KR20060086840A - Communication system, communication terminal comprising virtual network switch and portable electronic device comprising organism recognition unit - Google Patents

Abstract

The communication terminal (2) of a communication system (1) comprises a virtual network switch (22) which can alter the destination of data being transmitted/received between the communication terminal (2) and a network (5) forcibly, wherein data is transmitted/received between the network (5) and the communication terminal (2) through a portable electronic device (3). Various functions, including a security function, can be supplemented by providing the function of software mounted on the portable electronic device (3) itself to the communication terminal (2). Even if a communication terminal connected directly with the network is not provided with such functions as VPN, firewall or virus check, high-safety communication can be ensured utilizing these security ensuring means mounted on the portable electronic device.

Description

TECHNICAL SYSTEM, COMMUNICATION TERMINAL COMPRISING VIRTUAL NETWORK SWITCH AND PORTABLE ELECTRONIC DEVICE COMPRISING ORGANISM RECOGNITION UNIT}

The present invention relates to a communication system having a communication terminal having a network communication function and a portable electronic device capable of communicating with the communication terminal. More specifically, the present invention relates to a communication system capable of accessing various networks using a communication terminal according to a communication security level preset in a portable electronic device.

Conventionally, all software and setting information necessary for connecting a communication device to a public network, such as the Internet, and the like, are preloaded in the communication device or temporarily installed in the communication device, and the information is stored inside the communication device. The format in which the software runs is common. Even in the case of securing the security during communication, the communication device is equipped with software for securing security in advance or temporarily installed.

Here, as a means of securing security during communication, a VPN technology for securing security by using a part of a shared line as a virtual leased line by using encrypted data between the communicating party and the other party to communicate, and unnecessary communication during communication. Firewall technology to prevent exchange of information with counterparts, and illegal virus removal technology to check and remove malicious virus software for the exchanged data.

As for the VPN technology, when communicating over the Internet, IP-VPN technology is widely used to prevent the risk of eavesdropping and alteration of data by an unspecified number of others. In the case of using the IP-VPN technology, the communicating client terminal can install a predetermined VPN client software in the communication terminal and perform a necessary setting operation by the network engineer, thereby enabling connection with the designated VPN gateway device. . When the client terminal communicates with the other party, by performing encrypted communication via the VPN gateway device, communication with the other party can be securely performed on the Internet.

In addition, about a firewall technology, the simple setting can also be equipped in advance using the software standardly mounted in OS on a communication terminal. However, in the case of use in a company or the like, a method of purchasing the firewall software and introducing it to each communication terminal or purchasing a dedicated firewall device and installing it at the entrance of the network to defend the network itself in advance. Etc. are common. In general, it is generally necessary to perform a preset setting by an expert, and therefore it is common to be a defense method for a specific terminal and a specific network.

Also, in the case of fraudulent virus removal technology, virus removal software is introduced in advance on a communication terminal in advance as in the above-described firewall technology and regularly removed, or the virus removal software is introduced into a specific server device on a network, and the like. It is common to rescue viruses on a server by performing communication via a device.

In the prior art, there are many cases where the start of communication is based on the premise that all necessary software is installed in the network device. However, in the present society, there are numerous means of accessing the network represented by the Internet, and individuals can freely use the network at their own will without having to go through a network device controlled under the management of the network manager in advance. However, it is a phenomenon that network control and information control in a limited area by a network administrator have virtually no meaning, and it is urgent to provide a means of managing a network to an individual who attempts to access the network. Currently, Internet cafes and public wireless services are provided, but it is difficult to know how much security the companies that manage and manage these lines and terminals are taking measures to protect themselves. We think that it is desirable to use with.

On the other hand, the following disadvantages also arise from the viewpoint of the processing capacity of the communication terminal itself. In other words, the necessary processing capability of software hardware mounted on each communication terminal is increasing every year, and the processing capability of the communication terminal is steadily rising in accordance with it. However, even if the processing capacity of the communication terminal is improving, when one communication terminal processes all the tasks, the application execution ability for the user to be performed by the communication terminal is limited, and the tasks related to the communication are performed. You have to run it.

Due to the increase in the amount of information that comes with the speed of the network, the damage caused by it tends to be more frequent. Moreover, in view of the user, since the necessity of replacing the communication terminal itself arises because of the occurrence of a failure due to the delay of some of such work, the efficiency is poor. In addition, in the case of a user who communicates using a plurality of communication terminals, the state of the communication environment depends on the capabilities of the individual terminals, and the instability of the network cannot be avoided.

When performing communication using individual security technology, for example, VPN technology, VPN client software is installed on the client terminal as a premise, and the necessary communication settings must already be set. In addition, this communication setting is generally detailed in network technology, and it is difficult to set it unless it knows all the setting information required by the VPN gateway of the communication destination.

As a result, the terminal which can communicate with a VPN is limited to the information terminal distribute | distributed in the state which the company set to the employee beforehand. Unless the employee has the information terminal, it is virtually impossible to communicate with a VPN connection to a company's resources. As a countermeasure, such an employee may be limited by using a low-speed dial-up connection using a public public line, or by using a service provided by a third-party Internet service provider, a mobile phone service provider, or the like, which is unable to manage the security of a corporate manager. There is only access to mail. However, this method is inherently dangerous for network administrators and is undesirable.

Moreover, the various setting information for communication set on the VPN client software can be accessed easily by a third party other than the owner of the communication terminal if a simple security check is passed. Therefore, a malicious third party steals the setting information relatively easily from the terminal of the careless client terminal owner, sets it on another terminal, and connects to the VPN gateway, thereby enabling access to secret data such as an enterprise. There is a difficulty to throw away.

In addition, in the use of a firewall, the use of virus removal software, etc., there are limitations on the network and communication terminal which can be used by the conventional technique, and the method which uses the general Internet widely is not limited to the communication terminal itself which actually communicates. This is a phenomenon.

SUMMARY OF THE INVENTION In view of the above, an object of the present invention is to assume that a communication terminal having a communication function is equipped with all necessary software beforehand, and use the communication terminal to perform communication at a desired security level. Disclosed is a communication system capable of performing, and a communication terminal and a portable electronic device for use in the communication system.

In order to achieve the above object, the communication system of the present invention,

A communication terminal having network connection means,

Has a portable electronic device capable of communicating with the communication terminal,

The communication terminal is provided with a virtual network switch capable of forcibly changing the transmission destination of data transmitted and received between the network connected by the network connection means,

The portable electronic device includes security securing means for ensuring communication security with the network by the communication terminal,

The communication terminal performs data transmission and reception with the network via the security means of the virtual network switch and the portable electronic device.

Here, as said security | security securing means, a VPN means, a virus removal means, and a firewall means are mentioned.

The virtual network switch can be a virtual IP switch incorporated in the network layer of the OSI 7 layer model in TCP / IP, which is an Internet standard protocol. The virtual IP switch transmits a packet received from the network to a higher transport layer or the portable electronic device according to a preset condition, and transmits a packet from the portable electronic device to a preset condition. Therefore, it is characterized by returning to the above-mentioned network of an upper transport layer or a transmission source.

Next, in addition to the above configuration, the communication system of the present invention performs the security check of the storage medium of the communication terminal and the application by the security securing means of the portable electronic device via the virtual network switch. It features.

The portable electronic device further includes a biometric device such as a fingerprint sensor, a biometric information storage unit in which biometric information is stored in advance, and biometric information read by the biometric device in the biometric information storage unit. By contrast with biometric information, it is preferable to have an authentication means for granting access to the network through the communication terminal.

On the other hand, the communication system of the present invention,

A communication terminal having network connection means,

Has a portable electronic device capable of communicating with the communication terminal,

The communication terminal is provided with security securing means for securing communication security with the network,

Since the portable electronic device communicates with the network via the security securing means, a communication setting information storage unit storing and holding necessary communication setting information, a biometric device such as a fingerprint sensor, and biometric information are stored in advance. And an authentication means for collating the retained biometric information storage unit and the biometric information read by the biometric recognition device with the biometric information stored in the biometric information storage unit.

In this way, in the communication system of the present invention configured as described above, it is not limited to the kind of software mounted on the communication terminal having the network communication function to be used, and the function of the software mounted on the portable electronic device itself is given to the communication terminal. It can provide and complement various functions, such as a security function. Therefore, even when the communication terminal directly connected to the network is not equipped with a function such as a VPN, a firewall, a virus check, or the like, these highly secured means installed in the portable electronic device can be used to perform highly reliable communication. have.

In addition, although the portable electronic device does not have its own physical network connection means, when the portable electronic device is connected to a separate communication terminal directly connected to the network, the portable electronic device communicates with the network by the virtual network switch of the communication terminal. Virtually intervening between the terminals. Therefore, communication can be performed between the communication terminal and the network by using the security ensuring means installed in the portable electronic device.

Furthermore, when the portable electronic device is equipped with a biometric device, authentication is performed by the biometric device so that the mobile device can be connected to a unique physical network, such as a PC or a mobile phone, to which the device is connected. It can establish a connection to a designated network on the Internet.

1 is an overall configuration diagram showing an example of a communication system to which the present invention is applied.

2 is an overall configuration diagram showing another example of a communication system to which the present invention is applied.

3 is an overall configuration diagram showing still another example of a communication system to which the present invention is applied.

4 is an explanatory diagram showing an example of a virtual network switch mounted in the communication terminal of the communication system of FIGS.

FIG. 5 is an explanatory diagram showing an example of a virtual network switch mounted in a communication terminal of the communication system of FIGS. 1 to 3.

6 is an overall configuration diagram illustrating an example of a communication system according to another embodiment of the present invention.

7 is an overall configuration diagram illustrating a modification of the communication system of FIG. 6.

FIG. 8 is an overall configuration diagram showing another modification of the communication system of FIG. 6.

Best Mode for Carrying Out the Invention

EMBODIMENT OF THE INVENTION Below, the Example of the communication system to which this invention is applied is described with reference to drawings.

1 is an overall configuration diagram showing an example of a communication system to which the present invention is applied. The communication system 1 of this example is a portable electronic device 3 capable of communicating between a communication terminal 2 including a network connection means 21 such as a PC, a cellular phone, and the communication terminal 2. (Hereinafter, also referred to as "token"), it is possible to connect to a predetermined network 5 via a communication network 4 such as the Internet.

The communication terminal 2 is provided with the virtual network switch 22 which can forcibly change the transmission destination of the data transmitted / received with the network 5 connected by the network connection means 21. FIG. By this virtual network switch 22, data transmitted from the network 5 to the communication terminal 2 is transmitted to the portable electronic device 3, and via the portable electronic device 3 again, the communication terminal. It returns to the virtual network switch 22 of (2), and is processed by the application 23 etc. of the communication terminal 2 here. Transmission data from the communication terminal 2 to the network 5 is also transmitted from the virtual network switch 22 via the portable electronic device 3 to the network 5 of the communication destination again via the virtual network switch 22. Thus, although the portable electronic device 3 is physically connected to the communication terminal 2 by the virtual network switch 22, it is as if it is interposed between the network 5 and the communication terminal 2. Functions like

This portable electronic device 3 is equipped with security ensuring means for securing communication security with the network 5 by the communication terminal 2. In this example, a VPN client function 31 and a storage unit 32 in which VPN setting information is stored are provided.

Therefore, in the communication system 1 of this example, after connecting the portable electronic device 3 to the communication terminal 2 and enabling mutual communication, it uses the communication connection means 21 of the communication terminal 2 to network. (5) When communication with the (VPN server) is started, the virtual network switch 22 functions. As a result, communication using the VPN of the portable electronic device 3 is formed between the network 5 and the communication terminal 3.

Here, the portable electronic device 3 includes a biometric device 33 such as a fingerprint sensor, a biometric information storage unit 34 in which biometric information is stored in advance, and a biometric read by the biometric device 33. It is preferable to include an authentication unit 35 for authenticating by matching the information with the biometric information stored in the biometric information storage unit 34.

2 is an overall configuration diagram showing another example of the communication system according to the present invention. The communication system 1A shown in this figure uses the functions of the virtual network switch 22 to manage the media (hard disk, removable disk, external memory, etc.) of the communication terminal 2A, and the program. Management is configured to be performed from the side of the portable electronic device 3A.

The virtual network switch 22 of the communication terminal 2A has a function of accessing a storage medium (hard disk, removable disk, etc.) 24 of the communication terminal 2A. The portable electronic device 3A is equipped with a virus check function 31A as a security securing means and a virus pattern information storage unit 32A.

After the portable electronic device 3A is connected to the communication terminal 2A and identity verification is performed, the virus check function 31A performs a storage medium 24 on the virtual network switch 22 of the communication terminal 2A. ), A command packet for accessing the application 23 is issued. Thereby, the security check of the various media of the communication terminal 2A can be performed from the side of the portable electronic device 3A.

3 is an overall configuration diagram showing still another example of the communication system according to the present invention. The communication system 1B shown in this figure has a structure in which the portable electronic device 3B is provided with a firewall function 31B as security means and a memory part 32B of the firewall setting information therefor. have. Also in this communication system 1B, by the function of the virtual network switch 22, the portable electronic device 3B is virtually interposed between the communication network 4 and the communication terminal 2B, and is invaded from the outside. The detection can be performed so that secure communication can be performed.

Here, the virtual network switch 22 provided in the communication terminal 2 (2A, 2B) can be a virtual IP switch incorporated in the network layer of the OSI 7 layer model in TCP / IP which is an Internet standard protocol. have.

4 is an explanatory diagram showing a seven-layer model of OSI. The virtual IP switch 68 is installed in the network layer 63 in the seven-layer model 6. The virtual IP switch 62 switches the packet transmission destination to the portable electronic device 3 (3A, 3B) which is the upper transport layer 63 or another network device. The other layers 61, 62, 64 to 67 need not be changed at all.

The virtual IP switch 68 is different from the switch of the general layer 3, and when it transmits a packet to the portable electronic device 3 (3A, 3B), it is necessary to hold | maintain the information of a one packet, without missing. Therefore, one packet must be encapsulated in a packet for transmission. The encapsulated packet is returned to the original packet in the device 3 (3A, 3B) of the transfer destination, the process is performed by the application on the device, and the packet is passed to the virtual IP switch 68 again.

In addition, FIG. 5 is explanatory drawing in the case of fitting the said seven-layer model to the network model of a window (registered trademark). In this figure, "vsw.sys" on the intermediate layer is a virtual network switch. The software determines which of the higher level protocols on the portable electronic device 3 (3A, 3B) and the communication terminal 2 (2A, 2B) transmits the packet. This intermediate layer is a standard layer prepared for Windows' network architecture, and software for packet filtering using this layer is commercially available.

6 is an overall configuration diagram showing a communication system according to the present invention. This communication system 1C also includes a communication terminal 2C and a portable electronic device (token) 3C. The communication terminal 2C is provided with a network communication means 21A and a VPN client function 26. In contrast, the portable electronic device 3C includes a storage unit 32C in which VPN setting information necessary for performing communication using the VPN client function 26 is stored. The portable electronic device 3C further includes a biometric device 33 such as a fingerprint sensor, a biometric information storage unit 34 in which biometric information is stored in advance, and biometric information read by the biometric device 33. The authentication unit 35 that performs authentication by matching the information with the biometric information stored in the biometric information storage unit 34 is provided.

In the communication system 1C of this structure, the program which processes a security is mounted on the side of the communication terminal 2C, and the information required in order to operate it is kept on the side of the token 3C, and the biometric device 33 The processing is carried out in cooperation with them by the recognition result.

7 is an overall configuration diagram showing a communication system with a virus check function to which the present invention is applied. In this communication system 1D, a virus check function (software) 27 is mounted on the side of the communication terminal 2D, and the virus setting information necessary for executing it is stored in the storage unit 32D of the portable electronic device 3D. Maintained at If authenticated by the biometric device 33, both can cooperate to perform a virus check and secure communication.

8 is an overall configuration diagram showing a communication system having a firewall function to which the present invention is applied. In this communication system 1E, the personal firewall function 28 is mounted on the side of the communication terminal 2E, and the portable electronic device 3E is provided with a storage unit 32E in which the firewall setting information for it is stored. It is. Even in this case, when the personal identification is performed by the biometric device 33, both parties can cooperate and secure communication can be performed.

As described above, according to the communication system, the communication terminal and the portable electronic device of the present invention, the following effects are obtained.

(1) By carrying a portable electronic device with a biometric device according to the present invention, a user can use a communication terminal having all network communication functions at all places to check VPN connections and security for necessary resources on the Internet. It is possible to perform secure communication while performing. Therefore, it is possible to communicate using the optimum communication means available while maintaining the security policy set by oneself at a necessary place, without being bound by the security restrictions set by the line operator.

(2) There is no need to maintain security threatening information in the communication terminal, and by encrypting and storing communication setting information about VPN connection, personal firewall setting, virus check setting, and other security on the portable electronic device, The risk of leakage of setting information for three parties is significantly reduced.

(3) The load on the communication terminal consumed for the security check is reduced, and the performance improvement of other processes can be expected.

(4) In relation to the above (2), it is almost unnecessary for the user to be involved in the operation of the VPN client software or the like in general use. In addition, since access to the setting information can be restricted by encryption means available only to the network administrator, the risk of inadvertently changing the setting information of the client / software can be significantly reduced. As a result, the effect of reducing the labor cost of the network administrator and the management cost of the enterprise is expected.

(5) The portable electronic device of the present invention can be carried by an individual as an ID, and the communication setting information relating to the VPN software, personal firewall, virus removal software, and connection thereof associated with the ID can be saved. In this way, a company or the like that rents the device may install a VPN client or software to a newly used communication device, or set up a VPN connection on the basis of the movement of an employee, a user, or a communication device such as a PC to be used. There is no need to perform work or the like. Since only a communication interface with the token needs to be secured, the labor force of the network administrator is significantly reduced.

(6) In association with the above-mentioned ID, by associating the mechanism according to the present invention with software such as security software, identification of the license information by the biometric device, issue of the ID after authentication to the network server, and license It is possible to reliably execute the provision of the update function of the software embedded in the token after confirmation, not for the terminal but for the person carrying it.

(7) If the specification of the communication terminal cannot provide sufficient functions of the application or communication software in use, it is possible to respond by replacing only the necessary communication processing capability with another distributed processing apparatus without changing the communication terminal itself. At the same time, by carrying such a distributed processing apparatus, it is possible to always obtain a stable communication environment without carrying the terminal itself.

Claims (10)

A communication terminal having network connection means, Has a portable electronic device capable of communicating with the communication terminal, The communication terminal is provided with a virtual network switch capable of forcibly changing the transmission destination of data transmitted and received between the network connected by the network connection means, The portable electronic device includes security securing means for ensuring communication security with the network by the communication terminal, And said communication terminal transmits and receives data to and from said network via said security network means of said virtual network switch and said portable electronic device. The communication system according to claim 1, wherein said security means comprises at least one of an encrypted data transmission means, a virus removal means, and a firewall means. The virtual network switch according to claim 1 or 2, wherein the virtual network switch is a virtual IP switch incorporated in the network layer of the OSI 7 layer model in TCP / IP, which is an Internet standard protocol. The virtual IP switch transmits a packet received from the network to a higher transport layer or the portable electronic device according to a preset condition, and transmits a packet from the portable electronic device to a preset condition. Therefore, the communication system returns to the network of a higher transport layer or a transmission source. The method according to claim 1, 2 or 3, wherein the security of the storage medium of the communication terminal and the application is checked by the security securing means of the portable electronic device via the virtual network switch. Communication system. The portable electronic device according to any one of claims 1 to 4, wherein the portable electronic device includes a biometric device such as a fingerprint sensor, a biometric information storage unit in which biometric information is stored in advance, and read by the biometric device. And authentication means for allowing access to the network through the communication terminal by matching the biometric information with the biometric information stored in the biometric information storage unit. The said communication terminal provided with the said virtual network switch as described in any one of Claims 1-5. The said portable electronic device as described in any one of Claims 1-5. A communication terminal having network connection means, Has a portable electronic device capable of communicating with the communication terminal, The communication terminal is provided with security securing means for securing communication security with the network, The portable electronic device includes a communication setting information storage unit for storing communication setting information necessary for communicating with the network through the security securing means, a biometric device such as a fingerprint sensor, and biometric information in advance. And a biometric information storage unit and authentication means for matching biometric information read by the biometric recognition device with biometric information stored in the biometric information storage unit. The communication system according to claim 8, wherein said security means comprises at least one of an encrypted data transmission means, a virus removal means, and a firewall means. The portable electronic device according to claim 8 or 9.

Images