WO2010038726A1

WO2010038726A1 - Information report system, information report method, communication terminal, and program

Info

Publication number: WO2010038726A1
Application number: PCT/JP2009/066921
Authority: WO
Inventors: 玄奥山; 卓弥村上; 嘉昭奥山
Original assignee: 日本電気株式会社
Priority date: 2008-09-30
Filing date: 2009-09-29
Publication date: 2010-04-08
Also published as: JPWO2010038726A1

Abstract

It is possible to prevent access to a disguised network. Data check information is acquired via a high-secure network while data is acquired via a low-secure network. The acquired check information is compared to the data. If the comparison result is “not matched,” the low-secure network is determined to be a disguised network and access to the low-secure network is inhibited. Moreover, it is reported to a managing server on the high-secure network that the low-secure network is disguised.

Description

Information notification system, information notification method, communication terminal, and program

The present invention relates to an information notification system, an information notification method, and a communication terminal for notifying the existence of a camouflaged network.

In recent years, communication terminals have a plurality of wireless communication units, and the use of switching connection networks as required is increasing. For example, a communication terminal having a communication unit connected to a cellular network and a communication unit connected to a wireless LAN, connected to a cellular network outdoors, and connected to a wireless LAN indoors has been put into practical use.

In such a case, the communication terminal switches various networks or uses them simultaneously. There are various types of networks to be connected, and the operation policies of each network differ greatly. For example, an IP network of a cellular network operator and a corporate network intranet are equipped with authentication and encryption functions, and can be said to be very secure networks (networks with high security). On the other hand, in the case of a free wireless LAN spot, there is an insecure network (a network with low security) that does not have an authentication or encryption function.

Hereinafter, in the present specification, a network such as the IP network or the corporate network intranet of the cellular network operator is referred to as a highly secure network. A network in which a Web server or DNS may be spoofed or a network in which communication contents may be analyzed because it is not encrypted is referred to as a low secure network.

Recent communication terminals can download data such as applications and contents from a server via a network, and can receive various services using the downloaded data. For example, the application includes a Java (registered trademark) application in a mobile phone. When such a communication terminal switches between a high secure network and a low secure network or uses them simultaneously, a security threat occurs.

Suppose, for example, that a malicious application exists on a low secure network. It is assumed that the communication terminal downloads such an application and executes it when connected to a highly secure network. Then, it is conceivable that this malicious application attacks a highly secure network and steals information or performs a destructive action in the network.

Hereafter, consider the case of a Java applet application. In the case of a Java applet application, this application can usually communicate only with a downloaded site. For example, an application downloaded from “http://www.example.com” is restricted by “Java VM” so that it can communicate only with “www.example.com”.

In the above case, since the DNS in the highly secure network is reliable, the application can communicate with the intended server (www.example.com). However, in the case of a low secure network, not only applications and Web servers but also DNS cannot be trusted. It is possible for a malicious network administrator to set up a malicious DNS server and direct the application to be downloaded from a spoofed server.

For example, assume that a communication terminal downloads an application from a Web server that is misrepresented as “http://www.some-secure-server.com”. This application is allowed to communicate with “www.some-secure-server.com”. If a server having the same DNS name exists on the highly secure network, a malicious application can communicate with the server and attack the server. That is, an application on the low secure network can attack a server on the high secure network. This is a big problem.

On the other hand, suppose that you downloaded legitimate applications and content from “http://www.some-secure-server.com” on the highly secure network. When this communication terminal is connected to the malicious network, the application or content is connected to a server that has been misrepresented, and the communication content may be analyzed. That is, there is a possibility that communication contents of applications and contents on the high secure network may be guided on the low secure network and analyzed. This can be a big problem, especially in an application closed in a highly secure network environment.

As a countermeasure against such security threats, installation of an HTTPS (Hypertext Transfer Protocol Security) server or the like is conceivable, but the cost increases, such as acquiring a certificate or requiring server settings. For this reason, it is good that an application or content revenue can be obtained like a content provider, but it is difficult to use HTTPS with freeware or public information created by individuals.

Therefore, for example, Patent Document 1 presents a method of comparing a communication network associated with an application with a connected communication network and limiting the function of the application when these are different.

As described above, if the application is associated with the communication network to be used, the application on the low secure network cannot access the high secure network, and conversely, the application on the high secure network accesses the low secure network. I can't.

JP 2004-320369 A

However, there are applications that do not have any problems using either high-secure or low-secure networks. Specifically, it is a communication application placed on a server that can be accessed via either a high secure or low secure network. Since such an application can be accessed via a highly secure network, at least the DNS can be trusted. In addition, since it can be accessed via a low secure network, it is not an application closed in a high secure network environment. For this reason, such an application essentially does not require the above limitation.

However, the above solution makes it impossible for such an application to use both networks. Such a problem also occurs in the same manner when the application is replaced with other data such as content in Patent Document 1 described above.

From the above, a mechanism for authenticating the server is necessary to enable use of data such as applications and contents in multiple networks while maintaining security. That is, if it is possible to verify the origin of data and prove that the server is not spoofed, that is, if it can be proved that the network is not impersonated, there is no problem even if the use of a plurality of networks is permitted. Further, if the existence of a camouflaged network can be known, access to the camouflaged network can be prevented. However, conventional communication terminals do not have a mechanism for authenticating whether or not the network is forged, and there is also a mechanism for notifying other devices in the system of the presence of the forged network. There wasn't.

The present invention has been made to solve such a problem, and an object of the present invention is to authenticate whether a network is camouflaged at a communication terminal and prevent access to the camouflaged network. Another object is to provide an information notification system, an information notification method, and a communication terminal capable of notifying other devices in the system of the presence of a camouflaged network.

In order to achieve the above object, the present invention includes a first network, a second network having lower security than the first network, and a communication terminal connectable to the first and second networks. The information notifying system provided, wherein the communication terminal includes collation means for collating data collation information acquired from one of the first and second networks with data acquired from the other network; A reliability information DB constructing means for constructing a reliability information DB as a database of information indicating the reliability of access to resources from the collation result of the collation means, and a system using information in the reliability information DB as collation result information And a collation result information notifying unit for notifying other devices within the apparatus.

In order to achieve the above object, the present invention provides an information notification method, comprising: collating information of data from either one of a first network and a second network having lower security than the first network. A step of acquiring, a step of acquiring data from the other network of the first and second networks, and a step of comparing the verification information of the data acquired from the one network with the data acquired from the other network And a step of constructing a reliability information DB as a database of information indicating the reliability of access to the resource from the result of the collation, and other information in the system from the communication terminal as the collation result information using the information in the reliability information DB. And a verification result information notification step for notifying the other device.

In order to achieve the above object, the present invention is a communication terminal, and acquires data collation information from either one of a first network and a second network having lower security than the first network. Means for acquiring data from the other network of the first and second networks, means for verifying data verification information acquired from the one network, and data acquired from the other network; Means for constructing a reliability information DB as a database of information indicating the reliability of access to resources from the result of the verification, and information in the reliability information DB is notified to other devices in the system as verification result information And a verification result information notification means.

The present invention for achieving the above object is a program for a terminal, and the program connects the terminal to one of a first network and a second network having lower security than the first network. Means for obtaining data collation information from the network, means for obtaining data from the other network of the first and second networks, data collation information obtained from the one network, and data obtained from the other network A means for collating data, a means for constructing a reliability information DB as a database of information indicating the reliability of access to resources from the result of the collation, and a system using information in the reliability information DB as collation result information It functions as a verification result information notification means for notifying other devices within That.

According to the present invention, in the communication terminal, the collation information of the data acquired from one of the first network (high secure network) and the second network (low secure network) and the data acquired from the other network And the reliability information DB is constructed as a database of information indicating the reliability of access to the resource from the comparison result, and the information in the reliability information DB is used as the verification result information to other devices in the system. Since notification is made, it is possible to authenticate whether the network is impersonated, prevent access to the impersonated network, and notify other devices in the system of the presence of the impersonated network. Become.

It is a figure which shows the structure of one Example (Example 1) of the information notification system which concerns on this invention. FIG. 3 is a diagram for explaining Example 1-1. FIG. 10 is a diagram illustrating an example of writing information to the reliability information DB when the collation result is “match” in Example 1-1. FIG. 11 is a diagram illustrating an example of writing information to the reliability information DB when the collation result is “mismatch” in Example 1-1. It is a figure explaining Example 1-2. FIG. 10 is a diagram illustrating an example of writing information to the reliability information DB when the collation result is “match” in Example 1-2. FIG. 10 is a diagram illustrating an example of writing information to the reliability information DB when the collation result is “mismatch” in Example 1-2. It is a figure which illustrates an information notification system in case a plurality of low secure networks exist. It is a figure which shows a mode that the database of information is constructed | assembled in reliability information DB in the information notification system shown in FIG. 3 is a block diagram showing a main part of a management server on the high secure network 4. FIG. It is a figure which shows the example of writing of the information to the camouflaged network management information DB of this management server. It is a figure which shows the structure of the other Example (Example 2) of the information notification system which concerns on this invention. 10 is a flowchart illustrating processing operations in a communication terminal in the information notification system according to the second embodiment. It is a figure which shows the example of writing of the information to reliability information DB at the time of acquiring data first using a high secure network in the information notification system of Example 2. FIG. It is a figure which shows the example of writing of the information to reliability information DB when the collation result is "match" in the information notification system of Example 2. FIG. It is a figure which shows the example of writing of the information to reliability information DB when the collation result is "mismatch" in the information notification system of Example 2. FIG. It is a figure which shows the structure of the other Example (Example 3) of the information notification system which concerns on this invention. 10 is a flowchart illustrating processing operations in a communication terminal in the information notification system according to the third embodiment. It is a figure which illustrates the attribute file in the information notification system of Example 3. It is a figure which shows the specific example of the collation process in the information notification system of Example 3. FIG. It is a figure which shows the example of writing of the information to reliability information DB when the collation result is "match" in the information notification system of Example 3.

The present invention relates to a first network, a second network (low secure network) having lower security than the first network (high secure network), and communication connectable to the first and second networks. A collation unit that collates collation information of data acquired from one of the first and second networks with data acquired from the other network in a communication terminal in an information notification system including a terminal; A reliability information DB construction unit for constructing a reliability information DB as a database of information indicating the reliability of access to resources from the collation result of the collation unit, and other information in the system using the information in the reliability information DB as collation result information And a verification result information notifying unit for notifying to other devices.

In the present invention, in the communication terminal, the collation information of the data acquired from one of the first network (high secure network) and the second network (low secure network) and the data acquired from the other network are Matched. Then, the reliability information DB is constructed as a database of information indicating the reliability of access to the resource from the collation information of the data and the collation result of the data, and the information in the reliability information DB is used as the collation result information. Notify other devices in In the present invention, “data” refers to a general term for data acquired by a communication terminal via a network, such as an application or content.

For example, as a first example, in the present invention, comparison information of data acquired from a high secure network is compared with verification information generated from data acquired from a low secure network. Judge that data obtained from a low-secure network is reliable. If they do not match, it is determined that the data acquired from the low secure network is not reliable.

Here, being able to trust data means that it is data obtained from a server that is not spoofed (trusted server), that is, data obtained from a network that is not impersonated. “Unreliable data” means data acquired from a spoofed server (untrusted server), that is, data acquired from a spoofed network.

In the above, if the two do not match, for example, as information indicating the reliability of access to the low secure network, the identifier of the low secure network and the information indicating whether or not the connection is possible (in this case, information indicating “not connectable”) Are stored in the reliability information DB. Further, the data acquired from the low secure network is discarded, and the identifier of the low secure network and the identifier of the data acquired from the low secure network are associated with each other and stored in the reliability information DB. In addition, the pair of the identifier of the low secure network and the identifier of the data in the information in the reliability information DB is notified to other devices in the system as collation result information.

This makes it possible to prohibit access to the camouflaged low secure network by referring to the information in the reliability information DB in the communication terminal. In addition, other devices can receive the notification of the verification result information from the communication terminal and know the presence of the camouflaged low secure network. Further, it becomes possible to know data that may be falsified in the network.

In the first example, when the collation result is “mismatch”, it is conceivable to store the data acquired from the low secure network in the communication terminal. In this case, since the stored data is not reliable, use in the high secure network or the low secure network is prohibited.

As a second example, in the present invention, the collation information of the data acquired from the low secure network is compared with the collation information generated from the data acquired from the high secure network. Judge that the verification information obtained from the low-secure network is reliable. If the two do not match, it is determined that the collation information acquired from the low secure network is not reliable.

Here, being able to trust the collation information means that it is collation information acquired from a server that is not spoofed (trusted), that is, collation information acquired from a network that is not impersonated. The fact that the verification information is not reliable means that the verification information is acquired from the camouflaged network.

In the above, if the two do not match, for example, as information indicating the reliability of access to the low secure network (resource), the low secure network identifier and the connectability information (in this case, “not connectable” Are stored in the reliability information DB. Further, as information indicating the reliability of access to the data (resource) acquired from the high secure network, the identifier of the data and the identifier of the high secure network are stored in the reliability information DB. Further, the identifier of the low secure network and the identifier of the data acquired from the high secure network are associated with each other and stored in the reliability information DB. In addition, the pair of the identifier of the low secure network and the identifier of the data in the information in the reliability information DB is notified to other devices in the system as collation result information.

This makes it possible to prohibit access to the camouflaged low secure network by referring to the information in the reliability information DB in the communication terminal. In addition, access to data downloaded via the high secure network can be permitted when connected to the high secure network, thereby enabling use of data in the high secure network. In addition, other devices can receive the notification of the verification result information from the communication terminal and know the presence of the camouflaged low secure network. In addition, it is possible to know data in which the collation information may be falsified in the network.

In the present invention, for example, a hash value can be used as the data collation information. In the present invention, data is acquired from each of the first and second networks, collation information such as a hash value is generated from the data acquired from the first and second networks, and the generated collation information is You may make it compare. Such a collation method is also included in the category of the present invention. Further, in the present invention, the collation result information for other devices may not necessarily be a pair of the identifier of the low secure network and the identifier of the data, and the identifier of the low secure network may be the collation result information.

In the present invention, as other devices in the system, a management server on the highly secure network, another communication terminal in the system, a server to be impersonated in the system traced from the highly secure network, and an access point on the disguised network It is conceivable to notify the verification result information to the terminal of the administrator of the system.

Also, a camouflaged network management information DB constructing unit that constructs a database of verification result information notified from the communication terminal as a camouflaged network management information DB to a management server on the highly secure network, and information in the camouflaged network management information DB A camouflaged network management information notification unit for notifying other devices in the system may be provided. In this case, as other devices in the system, a camouflaged network management information DB is installed in a communication terminal in the system, a camouflaged server in the system traced from a highly secure network, a terminal of an administrator of an access point on the camouflaged network, etc. It is conceivable to notify the information inside.

Hereinafter, the details of the present invention will be described in detail with reference to the drawings.
[Example 1]
FIG. 1 is a diagram showing the configuration of an embodiment of an information notification system according to the present invention. In the figure, 1 is a communication terminal and 2 is a download server.

The communication terminal 1 includes a communication control unit 11, a collation unit 12, a reliability information DB 13, a reliability information DB construction unit 14, a storage unit 15, and a data access unit 16. The download server (hereinafter referred to as a server) 2 has data 21 such as applications and contents, and collation information (for example, hash value) 22 of the data 21.

The server 2 is connected to the high secure network 3 and the low secure network 4, and the communication terminal 1 uses at least one of the high secure network 3 and the low secure network 4 via the communication control unit 11. Access to the server 2 is possible. A management server 5 is provided in the highly secure network 3.

There are various types of networks, but there are two types: a high secure network 3 and a low secure network 4 that is less secure than the high secure network 3.

The highly secure network 3 is a network whose security is ensured to some extent, such as an IP network of a cellular network operator or an in-house LAN. In these networks, servers existing inside the network, such as DNS servers and proxy servers, may be considered reliable. On the other hand, the low secure network 4 includes a free wireless LAN spot. In such a network, the servers in the network are considered to be unreliable. For example, it is easy to install a free wireless LAN spot in which a malicious person has installed a DNS server that intentionally misrepresents a DNS name.

In the system according to the first embodiment, the communication control unit 11 of the communication terminal 1 acquires the collation information 22 from the server 2 through one of the high secure network 3 and the low cure network 4 and transmits data through the other network. 21 is acquired. The collation unit 12 of the communication terminal 1 collates the acquired collation information 22 with the data 21.

Hereinafter, a case in which the verification information 22 is acquired through the high secure network 3 and the data 21 is acquired through the low secure network 4 is referred to as Example 1-1. A case where the data 21 is acquired through the high secure network 3 and the collation information 22 is acquired through the low secure network 4 is referred to as Example 1-2. Each case will be described.

Example 1-1
Example 1-1 will be described with reference to FIG. The communication control unit 11 of the communication terminal 1 acquires the verification information 22 through the high secure network 3 and acquires the data 21 through the low secure network 4. The communication control unit 11 acquires the collation information 22 and the data 21 at the same time. That is, when the collation information 22 is obtained first, the data 21 is obtained immediately after the collation information 22 is obtained.

In the communication terminal 1, the collation unit 12 collates the collation information acquired through the high secure network 3, in this example, the hash value 22 and the data 21 acquired through the low secure network 4. In this case, a hash value is generated from the data 21 acquired through the low secure network 4, and the hash value is compared with the collation information (hash value) 22 acquired through the high secure network 3.

The collation unit 12 determines that the data 21 acquired from the low secure network 4 is reliable when the collation result is “match”. In the case of “mismatch”, it is determined that the data 21 acquired from the low secure network 4 is not reliable.

Here, that the data can be trusted means that the data 21 is obtained from the server 2 that is not spoofed, that is, the data 21 that is obtained from the low-secure network 4 that is not impersonated. “Unreliable data” means that the data 21 ′ is obtained from the spoofed server 2 ′, that is, the data 21 ′ obtained from the camouflaged low secure network 4.

In addition, when the collation result is “match”, the collation unit 12 stores the data 21 acquired from the low secure network 4 in the storage unit 15. If the collation result is “mismatch”, the data 21 ′ acquired from the low secure network 4 is not reliable and is discarded without being stored in the storage unit 15.

[If the matching result is "match"]
The collation result in the collation unit 12 is sent to the reliability information DB construction unit 14. When the collation result in the collation unit 12 is “match”, the reliability information DB construction unit 14 uses the data 21 acquired from the low secure network 4 as a resource. As information indicating the reliability of access to this resource, the identifier of the data (data identifier), the identifier of the network used to acquire the collation information of the data (NW identifier), and the network used to acquire the data Is associated with the identifier (NW identifier) in the table TB1 in the reliability information DB 13. In this example, the data identifier #DA of the data 21, the NW identifier HNW of the high secure network 3, and the NW identifier LNW of the low secure network 4 are written as a pair in the table TB1 in the reliability information DB 13. An example is shown in TB1 of FIG.

Also, the reliability information DB construction unit 14 uses the low secure network 4 as a resource when the collation result in the collation unit 12 is “match”. Then, as information indicating the reliability of access to the resource, the correspondence between the identifier of the low secure network 4 and the information on whether or not connection is possible is written in the table TB2 in the reliability information DB13. In this example, the NW identifier LNW of the low secure network 4 and the information (“◯”) indicating that connection is possible are paired and written in the table TB2. An example is shown in TB2 of FIG.

[Access to data]
The data access unit 16 is downloaded via the low secure network 4 when connected to the high secure network 3 and when connected to the low secure network 4 by referring to the table TB1 in the reliability information DB 13. Access to the data 21 in the storage unit 15 is permitted.

[Access to the network]
The communication control unit 11 permits access to the low secure network 4 by referring to the table TB2 in the reliability information DB 13. Note that the highly secure network 3 is considered to be highly reliable, and access to the network is always permitted without referring to the information in the reliability information DB 13.

In this way, in Example 1-1, the communication terminal 1 is authenticated when the collation result in the collation unit 12 is “match”, that is, when it is authenticated that the low secure network 4 is not impersonated. It becomes possible to access any of the high secure network 3 and the low secure network 4. Further, the data 21 in the storage unit 15 can be accessed when connected to any network, and the use of the data 21 in both the high secure network 3 and the low secure network 4 can be maintained while maintaining security. It becomes possible.

[If the verification result is "Disagree"]
The collation result in the collation unit 12 is sent to the reliability information DB construction unit 14. When the collation result in the collation unit 12 is “mismatch”, the reliability information DB construction unit 14 does not have an identifier (data identifier) of the data 21 ′ acquired from the low secure network 4 and a usable network. Is written in the table TB1 in the reliability information DB 13. In this example, the data identifier #DA of the data 21 ′ is associated with the information (“−”) indicating that there is no usable network and written in the table TB1 in the reliability information DB 13. An example is shown in TB1 of FIG.

Further, when the collation result in the collation unit 12 is “mismatch”, the reliability information DB construction unit 14 uses the low secure network 4 as a resource, and uses low secure network as information indicating the reliability of access to this resource. The association between the identifier of the network 4 and the information indicating whether or not connection is possible is written in the table TB2 in the reliability information DB 13. In this example, the NW identifier LNW of the low secure network 4 and the information (“×”) indicating that the connection is impossible are paired and written in the table TB2. An example is shown in TB2 of FIG.

Further, the reliability information DB construction unit 14 associates the identifier of the low secure network 4 with the identifier of the data 21 ′ acquired from the low secure network 4 when the collation result in the collation unit 12 is “mismatch”. Is written in the table TB3 in the reliability information DB13. In this example, the NW identifier LNW and the data identifier #DA of the low secure network 4 are written in the table TB3 as a pair. An example is shown in TB3 of FIG.

[Access to the network]
The communication control unit 11 prohibits access to the low secure network 4 by referring to the table TB2 in the reliability information DB 13. Note that the highly secure network 3 is considered to be highly reliable, and access to the network is always permitted without referring to the information in the reliability information DB 13.

[Notification to Management Server]
When the pair of the low secure network identifier LNW and the data identifier #DA is written in the table TB3 in the reliability information DB 13, the communication control unit 11 newly writes the low secure network identifier LNW and the data identifier #DA. The management server 5 of the highly secure network 3 is notified as the matching result information 17.

In this way, in Example 1-1, when the collation result in the collation unit 12 of the communication terminal 1 is “mismatch”, that is, when it is authenticated that the low secure network 4 is camouflaged, Access to the camouflaged low secure network 4 is prohibited. Thereby, access to the highly secure network 4 is permitted, and security is ensured.

Further, in the embodiment 1-1, the management server 5 can know the presence of the camouflaged low secure network 4 from the collation result information 17 notified from the communication terminal 1. In addition, it is possible to know that the data 21 with the data identifier #DA may be tampered with in the network.

In the above description, when the collation result in the collation unit 12 is “mismatch”, the data 21 ′ acquired from the low secure network 4 is discarded, but the data 21 ′ acquired from the low secure network 4 is discarded. May be stored in the storage unit 15. In this case, the data 21 'is not reliable, but the data 21' can be examined later by storing it in the storage unit 15 of the communication terminal 1. When the data 21 ′ is stored in the storage unit 15, by referring to the table TB1 (FIG. 4) in the reliability information DB 13, the high secure network 3 and the low secure network 4 of the data 21 ′ are stored. The use of is prohibited.

[Example 1-2]
Example 1-2 will be described with reference to FIG. The communication control unit 11 of the communication terminal 1 acquires data 21 through the high secure network 3 and acquires verification information 22 through the low secure network 4. The communication control unit 11 acquires the collation information 22 and the data 21 at the same time. That is, when the data 21 is acquired first, the verification information 22 is acquired immediately after the data 21 is acquired.

In the communication terminal 1, the collation unit 12 collates the collation information (in this example, a hash value) 22 acquired through the low secure network 4 and the data 21 acquired through the high secure network 3. In this case, a hash value is generated from the data 21 acquired through the high secure network 3, and the hash value is compared with the collation information 22 (hash value) acquired through the low secure network 4.

When the collation result is “match”, the collation unit 12 determines that the collation information 22 acquired from the low secure network 4 is reliable. When it is “mismatch”, it is determined that the collation information 22 acquired from the low secure network 4 is not reliable.

Here, the fact that the collation information is reliable means that the collation information 22 acquired from the server 2 that is not spoofed, that is, the collation information 22 acquired from the low-secure network 4 that is not impersonated. The fact that the collation information cannot be trusted means that the collation information 22 ′ acquired from the server 2 ′ being spoofed, that is, the collation information 22 ′ acquired from the camouflaged low secure network 4.

In this case, the collation unit 12 stores the data 21 acquired from the high secure network 3 in the storage unit 15 regardless of “match” / “mismatch” of the collation result. That is, since the high secure network 3 has high reliability, the data 21 acquired from the high secure network 3 is stored in the storage unit 15 even when the collation result in the collation unit 12 is “mismatch”. .

[If the matching result is "match"]
The collation result in the collation unit 12 is sent to the reliability information DB construction unit 14. When the collation result in the collation unit 12 is “match”, the reliability information DB construction unit 14 uses the data 21 acquired from the high secure network 3 as a resource. As information indicating the reliability of access to this resource, the identifier of the data (data identifier), the identifier of the network used to acquire the collation information of the data (NW identifier), and the network used to acquire the data Is associated with the identifier (NW identifier) in the table TB1 in the reliability information DB 13. In this example, the data identifier #DA of the data 21, the NW identifier HNW of the high secure network 3, and the NW identifier LNW of the low secure network 4 are written as a pair in the table TB1 in the reliability information DB 13. An example is shown in FIG.

Further, when the collation result in the collation unit 12 is “match”, the reliability information DB construction unit 14 uses the low secure network 4 as a resource, and uses low secure network as information indicating the reliability of access to this resource. The association between the identifier of the network 4 and the information indicating whether or not connection is possible is written in the table TB2 in the reliability information DB 13. In this example, the NW identifier LNW of the low secure network 4 and the information (“◯”) indicating that connection is possible are paired and written in the table TB2. An example is shown in FIG.

[Access to data]
The data access unit 16 is downloaded via the high secure network 3 when connected to the high secure network 3 and when connected to the low secure network 4 by referring to the table TB1 in the reliability information DB 13. Access to the data 21 in the storage unit 15 is permitted.

[Access to the network]
The communication control unit 11 permits access to the low secure network 4 by referring to the table TB2 in the reliability information DB 13. In this case, it is assumed that the highly secure network 3 has high reliability, and access to the network is always permitted without referring to the information in the reliability information DB 13.

In this way, in Example 1-2, the communication terminal 1 is authenticated when the collation result in the collation unit 12 is “match”, that is, when it is authenticated that the low secure network 4 is not impersonated. It becomes possible to access any of the high secure network 3 and the low secure network 4. Further, the data 21 in the storage unit 15 can be accessed when connected to any network, and the use of the data 21 in both the high secure network 3 and the low secure network 4 can be maintained while maintaining security. It becomes possible.

[If the verification result is "Disagree"]
The collation result in the collation unit 12 is sent to the reliability information DB construction unit 14. When the collation result in the collation unit 12 is “mismatch”, the reliability information DB construction unit 14 uses the data 21 acquired from the high secure network 3 as a resource, and indicates information indicating the reliability of access to this resource. The correspondence between the identifier of the data (data identifier) and the identifier of the network (NW identifier) used to acquire the data is written in the table TB1 in the reliability information DB 13. In this example, the data identifier #DA of the data 21 and the NW identifier HNW of the high secure network 3 used to acquire the data 21 are associated and written to the table TB1 in the reliability information DB 13. An example is shown in FIG.

Further, when the collation result in the collation unit 12 is “mismatch”, the reliability information DB construction unit 14 uses the low secure network 4 as a resource, and uses low secure network as information indicating the reliability of access to this resource. The association between the identifier of the network 4 and the information indicating whether or not connection is possible is written in the table TB2 in the reliability information DB 13. In this example, the NW identifier LNW of the low secure network 4 and the information (“×”) indicating that the connection is impossible are paired and written in the table TB2. An example is shown in FIG.

Further, the reliability information DB construction unit 14 associates the identifier of the low secure network 4 with the identifier of the data 21 acquired from the high secure network 3 when the collation result in the collation unit 12 is “mismatch”. It writes in table TB3 in reliability information DB13. In this example, the NW identifier LNW and the data identifier #DA of the low secure network 4 are written in the table TB3 as a pair. An example is shown in FIG.

[Access to data]
The data access unit 16 refers to the table TB1 in the reliability information DB 13 to access the data 21 in the storage unit 15 downloaded via the high secure network 3 when connected to the high secure network 3. Allow access.

[Access to the network]
The communication control unit 11 prohibits access to the low secure network 4 by referring to the table TB2 in the reliability information DB 13. In this case, it is assumed that the highly secure network 3 has high reliability, and access to the network is always permitted without referring to the information in the reliability information DB 13.

[Notification to Management Server]
When the pair of the low secure network identifier LNW and the data identifier #DA is written in the table TB3 in the reliability information DB 13, the communication control unit 11 newly writes the low secure network identifier LNW and the data identifier #. A pair with DA is notified to the management server 5 of the highly secure network 3 as the matching result information 17.

In this way, in Example 1-2, when the collation result in the collation unit 12 is “mismatch”, that is, when it is authenticated that the low secure network 4 is impersonated, the impersonated low Access to the secure network 4 is prohibited. Thereby, access to the highly secure network 3 is permitted and security is ensured. In addition, access to the data 21 in the storage unit 15 is permitted when connected to the high secure network 3, and the data 21 can be used in the high secure network 3.

Further, in the embodiment 1-2, the management server 5 can know the presence of the camouflaged low secure network 4 from the collation result information 17 notified from the communication terminal 1. Further, it is possible to know that the collation information 22 of the data identifier #DA 21 may be falsified in the network.

In the above-described embodiments 1-1 and 1-2, the access to the high secure network 3 is always permitted without referring to the information in the reliability information DB 13, but the low secure network 4 and Similarly, the high secure network 3 is also written in the table TB2 as a pair with the NW identifier HNW and information (“◯”) indicating that connection is possible, and by referring to this table TB2, You may make it judge whether access is possible.

In the above-described embodiment 1-2, the acquisition of the data 21 through the high secure network 3 and the acquisition of the collation information 22 through the low secure network 4 are performed simultaneously. Is stored in the storage unit 15, and when the communication terminal 1 enters the communication range of the low secure network 4, the verification information 22 is acquired through the low secure network 4, and the acquired verification information 22 and the storage unit 15 are stored. You may make it collate with the data 21 preserve | saved.

Further, in the above-described embodiments 1-1 and 1-2, the example in which the number of the low secure networks 4 is one has been described. However, there are actually a plurality of low secure networks 4. FIG. 8 shows a case where there are three low secure networks 4-1, 4-2 and 4-3 as an example.

In the system shown in FIG. 8, for example, when the embodiment 1-1 is adopted, a reliability information database is constructed in the reliability information DB 13 of the communication terminal 1 as follows.

In FIG. 8, the NW identifier of the low secure network 4-1 is LNW1, the NW identifier of the low secure network 4-2 is LNW2, and the NW identifier of the low secure network 4-3 is LNW3. Further, the server 2 has data 21-1, 21-2, 21-3 such as applications and contents, and the collation information 22-1 as the hash value of the data 21-1, 21-2, 21-3. 22-2 and 22-3. The data identifier of the data 21-1 is #DA, the data identifier of the data 21-2 is #DB, and the data identifier of the data 21-3 is #DC.

In this case, the communication terminal 1 obtains the collation information 22-1 through the high secure network 3, obtains the data 21-1 through the low secure network 4-1, and the obtained collation information 22-1 and data 21-1 And match.

Here, when the collation result is “match”, it is determined that the data 21-1 acquired from the low secure network 4-1 is reliable, and is associated with the data identifier #DA of the data 21-1. The NW identifier HNW of the high secure network 3 and the NW identifier LNW1 of the low secure network 4-1 are written in the table TB1 in the reliability information DB 13. Further, the NW identifier LNW1 of the low secure network 4-1 and the information (“◯”) indicating that connection is possible are paired and written in the table TB2. An example of these is shown in FIG.

Next, the collation information 22-2 is obtained through the high secure network 3, the data 21-2 is obtained through the low secure network 4-2, and the obtained collation information 22-2 and the data 21-2 are collated.

Here, when the collation result is “mismatch”, it is determined that the data 21-2 acquired from the low secure network 4-2 is not reliable, and is used in association with the data identifier #DB of the data 21-2. Information (“-”) indicating that there is no possible network is written in the table TB1 in the reliability information DB 13. Further, the NW identifier LNW2 of the low secure network 4-2 and the information (“×”) indicating that connection is not possible are written in the table TB2 as a pair. In addition, the NW identifier LNW2 of the low secure network 4-2, which cannot be connected, and the data identifier #DB of the data 21-2 are written in the table TB3 as a pair. An example of these is shown in FIG.

Next, collation information 22-3 is obtained through the high secure network 3, data 21-3 is obtained through the low secure network 4-2, and the obtained collation information 22-3 and data 21-3 are collated.

Here, when the collation result is “mismatch”, it is determined that the data 21-3 acquired from the low secure network 4-3 is not reliable, and is used in association with the data identifier #DC of the data 21-3. Information (“-”) indicating that there is no possible network is written in the table TB1 in the reliability information DB 13. Further, the NW identifier LNW3 of the low secure network 4-3 and the information (“×”) indicating that the connection is impossible are paired and written in the table TB2. In addition, the NW identifier LNW3 of the low secure network 4-3 that cannot be connected and the data identifier #DC of the data 21-3 are written in the table TB3 as a pair. An example of these is shown in FIG.

As described above, according to this system, an attack on a server on a highly secure network can be prevented. This is because by downloading data and verification information from a plurality of networks and performing verification processing, it is understood that the data is not malicious data on the camouflaged server.

The reason is
1) Since the server can be reached from multiple networks, the server is the same and placed on the Internet.
Or
2) Although the server is camouflaged, it is understood that the data is not malicious because the data has not been tampered with. This can prevent the highly secure network from being attacked by malicious data on the low secure network.

In addition, according to this system, it is possible to prevent access to a network in which DNS is spoofed. This is because it is determined whether or not access to the network is possible by using the reliability information in the reliability information DB.

Also, according to this system, the server installation cost can be reduced. Up to now, when installing a reliable server, it was costly to acquire a certificate. However, in this system, it is possible to improve the security level by only storing the collation information on the server side, without requiring other preparations.

Further, according to this system, the communication terminal 1 authenticates whether or not the network is camouflaged, prevents access to the camouflaged network, and manages the presence of the camouflaged network in the highly secure network 3. 5 can be notified. This is because the information in the reliability information DB is notified to the management server 5 as the collation result information 17. Thereby, the management server 5 can grasp | ascertain the network by which the collation process became inconsistent, ie, the camouflaged network.

In the first embodiment described above, the verification result information 17 is notified to the management server 5 in the high secure network 3. However, as other devices in the system, other communication terminals 1 in the system, high secure network The verification result information 17 may be notified to the server to be camouflaged (server 2) in the system traced from 3 and the terminal of the manager of the access point on the camouflaged network.

When notifying the other communication terminal 1 of the verification result information 17, the other communication terminal 1 can grasp the network camouflaged in advance and can prevent access to the camouflaged network. Further, when the verification result information 17 is notified to the server to be camouflaged, it can be known that the user is camouflaged. Further, when notifying the collation result information 17 to the terminal of the access point manager, the manager of the access point can know that the access point is being used. As a result, it can be expected that the administrator of the access point takes measures such as strengthening the encryption of the access point.

Further, when the verification result information 17 is notified to another communication terminal 1, the other communication terminal 1 that has received the notification of the verification result information 17 is within the communication range of the camouflaged network identified from the notified verification result information 17. When entering, an icon indicating that the display is camouflaged may be displayed. When another communication terminal 1 that has received the notification of the verification result information 17 attempts to connect to the camouflaged network (spoofing server) specified from the notified verification result information 17, “this network (server ) May have a security problem and may be fraudulent, is it OK? "

Further, when the verification result information 17 is notified to the access point manager's terminal, when there is an access request from the communication terminal 1 at the access point manager's terminal that has received the verification result information 17, the communication is performed. It is determined whether the communication destination of the terminal 1 is a camouflaged network (fake data identifier or camouflaged server) identified from the collation result information 17 notified. As a result of the determination, if the network is a camouflaged network, the access request from the communication terminal 1 may be blocked so that the path ahead is not blocked. Thereby, even if the communication terminal 1 does not know the information of the camouflaged network, it can be prevented on the access point side.

When notifying the verification result information 17 to the management server 5, as shown in FIG. 10, impersonation for constructing the database of the verification result information 17 notified from the communication terminal 1 as the camouflaged network management information DB 51. You may make it provide the network management information DB construction part 52 and the camouflaged network management information notification part 53 which notifies the information in the camouflage network management information DB51 to the other apparatus in a system.

In this case, the camouflaged network management information DB construction unit 52 receives the notification of the collation result information 17 from each communication terminal 1 in the system, and stores the NW identifier of the camouflaged network of the entire system in the network management information DB 51. A table TB4 indicating the relationship with the data identifier of data that may have been tampered with is created. FIG. 11 shows an example of this.

The management server 5 stores the contents of the table TB4 of the camouflaged network management information DB 51 from the communication terminal 1 in the system, the impersonated server (server 2) in the system that can be traced from the highly secure network 3, and the access points on the camouflaged network. Notify the administrator's terminal.

When the contents of the table TB4 of the camouflaged network management information DB51 are notified from the management server 5 to the communication terminal 1 in the system, the camouflaged network management is performed in the communication terminal 1 that has received the notification of the contents of the table TB4 of the camouflaged network management information DB51. When entering the communication range of the camouflaged network specified from the contents of the table TB4 of the information DB 51, an icon indicating that the camouflage is camouflaged may be displayed on the display. In addition, when the communication terminal 1 that has received the notification of the contents of the table TB4 of the camouflaged network management information DB 51 attempts to connect to the camouflaged network identified from the contents of the notified table TB4 of the camouflaged network management information DB 51. , A dialog like "Is this network a security problem and might be fraudulent? Are you sure?" May be displayed.

When notifying the contents of the table TB4 of the camouflaged network management information DB 51 from the management server 5 to the terminal of the access point manager, the terminal of the manager of the access point that has received notification of the contents of the table TB4 of the camouflaged network management information DB 51 When there is an access request from the communication terminal 1, a camouflaged network (fake data identifier or camouflaged server) identified from the contents of the table TB4 of the camouflaged network management information DB 51 notified of the communication destination of the communication terminal 1 If it is a camouflaged network, the access request from the communication terminal 1 may be blocked to close the path ahead and prevent the connection. Thereby, even if the communication terminal 1 does not know the information of the camouflaged network, it can be prevented on the access point side.

In addition, the information in the camouflaged network management information DB 51 is not notified from the management server 5, but the manager of the camouflaged network management information DB 51 from another communication terminal 1, the server to be camouflaged (server 2), the access point, or the like. Information may be referred to. Thereby, the information of the camouflaged network can be shared.

In the first embodiment described above, the verification result information 17 is notified to the management server 5 when there is a mismatch in the verification process. However, the present invention is not limited to this. That is, it is conceivable to notify the matched information as the matching result information 17. In this case, the management server 5 can grasp a correct network that is not camouflaged.

In the first embodiment described above, a pair of the low secure network identifier and the data identifier is sent as the verification result information 17 to the management server 5, but the low secure network identifier is sent as verification result information. Also good.

In the embodiment 1-1, the verification information 22 is acquired through the high secure network 3, and in the embodiment 1-2, the verification information 22 is acquired through the low secure network 4. However, the data 21 is acquired from each of the high secure network 3 and the low secure network 4, the hash value is generated from each data 21 acquired from the high secure network 3 and the low secure network 4, and the generated hash values are compared. (Hash comparison) may be performed. In this case, the hash comparison is not necessarily performed, and a binary comparison for comparing the binary values of the acquired data 21 may be used. Such a case will be described below as Example 1-3.

[Example 2: Example 1-3 was adopted]
FIG. 12 is a diagram showing the configuration of another embodiment (embodiment 2) of the information notification system according to the present invention. In the second embodiment, the communication terminal 1 is assumed to be 1A in order to distinguish it from the communication terminal used in the information notification system of the third embodiment described later.

The communication terminal 1A includes a communication control unit 11, a collation unit 12, a reliability information DB 13, a reliability information DB construction unit 14, a storage unit 15, and a data access unit 16.

In the information notification system according to the second embodiment, the communication control unit 11 of the communication terminal 1A is a control unit that performs communication by connecting to a network, and includes an NW identification unit 111 and a communication unit 112.

The NW identification unit 111 identifies a connected network. In FIG. 12, it is determined whether it is connected to the high secure network 3 or the low secure network 4. For example, in the case of 3G wireless, the connected network name is determined, and in the case of wireless LAN, the connected network is determined by the BSSID and ESSID of the connected access point.

The communication unit 112 acquires data such as applications and contents from the server 2 via either the high secure network 3 or the low secure network 4. For example, 3G wireless, Ethernet (registered trademark), wireless LAN (IEEE802.11), Bluetooth (registered trademark), and the like can be given.

Further, the communication unit 112 has a function of passing the acquired data to the verification unit 12 together with the identifier (data identifier) and the network identifier (NW identifier). The data identifier includes a URL, for example, and can be represented by “http://foo.bar.com/sample.exe”. Furthermore, the communication unit 112 has a function of determining whether or not access is possible by referring to reliability information in the reliability information DB 13 when the communication terminal 1 accesses the network.

The communication unit 112 also notifies the management server 5 on the high secure network 3 of the information in the reliability information DB 13 as the verification result information 17 when the verification result in the verification unit 12 is “mismatch”. have. The function of the communication unit 112 corresponds to the verification result information notification unit referred to in the present invention.

The collation unit 12 collates data based on the data, data identifier, and NW identifier passed from the communication unit 112. Specifically, it is checked whether or not it matches the data already downloaded, and the information in the reliability information DB 13 is updated via the reliability information DB construction unit 14 according to the result of the check.

The storage unit 15 stores the acquired data. When the data 21 is downloaded from the server 2 and the data does not exist in the communication terminal 1, the verification unit 12 regards the data as being downloaded for the first time and stores the data in the storage unit 15.

As the reliability information, the reliability information DB 13 associates the data identifier with the NW identifier (table TB1), associates the NW identifier with the connectability information (table TB2), and associates the NW identifier with the data identifier (table TB3). ).

The reliability information DB construction unit 14 updates the contents of the tables TB1, TB2, and TB3 in the reliability information DB 13 based on the data identifier, NW identifier, and verification result information passed from the verification unit 12.

When there is a data access request from the user or application of the communication terminal 1, the data access unit 16 refers to the NW identifier (obtained from the NW identification unit 111) of the currently connected network and the information in the reliability information DB 13. By doing so, it has a function of determining whether or not access to data stored in the storage unit 15 is possible.

[Download data]
Next, the operation when the user downloads the data 21 from the server 2 using the communication terminal 1A will be described with reference to the flowchart shown in FIG.

The communication terminal 1A uses the communication unit 112 to acquire data 21 from the server 2 (step S101). At this time, the communication unit 112 acquires the NW identifier from the NW identification unit 111. That is, the network NW identifier used to acquire the data 21 is acquired. Then, the communication unit 112 passes the acquired data, the identifier of the data, and the network NW identifier used to acquire the data to the verification unit 12.

The collation unit 12 searches the storage unit 15 and the reliability information DB 13 to check whether data having the same data identifier already exists (S102). When data 21 is first acquired, information corresponding to the data identifier of the data 21 is not yet stored in the storage unit 15 and the reliability information DB 13.

In this case, in accordance with NO in step S103, the collation unit 12 stores the data 21 in the storage unit 15 (step S104). Further, the association between the data identifier and the NW identifier is written to the table TB1 in the reliability information DB 13 via the reliability information DB construction unit 14 (step S105). If the NW identifier is an identifier of the low secure network, the association between the NW identifier and the connection availability information is written in the table TB2 in the reliability information DB 13 via the reliability information DB construction unit 14. (Step S106).

In this example, it is assumed that data 21 is first acquired using the high secure network 3. In this case, as shown in FIG. 14, the NW identifier HNW of the high secure network 3 is written in the table TB1 in the reliability information DB 13 in association with the data identifier #DA of the data 21.

• When data is downloaded for the first time, associating it with a network indicates that the data may be operated using the “used for downloading” network. In other words, the data operation is restricted (communication refused, etc.) while connected to a network other than the network used for downloading.

Next, the case where the same data (those with the same data identifier) are downloaded for the second time or later will be described. In this example, it is assumed that the same data (having the same data identifier) is acquired using the low secure network 4. Also in this case, the communication unit 112 delivers the data, the data identifier, and the NW identifier to the verification unit 12.

The collation unit 12 searches the storage unit 15 and the reliability information DB 13 to check whether data having the same data identifier already exists (step S102). Since this is the second download, data with the same data identifier is found.

In response to YES in step S103, the collation unit 12 collates whether the data having the same data identifier stored in the storage unit 15 (data downloaded last time) and the data acquired this time are the same (step) S107). For example, various collation methods such as a hash comparison for comparing the hash values of the data and a binary comparison for comparing the binary values of the data can be considered.

This is nothing more than collating the previously downloaded data with the data acquired this time. That is, the data acquired from the high secure network 3 is compared with the data acquired from the low secure network 4.

In this collation, if they completely match (YES in step S108), it can be guaranteed that the data acquired this time is exactly the same as the data acquired last time. In other words, it can be said that the same data is acquired from the same server as the previously acquired server.

In this case, the collation unit 12 trusts the association between the data identifier #DA of the data 21 acquired this time and the network NW identifier LNW used to acquire the data 21 via the reliability information DB construction unit 14. The information is added to the table TB1 of the degree information DB (step S105). Further, the association between the NW identifier LNW of the low secure work 4 and the information indicating that the connection is possible (“◯”) is written to the table TB2 in the reliability information DB 13 via the reliability information DB construction unit 14 (step S2). S106). FIG. 15 shows an example of the table.

If the acquired data does not match (NO in step S108), the data 21 'acquired this time is discarded (step S109). Further, the association between the NW identifier LNW of the low secure network 4 and the information indicating that connection is not possible (“×”) is written to the table TB2 in the reliability information DB 13 via the reliability information DB construction unit 14 (step S2). S110). FIG. 16 shows an example of the table.

Further, the association between the NW identifier LNW of the low secure network 4 that is not connectable via the reliability information DB constructing unit 14 and the data identifier #DA of the data 21 ′ acquired via the low secure network 4 is performed. The data is written in the table TB3 in the reliability information DB 13 (step S111. Then, the pair of the NW identifier LNW and the data identifier #DA of the low secure network 4 newly written in the table TB3 is used as the collation result information 17, and the high secure network 3 (step S112), an example of a table is shown in FIG.

[Access to downloaded data]
Next, processing when accessing data downloaded in the storage unit 15 of the communication terminal 1 will be described. Now, it is assumed that the user or application of the communication terminal 1 has requested access to the data 21 in the storage unit 15.

At this time, the data access unit 16 searches the reliability information DB 13 using the data identifier #DA of the request destination data 21 and the NW identifier acquired from the NW identification unit 111 and is stored in the storage unit 15. It is determined whether or not the data 21 can be accessed.

For example, assume that the contents of the table TB1 in the reliability information DB 13 are in a state as shown in FIG. In this case, since the data identifier #DA and the NW identifier HNW / LNW are associated with each other in the table TB1 in the reliability information DB 13, the data access unit 16 is connected to the high secure network 3 and has a low secure state. When connecting to the network 4, access to the data 21 in the storage unit 15 is permitted.

On the other hand, when the content of the table TB1 in the reliability information DB 13 is in a state as shown in FIG. 16, for example, the data access unit 16 uses the data identifier #DA in the table TB1 in the reliability information DB 13. Since only the NW identifier HNW is associated, access to the data 21 in the storage unit 15 is permitted only when connected to the highly secure network 3.

[Access to the network]
Next, processing when the communication terminal 1 connects to the network will be described. When connecting to the network, the communication unit 112 acquires the NW identifier from the NW identification unit 111. Then, the reliability information DB 13 is searched using the acquired NW identifier to determine whether or not access to the network is possible.

For example, assume that the contents of the table TB2 in the reliability information DB 13 are in a state as shown in FIG. In this case, since the communication unit 112 associates the NW identifier LNW with the information indicating that connection is possible (“◯”) in the table TB2 in the reliability information DB 13, the communication unit 112 accesses the low secure network 4. to approve.

On the other hand, when the content of the table TB2 in the reliability information DB 13 is in a state as shown in FIG. 16, for example, the communication unit 112 determines that the connection with the NW identifier LNW is impossible in the table TB2 in the reliability information DB 13. Since the indicated information (“x”) is associated, access to the low secure network 4 is not permitted.

[Example 3: Example 1-1 was adopted]
Next, Example 3 will be described in detail with reference to the drawings. In the second embodiment, when the data is downloaded, the storage unit 15 and the reliability information DB 13 are searched, and when data having the same data identifier exists, it is determined whether or not the data is the same in step S108 of FIG. On the other hand, in the third embodiment, a part of the data is downloaded from a different network and collated to determine the same data.

FIG. 17 is a diagram illustrating a configuration of the information notification system according to the third embodiment. In the third embodiment, the communication terminal 1 to be used is 1B. In the communication terminal 1B, an attribute analysis unit 113 is added to the communication control unit 11, and a verification data generation unit 121 and a data verification unit 122 are added to the verification unit 12.

The communication unit 112 acquires the attribute file 23 of the data 21 from the server 2 via the high secure network 3 (step S201 in FIG. 18). The attribute analysis unit 113 determines whether or not matching information is included in the acquired attribute file 23 (step S202).

In the third embodiment, the collation information is data for specifying data, and may be a key issued by a download source or a hash value of data as described above. Further, an irreversible value derived by a one-way function such as a hash value may be used, but is not particularly defined. Here, the hash value of the data is used.

Here, when the collation information is not included (NO in step S203), the main body of the data 21 is acquired from the high secure network 3 (step S204). If collation information is included (YES in step S203), the main body of the data 21 is acquired from a URL described in the attribute file 23 via a different network (step S205). In this example, it is acquired from the low secure network 4 according to the description of the network to be used (described later) included in the attribute file 23.

Next, transition to data verification processing. The collation information generation part 121 produces | generates collation information from the acquired data 21 (step S206). Here, as described above, the hash value of the data 21 is calculated.

The data verification unit 122 compares the hash value generated by the verification information generation unit 121 with the hash value acquired in step S202 (step S207). This is nothing more than collating data acquired from the high secure network 3 and data acquired from the low secure network 4.

Here, if the hash values do not match (NO in step S208), it is assumed that data has been acquired from an unintended server, and the acquired data is discarded (step S209). The subsequent processing is the same as the processing from step S110 of FIG.

If the hash values match (YES in step S208), the data 21 obtained from the same server 2 is considered. That is, it is determined that the data 21 ′ is not acquired from the spoofed server 2 ′ on the low secure network 4. The subsequent processing is the same as the processing from step S104 in FIG.

Next, the operation of the third embodiment will be described more specifically. In this example, download of a Java application in a mobile terminal (communication terminal) will be described as an example. Assume that the mobile terminal is connected to a cellular network that is a highly secure network and a wireless LAN network that is a low secure network. It is assumed that the downloaded Java application communicates with the server 2 of FIG. 17 using any of the networks during execution.

First, Java application download processing will be described. Normally, downloading of a Java application starts from downloading an attribute file called an ADF file or a JAD file. The mobile terminal verifies attributes such as the size and origin of the Java application, and if necessary, confirms whether the user can download the file. When it is determined to download, the main body of the Java application is downloaded to the portable terminal. Below, it demonstrates along this flow.

In FIG. 17, the user of the communication terminal 1B selects a Java application to be downloaded from an input device (not shown). At this time, the communication unit 112 of the communication terminal 1B acquires the attribute file 23 of the selected Java application from the server 2. The attribute file 23 is acquired via the cellular network 3.

The acquired attribute file 23 is passed to the attribute analysis unit 113. An attribute file 23 in this embodiment is shown in FIG. In the attribute file 23, in addition to the data name, the URL of the data body and the type of network to be used (in this example, cellular / wireless LAN) are described. Further, the hash value of the data body is described as the collation information 22. Here, the hash function for generating the hash value is not particularly defined, but may be determined in advance by the server 2 and the communication terminal 1B, or may be defined by the communication carrier managing the cellular network 3. . Further, it may be described in the attribute file 23.

The attribute analysis unit 113 verifies the attribute file 23 and determines whether to use the wireless LAN network 4. In the present embodiment, as shown in FIG. 19, since the hash value is described as the collation information 22, and the wireless LAN is described as the network to be used, it is determined that the Java application uses the wireless LAN network 4. The acquired attribute file 23 is stored in the storage unit 15 by the communication unit 112.

Next, the main body (application A) of the data 21 is acquired via the wireless LAN network 4 based on the data URL in the attribute file 23. The collation information generation unit 121 calculates the hash value of the acquired application A, and the data collation unit 122 collates with the hash value in the attribute file 23. This is shown in FIG.

If the hash value in the attribute file 23 matches the calculated hash value, the data matching unit 122 determines that the acquired application A has not been tampered with and can be trusted, and the cellular network 3 and the wireless LAN Use in both networks is permitted.

That is, the NW identifier CELN of the cellular network 3 and the NW identifier WLAN1 of the wireless LAN network 4 are written in the table TB1 of the reliability information DB 13 in association with the data identifier #A of the application A. Also, the correspondence between the NW identifier WLAN1 of the wireless LAN network 4 and information indicating that connection is possible (“◯”) is written in the table TB2 of the reliability information DB13. This is shown in FIG. Further, the acquired application A is stored in the storage unit 15.

Next, processing when the downloaded application A is executed will be described. The data access unit 16 receives an access request for the application A, searches the reliability information DB 13 using the data identifier #A of the application A and the NW identifier acquired from the NW identification unit 111, and stores the application in the storage unit 15. It is determined whether or not A can be accessed.

In this case, since the data identifier #A and the NW identifier CELN / WLAN1 are associated with each other in the table TB1 in the reliability information DB 13, the data access unit 16 is connected to the cellular network 3 and the wireless LAN network. 4, the access to the application A in the storage unit 15 is permitted.

Further, the communication unit 112 acquires an NW identifier from the NW identification unit 111, searches the reliability information DB 13 using the acquired NW identifier, and determines whether or not access to the network is possible. In this case, the table TB2 in the reliability information DB 13 is associated with the NW identifier WLAN1 and information indicating that connection is possible (“◯”), so access to the wireless LAN network 4 is permitted. For network 3, access to the network is always permitted.

Thus, the communication terminal 1B can use the application A in the storage unit 15 at the same time or by switching the cellular network 3 and the wireless LAN network 4.

In the third embodiment, the example in which the example 1-1 is adopted has been described. However, the example 1-2 can be adopted in the same manner. In this case, the communication unit 112 acquires the attribute file 23 from the server 2 via the low secure network 4 and acquires the data 21 from the server 2 via the high secure network 3.

In the first to third embodiments described above, the downloaded data 21 is communicated with the server 2, but the present invention is not limited to this. That is, when it is determined that the server 2 is reliable, communication may be permitted by determining that the server 2 is reliable if it is a server in the same subnet or domain. In this case, the data 21 can communicate with a plurality of servers.

If it is determined that a server other than the server 2 is reliable, communication with the server may be permitted. In this case, the data 21 can communicate with a plurality of servers other than the server 2.

In the first to third embodiments described above, when the collation processing does not match, access to the low secure network having the NW identifier is prohibited, but the present invention is not limited to this. That is, it is possible to perform a reversion process such as performing the collation process again after an arbitrary time has elapsed and permitting access if they match.

In the first to third embodiments described above, the determination of whether to access data is combined with the determination of whether to access the network. However, the determination of whether to access data is performed independently. Alternatively, it may be possible to determine whether to access the network independently.

When the determination of whether or not access to the network is performed independently, the data 21 ′ acquired from the camouflaged low secure network 4 may be used in the high secure network. Discard without.

It should be noted that the present invention described above can be configured by hardware, as is apparent from the above description, but can also be realized by a computer program. In such a configuration, functions and operations similar to those of the above-described embodiments are realized by a processor that operates according to a program stored in a program memory. Note that some functions of the above-described components can be realized by a computer program.

Although the present invention has been described with reference to the embodiments and examples, the present invention is not necessarily limited to the above-described embodiments and examples, and various modifications can be made within the scope of the technical idea. I can do it.

This application claims priority based on Japanese Patent Application No. 2008-252689 filed on Sep. 30, 2008, the entire disclosure of which is incorporated herein.

1 (1A, 1B) Communication terminal 11 Communication control unit 111 NW identification unit 112 Communication unit 113 Attribute analysis unit 12 Verification unit 121 Verification data generation unit 122 Data verification unit 13 Reliability information DB
14 reliability information DB construction unit 15 storage unit 16 data access unit 17 collation result information 2 download server 21 data 22 collation information 23 attribute file 3 highly secure network (cellular network)
4 Low secure network (wireless LAN network)
5 management server 51 camouflaged network management information DB
52 Camouflaged network management information DB construction unit 53 Camouflaged network management information notification unit TB1, TB2, TB3 table

Claims

An information notification system comprising a first network, a second network having lower security than the first network, and a communication terminal connectable to the first and second networks,
The communication terminal is
Collation means for collating data collation information acquired from one of the first and second networks with data acquired from the other network;
A reliability information DB constructing means for constructing a reliability information DB as a database of information indicating the reliability of access to resources from the collation result of the collating means;
An information notification system comprising: verification result information notification means for notifying information in the reliability information DB to other devices in the system as verification result information.
2. The information notification system according to claim 1, wherein the verification result information notification means notifies the verification result information to a management server on the first network.
The information notification system according to claim 1, wherein the verification result information notification means notifies the verification result information to other communication terminals in the system.
2. The information notification system according to claim 1, wherein the verification result information notification means notifies the verification result information to a server to be camouflaged in the system traced from the first network.
The information notification system according to claim 1, wherein the verification result information notification means notifies the verification result information to a terminal of an administrator of an access point on the network that is camouflaged.
The management server on the first network is:
A camouflaged network management information DB constructing means for constructing a database of collation result information notified from the communication terminal as a camouflaged network management information DB;
The information notification system according to claim 2, further comprising: a camouflaged network management information notifying unit configured to notify information in the camouflaged network management information DB to other devices in the system.
7. The information notification system according to claim 6, wherein the camouflaged network management information notification means notifies the information in the camouflaged network management information DB to a communication terminal in the system.
The information notifying system according to claim 6, wherein the disguised network management information notifying means notifies the impersonated server in the system traced from the first network of the information in the impersonated network management information DB.
7. The information notification system according to claim 6, wherein the spoofed network management information notifying means notifies information in the spoofed network management information DB to a terminal of an access point manager on the camouflaged network.
The other communication terminal in the system that has received the notification of the verification result information is provided with means for notifying that when entering the communication range of the camouflaged network specified from the notified verification result information. The information notification system according to claim 3.
The other communication terminal in the system that has received the notification of the verification result information includes a means for notifying when a connection to the camouflaged network specified from the notified verification result information is attempted. The information notification system according to claim 3.
The communication terminal in the system that has received the notification of the information in the camouflaged network management information DB indicates that when it enters the communication area of the camouflaged network specified from the notified information in the camouflaged network management information DB. The information notification system according to claim 7, further comprising a notification unit.
The communication terminal in the system that has received the notification of the information in the camouflaged network management information DB is notified when the connection to the camouflaged network specified from the notified information in the camouflaged network management information DB is attempted. The information notification system according to claim 7, further comprising means for informing the user.
The access point manager terminal that has received the notification of the verification result information is a camouflaged network identified from the verification result information notified of the communication destination of the communication terminal when an access request is received from the communication terminal. 6. The information notification system according to claim 5, further comprising means for judging whether or not the access request is received from the communication terminal when the network is a camouflaged network.
The terminal of the administrator of the access point that has received the notification of the information in the camouflaged network management information DB is the camouflaged network management information DB in which the communication destination of the communication terminal is notified when there is an access request from the communication terminal. 10. The information notification system according to claim 9, further comprising means for determining whether or not the network is a camouflaged network specified from information in the network and blocking an access request from the communication terminal if the network is a camouflaged network. .
The other communication terminals in the system that have received the notification of the verification result information are provided with means for notifying when a connection to the camouflaged server specified from the notified verification result information is attempted. The information notification system according to claim 3.
The communication terminal in the system that has received the notification of the information in the camouflaged network management information DB is notified when a connection to the camouflaged server specified from the notified information in the camouflaged network management information DB is attempted. The information notification system according to claim 7, further comprising means for informing the user.
Obtaining collation information for data from either one of the first network and the second network having lower security than the first network;
Obtaining data from the other network of the first and second networks;
Collating information acquired from the one network with data acquired from the other network; and
Constructing a reliability information DB as a database of information indicating the reliability of access to resources from the result of the matching;
A collation result information notifying step of notifying information in the reliability information DB as collation result information from the communication terminal to other devices in the system.
19. The information notification method according to claim 18, wherein the verification result information notifying step notifies the verification result information to a management server on the first network.
19. The information notification method according to claim 18, wherein the verification result information notification step notifies the verification result information to another communication terminal in the system.
19. The information notification method according to claim 18, wherein the verification result information notification step notifies the verification result information to a server to be camouflaged in a system traced from the first network.
19. The information notification method according to claim 18, wherein the verification result information notification step notifies the verification result information to a terminal of an administrator of an access point on the network that is camouflaged.
In the management server on the first network,
A camouflaged network management information DB construction step of constructing a database of verification result information notified from the communication terminal as a camouflaged network management information DB;
20. The information notification method according to claim 19, further comprising: a camouflaged network management information notification step of notifying other devices in the system of information in the camouflaged network management information DB.
The camouflaged network management information notification step includes:
The information notification method according to claim 23, wherein information in the camouflaged network management information DB is notified to a communication terminal in the system.
24. The information notifying method according to claim 23, wherein the spoofed network management information notifying step notifies information in the spoofed network management information DB to a server to be camouflaged in a system traceable from the first network.
24. The information notifying method according to claim 23, wherein the notifying network management information notifying step notifies the terminal of an administrator of an access point on the disguised network of information in the disguised network management information DB.
Means for acquiring collation information of data from either one of the first network and the second network having lower security than the first network;
Means for obtaining data from the other network of the first and second networks;
Means for collating data collation information obtained from the one network and data obtained from the other network;
Means for constructing a reliability information DB as a database of information indicating the reliability of access to the resource from the result of the verification;
A communication terminal comprising: verification result information notifying means for notifying information in the reliability information DB to other devices in the system as verification result information.
28. The communication terminal according to claim 27, wherein the verification result information notifying unit notifies the verification result information to a management server on the first network.
28. The communication terminal according to claim 27, wherein the verification result information notification means notifies the verification result information to other communication terminals in the system.
28. The communication terminal according to claim 27, wherein the verification result information notification means notifies the verification result information to a server to be impersonated in a system traceable from the first network.
28. The communication terminal according to claim 27, wherein the verification result information notifying means notifies the verification result information to a terminal of an administrator of an access point on the disguised network.
A terminal program, wherein the program
Means for acquiring collation information of data from either one of the first network and the second network having lower security than the first network;
Means for obtaining data from the other network of the first and second networks;
Means for collating data collation information obtained from the one network and data obtained from the other network;
Means for constructing a reliability information DB as a database of information indicating the reliability of access to the resource from the result of the verification;
A program for causing the information in the reliability information DB to function as verification result information notification means for notifying other devices in the system as verification result information.