JP2006270312A - Communication management device, communication system, and method of managing communication - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To permit an access by an SSL communication system from a terminal equipment besides a local network to a WEB in the local network by the authentication of authority using an electronic certificate. <P>SOLUTION: An external certificate which external terminal equipment uses in an external network, a certificate for external connection, and a public key used on the occasion of the acquisition, and a private key which makes a pair are stored in relation in a database. The certificate for the external attach is used in the network, in case that an external equipment accesses the WEB in the local network. This instrument shell external certificate is acquired according to the access from the external terminal equipment. This certificate, certificate for corresponding external attach, and the private key are extracted from the database. The authentication performance execution of the access permission of the external terminal equipment is required in a substitute from the WEB1 using the certification for the external attach and the private key which are extracted. The authentication of the authority transmits the answer from the WEB to the external terminal equipment. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention relates to a communication management device, a communication system including the communication management device, a communication management method, and a program.

  2. Description of the Related Art Conventionally, a technique has been proposed in which an authorization (access right) for accessing, for example, a predetermined WEB or the like from a terminal device owned or managed by an individual user is authenticated using an electronic certificate (for example, Patent Document 1).

  Authentication using an electronic certificate has higher security against fraud such as user impersonation and eavesdropping on the network than authentication using an ID or password.

  By combining such an authentication technique with a communication technique using an encryption method such as SSL (Secure Sockets Layer), for example, higher security can be realized.

  As shown in FIG. 6, for example, as shown in FIG. 6, SSL-based communication is possible as a communication system to which a technology combining authentication technology using an electronic certificate and communication technology using an encryption method is applied. Terminal device 402 assigned to each user, a CA (Certificate Authority) 403 that issues an electronic certificate in response to a request from the terminal device 402, and an electronic certificate issued by the CA 403 There is a system that includes a WEB 404 that recognizes an authority when accessed by SSL using a certificate and permits communication.

In such a system, only when the WEB 404 is accessed by SSL using the electronic certificate issued from the CA 403, the contents of the WEB 404 can be browsed.
JP 2004-289247 A

  By the way, in the system as described above (FIG. 6), the external terminal device 405 outside the intranet 401 cannot access the WEB 404.

  In other words, in the intranet 401, the terminal device 402 is assigned, and even from the external terminal device 405 owned by the user who has the authority to access the WEB 404, the WEB 404 cannot be accessed.

  For this reason, there has been a problem that, for some reason, even if a user having authority in the intranet 401 wants to access the WEB 404 using the external terminal device 405, the access is not permitted.

  The present invention has been made in order to solve the above-described problems. From a terminal device outside the local network such as an intranet (external terminal device), encrypted communication such as SSL to a WEB inside the local network. It is an object of the present invention to provide a communication management device, a communication system including the communication management device, a communication management method, and a program that allow access by a method by authentication of access authority using an electronic certificate.

  In order to solve the above-described problems, a communication management apparatus according to the present invention is a communication management apparatus that manages a communication connection in an external network that communicates in an external network that is an external network to the local network. A first electronic certificate used in the local network when the external terminal device accesses the WEB in the local network, and a public key used in obtaining the first electronic certificate, A database that stores a paired secret key and a second electronic certificate used by the external terminal device in the external network in association with each other, and the external terminal device responds to an access from the external terminal device. First acquisition means for acquiring the second electronic certificate; and the first acquisition. Extraction means for extracting the first electronic certificate and private key corresponding to the second electronic certificate acquired by the means from the database, and the first electronic certificate and private key extracted by the extraction means. When the WEB in the local network is requested by the proxy to execute the authentication operation of the access authority of the external terminal device, and the WEB authenticates that the access authority exists, the WEB Proxy communication means for transmitting a response to the external terminal device.

  In the communication management device according to the present invention, in response to an access from an internal terminal device having a third electronic certificate used in the local network, the third electronic certificate is acquired from the internal terminal device. 2 and a key pair of a private key and a public key are generated in response to access from the internal terminal device, and the first electronic certificate is acquired from the certificate authority using the public key. Obtained by the third obtaining means, the fourth obtaining means for obtaining the second electronic certificate from the external terminal device designated by the accessing internal terminal device, and the third obtaining means. The first electronic certificate, the private key of the key pair used to obtain the first electronic certificate, and the second electronic certificate obtained by the fourth obtaining unit. Associated with the data It is preferable to provide a storage processing means for performing a process of storing the base, a.

  The communication management device of the present invention further comprises URL transmission means for transmitting a disposable URL to the e-mail address transmitted at the time of access from the accessing internal terminal device, and the fourth acquisition Preferably, the means acquires the second electronic certificate from an external terminal device that has accessed the disposable URL.

  It is preferable that the communication management apparatus of the present invention manages communication using the SSL communication method.

  A communication system according to the present invention includes the communication management device according to the present invention and the WEB.

  The communication system of the present invention includes the communication management device of the present invention, the WEB, the internal terminal device, and the certificate authority.

  Further, the communication management method of the present invention is a method for managing a communication connection to an inside of the local network from an external terminal device that communicates in an external network that is an external network to the local network. A first electronic certificate used in the local network when accessing the WEB in the local network, and a private key paired with the public key used in obtaining the first electronic certificate; A storage process for storing the second electronic certificate used in the external network by the external terminal device in association with the second electronic certificate from the external terminal device in response to an access from the external terminal device. A first obtaining process for obtaining a certificate, and a second obtaining process obtained by the first obtaining process. An extraction process for extracting the first electronic certificate and private key corresponding to the child certificate from the database, and using the first electronic certificate and private key extracted by the extraction process in the local network Requesting the WEB of the external terminal device to execute an access authority authentication operation on behalf of the WEB, and when the WEB authenticates that the user has the access authority, a response from the WEB is sent to the external terminal device. And a proxy communication process for transmission to the network.

  In the communication management method of the present invention, in response to access from an internal terminal device having a third electronic certificate used in the local network, the third electronic certificate is acquired from the internal terminal device. 2 and a key pair of a private key and a public key is generated in response to the access from the internal terminal device, and the first electronic certificate is acquired from the certificate authority using the public key. A third acquisition step; and a fourth acquisition step of acquiring the second electronic certificate from an external terminal device designated by the accessing internal terminal device, wherein the storage processing step The first electronic certificate obtained by the third obtaining process, the private key of the key pair used for obtaining the first electronic certificate, and obtained by the fourth obtaining process. Said second electricity And certificates, is preferably a process of storing in association with.

  The communication management method of the present invention further includes a URL transmission process of transmitting a disposable URL to the e-mail address transmitted at the time of access from the internal terminal device that has performed the access, and the fourth acquisition Preferably, in the process, the second electronic certificate is obtained from an external terminal device that has accessed the disposable URL.

  In the communication management method of the present invention, it is preferable to manage communication by the SSL communication method.

  The program of the present invention is a program for causing a computer to execute a communication management method.

  According to the present invention, when the external terminal device accesses the WEB in the local network, the first electronic certificate used in the local network and the public key used in acquiring the first electronic certificate And a second electronic certificate used by the external terminal device in the external network in association with each other and stored as a database, and from the external terminal device in response to access from the external terminal device Obtaining a second electronic certificate, extracting a first electronic certificate and a private key corresponding to the obtained second electronic certificate from the database, extracting the first electronic certificate and Using a secret key, the WEB in the local network is requested to execute an authentication operation for the access authority of the external terminal device on behalf of the user, and the access authority is granted. When the WEB is authenticated by the WEB, a response from the WEB is transmitted to the external terminal device. Therefore, a terminal device (external terminal device) outside the local network such as an intranet can send a WEB inside the local network. Can be configured to be permitted by access authority authentication using an electronic certificate.

  Embodiments according to the present invention will be described below with reference to the drawings.

  1 to 3 are block diagrams showing a communication system 100 according to this embodiment.

  As shown in FIG. 1, a communication system 100 according to the present embodiment includes an intranet (local network) 109 and an external terminal device 101 that can normally perform communication on a network (external network) outside the intranet 109; It is configured with.

  Among these, the external terminal device 101 stores and holds in advance an electronic certificate (external certificate 102: second electronic certificate) used for communication connection in an external network. Specifically, the external terminal device 101 is, for example, a mobile phone such as a FOMA terminal.

  The intranet 109 is a CA that issues a plurality of internal terminal devices 107 capable of executing communication in the intranet 109 and an electronic certificate (third electronic certificate: hereinafter, internal certificate) used in the intranet 109. (Certificate Authority: certificate authority) 108, communication management device 103 that authenticates external terminal device 101, and internal terminal device 107 can be accessed, and by external communication terminal 101 authenticated by communication management device 103 And an internal WEB (WEB) 106 that can also be accessed.

  Among these, the internal terminal device 107, the CA 108, and the internal WEB 106 are general well-known devices.

  That is, the internal terminal device 107 is, for example, a PC (Personal Computer) or other terminal device, and has a browser that can support SSL communication (SSL communication method). Such an internal terminal device 107 is assigned to each internal user who has the authority to communicate within the intranet 109.

  The CA 108 is a certificate authority having a function such as certificate issuance in a public key infrastructure (PKI), and issues an internal certificate for each internal terminal device 107, that is, for each internal user.

  The internal WEB 106 is a general HTTP (Hyper Text Transfer Protocol) server that supports SSL communication.

  Further, the communication management apparatus 103 terminates the communication connection from the external terminal apparatus 101 to the internal WEB 106 of the intranet 109 (for example, in this embodiment, connection by SSL communication) at the boundary between the inside and the outside of the intranet 109.

  Then, the communication management apparatus 103 requests the internal WEB 106 to authenticate access authority to the internal WEB 106 of the external terminal apparatus 101 that has been accessed from outside the intranet 109.

  The communication management device 103 is configured in detail as shown in FIG.

  That is, the communication management apparatus 103 is an intranet that performs SSL communication between the external communication unit (first acquisition unit) 202 that performs SSL communication with the external terminal device 101 and the internal WEB 106 in the intranet 109. Internal communication means 203, a WEB page for accessing from the external terminal device 101, that is, a certificate registration page creation means 204 for creating a certificate registration page, which will be described later, and a certificate linkage means for associating certificates 205, the external connection certificate (first electronic certificate), the external certificate, and the private key (the private key paired with the public key used for obtaining the first electronic certificate) are stored in association with each other. Certificate corresponding to the certificate correspondence database 206 (database) and the external terminal certificate issuance request from the internal terminal device 107 An issuance acceptance unit 207, a certificate issuance request unit 209 that requests the CA 108 to issue a certificate for external connection, and a key pair generation unit 208 that generates a key pair for external connection (described later). Has been.

  The communication management device 103 includes, for example, a CPU that performs various control operations, a ROM that stores and holds a control program (program) for the CPU, and a RAM that functions as a work area for the CPU. Then, by operating according to the program stored in the ROM, it functions as each of the above means 202, 203, 204, 205, 206, 207, 208, 209.

  Each user in the intranet 109 generates a private key / public key pair in the internal terminal device 107 in advance, and transmits the public key to the CA 108 to thereby generate the internal key for the CA 108. Apply for a certificate.

  Upon receiving this application, the CA 108 generates a certificate (internal certificate) from the sent public key, and issues (transmits) the generated internal certificate to the internal terminal device 107.

  The internal terminal device 107 that has received the internal certificate from the CA 108 stores and holds the pair 105 of the internal certificate and the private key generated when applying for the internal certificate.

  Thus, the internal terminal device 107 of each user in the intranet 109 stores and holds the internal certificate / private key pair 105 in advance.

  Thus, each user in the intranet 109 having the internal certificate issued from the CA accesses the internal WEB 106 from the internal terminal device 107 by using the pair 105 of the internal certificate and the private key, and It is possible to browse information.

  Here, in order to allow a certain user (hereinafter referred to as user A) among the users in the intranet 109 to access the internal WEB 106 using his / her external terminal device 101, the following description will be given. As described above, it is necessary to register in advance in the communication management apparatus 103 the association between the self internal certificate and the external certificate of the self external terminal apparatus 101.

  Hereinafter, with reference to FIG. 3 and FIG. 4, an operation when the user A performs such registration using the internal terminal device 107 will be described.

  First, the user A uses the internal terminal device 107 to access the communication management device 103 by the SSL communication method, and registers the electronic mail address of the external terminal device 101 of the user A in the communication management device 103. At this time, the communication management device 103 acquires the internal certificate 111 of the user A from the internal terminal device 107 by negotiation of SSL communication (1).

  Subsequently, the communication management apparatus 103 generates a key pair (private key and public key) for user A's external connection, sends the public key to the CA 108, and sends a certificate (external connection) to the CA 108. (2) (second acquisition process: step S1).

  Here, in the present embodiment, external connection means access to the internal WEB 106 using the external terminal device 101.

  The CA 108 creates a certificate (external connection certificate) from the public key sent from the communication management apparatus 103, and issues (transmits) the generated external connection certificate 110 to the communication management apparatus 103 ( 3).

  The communication management apparatus 103 acquires the external connection certificate 110 issued from the CA 108 (third acquisition process: step S2).

  The communication management apparatus 103 corresponds to the private key generated in (2), the external connection certificate 110 issued in (3), and the internal certificate 111 acquired from the internal terminal apparatus 107 in (1). And the private key, the external connection certificate 110, and the internal certificate 111 are associated with each other and stored in the certificate correspondence database 206 (4).

  The communication management device 103 is discarded for each registration procedure addressed to the e-mail address registered in (1), that is, addressed to the external terminal device 101 of the user A (and therefore unique to each registration procedure). The URL (Uniform Resource Locator) of the (certificate registration page) is sent (5) (URL transmission process: step S3).

  The external terminal device 101 accesses the URL sent in (5) by the SSL communication method. At this time, the communication management apparatus 103 acquires the external certificate 102 of the user A from the external terminal apparatus 101 of the user A by negotiation of SSL communication (fourth acquisition process: step S4).

  The communication management apparatus 103 associates the secret key generated in (2) with the external connection certificate issued in (3) and the external certificate 102 acquired in (6), and these secrets The key, the external connection certificate 110, and the external certificate 102 are associated with each other and stored in the certificate correspondence database 206 (7) (storage process: step S5). That is, the certificate correspondence database 206 stores and holds the pair 104 in which the external connection certificate 110 and the private key are associated with each user.

  This completes the registration operation.

  Here, when the user A accesses the internal WEB 106 from the outside of the intranet 109 using the external terminal device 101, the communication management device 103 uses the external connection certificate 110 instead of the external terminal device 101 to The WEB 106 is accessed and the internal WEB 106 authenticates the access right from the external terminal device 101. Therefore, at the time of the authentication, the internal WEB 106 can recognize that the access using the external connection certificate 110 of the user A by the communication management apparatus 103 is an access from the outside of the intranet 109 by the user A. The association between the external connection certificate 110 and the user A (for example, the association between the user A's external connection certificate 110 and the internal certificate 111) needs to be registered in the internal WEB 106 in advance. This registration is performed between the completion of the registration operation described with reference to FIG. 3 and the first access from the external terminal device 101 to the internal WEB 106 (for example, the administrator of the internal WEB 106 or communication management). Device 103).

  Next, the operation of the communication management apparatus 103 during the registration operation described with reference to FIGS. 3 and 4 as described above will be described with reference to FIG.

  First, the user A uses the internal terminal device 107 to access the certificate issuance accepting means 207 of the communication management device 103 using the SSL communication method, and the user A's e-mail address of the external terminal device 101 is a certificate. It transmits to the issue reception means 207.

  At this time, the certificate issuance accepting means (second obtaining means) 207 obtains the internal certificate 111 of the user A from the internal terminal device 107 by SSL communication negotiation (second obtaining process: step S1). .

  Subsequently, the certificate issuance acceptance unit 207 instructs the key pair generation unit 208 to generate a key pair (private key and public key) for user A's external connection.

  Upon receipt of this instruction, the key pair generation means (which constitutes the third acquisition means) 208 generates a key pair (private key and public key) for user A's external connection, and the generated key pair is a certificate. Pass to the issue request means 209.

  The certificate issuance requesting means (which constitutes the third obtaining means) 209 sends the public key of the key pair passed from the key pair generating means 208 to the CA 108, and sends a certificate (external connection) to the CA 108. Apply for issuance of certificate 110).

  The CA 108 creates a certificate (external connection certificate 110) from the sent public key, and issues (transmits) the generated external connection certificate 110 to the certificate issuance request unit 209.

  The certificate issuance request unit 209 obtains the external connection certificate 110 issued from the CA 108 (third acquisition process: step S2).

  The certificate issuance request unit 209 includes the external connection certificate 110 acquired from the CA 108, the private key generated when acquiring the external connection certificate 110, and the internal certificate 111 acquired from the internal terminal device 107. The associated external connection certificate 110, the private key and the internal certificate 111 are sent to the certificate linkage unit 205, and the associated external connection certificate 110, the private key and the internal certificate are associated with each other. The certificate cooperation unit 205 is instructed to store 111 in the certificate correspondence database 206.

  Upon receiving this instruction, the certificate linkage unit 205 receives the external connection certificate 110 and the internal certificate 111 sent from the certificate issuance request unit 209 (corresponding external connection certificate 110 and internal certificate 111). Is stored in the certificate correspondence database 206, while the certificate registration page creation unit 204 is instructed to create a certificate registration page.

  The certificate registration page creation means (URL transmission means) 204 creates the URL of the certificate registration page, and sends the created URL to the e-mail address of the external terminal device 101 of the user A. (URL transmission process: step S3).

  Upon receiving this instruction, the external communication means 202 sends the URL of the certificate registration page to the email address of the external terminal device 101 of the user A.

  Thereafter, the external terminal device 101 accesses the URL sent from the external communication unit 202 of the communication management device 103 by the SSL communication method.

  At this time, the external communication unit (fourth acquisition unit) 202 of the communication management apparatus 103 acquires the external certificate 102 of the user A from the external terminal apparatus 101 of the user A by negotiation of SSL communication (the first terminal). 4 acquisition process: Step S4).

  The certificate linkage unit (storage processing unit) 205 of the communication management apparatus 103 includes the acquired external certificate 102, the external connection certificate 110, and the private key used when acquiring the external connection certificate 110. Association is performed, and the external certificate 102, the external connection certificate 110, and the private key are associated and stored in the certificate correspondence database 206 (storage process: step S5).

  This completes the registration operation.

  In this way, in the communication management apparatus 103, for each user, the external connection certificate 110 and private key pair 104 are registered (in the certificate correspondence database 206) and the pair 104 (external The connection certificate 110 and private key pair) and the external certificate 102 are registered in association with each other (in the certificate correspondence database 206).

  Then, the communication management apparatus 103 uses the pair 104 (the pair of the external connection certificate 110 and the private key) corresponding to the external certificate 102 acquired from the accessed external terminal apparatus 101 to the internal WEB 106. Access (connect) on behalf of the external terminal device 101, and cause the internal WEB 106 to perform an authentication operation (requests the external terminal device 101 to execute an authentication operation on the access authority of the external terminal device 101). When it is authenticated by the internal WEB 106, a response from the internal WEB 106 is transmitted to the external terminal device 101.

  Next, an operation when a certain user accesses the internal WEB 106 in the intranet 109 using the external terminal device 101 will be described with reference to FIGS.

  First, the external terminal device 101 accesses the communication management device 103 by SSL communication and establishes a connection for SSL communication.

  At this time, the external terminal apparatus 101 transmits the external certificate 102 held by itself to the communication management apparatus 103.

  The communication management apparatus 103 acquires the external certificate 102 from the external terminal apparatus 101 (first acquisition process: step S11).

  Subsequently, the communication management apparatus 103 verifies the validity of the external certificate 102 transmitted from the external terminal apparatus 101 (for example, whether the external certificate 102 has been falsified).

  As a result of the verification, when it is determined that the external certificate 102 transmitted from the external terminal device 101 is a valid certificate, the communication management device 103 uses the external connection certificate 110 and the private key corresponding to the accessing user. The pair 104 is searched from the certificate correspondence database 206 (extraction process: step S12).

  Subsequently, the communication management apparatus 103 accesses the internal WEB 106 using the retrieved pair 104 (the external connection certificate 110 and the private key of the accessing user). This causes the internal WEB 106 to authenticate the access right to the internal WEB 106 of the accessed external terminal device 101. Further, the communication management apparatus 103 returns a response from the internal WEB 106 to the external terminal apparatus 101 (proxy communication process: step S13).

  Thereby, the external terminal device 101 can access the internal WEB 106 and browse the information.

  Next, the operation of the communication management apparatus 103 when a certain user accesses the internal WEB 106 in the intranet 109 using the external terminal apparatus 101 will be described in detail with reference to FIGS.

  First, the external terminal device 101 accesses the external communication means 202 of the communication management device 103 by SSL communication and establishes a connection for SSL communication. At this time, the external communication unit (first acquisition unit) 202 acquires information indicating that access to any desired internal WEB 106 is requested and the external certificate 102 from the external terminal device 101 (first unit). Acquisition process: Step S11).

  Subsequently, the external communication unit 202 notifies the intranet communication unit 203 of the user-specific information (ID) included in the external certificate 102 acquired when the SSL communication connection is established, and the access to the desired internal WEB 106 is transmitted to the intranet. The internal communication unit 203 performs this.

  The intranet communication means (proxy communication means) 203 transfers the notified user specific information to the certificate linkage means 205, and a pair 104 (a pair of the external connection certificate 110 and the private key) corresponding to the user specific information. ) Is obtained from the certificate correspondence database 206. Note that it is possible to search the certificate correspondence database 206 using not only the external certificate 102 itself but also user-specific information included in the external certificate 102 as a search key.

  Upon receiving the instruction from the intranet communication means 203, the certificate cooperation means (extraction means) 205 searches (extracts) and acquires the pair 104 corresponding to the notified user specific information from the certificate correspondence database 206. (Extraction process: step S12), the acquired pair 104 is transferred to the intranet communication means 203.

  Intranet communication means (proxy communication means) 203 establishes an SSL connection with internal WEB 106 using pair 104 (a pair of external connection certificate 110 and private key) acquired from certificate linkage means 205. Communication, and a response from the internal WEB 106 is returned to the external terminal device 101 via the external communication means 202 (proxy communication process: step S13).

  Thereby, the external terminal device 101 can access the internal WEB 106 and browse the information.

  According to the embodiment as described above, the communication management apparatus 103 includes the external connection certificate 110 used in the intranet 109 when the external terminal apparatus 101 accesses the internal WEB 106 in the intranet 109, and this The private key paired with the public key used for obtaining the external connection certificate 110 and the external certificate 102 used by the external terminal device 101 in the external network are associated with each other and stored as the certificate correspondence database 206. The external certificate 102 is acquired from the external terminal device 101 in response to the access from the external terminal device 101, and the external connection certificate 110 and the private key pair 104 corresponding to the acquired external certificate 102 are certified. (Search) from the certificate correspondence database 206, and the extracted external connection certificate 1 Using the 0 and private key pair 104, the internal WEB 106 in the intranet 109 is requested to execute the access authority authentication operation of the external terminal apparatus 101 on behalf of the user, and the internal WEB 106 authenticates that the user has the access authority. In this case, since the response from the internal WEB 106 is transmitted to the external terminal device 101, the electronic certificate is transmitted from the external terminal device 101 to the internal WEB 106 in the intranet 109 using the SSL communication method. It can be configured such that it can be permitted by authentication of the used access authority.

  Further, the communication management device 103 acquires the internal certificate 111 from the internal terminal device 107 in response to the access from the internal terminal device 107 having the internal certificate 111 used in the intranet 109, and responds to the access. A key pair of a private key and a public key (for acquiring the external connection certificate 110) is generated, and the external connection certificate 110 is acquired from the CA 108 using the public key, and the access is performed. The external certificate 102 is acquired from the external terminal device 101 designated by the internal terminal device 107 (for example, an e-mail address), the external connection certificate 110 acquired from the CA 108, and the external connection certificate 110 Associating the private key of the key pair used at the time of acquisition with the external certificate 102 acquired from the designated external terminal device 101 Since the process of storing the Akirasho corresponding database 206, in response to an access from the internal terminal device 107 having an internal certificate 111, automatically, it is possible to generate a certificate corresponding database 206. That is, the correspondence between the external certificate 102 and the external connection certificate 110 can be automatically registered in response to an access from the internal terminal device 107.

  In addition, the communication management apparatus 103, for example, transmits the URL of the disposable homepage to the e-mail address transmitted at the time of access from the accessing internal terminal apparatus 107, and accesses the disposable URL. By acquiring the external certificate 102 from the external terminal device 101, the external certificate 102 to be registered in the certificate correspondence database 206 can be acquired.

  As described above, according to the present embodiment, by providing the communication management apparatus 103 in the intranet 109 having a conventionally well-known configuration, the components in the original intranet 109 (the internal terminal apparatus 107, the internal WEB 106, and the CA 108) are changed. Without adding, it is possible to access the internal WEB 106 in the intranet 109 from the external terminal device 101 by authenticating the terminal using a certificate.

  In the above-described embodiment, a mobile phone is exemplified as the external terminal device 101. However, the external terminal device 101 may be another terminal device (for example, PHS (Personal Handy-phone System), PDA (Personal Digital Assistant), or the like. For example, a portable terminal device or a PC).

  In the above embodiment, the PC is exemplified as the internal terminal device 107. However, the internal terminal device 107 may be another terminal device (for example, a mobile phone, a personal handy-phone system (PHS), or a personal digital assistant (PDA)). Or a portable terminal device).

  In the above embodiment, an intranet is exemplified as the local network, but the local network may be another network.

1 is a block diagram showing a communication system according to an embodiment of the present invention. 1 is a block diagram showing a communication system according to an embodiment of the present invention. 1 is a block diagram showing a communication system according to an embodiment of the present invention. It is a flowchart which shows the flow of operation | movement of the communication system of the communication system at the time of performing registration operation | movement. It is a flowchart which shows the flow of operation | movement of the communication system at the time of accessing from the outside of an intranet. It is a block diagram which shows the conventional communication system.

Explanation of symbols

100 Communication System 103 Communication Management Device 101 External Terminal Device 107 Internal Terminal Device 108 CA (Certificate Authority)
102 External certificate (second electronic certificate)
106 Internal WEB (WEB)
109 Intranet (local network)
202 External communication means (first acquisition means, fourth acquisition means)
203 Intranet communication means (proxy communication means)
204 Certificate registration page creation means (URL transmission means)
205 Certificate linkage means (extraction means, storage processing means)
206 Certificate Database (Database)
207 Certificate issuance acceptance means (second acquisition means)
208 Key pair generation means (third acquisition means)
209 Certificate issuance request means (third acquisition means)

Claims (11)

A communication management device for managing communication connection in the local network from an external terminal device that performs communication in an external network that is an external network to the local network,
When the external terminal device accesses the WEB in the local network, a pair of a first electronic certificate used in the local network and a public key used in obtaining the first electronic certificate A database that stores an associated secret key and a second electronic certificate that the external terminal device uses in the external network in association with each other;
First acquisition means for acquiring the second electronic certificate from the external terminal device in response to access from the external terminal device;
Extraction means for extracting a first electronic certificate and a private key corresponding to the second electronic certificate acquired by the first acquisition means from the database;
Using the first electronic certificate and the private key extracted by the extracting means, the WEB in the local network is requested on behalf of the execution of the access authority authentication operation of the external terminal device, and the access authority Proxy communication means for transmitting a response from the WEB to the external terminal device when it is authenticated by the WEB,
A communication management device comprising: Second acquisition means for acquiring the third electronic certificate from the internal terminal device in response to an access from the internal terminal device having a third electronic certificate used in the local network;
A third acquisition unit that generates a key pair of a private key and a public key in response to access from the internal terminal device, and acquires the first electronic certificate from a certificate authority using the public key. ,
Fourth acquisition means for acquiring the second electronic certificate from an external terminal device designated by the accessing internal terminal device;
The first electronic certificate acquired by the third acquisition unit, the private key of the key pair used for acquiring the first electronic certificate, and the acquired by the fourth acquisition unit Storage processing means for performing processing for associating and storing the second electronic certificate in the database;
The communication management apparatus according to claim 1, further comprising: URL transmitting means for transmitting a disposable URL to the e-mail address transmitted at the time of access from the internal terminal device that has performed the access;
The communication management apparatus according to claim 2, wherein the fourth acquisition unit acquires the second electronic certificate from an external terminal device that has accessed the disposable URL.   The communication management apparatus according to any one of claims 1 to 3, wherein communication according to an SSL communication method is managed.   A communication system comprising the communication management device according to claim 1 and the WEB.   A communication system comprising the communication management device according to claim 2, the WEB, the internal terminal device, and the certificate authority. A method of managing communication connection in the local network from an external terminal device that performs communication in an external network that is an external network to the local network,
When the external terminal device accesses the WEB in the local network, a pair of a first electronic certificate used in the local network and a public key used in obtaining the first electronic certificate A storage process for storing the secret key formed and the second electronic certificate used by the external terminal device in the external network in association with each other;
A first acquisition step of acquiring the second electronic certificate from the external terminal device in response to an access from the external terminal device;
An extraction process of extracting from the database the first electronic certificate and the private key corresponding to the second electronic certificate acquired by the first acquisition process;
Using the first electronic certificate and private key extracted in the extraction process, the WEB in the local network is requested to execute an access authority authentication operation of the external terminal device on behalf of the WEB, and the access authority A proxy communication process of transmitting a response from the WEB to the external terminal device when it is authenticated by the WEB,
A communication management method comprising: A second acquisition step of acquiring the third electronic certificate from the internal terminal device in response to an access from the internal terminal device having a third electronic certificate used in the local network;
A third acquisition step of generating a key pair of a private key and a public key in response to an access from the internal terminal device, and acquiring the first electronic certificate from a certificate authority using the public key. ,
A fourth acquisition step of acquiring the second electronic certificate from the external terminal device designated by the accessing internal terminal device;
Further comprising
The storage processing step includes the first electronic certificate acquired in the third acquisition step, the secret key of the key pair used for acquiring the first electronic certificate, and the fourth electronic certificate. 8. The communication management method according to claim 7, wherein the second electronic certificate acquired by the acquisition process is a process of storing the second electronic certificate in association with each other. A URL transmission step of transmitting a disposable URL to the e-mail address transmitted at the time of access from the internal terminal device that performed the access;
9. The communication management method according to claim 8, wherein, in the fourth acquisition process, the second electronic certificate is acquired from an external terminal device that has accessed the disposable URL.   The communication management method according to any one of claims 7 to 9, wherein communication according to an SSL communication method is managed. The program for making a computer perform the communication management method as described in any one of Claims 7 thru | or 10.

Images