mail address may be given from an authentication server or a mail server instead of being stored in the IC card.

1 is a block diagram of a local communication system according to an embodiment of the present invention. The perspective view which shows the structure of the portable radio | wireless terminal of FIG. The block diagram which shows the flow of the data in the communication system of FIG. The block diagram which shows the flow of the data in the communication system of FIG. The block diagram which shows the conventional local area communication system.

Explanation of symbols

10: Local communication system 11: Portable wireless terminal 12: Access point 13: Relay server 14: Authentication server 15: Data server 16: Mail server 17: Telephone server 20: Internet 21: Local communication line 30: IC card 31: IC card slot 32: LCD
33: Key input device

Claims (5)

A storage medium for storing predetermined data including personal authentication data;
A terminal device having at least data reading means for reading the predetermined data from the storage medium and wireless communication means for transmitting / receiving data to / from the outside;
Data relay means for bidirectionally relaying data between the wireless communication means and the communication line of the terminal device;
Determine whether the personal authentication data connected to the communication line and received from the terminal device via the data relay means and the route of the communication line are correct, and approve the access qualification by the terminal device based on the determination / Server for authentication to deny,
A local communication system comprising: a server group including at least one server that is connected to the communication line and permits access by a terminal device whose access qualification is approved by the authentication server.   The local communication system according to claim 1, wherein the authentication server determines whether the path of the communication line is correct or not based on whether or not the received data includes information indicating that the data has passed through the data relay unit.   The communication line is the Internet, the storage medium further stores a personal IP address, and the server group uses the personal IP address to access a terminal device whose access qualification is approved by the authentication server. The on-premises communication system according to claim 1, further comprising a data server that permits   The storage medium further stores a personal mail address, and the server group includes a mail server that permits a terminal device whose access qualification is approved by the authentication server to access the Internet using the personal mail address. The on-premises communication system according to claim 3.   The terminal device has voice data collection means for collecting voice data, and the server group functions as an IP phone using a specific phone number for a terminal device whose access qualification is approved by the authentication server. The on-site communication system according to claim 3 or 4, further comprising a telephone server for adding a telephone number.

Images