JP2008294814A - Automatic encryption device of file utilizing connection information about acquired network, method and program therefor - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To prevent the flowing-out of information via a storage device of a terminal without spoiling convenience of a user in a communication terminal which can be connected to a plurality of networks. <P>SOLUTION: Connection information about a network which acquires a file is utilized. The file is acquired from the network and the acquired file and the network which is an acquisition destination of the file are associated with each other and stored. The file is encrypted using information required for connecting to the network acquired when the file is acquired as an encryption key. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

  The present invention relates to a file encryption method in a communication apparatus connectable to a plurality of networks.

  In recent years, with the widespread use of mobile communication terminals such as mobile phones, it has become common to communicate by connecting a terminal to a network in various environments not limited to homes and workplaces. Typical network connection means includes a cellular phone network and a wireless local area network (LAN).

  On the other hand, remote network connection using VPN (Virtual Private Network) is becoming widespread, and the number of networks that can be accessed by mobile terminals is increasing explosively.

  Accordingly, information acquired from a network that handles confidential information such as an in-house LAN can be easily stored in the storage of the portable terminal. However, this is a problem because information is leaked outside the network due to storage theft or loss.

  In order to prevent leakage of information stored in such storage, file encryption is generally performed. In the prevention of outflow by file encryption, encryption is performed after setting a key for each file, so that only a user who knows the key can access the contents of the file.

  Here, as a related technique, Patent Document 1 proposes a technique for automatically encrypting contents stored in a storage in accordance with a preset encryption key when a mobile terminal is disconnected from the in-house LAN. Yes.

According to this technology, when the mobile terminal is connected to the in-house LAN again, the content stored in the storage can be decrypted using the same encryption key as that used for encryption, and the stored content can be accessed. It becomes like this.
JP-A-10-161935

  However, the existing encryption technology needs to set an encryption key for each file. And once you try to change the key set for a file, you need to change all the files that all users have, so changing the key is not easy and not realistic. It was.

  In the technique described in Patent Document 1, a communication terminal needs to be connected to an in-house LAN in order for a user to access the contents of a file.

  Therefore, the contents of the file can be used only when connected to the in-house LAN, and there is a problem that the convenience of the portable terminal that can access various networks is impaired.

  Further, when exchanging encrypted data with other terminals, it is necessary to share not only the encrypted data but also the encryption key used for encryption between the terminals. In other words, it is necessary to prepare encryption keys for other terminals that are exchange destinations. As a result, there is a problem in that the user's labor is increased.

  Therefore, the present invention can prevent leakage of information through the storage of the mobile terminal by encrypting highly confidential data without impairing the convenience of the user accessing the contents of the file. An object of the present invention is to provide an automatic file encryption apparatus using the network connection information, its method, and its program.

  According to the present invention, a file automatic encryption communication device using network connection information from which a file has been acquired as a first device, the file acquisition means for acquiring a file from the network, and the acquired file And a network identification unit that stores the file acquisition destination in association with each other, and a file that uses information necessary for connecting to the network acquired when the file acquisition unit acquires the file as an encryption key. And an encryption unit for encrypting the communication device.

  In addition, a file automatic encryption communication device using the network connection information from which the file is acquired as the second device, and when the file encrypted using the encryption key is read, the encrypted file A network determination unit for determining the network from which the file is acquired, and a decryption unit for decrypting the file using information necessary for connecting to the network from which the file is acquired as a decryption key. A communication device is provided.

  A file automatic encryption communication device that uses network connection information from which a file has been acquired as a third device, and that acquires a file from a remote network using VPN, and the acquisition The network identification means for storing the file and the remote network from which the file is acquired in association with each other, and information necessary for connecting to the remote network obtained when the file acquisition means acquires the file. There is provided a communication device comprising: encryption means for encrypting a file as an encryption key.

  Also, as a first method, a file automatic encryption communication method using connection information of a network from which a file is acquired, the file acquisition step of acquiring a file from the network, the acquired file, and the file A network identification step that stores the network that is the acquisition destination of the file in association with each other, and encrypts the file using information necessary for connecting to the network acquired when the file is acquired in the file acquisition step as an encryption key A communication method comprising: an encryption step.

  Also, as a second method, an automatic file encryption communication method using the network connection information from which the file was acquired, and the encrypted file is read when the file encrypted using the encryption key is read. A network determination step for determining the network from which the file is acquired, and a decryption step for decrypting the file using information necessary for connecting to the network from which the file is acquired as a decryption key. A communication method is provided.

  In addition, as a third method, a file automatic encryption communication method using connection information of a network from which a file is acquired, the file acquisition step of acquiring a file from a remote network using VPN, and the acquisition The network identification step for storing the file and the remote network from which the file is acquired in association with each other, and information necessary for connecting to the remote network acquired when the file is acquired in the file acquisition step. And an encryption step for encrypting a file as an encryption key.

  An automatic file encryption communication program using network connection information from which a file has been acquired as a first program, the file acquisition function for acquiring a file from the network, the acquired file, and the file A network identification function that stores the network that is the acquisition destination of the file in association with each other, and encrypts the file using information necessary for connecting to the network acquired when the file is acquired by the file acquisition function as an encryption key There is provided a communication program characterized by causing a computer to realize an encryption function.

  In addition, a file automatic encryption communication program using the network connection information from which the file is acquired as the second program, the encrypted file when reading the file encrypted using the encryption key A network determination function for determining the network from which the file is acquired and a decryption function for decrypting the file using information necessary for connecting to the network from which the file is acquired as a decryption key. A featured communication program is provided.

  A file automatic encryption communication program that uses network connection information from which a file has been acquired as a third program, and that acquires a file from a remote network using VPN, and the acquisition The network identification function for storing the file and the remote network from which the file is acquired in association with each other, and information necessary for connecting to the remote network acquired when the file is acquired by the file acquisition function. There is provided a communication program characterized in that a computer realizes an encryption function for encrypting a file as an encryption key.

  According to the present invention, when an encrypted file is leaked by encrypting the file acquired from the network by the communication terminal using the information for connecting to the network used for acquiring the file. However, a communication terminal that does not have the authority to connect to the network can prevent access to the contents of the file.

  Next, examples for carrying out the present invention will be described in detail.

[Example 1]
In this embodiment, a case where the mobile terminal acquires a file from the in-house LAN is handled.

[Description of configuration]
<Description of communication system>
FIG. 1 is a block diagram illustrating a configuration of a communication system according to the present embodiment.

  The communication system 101 includes two local networks, an in-house network 105 and a home network 106. Communication devices are connected to each network.

  The in-house network 105 is a LAN constructed for use by the company for in-house use, and functions as a so-called in-house intranet. When in-house communication equipment performs communication, data is exchanged via this in-house network 105.

  The home network 106 is a LAN laid for use in home applications, and data is exchanged via the home network 106 when home communication devices communicate.

  The file server 108 and the file server 109 are communication servers connected to the in-house network 105 and the home network 106, respectively. In addition, a file 110 and a file 111 that can be acquired by the communication terminal 102 are stored.

  The communication terminal 102 is a portable terminal having a communication function, and can be connected to the in-house network 105 and the home network 106.

  At this time, as communication means used for connection, for example, wired LAN, wireless LAN, public telephone network, mobile phone network, PHS (Personal Handy-phone Systems), IrDA (Infrared Data Association), Bluetooth (registered trademark), serial communication Etc. are assumed.

  In this regard, in this embodiment, a wireless LAN is used. The protocol used by the communication terminal 102 for communication with other communication terminals is TCP / IP (Transmission Control Protocol / Internet Protocol).

  The access point 103 and the access point 104 are wireless LAN access points. The communication terminal 102 communicates with the in-house network 105 and the home network 106 via these access points.

  The authentication server 107 is a server for managing users connected to the in-house network 105 and managing access logs.

<Description of communication terminal>
FIG. 2 is a diagram illustrating a configuration example of a terminal corresponding to the communication terminal 102 in FIG.

  As shown in the figure, the communication terminal 201 includes an input device 202, an output device 203, a data processing device 204, a storage device 205, and a communication interface 206.

  The input device 202 is a device used when a user inputs to the communication terminal 201, represented by a keyboard, a pointing device, a voice input device, and the like.

  The output device 203 is a display device, and is a device used when notifying a user of an execution result of an application.

  The data processing device 204 is a device that executes a program according to a predetermined procedure. The data processing device 204 includes a file acquisition application 207, a network connection application 208, an encryption program 209, and a network identification program 210.

  The storage device 205 is a device that stores various data. The stored data can be written and read by an application executed by the data processing device 204.

  The communication interface 206 is a communication unit that is used for the communication terminal 201 to connect to the network and perform communication. Since the present embodiment assumes the case where the wireless LAN is used as described above, the communication interface 206 is a wireless LAN interface. In addition, it is possible to connect to both the in-house network 105 and the home network 106 by switching.

  The file acquisition application 207 is an application that acquires a file from a server via a network and stores it in the storage device 205. As a specific example, an FTP (File Transfer Protocol) application, file sharing software, or the like corresponds.

  The network identification program 210 is a program that determines from which network the file is acquired when the file acquisition application 207 acquires the file from the network. A communication request from the application is hooked to identify the host network to which the application is communicating.

  The network connection application 208 is an application that performs settings for the communication interface 206 to connect to the network.

  The communication terminal 201 holds a network to which the communication terminal 201 can be connected and information necessary for connecting to the network (hereinafter referred to as a profile). Further, history information indicating whether or not the communication terminal 201 has actually been connected to each network is held.

  The encryption program 209 is a program that performs encryption when the file acquired by the file acquisition application 207 from the network is stored in the storage device 205. A file storage request from the application is hooked, and necessary encryption is performed on the file, and then the file is stored in the storage device 205.

[Description of operation]
The operation of this embodiment will be described in detail.

  First, the flow of connection of the communication terminal 102 to the in-house network 105 will be described with reference to FIGS.

  The user activates the network connection application 208 in order to connect the communication terminal 102 to the network (S301).

  When the network connection application 208 is activated, a list of network profile names connectable at that time is displayed on the output device 203 and presented to the user. Here, in the present embodiment, specifically, it is displayed that connection to the in-house network 105 and the home network 106 is possible.

  The user selects a profile name of a network to be connected from the connectable networks displayed on the output device 203, and notifies the network connection application 208 via the input device 202 (S302). Here, the following description will be made assuming that the user selects the in-house network 105.

  The network connection application 208 refers to the connection profile of the selected in-house network 105 and performs connection processing to the in-house network 105 using the communication interface 206.

  Here, FIG. 4 shows the contents of the connection profiles of the in-house network 105 and the home network 106. Information other than the items shown in FIG. 4 may be required to actually connect to the wireless LAN, but this is omitted here. A profile for the in-house network 105 is shown as a table 401 in the figure. A profile for the home network 106 is shown as a table 402 in the figure.

  Next, the specific contents of each item shown in FIG. 4 will be described.

  The profile name is a name displayed when the user selects a network to connect to.

  An ESSID (Extended Service Set Identifier) is one of network identifiers and is a name that identifies a wireless LAN access point group. The terminal can communicate with an access point having the ESSID specified here.

  The wireless encryption method is an encryption method used for communication between a terminal and an access point. Generally, WEP (Wireless Equivalent Privacy), WPA (Wi-Fi Protected Access), WPA2, etc. are used.

  The pre-shared key is information shared between the terminal and the access point for encryption of the wireless section. The actual encryption key is generated from information such as the pre-shared key, the MAC address, and the initialization vector in accordance with a rule determined by the encryption method. In general, in the case of a network that requires authentication for connection, since the encryption key between the terminal and the access point is dynamically changed, this information is not set in the profile.

  The authentication method is a method for performing authentication between an authentication server terminal and a terminal existing in the network, whether the terminal may connect to the network and perform communication. As soon as the authentication is completed, the terminal can update the wireless encryption key with the authentication server.

  Whether authentication is required depends on the network. In this embodiment, the in-house network 105 is a network that requires authentication, and the home network 106 is a network that does not require authentication. When authentication is required, the network connection application 208 performs authentication with the authentication server according to the user name and password using the method specified in the profile.

  The server certificate is data used to prove that the authentication server is a regular authentication server when the terminal performs authentication. Here, the file name corresponding to the certificate is specified.

  Next, description of the operation will be continued. The network connection application 208 determines whether authentication is necessary according to the contents of the selected profile (S303).

  If the selected network is a network that does not require authentication, it communicates with the access point specified by the ESSID of the profile using the designated encryption method and connects to the network (S306).

  On the other hand, if the selected network is a network that requires authentication, the network connection application 208 authenticates the access point specified by the ESSID of the profile (the access point 103 in this embodiment). A request is issued (S304). At this time, the authentication method described in the profile is also notified to the access point 103 at the same time. The access point 103 notifies the authentication server 107 of the received authentication request.

  The communication terminal 102 and the authentication server 107 perform mutual authentication through the access point 103 (S305). In the mutual authentication, the network connection application 208 authenticates that the authentication server 107 is a genuine authentication server by using the server certificate in the profile, and the authentication server 107 confirms that the user name and password are correct and communicates with the communication terminal. This is done by authenticating 102.

  The authenticated communication terminal 102 then connects to the in-house network 105 via the access point 103 and becomes communicable (S306).

  Next, a flow in which the communication terminal 102 connected to the internal network 105 acquires the file 110, which is a file on the internal network 105, will be described with reference to FIGS.

  The user activates the file acquisition application 207 to acquire a file on the in-house network 105 (S501). The file acquisition application 207 is an FTP client, for example, and is an application that can acquire data in units of files from the network.

  Here, the user inputs to the file acquisition application 207 so as to acquire the file 110 stored in the file server 108.

  Then, the file acquisition application 207 issues a communication request according to the user input, communicates with the file server 108, and acquires the file 110.

  The network identification program 210 hooks the communication request of the file acquisition application 207 and saves information on the network from which the file acquisition application 207 has acquired the file 110 (S502). Here, the connection profile of the in-house network 105 that is the network from which the file 110 is acquired is referred to.

  Then, the file acquired by the file acquisition application 207 and the information of the connection profile are stored in association with each other.

  The file acquisition application 207 issues a file save request to save the acquired file 110 in the storage device 205 (S503). The encryption program 209 hooks the issued file storage request and determines whether encryption is necessary.

  Then, the encryption program 209 communicates with the network identification program 210 to obtain a connection profile associated with the file 110 (S504).

  First, the encryption program 209 refers to the acquired connection profile and determines whether mutual authentication with the authentication server is necessary when connecting to the corresponding network (S505).

  If mutual authentication is required, the file 110 is encrypted using the authentication server certificate as an encryption key (S507). Here, the encryption program 209 encrypts the file using a method that uses the same data for the encryption key and the decryption key, that is, a symmetric key encryption method.

  FIG. 6 shows the relationship between encryption input and output. The header of the output data includes a connection means (wireless LAN in this embodiment), a connection profile ESSID, and a name indicating what information is used as an encryption key (in the case of FIG. 6, the server certificate is a file). Indicating that it was used as the encryption key.). Following the header, data obtained by encrypting the original file 110 using the server certificate as a key is recorded.

  The encryption program 209 stores the encrypted data shown in FIG. 6 in the storage device 205, and returns the process to the file acquisition application 207 (S508).

  If mutual authentication is not required in S505, it is determined whether or not a wireless zone encryption key exists in the connection profile (S506).

  When the encryption key for the wireless section is set as in the home network profile 402, the file is encrypted using the encryption key (S507) and stored in the storage device 205 (S508). Again, the encryption program 209 uses a symmetric key cryptosystem.

  The state of encryption is shown in FIG. As in the case of using the server certificate described above with reference to FIG. 6, the ESSID and key information are recorded in the output header. On the other hand, if the wireless zone encryption key is not set in the profile, the profile is stored in the storage device 205 without being encrypted.

  Next, the flow of decrypting an encrypted file will be described with reference to FIG. FIG. 9 shows the configuration of a terminal that reads a file. It is assumed that the encrypted file has been copied or moved from the communication terminal 201 to the communication terminal 901 via an external storage device or performing data communication between terminals.

  The basic configuration of the communication terminal 901 is almost the same as that of the communication terminal 201, but is different in that a file use application 907 is provided. Here, the file use application 907 is an application that accesses the storage device 905 to read and use the file. An arbitrary application such as an editor or spreadsheet software specifically corresponds to the file use application 907.

  The user activates the file use application 907 and reads the file stored in the storage device 905 (S801). The user uses the input device 902 to input a file to be read into the file use application 907. Here, it is assumed that the file 110 previously encrypted and stored is selected. The file use application 907 issues a file read request in accordance with a user input.

  The decryption program 909 hooks the issued file read request and determines whether the requested file is an encrypted file (S802). This determination is made after reading a file actually stored in the storage device 905.

  If the target file is not encrypted, the file is passed to the file use application 907 as it is.

  On the other hand, when the target file is encrypted, the decryption program 909 refers to the header information of the file and reads the ESSID and encryption key information of the network that acquired the file before encryption.

  Among these, using the ESSID information, the network connection application 908 is inquired as to whether there is a history that the communication terminal 901 has connected to the network having the designated ESSID (S803).

  At this time, if there is no history of connection to the specified ESSID network, an error is returned to the file use application 907 without decrypting the file (S805).

  If there is a history of connection to the specified ESSID network, the decryption program 909 decrypts the file (S804).

  Information on the connection profile in which the specified ESSID is described is acquired from the network connection application 908, and information specified by the encryption key information read from the header first is read from the connection profile.

  Using the read information as a decryption key, the encrypted file is decrypted. Since the file is encrypted with a symmetric key encryption method when it is stored, it can be correctly decrypted if the same key information is used.

  Next, the effect of the present embodiment will be described.

  When the file 110 acquired by the communication terminal 201 from the in-house network 105 is stored in a storage device in the communication terminal 201, it is automatically used by using a server certificate which is information necessary for connecting to the in-house network 105. Encrypted. As a result, when the same file is transferred to another terminal via the storage device, the contents of the file cannot be accessed at the transferred destination terminal, so that the confidentiality can be maintained.

  The file acquired from the network that the communication terminal 201 does not have an authentication server such as the home network 106 is encrypted in the same manner as the file acquired from the in-house network 105 by using the encryption key of the wireless section, You can keep it confidential.

  Also, even when the encrypted file is transferred to another terminal via the storage device, if the transferred destination terminal is a terminal that can be connected to the network from which the file is acquired, the decryption is performed. It becomes possible. As a result, between terminals that can be connected to the in-house network 105, files can be exchanged and data can be referred to, and convenience is not impaired.

[Second Embodiment of the Invention]
An embodiment in the case where the mobile terminal uses VPN using IPsec (Security Architecture for Internet Protocol) will be described. In the present embodiment, a case where a mobile terminal connects to an in-house network using VPN via the Internet and acquires a file from the in-house LAN is handled.

[Description of configuration]
<Configuration of communication system>
FIG. 10 shows the configuration of the communication system of the second embodiment.

  The communication system 1001 includes two local networks, an in-house network 1005 and a home network 1006, and a wide area network that can be connected from each local network, and a communication device is connected to each network.

  The in-house network 1005, the access point 1003, and the file server 1007 are the same as the in-house network 105, the access point 103, and the file server 108, respectively, in the first embodiment, and are a network and a communication device that constitute an in-house intranet.

  The public wireless service network 1006 is a public wireless LAN and is a local network laid at a coffee shop or a station. The public wireless service network 1006 includes an access point 1004 so that a user who contracts a connection service can connect to the public wireless service network 1006 using a wireless LAN.

  The in-house network 1005 and the public wireless service network 1006 are connected to the Internet 1010, and communication devices connected to the local networks can communicate with any communication device connected to the Internet 1010.

  The VPN gateway server 1009 is a gateway server used by a communication terminal such as the communication terminal 1002 to make a VPN connection to the corporate network 1005 via the Internet 1010.

  The communication terminal 1002 is a portable terminal having a communication function, and can be connected to the in-house network 1005 and the public wireless service network 1006. The communication terminal 1002 is a terminal that can be connected to the in-house network 1005 via the Internet 1010 and the VPN gateway server 1009 even when the in-house network 1005 cannot be directly connected.

<Configuration of communication terminal>
FIG. 11 shows the configuration of a communication terminal in the second embodiment.

  A communication terminal 1101 is a communication terminal corresponding to the communication terminal 1002. The input device 1102, the output device 1103, the processing device 1104, the communication interface 1106, and the storage device 1105 provided in the communication terminal 1101 are the input device 202, the output device 203, the processing device 204, the communication interface 206, respectively, in the first embodiment. This is the same as the storage device 205.

  Similar to the network connection application 208 of the first embodiment, the network connection application 1108 is an application for setting the communication interface 1106 to connect to the network in response to a user request.

  A VPN connection application 1109 is an application that sets a VPN in response to a user request and connects the communication terminal 1101 to a remote network. The VPN connection application 1109 holds setting information (VPN profile) for each remote network to be connected.

  A file acquisition application 1107 is an application that acquires a file from a server via a network and stores it in the storage device 1105. Unlike the file acquisition application 207 of the first embodiment, it also has a function of acquiring a file on a remote network connected by VPN.

  The VPN processing program 1111 is a program for changing the format of transmission / reception data for VPN when an application performs communication using VPN.

  The network identification program 1112 is a program that determines from which network the file is acquired when the file acquisition application 1107 acquires the file from the network. Unlike the network identification program 210 of the first embodiment, it is possible to determine the communication destination network for communication performed via VPN.

  The encryption program 1110 is a program that performs encryption when the file acquisition application 1107 stores a file acquired from the network in the storage device 1105. A VPN-specific process is performed on the file acquired using the VPN.

[Description of operation]
The operation of the second embodiment will be described.

  First, a flow in which the communication terminal 1002 is connected to the in-house network 1005 by VPN will be described with reference to FIG.

  It is assumed that the user has already connected the communication terminal 1101 to the public wireless service network 1006 using the network connection application 1108.

  The user activates the VPN connection application 1109 to connect the communication terminal 1101 to the network via VPN (S1201). When the VPN connection application 1109 is activated, a VPN connection profile name list is displayed on the output device 1103 and presented to the user. Specifically, it is displayed that connection to the in-house network 1005 is possible.

  The user selects a profile name of a network desired to be VPN-connected from the networks displayed on the output device 1103, and notifies the VPN connection application 1109 via the input device 1102 (S1202). Here, the user selects the in-house network 1005.

  The VPN connection application 1109 refers to the VPN profile of the selected in-house network 1005 and performs VPN connection processing.

  FIG. 13 shows the contents of the VPN profile for the in-house network 1005. Information other than the items shown in FIG. 13 may be required to actually perform the VPN connection, but this is omitted here.

  Next, specific contents of each item shown in FIG. 13 will be described.

  The VPN profile name is a name displayed when the user selects a network to which a VPN connection is made.

  The VPN gateway is a domain name of a gateway server that is accessed when the terminal makes a VPN connection to the network.

  The authentication method is a method for allowing a terminal to make a VPN connection to a network and performing communication, or for a network provider to authenticate the terminal. The VPN gateway server of the network permits the VPN connection of the terminal only when the information set here is correct.

  The server certificate is data used to prove that the gateway server is a legitimate gateway server when the terminal performs authentication. Here, the file name corresponding to the certificate is specified.

  The VPN connection application 1109 connects to the gateway server according to the content of the selected VPN profile (S1203). The communication terminal 1002 is connected to the VPN gateway server 1009 from the public wireless service network 1006 via the Internet 1010.

  After connecting the communication terminal 1002 to the VPN gateway server 1009, the VPN connection application 1109 performs mutual authentication with the VPN gateway server 1009 (S1204). The VPN connection application 1109 uses the server certificate specified in the VPN profile to authenticate that the VPN gateway server 1009 is a genuine gateway, and the VPN gateway server 1009 is that the user name and password are those of a legitimate user. And the communication terminal 1002 is authenticated.

  If the authentication is successful, the communication terminal 1002 and the VPN gateway server 1009 exchange encryption keys used for communication between the two. The VPN connection application 1109 sets the exchanged key information in the VPN processing program 1111 and ends the VPN connection processing (S1205).

  After the VPN connection is completed, the communication terminal 1002 communicates with the in-house network 1005 as follows.

  When the communication terminal 1002 wants to transmit data to the in-house network 1005, the data to be transmitted is encrypted using an encryption key exchanged with the VPN gateway server 1009. Then, the encrypted data is transmitted to the VPN gateway server 1009 via the public wireless service network 1006.

  By decrypting the data received by the VPN gateway server 1009 and sending it to the internal network 1005, the communication terminal 1002 can virtually transmit the data to the internal network 1005.

  Conversely, when data is transmitted from the in-house network 1005 to the communication terminal 1002, the data transmitted to the communication terminal 1002 is encrypted using the encryption key exchanged by the VPN gateway server 1009 with the communication terminal 1002, and public wireless communication is performed. The data is transmitted to the communication terminal 1002 via the service network 1006. The communication terminal 1002 can decrypt the received data and virtually receive the data from the in-house network 1005.

  In the communication terminal 1002, the VPN processing program 1111 is in charge of processing for encrypting data to be transmitted and received. That is, when an application wants to transmit data to the in-house network 1005, the application passes the transmission data to the VPN processing program 1111. The VPN processing program 1111 encrypts the data and transmits it to the VPN gateway server 1009.

  On the contrary, when an application receives data from the in-house network 1005, the application issues a reception request to the VPN processing program 1111. The VPN processing program 1111 decrypts the received data and passes it to the application.

Next, a flow in which the communication terminal 1002 connected via VPN to the in-house network 1005 acquires a file on the in-house network 1005 will be described with reference to FIGS. 11 and 14.
As in the first embodiment, the user activates the file acquisition application 207, and issues a request to acquire the file file 1008 by specifying a file on the in-house network 1005 (S1401). In order to use VPN, a file acquisition request is received by the VPN processing program 1111 and data is acquired.

  The network identification program 1112 hooks the communication request and saves information on the remote network from which the file acquisition application 1107 has acquired the file 1008 (S1402). Here, the VPN connection profile of the in-house network 1005, which is the network from which the file 1008 has been acquired, is referenced, and the file 1008 acquired by the file acquisition application 1107 and the connection profile information are stored in association with each other.

  The file acquisition application 1107 issues a file save request to save the acquired file 1008 in the storage device 1105 (1403). The encryption program 1110 hooks the issued file storage request and determines whether encryption is necessary.

  The encryption program 1110 communicates with the network identification program 1112 to obtain a VPN connection profile associated with the file 1008 (S1404).

  The encryption program 1110 encrypts the file 1008 using the server certificate of the acquired VPN connection profile as an encryption key (S1405). FIG. 15 shows the relationship between input and output of encryption. In the header of the output data, information used as a connection means (VPN in this embodiment), the domain name of the VPN gateway, and an encryption key are recorded. Data obtained by encrypting the file 1008 with the server certificate follows as a body.

The encryption program 1110 saves the encrypted data in the storage device 1105, and returns the processing to the file acquisition application 1107 (S1406).
The flow for decrypting the encrypted file is the same as in the first embodiment, and is therefore omitted.

  Next, the effect of the second embodiment will be described.

  A file acquired by the communication terminal 1002 via the VPN connection from the in-house network 1005 is stored in a storage device in the communication terminal 1002 and is a server certificate of the VPN gateway server, which is information necessary for VPN connection to the in-house network 1005 Automatically encrypted using a certificate. As a result, when the file acquired from the in-house network 1005 by the communication terminal 1002 is transferred to another terminal via the storage device, the transferred terminal cannot access the contents of the file, and is confidential. Can be kept.

  Also, even when the encrypted file is transferred to another terminal via the storage device, it is decrypted if the transferred destination terminal is a terminal that can be connected to the network from which the file is acquired. Is possible. This makes it possible to exchange data and refer to data without impairing convenience between terminals that can be connected to the in-house network 105 by VPN.

  As described above, the first effect of the embodiment of the present invention is encrypted by encrypting the file acquired by the communication terminal from the network using the information for connecting to the network used for acquisition. Even if a file is leaked, a communication terminal that is not authorized to connect to the network cannot access the contents of the file.

  The second effect is that since the encryption is automatically performed in conjunction with the communication of the application, the user does not need to perform encryption for each file one by one. As a result, it is possible to reduce the trouble of performing encryption and to prevent the file from being forgotten to be encrypted.

The third effect is that when an encrypted file is accessed, it can be decrypted by any communication terminal that can access the network from which the file is obtained. This is a possible point. Thereby, unlike the technique described in Patent Document 1, access to the file can be permitted without impairing the convenience of the communication terminal.
Note that the communication system according to the present embodiment can be realized by hardware, software, or a combination thereof.

It is a block diagram which shows the structure of the communication system in 1st Example of this invention. It is a block diagram which shows the structure of the communication terminal device in 1st Example of this invention. It is a flowchart which shows the network connection operation | movement of the communication terminal device in 1st Example of this invention. It is explanatory drawing which shows the network connection profile in 1st Example of this invention. It is a flowchart which shows the file write-in operation | movement of the communication terminal device in 1st Example of this invention. It is explanatory drawing regarding the input / output of encryption in the 1st Example of this invention. It is explanatory drawing regarding the input / output of encryption in the 1st Example of this invention. It is a flowchart which shows file reading operation | movement of the communication terminal device in 1st Example of this invention. It is a block diagram which shows the structure of the communication terminal device which performs the decoding in 1st Example of this invention. It is a block diagram which shows the structure of the communication system in 2nd Example of this invention. It is a block diagram which shows the structure of the communication terminal device in 2nd Example of this invention. It is a flowchart which shows the VPN connection operation | movement of the communication terminal device in 2nd Example of this invention. It is explanatory drawing which shows the VPN connection profile in 2nd Example of this invention. It is a flowchart which shows the file write-in operation | movement of the communication terminal device in 2nd Example of this invention. It is explanatory drawing regarding the input / output of encryption in 2nd Example of this invention.

Explanation of symbols

101, 1001 Communication system 102, 201, 901, 1002, 1101 Communication terminal 104, 105, 1003, 1004 Access point 105, 1005 Internal network 106 Domestic network 107 Authentication server 108, 109, 1007 File server 110, 111, 1008 File 202, 902, 1102 Input device 203, 903, 1103 Output device 204, 904, 1104 Processing device 205, 905, 1105 Storage device 206, 906, 1106 Communication interface 207, 1107 File acquisition application 208, 908, 1108 Network connection application 209 909, 1110 Encryption program 210, 910, 1112 Network identification program 401 For in-house network Connection profile 402 for a home network connection profile 907 file using application 1006 public wireless service network 1009 VPN gateway server 1010 Internet 1109 VPN connection application 1111 VPN processing program 1301 VPN connection profile for the corporate network

Claims (19)

An automatic file encryption communication device using the network connection information from which the file was obtained,
A file acquisition means for acquiring a file from the network;
Network identification means for storing the acquired file and the network from which the file is acquired in association with each other;
Encryption means for encrypting the file using the information necessary for connecting to the network obtained when the file is acquired in the file acquisition means as an encryption key;
A communication apparatus comprising: The communication device according to claim 1,
A network discriminating unit for discriminating a network from which the encrypted file is acquired when the encrypted file is read by the encryption unit;
Decryption means for decrypting the file using the connection information necessary for connecting to the network from which the file was acquired as a decryption key;
The communication apparatus further comprising: An automatic file encryption communication device using the network connection information from which the file was obtained,
A network discriminating means for discriminating the network from which the encrypted file was acquired when reading the file encrypted using the encryption key;
Decryption means for decrypting the file using the information necessary for connecting to the network from which the file was acquired as a decryption key;
A communication apparatus comprising: The communication device according to claim 2 or 3,
The decryption means, when determining the network from which the encrypted file was acquired, determines whether or not the communication device has previously connected to the network, and only when there is a connected history A communication device that operates. The communication device according to any one of claims 2 to 4,
The decryption key used in the decryption means is a server certificate used in authentication for connecting the communication device to the network, or an access to the communication device when the communication device communicates with the access point using wireless communication. A communication apparatus, which is a pre-shared key used to generate an encryption key between points. The communication device according to any one of claims 1 to 5,
The encryption key used for encrypting the encrypted file is a server certificate used in authentication for the communication device to connect to the network, or the communication device communicates with the access point using wireless communication. A communication apparatus, which is one of pre-shared keys used for generating an encryption key between the communication apparatus and the access point. An automatic file encryption communication device using the network connection information from which the file was obtained,
A file acquisition means for acquiring a file from a remote network using VPN;
Network identification means for storing the acquired file in association with a remote network from which the file is acquired;
Encryption means for encrypting the file using the information necessary for connecting to the remote network obtained when the file is acquired in the file acquisition means as an encryption key;
A communication apparatus comprising: The communication device according to claim 7,
The communication apparatus, wherein the encryption key used for encrypting the file is a server certificate used for authentication for connecting the communication apparatus to a remote network using VPN. An automatic file encryption communication method using the connection information of the network that acquired the file,
A file acquisition step for acquiring a file from the network;
A network identification step of storing the acquired file and the network from which the file is acquired in association with each other;
An encryption step of encrypting the file using the information necessary for connecting to the network obtained when acquiring the file in the file acquisition step as an encryption key;
A communication method comprising: The communication method according to claim 9, comprising:
A network determination step of determining the network from which the encrypted file was acquired when reading the encrypted file in the encryption step;
A decryption step of decrypting the file using connection information necessary for connecting to the network from which the file is acquired as a decryption key;
A communication method, further comprising: An automatic file encryption communication method using the connection information of the network that acquired the file,
A network determination step of determining the network from which the encrypted file was acquired when reading the file encrypted using the encryption key;
A decryption step of decrypting the file using information necessary for connecting to the network from which the file was acquired as a decryption key;
A communication method comprising: The communication method according to claim 10 or 11,
The decryption step determines whether or not the communication method has previously connected to the network when determining the network from which the encrypted file was acquired, and only when there is a connection history A communication method characterized by being performed. The communication method according to any one of claims 10 to 12,
The decryption key used in the decryption step is a server certificate used in authentication for connecting the communication method to the network, or the communication method and access when the communication method communicates with the access point using wireless communication. A communication method, which is a pre-shared key used to generate an encryption key between points. The communication method according to any one of claims 9 to 13,
The encryption key used for encrypting the encrypted file is a server certificate used in authentication for connecting the communication method to the network, or the communication method communicates with the access point using wireless communication. In this case, the communication method is one of pre-shared keys used for generating an encryption key between the communication method and the access point. An automatic file encryption communication method using the connection information of the network that acquired the file,
A file acquisition step of acquiring a file from a remote network using VPN;
A network identification step for storing the acquired file in association with a remote network from which the file is acquired;
An encryption step for encrypting the file using the information necessary for connecting to the remote network obtained when acquiring the file in the file acquisition step as an encryption key;
A communication method comprising: The communication method according to claim 15, comprising:
The communication method, wherein the encryption key used for encrypting the file is a server certificate used for authentication for connecting to a remote network using VPN. An automatic file encryption communication program that uses the connection information of the network that acquired the file,
Get a file from the network, a file acquisition function,
A network identification function for storing the acquired file and the network from which the file is acquired in association with each other;
An encryption function that encrypts the file using the information necessary for connecting to the network obtained when the file is acquired in the file acquisition function as an encryption key;
A communication program for causing a computer to realize the above. An automatic file encryption communication program that uses the connection information of the network that acquired the file,
A network discrimination function for discriminating the network from which the encrypted file was acquired when reading the file encrypted using the encryption key;
A decryption function for decrypting the file with the information necessary for connecting to the network from which the file was acquired as a decryption key;
A communication program for causing a computer to realize the above. An automatic file encryption communication program that uses the connection information of the network that acquired the file,
File acquisition function that acquires files from remote networks using VPN,
A network identification function for storing the acquired file in association with a remote network from which the file is acquired;
An encryption function for encrypting a file using information necessary for connecting to a remote network obtained when the file is acquired in the file acquisition function as an encryption key;
A communication program for causing a computer to realize the above.

Images