JP2007151114A - Communication system, communication terminal with virtual network switch and portable electronic device with biological recognition apparatus - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To perform a communication of a desired security level without packaging required software in a communication terminal beforehand. <P>SOLUTION: A communication terminal (2) of a communication system (1) comprises a virtual network switch (22) to forcibly change a transfer destination of data to be exchanged with a network (5), and data are exchanged between the network (5) and the communication terminal (2) via a portable electronic device (3). The function of software packaged in the portable electronic device (3) itself is provided to the communication terminal (2) and various functions such as a security function is complemented. Even when a communication terminal directly connected to a network does not have a function such as VPN therefore, firewall and virus check, high-security communication are performed utilizing these security ensuring means packaged in the portable electronic device. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention relates to a communication terminal having a network communication function and a communication system having a portable electronic device capable of communicating with the communication terminal. More specifically, the present invention relates to a communication system capable of accessing various networks using a communication terminal according to a communication security level preset in a portable electronic device.

  Conventionally, all software and setting information necessary for communication by connecting a communication device to a public network such as the Internet are either preinstalled in the communication device or temporarily installed in the communication device. In general, the software is operated inside the communication device. When ensuring security during communication, software for ensuring security is preinstalled or temporarily installed in a communication device.

  Here, as a means to ensure security during communication, use a part of the shared line as a virtual private line by using the specified encrypted data with the communicating party to ensure security VPN technology, firewall technology to prevent information exchange with unnecessary communication partners during communication, and illegal virus removal technology to check and remove malicious virus software from the exchanged data and so on.

  As for the VPN technology, when communicating on the Internet, the IP-VPN technology is widely used in order to prevent the risk of data being wiretapped and tampered by an unspecified number of others. When using the IP-VPN technology, the client terminal that performs communication installs the VPN client software designated in advance in the communication terminal, and the network engineer performs the necessary setting work to perform the designated VPN gateway device. Can be connected. When the client terminal communicates with the other party, encrypted communication can be performed via the VPN gateway device, so that the client terminal can safely communicate with the other party on the Internet.

  As for the firewall technology, simple settings can be made in advance using software preinstalled in the OS on the communication terminal. However, when it is used in a company, firewall software is purchased and installed in each communication terminal, or a dedicated firewall device is purchased and installed at the entrance of the network to protect the network itself in advance. Such a method is generally used. All of these generally require a prior setting work by an expert, and therefore, it is usually a defense method for a specific terminal and a specific network.

  Furthermore, as with the above-described firewall technology, the virus removal software is also installed in advance on the communication terminal and periodically removed, or the virus removal software is installed on a specific server device on the network. In general, a computer that removes a virus on a server by installing and communicating via the same device is generally used.

In the prior art, when starting communication, it is often assumed that all necessary software is installed in advance on a network device. However, in today's society, there are innumerable means of connecting to networks represented by the Internet, and individuals are free to do so without going through network devices controlled in advance by the network manager. The network management and information control in a limited area by the network administrator has virtually no meaning at present, and for individuals who try to access the network themselves There is an urgent need to provide a network management means. Recently, Internet cafes and public wireless services are being provided, but it is difficult to know how much security measures are being taken by companies that operate and manage these lines and terminals. I think it is desirable to use it with its own defensive measures.

  On the other hand, the following adverse effects have also occurred from the viewpoint of the processing capability of the communication terminal itself. That is, the required processing capacity of software and hardware installed in individual communication terminals is steadily increasing year by year, and the processing capacity of communication terminals is also steadily increasing accordingly. However, even if the processing capability of a communication terminal is improved, when a single communication terminal processes all tasks, the application execution capability for the user to be performed by the communication terminal is limited to allow communication. There may be cases where related work must be performed.

  Due to the increase in the amount of information accompanying the speeding up of the network, the damage caused thereby tends to occur more frequently. Also, from the user's point of view, the efficiency of the communication terminal itself needs to be replaced because of the occurrence of a failure due to such a part of work delay, resulting in poor efficiency. In addition, in the case of a user who performs communication using a plurality of communication terminals, the state of the communication environment depends on the capability of each terminal, and it is inevitable that the network quality becomes unstable.

  When performing communication using individual security technologies, for example, VPN technology, it is necessary that VPN client software is installed on the client terminal as a premise and necessary communication settings have already been made. . Further, this communication setting is generally difficult to set unless it is familiar with network technology and does not know all the setting information required by the VPN gateway of the communication destination.

  As a result, terminals that can perform VPN communication are limited to information terminals that are distributed in a state in which the company has been set in advance for employees. Unless an employee brings the information terminal, it is virtually impossible to communicate with a company resource through a VPN connection. As a countermeasure, such employees may make low-speed dial-up connections using general public lines, or third-party Internet operators, mobile phone operators, etc. that are not under the security management of company administrators. There is only access to limited emails using services provided by. However, such a method is inherently dangerous for a network administrator and is not preferable.

  In addition, various setting information for communication set on the VPN client software can be easily accessed by a third party other than the owner of the communication terminal by passing a simple security check. . Therefore, it is relatively easy for a malicious third party to steal setting information from a careless client terminal owner's terminal, set it on another terminal, and connect it to the VPN gateway, so that confidential data such as companies can be obtained. There is a difficulty that can be accessed.

  The use of firewalls and virus removal software, etc., is limited to the networks and communication terminals that can be used with the conventional technology, and is not limited to the communication terminals themselves that actually communicate widely and the general Internet. The current situation is that there is no means to use with confidence.

  In view of the above points, an object of the present invention is to use a communication terminal with a desired security level without assuming that all necessary software is installed in advance in a communication terminal having a communication function. And a communication terminal and a portable electronic device for use in the communication system.

In order to achieve the above object, the communication system of the present invention provides:
A communication terminal provided with a network connection means;
A portable electronic device capable of communicating with the communication terminal,
The communication terminal includes a virtual network switch capable of forcibly changing a transfer destination of data transmitted / received to / from a network connected by the network connection unit,
The portable electronic device comprises security ensuring means for ensuring communication security with the network by the communication terminal,
The communication terminal transmits / receives data to / from the network via the virtual network switch and the security ensuring means of the portable electronic device.

  Here, examples of the security ensuring means include VPN means, virus removal means, and firewall means.

  The virtual network switch can be a virtual IP switch incorporated in the network layer of the OSI 7 hierarchical model in TCP / IP which is an Internet standard protocol. The virtual IP switch transfers a packet received from the network to a higher transport layer or the portable electronic device according to a preset condition, and the packet from the portable electronic device is preset. The network is returned to the upper transport layer or the network of the transmission source according to the conditions.

  Next, in addition to the above-described configuration, the communication system of the present invention checks the storage medium of the communication terminal and the security of the application by the security ensuring unit of the portable electronic device via the virtual network switch. It is characterized by doing.

The portable electronic device stores a biometric recognition device such as a fingerprint sensor, a biometric information storage unit in which biometric information is stored in advance, and biometric information read by the biometric recognition device in the biometric information storage unit. It is desirable to provide authentication means for permitting access to the network through the communication terminal by collating with the biometric information that is provided.

On the other hand, the communication system of the present invention
A communication terminal provided with a network connection means;
A portable electronic device capable of communicating with the communication terminal,
The communication terminal comprises security ensuring means for ensuring communication security with a network,
The portable electronic device includes a communication setting information storage unit that stores communication setting information necessary for communication with the network via the security ensuring unit, a biometric recognition device such as a fingerprint sensor, A biometric information storage unit in which information is stored and held, and an authentication unit that collates the biometric information read by the biometric recognition device with the biometric information stored in the biometric information storage unit. .

  In the communication system of the present invention configured as described above, the software function installed in the portable electronic device itself is not limited to the type of software installed in the communication terminal having the network communication function to be used. Various functions such as a security function can be supplemented by providing the communication terminal. Therefore, even if the communication terminal directly connected to the network does not have functions such as VPN, firewall, and virus check, it is possible to use these security securing means installed in the portable electronic device to ensure safety. High communication can be performed.

  In addition, the portable electronic device does not have its own physical network connection means, but when connected to another communication terminal directly connected to the network, the portable electronic device is connected by the virtual network switch of the communication terminal. Therefore, it is virtually interposed between the network and the communication terminal. Therefore, communication can be performed between the communication terminal and the network using the security ensuring means mounted on the portable electronic device.

  Furthermore, when the portable electronic device is equipped with a biometric recognition device, it is connected to a specific physical network such as a PC or a mobile phone to which the device is connected by performing personal authentication by the biometric recognition device. A connection to a specified network on the Internet can be established through the established communication terminal.

  Embodiments of a communication system to which the present invention is applied will be described below with reference to the drawings.

  FIG. 1 is an overall configuration diagram showing an example of a communication system to which the present invention is applied. The communication system 1 of this example includes a communication terminal 2 provided with a network connection means 21 such as a PC or a mobile phone, and a portable electronic device 3 (hereinafter referred to as “token”) that can communicate with the communication terminal 2. It is possible to connect to a predetermined network 5 via a communication network 4 such as the Internet.

  The communication terminal 2 includes a virtual network switch 22 that can forcibly change the transfer destination of data transmitted to and received from the network 5 connected by the network connection unit 21. By this virtual network switch 22, data transmitted from the network 5 to the communication terminal 2 is transferred to the portable electronic device 3, and again passes through the portable electronic device 3 to the virtual network switch 22 of the communication terminal 2. From here, the application 23 of the communication terminal 2 and the like are processed. Transmission data from the communication terminal 2 to the network 5 is also transmitted from the virtual network switch 22 via the portable electronic device 3 to the communication destination network 5 via the virtual network switch 22 again. Thus, although the portable electronic device 3 is physically connected to the communication terminal 2 by the virtual network switch 22, it functions as if it is interposed between the network 5 and the communication terminal 2. To do.

  The portable electronic device 3 includes security ensuring means for ensuring communication security between the communication terminal 2 and the network 5. In this example, a VPN client function 31 and a storage unit 32 in which VPN setting information is stored are provided.

  Therefore, in the communication system 1 of this example, after the portable electronic device 3 is connected to the communication terminal 2 to enable mutual communication, the communication connection means 21 of the communication terminal 2 is used to communicate with the network 5 (VPN server). When communication is started, the virtual network switch 22 functions. As a result, communication using the VPN of the portable electronic device 3 is formed between the network 5 and the communication terminal 3.

  Here, the portable electronic device 3 includes a biological recognition device 33 such as a fingerprint sensor, a biological information storage unit 34 in which biological information is stored and held in advance, and biological information read by the biological recognition device 33. It is desirable to include an authentication unit 35 that performs authentication by collating the biometric information stored in 34.

  FIG. 2 is an overall configuration diagram showing another example of the communication system according to the present invention. The communication system 1A shown in this figure uses the functions of the virtual network switch 22 to manage the medium (hard disk, removable disk, external memory, etc.) of the communication terminal 2A and execute the program. It is configured to perform from the device 3A side.

  The virtual network switch 22 of the communication terminal 2A has a function of accessing the storage medium (hard disk, removable disk, etc.) 24 of the communication terminal 2A. The portable electronic device 3A includes a virus check function 31A and a virus pattern information storage unit 32A as security ensuring means.

  After the portable electronic device 3A is connected to the communication terminal 2A and personal authentication is performed, the virus check function 31A accesses the storage medium 24 and the application 23 to the virtual network switch 22 of the communication terminal 2A. Issue a command packet. Thereby, the security check with respect to the various media of the communication terminal 2A can be performed from the portable electronic device 3A side.

  FIG. 3 is an overall configuration diagram showing still another example of the communication system according to the present invention. The communication system 1B shown in this figure has a configuration in which a portable electronic device 3B is provided with a firewall function 31B as security ensuring means and a firewall setting information storage unit 32B for that purpose. Also in the communication system 1B, the function of the virtual network switch 22 allows the portable electronic device 3B to virtually intervene between the communication network 4 and the communication terminal 2B to detect unauthorized intrusion from the outside. Safe communication can be performed.

Here, the virtual network switch 22 provided in the communication terminal 2 (2A, 2B) can be a virtual IP switch incorporated in the network layer of the OSI7 hierarchical model in TCP / IP which is the Internet standard protocol.

  FIG. 4 is an explanatory view showing a seven-layer model of OSI. A virtual IP switch 68 is installed in the network layer 63 in the seven-layer model 6. The virtual IP switch 68 switches the packet transfer destination to the upper transport layer 64 or the portable electronic device 3 (3A, 3B) which is another network device. The other layers 61, 62, and 64-67 do not need to be changed at all.

  The virtual IP switch 68 has a mechanism different from that of a general layer 3 switch, and when transferring a packet to the portable electronic device 3 (3A, 3B), it is necessary to maintain the original packet information without loss. Therefore, it is necessary to encapsulate the original packet with a transfer packet. The encapsulated packet is returned to the original packet in the transfer destination device 3 (3A, 3B), processed by the application on the device, and the packet is delivered to the virtual IP switch 68 again.

  FIG. 5 is an explanatory diagram when the seven-layer model is applied to a Windows (registered trademark) network model. In this figure, “vsw.sys” on the intermediate layer (Intermediate layer) is a virtual network switch. This software determines to which of the upper protocols on the portable electronic device 3 (3A, 3B) and the communication terminal 2 (2A, 2B) the packet is transferred. This intermediate layer is a standard layer prepared by the Windows network architecture, and packet filtering software using this layer is commercially available.

  Next, FIG. 6 is an overall configuration diagram showing a communication system according to the present invention. The communication system 1C also includes a communication terminal 2C and a portable electronic device (token) 3C. The communication terminal 2C includes a network communication means 21A and a VPN client function 26. In contrast, the portable electronic device 3 </ b> C includes a storage unit 32 </ b> C that stores VPN setting information necessary for communication using the VPN client function 26. The portable electronic device 3C includes a biometric recognition device 33 such as a fingerprint sensor, a biometric information storage unit 34 in which biometric information is stored in advance, and biometric information read by the biometric recognition device 33. An authentication unit 35 that performs authentication by collating with the biological information stored in 34 is provided.

  In the communication system 1C having this configuration, a security processing program is installed on the communication terminal 2C side, information necessary for operating the program is held on the token 3C side, and these are determined based on the recognition result by the biometric recognition device 33. Are executed in cooperation with each other.

  FIG. 7 is an overall configuration diagram showing a communication system having a virus check function to which the present invention is applied. In the communication system 1D, a virus check function (software) 27 is mounted on the communication terminal 2D side, and virus setting information necessary for executing the virus check function is held in the storage unit 32D of the portable electronic device 3D. When authenticated by the biometric recognition device 33, the two can cooperate to perform a virus check and perform safe communication.

  Next, FIG. 8 is an overall configuration diagram showing a communication system having a firewall function to which the present invention is applied. In this communication system 1E, a personal firewall function 28 is mounted on the communication terminal 2E side, and the portable electronic device 3E includes a storage unit 32E in which firewall setting information is stored. Also in this case, when the personal authentication is performed by the biometric recognition device 33, the two can cooperate to perform secure communication.

Industrial applicability

  As described above, according to the communication system of the present invention, the communication terminal used for the communication system, and the portable electronic device, the following effects can be obtained.

(1) By carrying a portable electronic device with a biometric recognition device according to the present invention, a user can use a communication terminal having any network communication function in any place to provide VPN for necessary resources on the Internet. It is possible to perform secure communication while performing connection and security check. Therefore, it is possible to perform communication using the best available communication means while maintaining the security policy set by itself in the necessary place without being restricted by the security restrictions set by the line operator. .

(2) It is no longer necessary to store information that threatens security in communication terminals, and VPN connection, personal firewall settings, virus check settings, and other communication settings information related to security are encrypted and stored in portable electronic devices. The risk of leakage of setting information to an external third party is greatly reduced.

(3) The load on the communication terminal spent for the security check is reduced, and the performance of other processes can be expected to improve.

(4) In relation to the above (2), it is almost unnecessary for the user himself to be involved in the operation of the VPN client software or the like in normal use. Also, access to the setting information can be restricted by encryption means that only network administrators can use, so there is a risk of inadvertently changing the setting information of the client software. Remarkably less. As a result, it is expected to reduce the labor of the network administrator and the management cost of the company.

(5) A portable electronic device according to the present invention can be carried by an individual as an ID, and VPN software associated with the ID, personal firewall, virus removal software, and communication setting information related to the connection can be stored. In this way, a company that lends the device, for example, installs VPN client software on a newly used communication device when a user employee is transferred, or a communication device such as a PC to be used is replaced. There is no need to perform setting work for VPN connection. Since it is only necessary to secure a communication interface with the token, the labor of the network administrator is remarkably reduced.

(6) In relation to the above ID, by associating the mechanism according to the present invention with software such as security software, the personal authentication by the biometric recognition device, the confirmation of license information by issuing the ID after authentication to the network server, the license It is possible to reliably provide the software update function built into the token after confirmation, not to the terminal, but to the person who carries it. (7) The specification of the communication terminal is used If the function of the application or communication software being used cannot be sufficiently provided, the communication terminal itself can be replaced by replacing it with another distributed processing device without replacing the communication terminal itself. By carrying your phone, you can always keep it safe without having to carry the device itself. It is possible to obtain a the communication environment.

1 is an overall configuration diagram illustrating an example of a communication system to which the present invention is applied. It is a whole block diagram which shows another example of the communication system to which this invention is applied. It is a whole block diagram which shows another example of the communication system to which this invention is applied. It is explanatory drawing which shows the example of the virtual network switch mounted in the communication terminal of the communication system of FIGS. It is explanatory drawing which shows the example of the virtual network switch mounted in the communication terminal of the communication system of FIGS. It is a whole block diagram which shows the example of the communication system which concerns on another form of this invention. It is a whole block diagram which shows the modification of the communication system of FIG. It is a whole block diagram which shows another modification of the communication system of FIG.

Claims (9)

(A) a communication terminal,
(i) network connection means, and
(ii) the communication terminal including a virtual network switch capable of forcibly changing a transfer destination of data transmitted to and received from the network connected by the network connection unit;
(B) A portable electronic device capable of communicating with the communication terminal, the portable electronic device comprising security ensuring means for ensuring communication security with the network by the communication terminal Including devices,
The communication terminal sends and receives data to and from the network via the virtual network switch and the security ensuring means of the portable electronic device,
A communication system in which the security of the storage medium of the communication terminal and the application is checked by the security ensuring unit of the portable electronic device via the virtual network switch.   2. The communication system according to claim 1, wherein the security ensuring means includes at least one of encrypted data transmission means, virus removal means, and firewall means. The virtual network switch is a virtual IP switch incorporated in the network layer of the OSI7 hierarchical model in TCP / IP which is an Internet standard protocol.
The virtual IP switch transfers a packet received from the network to an upper transport layer or the portable electronic device according to a preset condition, and the packet from the portable electronic device is preset. The communication system according to claim 1 or 2, wherein the communication is returned to the upper transport layer or the network of the transmission source in accordance with the conditions. The portable electronic device is:
A biometric recognition device such as a fingerprint sensor;
A biological information storage unit in which biological information is stored and held in advance;
And authentication means for permitting access to the network via the communication terminal by comparing biometric information read by the biometric recognition device with biometric information stored in the biometric information storage unit. A communication system according to any one of claims 1 to 3.   The said communication terminal provided with the said virtual network switch as described in any one of Claims 1 thru | or 4.   The portable electronic device according to any one of claims 1 to 4. (A) a communication terminal,
(i) network connection means, and
(ii) the communication terminal provided with security ensuring means for ensuring communication security with the network;
(B) a portable electronic device capable of communicating with a communication terminal,
(i) a communication setting information storage unit that stores and holds communication setting information necessary for performing communication with the network via the security ensuring unit;
(ii) a biometric recognition device such as a fingerprint sensor,
(iii) a biometric information storage unit in which biometric information is stored and held in advance; and (iv) an authentication unit that collates the biometric information read by the biometric recognition device with the biometric information stored in the biometric information storage unit. A communication system including the portable electronic device.   8. The communication system according to claim 7, wherein the security ensuring means includes at least one of encrypted data transmission means, virus removal means, and firewall means.   The portable electronic device according to claim 7 or 8.

Images