JP5347263B2 - Client device and communication method - Google Patents

Description

The present invention also relates to the client equipment, is used for communication between programs that the client device has.

  With the spread of the Internet in recent years, distributed systems such as WWW (World Wide Web) are widely used. Accordingly, not only simply downloading and displaying a document stored in the server apparatus but also downloading a program from the server apparatus and executing it on the client apparatus has become widespread.

  These include, for example, Java Applet that executes a Java (registered trademark) program in a Web browser, Java Script that executes a script in a Web browser, and a plug-in such as Flash.

  These downloaded programs cannot be guaranteed not to be malicious. Therefore, the operation is restricted in the environment where the program is executed. In the case of the above-described example, the files that can be accessed from the program are limited, or the parties that can communicate are limited to the server device that downloaded the program.

  Here, limiting the parties with whom communication is possible to the server device that has downloaded the program is a major limitation when the program is executed. An example of a conventional system that relaxes this restriction is described in Patent Document 1. This conventional system has a part called a redirector in the server device, and operates as follows.

  That is, when a client device wants to communicate with an arbitrary target, it connects to a redirector operating in the server device once, and the redirector performs communication instead of the client device. In other words, communication is performed through the redirector as an intermediary.

Japanese Patent No. 3966487 JP 2005-100440 A

  The first problem in the above-described technique is that passing through the redirector causes a load on the server device and causes a communication delay. This is because it is necessary to communicate via a redirector operating on the server device.

  The second problem is that multicast communication for distributing the same data to a plurality of client devices cannot be realized efficiently. The reason is that communication is always performed via the server device, and the load for data distribution is concentrated on the server device.

The present invention has been made to solve such a problem, and can directly communicate between downloaded programs without using a server device while maintaining security, and between downloaded programs. An object of the present invention is to provide a client device and a communication method capable of efficiently realizing multicast communication without distributing the load by distributing data while maintaining security.

The present invention provides a client device, comprising: a program management unit for holding information of a program being executed, and a data transceiver unit for performing acquisition of communication requests from other programs in other client devices, a communication requesting other The program includes a mutual authentication unit for confirming that the program is under the control of the same organization as the program being executed.

Further, when the present invention is viewed from the viewpoint of a communication method, the present invention is a communication that is executed by a client device that holds information about a program being executed and captures a communication request from another program in another client device. The method is characterized in that the mutual authentication means confirms that the other program of the communication request source is under the control of the same organization as the program being executed by the own apparatus.

When the present invention is viewed from the viewpoint of a computer program, the present invention can be installed in a computer device so that the computer device retains information on the program being executed, and in other client devices. In a computer program for realizing a function corresponding to the function of a client device having a data transmission / reception function for capturing a communication request from another program , the other program of the communication request source is the same as the program being executed by the own device It is characterized by realizing a mutual authentication function to confirm that it is under the management of the organization.

  According to the present invention, it is possible to communicate directly between downloaded programs without using a server device while maintaining security, and by distributing data while maintaining security between downloaded programs, Multicast communication can be efficiently realized without imposing a load on the server device.

  The embodiment of the present invention can securely communicate directly even between programs including a malicious possibility downloaded from a network.

  A communication system according to an embodiment of the present invention includes: a program management unit that starts program execution in a client device and retains program information being executed; a program that operates in a sandbox; and communication management in the sandbox And a multicast management unit, and the server device includes a multicast network structure management unit.

  Here, the sandbox is a means for performing processing for permitting or rejecting a communication request made by a program.

  When a program tries to communicate with another client device, the communication management unit checks whether the other client device is also executing a program under the same organization's management, and if so, only allows communication To do. By operating in this way, direct communication between client devices is realized while eliminating unauthorized access.

  In addition, the multicast network structure management unit of the server apparatus grasps the structure of the multicast network composed of each client apparatus, and designates to which client apparatus the multicast communication should be transferred to the client apparatus. Upon receiving the multicast communication, the communication management unit of the client device transfers the communication to another designated client device. Here, in the communication between the client apparatuses, it is confirmed whether or not the program under the management of the same organization is being executed, and the communication is permitted only in such a case.

  By operating as described above, the object in the embodiment of the present invention can be achieved.

  Patent Document 2 proposes that “a program includes a public key and a secret key representing the origin, and that mutual authentication between programs succeeds and communication between programs is permitted only when the public keys match”. Although disclosed, this proposal is located at a close distance, such as between a POS (Point of Sales) and a mobile phone device, and assumes communication between specific devices. There is no leakage.

  On the other hand, the present invention is intended for a device group that attempts to communicate with an arbitrary device via a network such as the Internet, a program that operates on the device group is malicious, and a device that is not related to the system. When there is a possibility of unauthorized access such as through a security hole, there is an effect of avoiding this.

  That is, while the proposal of Patent Document 2 is effective in that “information is not leaked in communication between specific devices”, in the present invention, in “communication between arbitrary devices via a network”. It is effective to avoid unauthorized access from a program, such as through a security hole, and there is a clear difference between the two.

(Effect of the invention)
The first effect is that it is possible to provide a system that can directly communicate between downloaded programs that may be malicious while maintaining security.

  The reason for this is to prevent unauthorized access by checking the program of the communication partner and only if the communication partner is a program under the control of the same organization.

  For example, if you consider unauthorized access that attempts to take over the vulnerability of other devices, such as bots and viruses, and if the only party that can communicate is the program under the same organization's control, then Since the target that can be attempted is limited to only the programs under its control, the act of hijacking is not established as a result, so that unauthorized access is avoided.

  The second effect is that multicast communication can be provided while maintaining security between downloaded malicious programs.

  The reason is that a multi-carrier network is constructed between programs that are confirmed to be programs managed by the same organization, and multicast communication is performed after preventing unauthorized access.

  As described above, multicast communication can be realized. Implementing in this way has the advantage that the program itself does not need to be aware of the structure and management of the multicast network.

(Embodiment of the present invention)
Next, embodiments of the present invention will be described with reference to the drawings.

  Referring to FIG. 1, an embodiment of the present invention includes a server device 101 that distributes a multicast network and distributes a program, and a client device 106. The client device 106 further includes a program management unit 107, a sandbox 112, and a multicast management unit 108.

  The sandbox 112 includes a program 117 that operates therein and a communication management unit 113. The communication management unit 113 includes a sandbox mutual authentication unit 114, a data encryption / conversion unit 115, and a data transmission / reception unit 116. The multicast management unit 108 includes a multicast network participation reception unit 109, a multicast communication destination management unit 110, and a life / death data transmission unit 111.

  The server apparatus 101 includes a matching processing unit 102, a life / death monitoring unit 103, a multicast network structure management unit 104, and a program distribution unit 105.

  These operate as follows.

  The target program 117 is distributed to the client device 106 using the program distribution unit 105. The program 117 is executed in the sandbox 112 to restrict its operation.

  First, direct communication between the client devices 106 will be described. Conventionally, communication is permitted only to the server apparatus 101 downloaded by the program because a malicious program may illegally access another PC or the like via the network.

  Therefore, when the client device 106 communicates with another client device 106, unauthorized access is limited only when the communication partner is a program (typically the same program) 117 under the management of the same organization. I can't do it.

  In order to realize this, when the program 117 operating under the sandbox 112 performs communication, the communication management unit 113 first captures the request. Then, it is confirmed whether or not the program 117 under the management of the same organization is operating with respect to the sandbox 112 of the communication partner. After confirmation, a communication path is established between the sandboxes 112, and the requested communication is performed through the communication path.

  Next, implementation of multicast will be described.

  In order to transmit the same data to a large number of client devices 106 without imposing a load on the server device 101, the client devices 106 constitute a network. As a network topology, for example, a tree structure can be considered. When the client device 106 first joins the multicast network, it operates as follows.

  The program 117 connects to the server apparatus 101 that manages the multicast network and requests participation. At this time, if the server apparatus 101 is the same as the one that downloaded the program 117, communication can be performed without authentication. Otherwise, authentication is performed between the sandboxes 112 as in the case of direct communication between the client devices 106.

  The server apparatus 101 performs some kind of matching process depending on the application. Possible applications include video conferencing and games with multiple participants. The server apparatus 101 returns the ID of the multicast network to join to the program.

  The program 117 passes this ID to the multicast network participation reception unit 109 and requests participation in the multicast network. The multicast network participation reception unit 109 requests the multicast network structure management unit 104 of the server apparatus 101 to participate. The multicast network structure management unit 104 selects an appropriate location for newly joining the client device 106 from the current multicast network structure. As the network changes, a multicast data transfer request is sent to the client devices 106 that have already participated. This is shown in FIG.

  In the case of FIG. 2, a client device newly participates in the lower right of the tree structure. Then, when multicast data arrives, the client device at the higher rank of the newly joined client device is requested to transfer the data to the newly joined client device.

  When the program 117 multicasts data, for example, in the case of a tree structure as shown in FIG. 2, multicast data is sent to the client device corresponding to the root of the tree. The client device that has received the data transfers the data to the client device below it. At this time, authentication is performed between the sandboxes 112 as in the case of direct communication between client devices.

  The server apparatus 101 monitors the life and death of the client apparatus 106. If there is a client apparatus 106 that leaves, the server apparatus 101 reconfigures the multicast network.

  Here, “the life and death of the client device 106” is expressed as “life” when the client device 106 is participating in the multicast network, and “death” when the client device 106 is disconnected from the multicast network. It is a thing.

  Next, the overall operation of this embodiment will be described with reference to the flowcharts of FIGS. First, download and execution of the program 117 will be described with reference to FIG. First, in step 301, the program management unit 107 downloads a program from the program distribution unit 105 of the server apparatus 101. Here, the program management unit 107 records from which server apparatus 101 the program 117 is downloaded. In step 302, the program management unit 107 executes the program 117 in the sandbox 112. The program management unit 107 keeps track of which program is being executed. This information will be used later.

  Next, direct communication between clients will be described. First, in step 401 of FIG. 4, the program 117 requests the communication management unit 113 to start communication. Next, in step 402, the connection destination is confirmed as its contents. In step 403, it is confirmed whether or not the connection destination is an already connected communication partner. If not connected (No in Step 403), the process proceeds to Step 404, where authentication between the sandboxes 112 is performed. This step will be described in detail with reference to FIG.

  In step 405, it is confirmed whether or not the communication partner is communicable. If not (No in step 405), the process proceeds to step 406, and an error is returned to the program 117. If it is a communicable partner (Yes in Step 405), the process proceeds to Step 407, and a communication path is established with the partner-side sandbox 112. This communication channel will be held as it is thereafter. If the communication partner is already connected in step 403 (Yes in step 403), the process proceeds to step 408. Here, conversion is performed such as encrypting communication contents or adding additional information for multicast communication to be described later. In step 409, the contents are transmitted using the established communication path.

  The receiving side accepts authentication between the sandboxes 112 in step 410. In step 411, it is determined whether or not the other party is communicable. If not (No in step 411), the process proceeds to step 412 and communication is rejected. If it is a communicable partner (Yes in Step 411), a communication path is established in Step 413. In step 414, the data is received through the established communication path. If the communication path has already been established, the process starts from step 414. In step 415, the communication content encryption and conversion performed in step 408 are decrypted. In step 416, the contents are transferred to the program 117.

  The established communication path is discarded when the program 117 ends. In this case, even when recognizing it and communicating with the same client device 106 again, the process proceeds from step 403 to step 404 to perform authentication between the sandboxes 112 and establish a communication path.

  Next, the contents of step 404 will be described in detail with reference to FIG. First, in step 501, authentication between the sandboxes 112 is started. In the next step 502, the correctness of the sandbox 112 itself is mutually confirmed. This is to prevent the data receiving side from receiving malicious data from the fake sandbox 112 and to prevent the transmitting side from leaking information to the fake sandbox 112.

  Confirming that each other is a regular sandbox 112 can be realized by embedding key data for confirming it in the sandbox 112 and using a method such as a challenge response method.

  Next, in step 503, information on the programs 117 being executed is exchanged. For this purpose, the information stored in the program management unit 107 in step 302 is used. In step 504, this information is used to confirm that the program 117 currently being executed in each other's sandbox 112 is a program managed by the same organization. If so (Yes in step 504), it is determined that the other party can communicate, and the process proceeds to step 505. If not (No in step 504), the process proceeds to step 506, and it is determined that the communication partner is not communicable.

  Here, in order to confirm that the program 117 is under the management of the same organization, it is only necessary to confirm that the program is a program downloaded from the same server apparatus 101. For this purpose, the server 101 that has downloaded the program 117 by the program management unit 107 is recorded, and in step 504, it can be confirmed whether the server names are the same.

  Alternatively, as another method, a method of attaching an electronic signature to the program 117 can be considered. That is, if it can be confirmed that the program is signed by the same organization, it can be guaranteed that the program of the communication partner is under the control of the same organization. In this case, the program management unit 107 confirms the electronic signature and extracts the name of the signed organization. In step 504, the organization name is confirmed. In this case, the server apparatus 101 that distributes the program 117 may be different from the server apparatus 101 that manages the multicast network.

  Note that the process of step 502 “confirming the legitimacy of the sandbox itself” can be omitted if it is only to avoid unauthorized access. For example, when the program A in the sandbox X requests communication to the program B in another sandbox Y, the sandbox X sends a request to the sandbox Y that “Program B is under the control of the same organization as the program A. Ask if it is. If they are the same, the sandbox X permits the communication request of the program A and sends out the packet.

  Here, even if the sandbox Y is not valid, there is no problem because the sandbox X permits the packet transmission from the program A. The effect of this is that only the program B in the sandbox Y that has made a false attack is attacked by the program A, but such a situation cannot occur.

  This is because if the sandbox Y wants to attack the program B, the program A does not need to be attacked, and the sandbox Y itself can attack.

  On the other hand, if step 503 is omitted, a communication request can be made to a program under the control of another organization, and an attack such as searching for a vulnerability and hijacking the program becomes possible. Therefore, step 503 cannot be omitted. is there.

  Next, implementation of multicast will be described. First, a procedure when a client newly joins a multicast network will be described with reference to FIG. First, in step 601, the program joins the multicast network to the matching processing unit 102 of the server apparatus 101. This is an application level request, and the matching processing unit 102 is generally prepared by an organization that distributes applications. For example, a video conference application may request participation in a conference, or an online game application may request participation in a party. Authentication is performed at the application level.

  In step 601, communication from the client device 106 to the server device 101 is performed. This communication is permitted when the data transmitting / receiving unit 116 recognizes that the communication is for the server apparatus 101 having the same (or the same domain) as the server apparatus 101 that downloaded the program 117. For this reason, the connection destination is confirmed and the information of the program 117 being executed is confirmed.

  Alternatively, the server apparatus 101 may execute a function having the same function as the sandbox 112 executed in the client apparatus 106. In this case, each module of the server apparatus 101 is executed in the sandbox 112, and the communication between the server apparatus 101 and the client apparatus 106 is performed by the authentication between the sandboxes 112 as in the communication between the client apparatuses 106. Done after going.

  The communication between the client device 106 and the server device 101 described above is the same in the later step 604.

  Next, in step 602, an ID indicating a multicast network to join from the matching processing unit 102 is received. In step 603, this ID is used to request the multicast network participation acceptance unit to participate in the multicast network.

  Next, in step 604, the multicast network participation reception unit 109 requests the multicast network structure management unit 104 of the server apparatus 101 to participate in the multicast network using the previously acquired ID. Here, even after accepting the participation request, this connection is held without disconnection, and is used for network information change notification and life / death monitoring from the server apparatus 101.

  Here, in steps 603 to 604, the ID of the multicast network received from the server apparatus 101 in steps 601 and 602 is used, and a request is made to the server apparatus 101 again in step 603. It is also possible to realize this by a method in which connection is made from the server apparatus 101 to the client apparatus 106 instead of requesting participation from the program 117 in step 603 to the multicast network participation reception unit 109. However, in this case, the client device 106 needs to authenticate by some method that the connection is from the correct server device 101.

  In step 605, the server apparatus 101 changes the network structure in order to cause the client apparatus 106 that has requested to participate to participate in the multicast network. Then, necessary information is transmitted to the necessary client device 106 in accordance with the change. For example, when a tree structure is used in the multicast network as shown in FIG. 2 and a newly participating client device 106 is connected to a leaf portion of the tree structure, the client device 106 to which the newly participating client device 106 is connected is connected. For the “new communication destination”, the IP address of the client device 106 is transmitted.

  Next, in step 606, necessary network information is also notified to the newly participating client device 106. For example, when the multicast network has a tree structure, the IP address of the client device 106 corresponding to the root of the tree is included. This is because when data is sent by multicast, it is necessary to send data to the client device 106 at the root of the tree structure.

  Next, referring to FIG. 7, the operation when data is transmitted using the multicast network will be described. First, in step 701, the program 117 requests the communication management unit 113 for multicast communication. In step 702, the data transmitting / receiving unit 116 recognizes that the request is a multicast communication request.

  In step 703, the multicast communication destination management unit 110 is referred to communicate with an appropriate client device 106. Here, for example, when the multicast network has a tree structure as shown in FIG. 2, the appropriate client device 106 is the client device 106 corresponding to the root. This information is passed to the client device 106 in step 606 of FIG.

  In step 704, communication is performed in the same manner as the direct communication between the client apparatuses 106 described in FIG. Here, in step 408, communication contents are converted according to multicast communication. For example, information indicating where the transmission source is, and data ID are added depending on circumstances.

  In the case of multicast communication, authentication between the sandboxes 112 must be performed. This is because it is not always reliable whether the communication destination designated by the server apparatus 101 is correct.

  Next, referring to FIG. 8, an operation when receiving multicast communication will be described.

  In step 801, the data transmitting / receiving unit 116 receives multicast communication and confirms that it is multicast communication.

  Next, in step 802, the contents of the data are confirmed, and it is possible to receive the same data a plurality of times depending on the realization of the multicast network, or whether it is already received data. For this purpose, the transmission source information added to the data or the data ID as described in step 704 is used.

  If it is not the data sent by itself but the data already received (No in step 802), the process proceeds to step 803. Then, the contents are transferred to the program 117 being executed in the sandbox 112.

  If it is the data sent by itself or the data already received (Yes in step 802), step 803 is skipped and the process proceeds to step 804.

  In step 804, the communication contents are transferred to an appropriate client device 106 with reference to the multicast communication destination management unit 110. For example, when a multicast network is configured with a tree structure as shown in FIG. 2, it corresponds to the client device 106 corresponding to the lower level of the own client device 106. This information is conveyed in step 605.

  In step 805, communication is performed in the same manner as the direct communication between the client apparatuses 106 described with reference to FIG. In this case as well, authentication between the sandboxes 112 is required as in step 704.

  Next, life and death monitoring will be described with reference to FIG. The life / death monitoring unit 103 of the server apparatus 101 uses the connection between the client apparatus 106 and the server apparatus 101 established in step 603 to check the life / death of the client apparatus 106 at regular intervals, for example. .

  The life / death monitoring unit 103 recognizes the client device 106 that has left in step 901. In step 902, the server apparatus 101 changes the multicast network and notifies the affected client apparatus 106 of the change of the multicast network information. For example, when a multicast network is configured with a tree structure as shown in FIG. 2, the client device 106 that is higher than the client device 106 that has left the client device 106 is the client device 106 that is lower than the client device 106 that has left the client device 106. Even ask to transfer multicast data.

(Second embodiment)
Next, a second embodiment of the present invention will be described with reference to the drawings.

  FIG. 10 is a configuration diagram of a computer that operates according to a computer program when the first embodiment is configured by the computer program.

  The computer program is stored in the recording media 1002 and 1005, read into the computers 1003 and 1006, and controls its operation. Thereby, the computer 1003 performs the same operation as the server apparatus 101 of the first embodiment, and the computer 1006 performs the same operation as the client apparatus 106 of the first embodiment.

  The computer program of the present embodiment is recorded on the recording media 1002 and 1005, so that the computers 1003 and 1006 can install the computer program of the present embodiment using the recording media 1002 and 1005.

  Alternatively, the computer program of this embodiment can be installed in the computers 1003 and 1006 via a network from a server apparatus that holds the computer program of this embodiment without using the recording media 1002 and 1005.

  Accordingly, functions corresponding to the functions of the server apparatus 101 and the client apparatus 106 of the first embodiment can be realized using the computers 1003 and 1006.

  Note that the computer program of this embodiment includes not only a computer program that can be directly executed by the computers 1003 and 1006 but also a program that can be executed by being installed in the hard disks of the computers 1003 and 1006. Also included are those that are compressed or encrypted.

(Example)
Next, the operation of the embodiment of the present invention will be described using specific examples. First, FIG. 11 shows a case where a language processing runtime 1104 is used as the sandbox 112. This corresponds to the case where, for example, JavaScript or Java Applet is used.

  The language processing system runtime 1104 includes a communication library 1106 and an auxiliary library 1105. These libraries are protected from the program 1108 and cannot be changed. The communication library 1106 includes a communication management unit 1107, which corresponds to the data transmission / reception unit 116 in FIG.

  The program management unit 1102 starts the program 1108 via the language processing runtime 1104.

  The program 1108 needs to go through the communication library 1106 when performing communication. Here, by changing the communication library 1106 of the language processing system runtime 1104 to include the communication management unit 1107 and capture the communication request from the program 1108, the operation described in the embodiment can be realized. .

  The program 1108 and the language processing system runtime 1104 need to communicate with the multicast management unit 1103 and the program management unit 1102. This can be realized, for example, by realizing the language processing system runtime 1104 and the multicast management unit 1103 by separate processes and connecting them using inter-process communication such as a shared memory or a socket.

  When the program 1108 requests the multicast management unit 1103 to participate in the multicast network (step 603 in FIG. 6), an auxiliary library 1105 for that purpose is prepared in the language processing system runtime 1104, and the program is executed via this. realizable. Alternatively, the multicast management unit 1103 itself may be realized as a library in the language processing system runtime 1104. In this case, the auxiliary library 1105 is not necessary.

  As another embodiment, a case where a process is used as the sandbox 112 is shown in FIG. Since the process has a limited isolation function as the sandbox 112, for example, it is conceivable to use the process together with a technique of improving the isolation function at the file system level using a root.

  Execution of the target program 1207 is started by the program management unit 1202. Then, the communication-related system call 1205 in the OS kernel 1204 includes the communication management unit 1206, and is changed so as to capture a communication request from the program 1207, thereby realizing the operation described in the embodiment. it can.

  The OS kernel 1204 recognizes that the communication is requested by the target program 1207 in cooperation with the program management unit 1202. For example, a method of registering the ID of the target program 1207 in the OS kernel 1204 when the program management unit 1202 starts the program 1207 can be considered for this cooperation.

  Communication between the communication management unit 1206 and the program 1207 and the multicast management unit 1203 can be realized by using interprocess communication by realizing the multicast management unit 1203 as a separate process. Alternatively, the multicast management unit 1203 can be incorporated into the OS kernel 1204 and realized as a system call.

  As another example, FIG. 13 shows a case where a virtual machine 1304 is used as the sandbox 112. In this case, since the program 1307 operates on the virtual machine 1304, the program 1307 includes an OS.

  The program management unit 1302 starts a program 1307 including an OS on the virtual machine 1304. Then, the virtual communication hardware 1305 configured in the virtual machine 1304 is changed to include the communication management unit 1306. Then, the communication request from the program 1307 including the OS is captured here.

  Communication from the program 1307 to the multicast management unit 1303 can be realized as network communication to the host OS. This communication is captured by the communication management unit 1306. Whether the communication is with the multicast management unit 1303 or a communication request to the outside can be determined based on the destination of the network packet.

  Communication between the virtual communication hardware 1305, the program management unit 1302, and the multicast management unit 1303 can be realized as inter-process communication.

  The present invention can be applied to a program for communicating or multicasting between programs downloaded via the Internet. The present invention can also be applied to communication or multicasting between programs embedded in a WWW page.

It is a block diagram which shows the structure of embodiment of this invention. It is a figure explaining the condition which participates in a multicast network. It is a flowchart at the time of distributing a program. It is a flowchart at the time of communicating between programs. It is a flowchart at the time of performing authentication between sandboxes. 6 is a flowchart when a client joins a multicast network. It is a flowchart at the time of transmitting by multicast communication. It is a flowchart at the time of performing reception by multicast communication. It is a flowchart which shows operation | movement when there exists the detached node. It is a block diagram which shows the structure of 2nd embodiment. It is a block diagram of the specific example which used the runtime of the language processing system as a sandbox. It is a block diagram of the specific example which used the process as a sandbox. It is a block diagram of the specific example using a virtual machine as a sandbox.

Explanation of symbols

101, 1001 Server device 102 Matching processing unit 103 Life / death monitoring unit 104 Multicast network structure management unit 105 Program distribution unit 106, 1004, 1101, 1201, 1301 Client device 107 Program management unit 108, 1103, 1203, 1303 Multicast management unit 109 Multicast Network participation reception unit 110 Multicast communication destination management unit 111 Life / death data transmission unit 112 Sandbox 113, 1107, 1206, 1306 Communication management unit 114 Inter-sandbox mutual authentication unit 115 Data encryption / conversion unit 116 Data transmission / reception units 117, 1108, 1207, 1307 Program 1002, 1005 Recording medium 1003, 1006 Computer 1102, 1202, 1302 Program management unit 1104 Language processing system Ntaimu 1105 auxiliary library 1106 communication library 1204 OS kernel 1205 communications-related system call 1304 virtual machine 1305 virtual communication hardware

Claims (6)

In a client device including a program management unit that holds information of a program being executed and a data transmission / reception unit that captures a communication request from another program in another client device,
The running program operates in a sandbox that performs a process of permitting or denying a communication request made by the other program,
The sandbox includes mutual authentication means for authenticating that the other program of the communication request source is a program belonging to the same organization as the program being executed in the own sandbox,
The mutual authentication means, after authenticating the validity of the sandbox with other sandbox communication requesting other programs belongs, program the communication requesting another program has been downloaded from the same server Or a means for authenticating whether the program is digitally signed by the same organization,
A client device. The client device according to claim 1 , wherein the client device is a client device in a multicast network in which a plurality of client devices download a program by multicast . In a communication method executed by a client device that holds information of a program being executed and captures a communication request from another program in another client device,
The running program operates in a sandbox that performs a process of permitting or denying a communication request made by the other program,
The sandbox executes a mutual authentication step for authenticating that the other program of the communication request source belongs to the same organization as the program being executed in the own sandbox,
The mutual authentication step, after authenticating the validity of the sandbox with other sandbox communication requesting other programs belongs, the communication requesting another program has been downloaded from the same server program Or authenticate that the program is digitally signed by the same organization,
A communication method characterized by the above. The communication method according to claim 3, wherein the communication method of a client device in a multicast network in which a plurality of client devices to download the program in multicast. When installed in a computer device, the computer device has a program management function for holding information about a program being executed, and a data transmission / reception function for capturing a communication request from another program in another client device . In a computer program for realizing a function corresponding to the function of a client device,
The running program operates in a sandbox that performs processing for permitting or denying a communication request made by the other program,
The sandbox realizes a mutual authentication function for authenticating that the other program of the communication request source belongs to the same organization as the program being executed in the own sandbox,
The mutual authentication means, after authenticating the validity of the sandbox with other sandbox communication requesting other programs belongs, program the communication requesting another program has been downloaded from the same server Or realize the function to authenticate whether the program is digitally signed by the same organization,
A computer program characterized by the above. 6. The computer program according to claim 5, wherein a plurality of client devices realize a function of a client device of a multicast network in which the program is downloaded by multicast .

Images