JP2000059357A - Closed group communication system, management server device and communication terminal, and their program storage medium - Google Patents

Abstract

(57) [Summary] [PROBLEMS] To construct a virtual closed area group (VPN) on a network using TCP / IP, such as a physical IP address of a terminal and a work place of a user. A VPN that does not depend on conditions can be constructed. A user ID and password of all users who use a network are registered in a management server, and an IC card is distributed to all users. In addition, all terminals 1 to 4 on the network are equipped with authentication / encryption software and an IC card reader. In the management server 5, a VPN is configured for each user ID, and the user is authenticated by the management server 5 using the IC card and the user ID / password from the terminal when using the network. At this time, the management server 5 associates the IP address of the user terminal with the VPN to which the user belongs, and registers the IP address.
A terminal used by a user belonging to the PN constitutes the VPN.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention constructs a plurality of virtual closed groups (hereinafter referred to as VPNs) on a network in which terminals can communicate with each other by using a TCP / IP protocol, and belongs to the same VPN. In particular, the present invention relates to a closed group communication system, a management server device and a communication terminal in which a VPN does not depend on a work place of a user, and a program storage medium thereof. Things.

[0002]

2. Description of the Related Art Conventionally, when a VPN is configured on a TCP / IP network, the VPN is conventionally configured on the basis of an IP address used by a terminal.

FIG. 10 shows a first conventional system configuration example, and FIG. 11 shows a second conventional system configuration example. 10 and 11, the terminal 10 and the terminal 20 are connected to the same VPN1.
And the terminal 30 and the terminal 40 have the same VPN2
Belongs to The management server 50 manages these pieces of VPN information. That is, the correspondence between the IP addresses fixedly assigned to the respective terminals and VPN1 and VPN2 is managed. The management server 50 and each terminal are connected by TC
It is connected via the P / IP network 60.

[0004] In FIG. 10, user A and user B can recognize and communicate with each other on the management server 50 as terminals having the same IP address in the same VPN 1, but as shown in FIG. When B moves to the work place,
On the management server 50, the user A cannot communicate with the user B because the IP address of the terminal 10 and the IP address of the terminal 40 are recognized as being on different VPNs.

[0005]

In the prior art, when a user moves a work place from a terminal normally used to another terminal, or when a terminal normally used is moved to another subnet, the IP address is changed. Is changed, the user cannot communicate with a terminal belonging to a different VPN even though the user has the same VPN. If communication is to be performed in such a case, it is necessary to change the setting of the IP address of the terminal configuring the VPN on the management server side that manages the VPN.

[0006] The present invention solves the above problems, and when constructing a VPN on a network, it is possible to construct a VPN that does not depend on physical conditions of the network, such as the IP address used by the terminal and the work place of the user. Even if the user changes the work place or uses another terminal, the same VP can be used without changing the IP address setting.
An object of the present invention is to enable secure communication with a user belonging to N.

[0007]

SUMMARY OF THE INVENTION The present invention assigns a unique user ID and a password to all users in the system, changes the VPN configuration unit in the management server from the conventional terminal IP address to the user ID, ID
The most main feature is that a VPN that does not depend on the physical network can be configured by managing the conversion table of the IP address of the terminal and the terminal.

When a user uses a communication network, authentication is performed by a management server using a user ID and a password. By registering the IP address of the terminal used by the user at the time of authentication in the management server, the conventional VPN technology using the IP address as a unit can be used as it is.

Further, by using a card-type storage medium (for example, an IC card) in addition to the user ID and the password for authentication, secure authentication can be performed.

[0010]

DESCRIPTION OF THE PREFERRED EMBODIMENTS [Summary of Embodiment of the Present Invention] As a precondition of the present system, on a single closed network using an arbitrary constituent device, a terminal belongs to an arbitrary subnet. It is assumed that the environment enables mutual communication using the TCP / IP protocol. It is assumed that there is one management server accessible from all terminals on the network, and authentication / encryption software and an IC card reader are installed on all terminals connected to the network.

[0011] Under such a premise, a user ID and password consisting of alphanumeric characters and the like are uniquely assigned to all network users (hereinafter, referred to as users) and set in the management server. On the management server, users who can communicate with each other are grouped using the user ID, and a plurality of virtual closed groups (VPN) are created on a single network. When the user uses the network, the user inserts the IC card into the IC card reader of the terminal and authenticates the terminal using the user ID and the password.
Make up the PN.

[0012] By constructing a VPN using a user ID, the VPN is not affected by the movement of the work terminal.
Secure communication is possible with users belonging to the same VPN.

[Usage Form] FIG. 1 shows a first system configuration example according to an embodiment of the present invention. In this system, user A and user B belong to the same VPN,
User C and user D belong to the same VPN. The management server 5 stores and manages these pieces of VPN information in the storage unit 53. The processing unit 51 is a unit that executes processing of the management server 5, and the communication unit 52 is a unit that executes communication with each of the terminals 1 to 4 via the TCP / IP network 6.

Each of the terminals 1 to 4 includes a processing unit 11 to 41 for executing processing in the terminal, and a communication unit 12 for communicating with the management server 5 and other terminals via the TCP / IP network 6.
And encryption software storage unit 1 that stores authentication and encryption software executed by the processing units 11 to 41 and the processing units 11 to 41
It has 3 to 43. Each terminal 1 to 4 has a user A
IC for reading IC cards 7A to 7D possessed by ~ D
Card readers 14 to 44 are provided.

In FIG. 1, user A works at terminal 1, user B works at terminal 2, user C works at terminal 3, and user D works at terminal 4. At this time, the terminal 1 and the terminal 2 can communicate, and the terminal 3 and the terminal 4 can communicate. However, communication between other terminals is not possible.

FIG. 2 shows a second embodiment according to the present invention.
1 shows an example of a system configuration. In FIG. 2, from the state of the system in FIG. 1, the user A moves the work place from the terminal 1 to the terminal 3 and the user C moves the work place from the terminal 3 to the terminal 1. In this case, terminal 1 and terminal 3 can communicate,
Terminal 2 and terminal 4 can communicate. However, communication between the terminals 1 and 2 and between the terminals 3 and 4 cannot be performed.

As described above, since the terminals constituting the VPN change according to the movement of the user, the user can communicate within the VPN without depending on the work place.

[Function of Each Unit] The function of each unit in the system shown in FIGS. 1 and 2 is as follows.

(A) Management server 5 Manages the correspondence between user IDs and passwords of all network users and their VPNs. Managing the correspondence between the user IDs of all network users and the public keys of each user. -Perform user authentication in response to a request from the terminal.・ If the authentication is successful, the IP of the terminal used by the user
The address is registered in association with the user ID. A communication encryption key required for communication within each VPN is distributed to terminals used by users.

(B) Authentication / encryption software storage unit 13,
23, 33, 43 Authentication / encryption software is built in all terminals 1-4 connected to the TCP / IP network 6. User I
D and the password are encrypted and transmitted to the management server 5 for authentication. The communication packet is encrypted using the communication encryption key distributed from the management server 5, and mutual communication between terminals in the VPN is performed.

(C) IC cards 7A to 7D, IC card readers 14, 24, 34, 44 One IC card 7A to 7D is assigned to each network user. An encryption key is stored in each of these IC cards, and the user can safely transmit a user ID and a password and receive a communication encryption key by using the IC card at the time of authentication.

[Features / Advantages] By using this system, a VPN can be configured for each user, and communication security between users within the VPN can be ensured. -Communication and communication security between users belonging to the same VPN are ensured even if the user moves from one work place to another. -User authentication can be performed safely by using an IC card.

[Processing Flow] FIG. 3 is a view for explaining an actual operation example of the system shown in FIG. FIG. 4 is a processing flowchart of the terminal, and FIG. 5 is a processing flowchart of the management server.

Before describing the actual operation, the premise will be briefly described. VPN users in advance
Access the management server 5 and enter the user ID, password,
And a VPN number to be used.
FIG. 6 shows an example of a user ID and a password registered in advance in the management server 5 by the VPN user.

Each of the IC cards 7A to 7D stores a public key of the management server 5 and a secret key for each user. For example, the public key of the management server 5 and the secret key of the user A are stored in the IC card 7A of the user A, and the public key of the management server 5 and the secret key of the user B are stored in the IC card 7B of the user B. Have been. It is assumed that encryption and decryption are performed between the terminal and the management server 5 by a public key encryption method. The management server 5 stores a secret key of the management server 5 and a public key for each user. FIG. 7 shows an example of a public key for each user managed by the management server 5.

User A and user B belong to VPN1,
User C and user D are set to belong to VPN2. The settings are as shown in FIG. Each of the users A to D has a user ID of USER-A,
Password is passwd1 and user B is USER-
B, User C is USER-C, User D is USER-D
Thus, a user ID is assigned to each.

The issuance / management of the IC cards 7A to 7D and the issuance / management of the management server 5 and the public key / private key for each user may be performed by the management server 5, or a third-party organization. It is also possible to obtain and use what is issued.

Hereinafter, the operation of the system shown in FIG. 1 will be described with reference to (1) to (26) shown in FIG. (1) When the user A wants to communicate with another user in the same VPN, the user A inserts the IC card 7A into the IC card reader 14 of the terminal 1. (2) The IC card reader 14 reads the public key of the management server 5 and the secret key of the user A from the IC card 7A into the memory of the terminal 1 (step S1 in FIG. 4). (3) The terminal 1 inputs a user ID and a password from the user A (S2 in FIG. 4). (4) The input user ID and password are encrypted with the public key of the management server 5 (S3 in FIG. 4). (5) The terminal 1 sends the encrypted user ID to the management server 5
And the password and the IP address of the terminal 1 are read and transmitted (S4 in FIG. 4). (6) The management server 5 receives the authentication packet (encrypted user ID and password) from the terminal 1 (S21 in FIG. 5), and decrypts the user ID and password with the secret key of the management server 5 (FIG. 5). 5 S22). (7) Next, the management server 5 performs authentication by comparing the user ID and the password with the registered contents shown in FIG. 6 (S2 in FIG. 5).
3). (8) If the authentication is successful, the management server 5
Is checked, and the source IP address 10.0.0.1 in the authentication packet sent from the user A is registered in the IP address column of the table shown in FIG. 6 in association with VPN1 (S24 in FIG. 5). ). When the IP address is not automatically set by the communication software in the authentication packet transmitted from the terminal 1 to the management server 5, the IP address of the terminal 1 may be read and transmitted to the management server 5. (9) The management server 5 encrypts the communication encryption key required for the terminal 1 to communicate within the VPN 1 with the public key of the user A (S25 in FIG. 5). At this time, data of the public key management table (FIG. 7) for each user ID registered in advance is used. (10) The management server 5 transmits the encrypted communication encryption key of the VPN 1 to the terminal 1 (S26 in FIG. 5). (11) The terminal 1 receives the encrypted communication encryption key of the VPN 1 from the management server 5 (S5 in FIG. 4) and decrypts it with the secret key of the user A (S6 in FIG. 4). (12) The terminal 1 returns a communication encryption key reception response to the management server 5 (S7 in FIG. 4). (13)-(24) At terminal 2, user B inserts IC card 7B
By inserting it into the C card reader 24, the authentication process for the user B is performed in the same manner, and the communication encryption key of the VPN 1 is distributed to the terminal 2. (25)-(26) By the above processing, the terminal 1 and the terminal 2 constitute the VPN 1 having the same communication encryption key.
Communication between the terminal 1 and the terminal 2 is performed by data encryption using the communication encryption key of the VPN 1 (S9 in FIG. 4). It should be noted that the IP addresses of users performing communication within the VPN can be obtained by accessing the management server 5.
Communication between the terminal 1 and the terminal 2 can be performed.

The same processing is performed for the users C and D to form the VPN2. The configuration information managed by the management server 5 after the user A, the user B, the user C, and the user D are respectively authenticated changes as shown in FIG.

When the state of the system configuration shown in FIG. 1 changes to the state of the system configuration shown in FIG. 2, the following operation is performed. FIG. 9 is a diagram for explaining the operation when the user A and the user C stop working at the terminals 1 and 3. Hereinafter, the operation will be described with reference to (1) to (12) shown in FIG. (1) The user A receives an IC card from the IC card reader 14 of the terminal 1
Remove the C card 7A. The terminal 1 uses the IC card 7
The extraction of A is detected (S11 in FIG. 4). (2) As a result, a request is made to the terminal 1 to delete the public key of the management server 5 and the secret key of the user A stored in the memory. (3) The terminal 1 deletes the public key of the management server 5 and the secret key of the user A from the memory (S12 in FIG. 4). (4) The terminal 1 transmits the IP address clear request of the user A to the management server 5 (S13 in FIG. 4). (5) The management server 5 receives the request for clearing the IP address of the user A from the terminal 1 (S31 in FIG. 5), and clears the IP address of the user A (S32 in FIG. 5). (6) The management server 5 returns an IP address clear response to the terminal 1 (S33 in FIG. 5). (7) to (12) The same processing is performed for the user C.

As described above, the terminal 1 and the terminal 3
Then, the user C returns to the state before being authenticated, and is no longer a member of the VPN. Subsequently, the user A is authenticated at the terminal 3 and the user C is authenticated at the terminal 1. At this time, the terminal 2 and the terminal 3 constitute a VPN1, and the terminal 1 and the terminal 4 constitute a VPN2. As a result, the users A and B and the users C and D can communicate with each other within the respective VPNs.

In the above description, an example in which an IC card is used as a card-type storage medium has been described. However, a magnetic card, a magneto-optical recording card, or another storage medium can be used as long as the storage medium is used. . The terminal does not need to be fixed, and may be a portable type having a built-in card-type storage medium reader / writer, and the present invention can be implemented by a wired / wireless communication network. It is.

A program for realizing each of the above processes by the computer of the management server 5 and the terminals 1 to 4 is stored in an appropriate storage medium such as a portable medium memory, a semiconductor memory, and a hard disk which can be read by the computer. Can be stored.

[0034]

As described above, according to the present invention,
VPN that does not depend on IP address in user units
Can be configured. Therefore, the user can perform communication with secure communication between users belonging to the same VPN without depending on the work place.

[Brief description of the drawings]

FIG. 1 is a diagram illustrating a first system configuration example according to an embodiment of the present invention.

FIG. 2 is a diagram showing a second system configuration example according to the embodiment of the present invention.

FIG. 3 is a diagram illustrating an actual operation example of the system shown in FIG. 1;

FIG. 4 is a processing flowchart of a terminal.

FIG. 5 is a processing flowchart of a management server.

FIG. 6 is a diagram illustrating an example of a user ID and a password registered in a management server by a VPN user.

FIG. 7 is a diagram illustrating an example of a public key for each user managed by the management server.

FIG. 8 is a diagram illustrating an example of VPN configuration information managed by a management server.

FIG. 9 is an explanatory diagram of an operation when the user stops working at the terminal.

FIG. 10 is a diagram showing a first example of a conventional system configuration.

FIG. 11 is a diagram showing a second example of a conventional system configuration.

[Explanation of symbols]

1, 2, 3, 4 terminal 11, 21, 31, 41 processing unit 12, 22, 32, 42 communication unit 13, 23, 33, 43 authentication / encryption software storage unit 14, 24, 34, 44 IC card reader 5 Management server 51 Processing unit 52 Communication unit 53 Storage unit 6 TCP / IP network 7A, 7B, 7C, 7D IC card

 ──────────────────────────────────────────────────続 き Continuing on the front page (72) Inventor Tomoyuki Saijo 3-19-2 Nishishinjuku, Shinjuku-ku, Tokyo Inside Japan Telegraph and Telephone Corporation (72) Inventor Taiyasu Ono 3-19, Nishishinjuku, Shinjuku-ku, Tokyo No. 2 Nippon Telegraph and Telephone Corporation F term (reference) 5J104 AA07 AA16 EA19 KA02 MA01 NA02 NA05 NA06 NA33 NA37 PA07 5K033 AA08 CB01 DA01 DB10 DB12 DB14 EC03

Claims (5)

[Claims] The present invention relates to a card-type storage medium possessed by each user, a communication terminal having an input / output interface for the card-type storage medium, and communication within a closed group between the communication terminals via a communication network. A closed-group communication system comprising a management server device for distributing the communication encryption key, wherein the card-type storage medium holds information on a public key of the management server device and a private key of each user; The management server device manages and stores a user ID and a password, a plurality of closed group numbers, and user IDs belonging to a closed group, which are assigned to each user who uses the communication terminal in advance, and transmits the user ID and the user ID belonging to the closed group. Decrypts the received user ID and password using the secret key of the management server device, and obtains the user ID and password. If is successfully authenticated, the user I
The communication encryption key of the closed group to which D belongs to the user ID
Means for encrypting with a public key of a user having a password and transmitting the encrypted data to the communication terminal, wherein the communication terminal reads the public key of the management server device and the user from the card type storage medium inserted into the input / output interface. Means for reading each private key, means for encrypting a user ID and a password using a public key of the management server device, and means for transmitting the encrypted user ID and password to the management server device via a communication network; Means for receiving an encryption key for communication with the communication terminal in the closed group and decrypting the communication key with the private key of each user; and encrypting communication information between the communication terminals using the decrypted encryption key for communication,
Means for performing communication between communication terminals within the closed group. 2. A management server device for distributing a communication encryption key for performing communication in a closed group between communication terminals via a communication network, wherein the management server device distributes a communication encryption key to each user who performs communication in the closed group in advance. Means for managing and storing a user ID and a password assigned to the user, a plurality of closed group numbers and a user ID belonging to the closed group, and a user ID and a password transmitted from a communication terminal used by the user. The communication terminal decrypts the user ID and password encrypted using the public key of the management server device read from the card type storage medium distributed to each user in advance using the secret key of the management server device. If the ID and password can be authenticated, the communication encryption key of the closed group to which the user ID belongs has the user ID. Means for encrypting with a public key of one user and transmitting the encrypted data to the communication terminal. 3. A communication terminal for performing communication via a communication network using a communication encryption key for performing communication in a closed group between communication terminals distributed from a management server device, wherein the communication terminal is a card type. From the input / output interface of the storage medium and the card-type storage medium in which the information of the public key of the management server device and the private key of each user are stored in advance, the public key of the management server device and the user Means for reading each private key, means for encrypting a user ID and a password using a public key of the management server device, and means for transmitting the encrypted user ID and password to the management server device via a communication network; Means for receiving an encryption key for communication with a communication terminal in a closed group and decrypting the same with a private key of each user; Means for encrypting communication information between the communication terminals using the communication encryption key thus formed, and performing communication between the communication terminals within the closed group. 4. A program storage medium storing a program used by a management server device for distributing a communication encryption key for performing communication in a closed group between communication terminals via a communication network, the program storage medium comprising: A process of managing and storing a user ID and a password, a plurality of closed group numbers, and a user ID belonging to a closed group assigned to each user who performs communication within the communication terminal; A process of decrypting the user ID and the password using the secret key of the management server device, a process of authenticating the decrypted user ID and the password by collating the previously registered user ID and the password, If the ID and the password are successfully authenticated, the communication encryption key of the closed group to which the user ID belongs is assigned to the user. A program storage medium for a management server device, storing a program for causing a computer to execute a process of encrypting with a public key of a user having a user ID and transmitting the encrypted data to the communication terminal. 5. A program used by a communication terminal that performs communication via a communication network using a communication encryption key for performing communication in a closed group between communication terminals distributed from a management server device. A program storage medium, which is a card-type storage medium in which information on the public key of the management server device and the private key of each user is stored in advance, via the input / output interface, the public key of the management server device and the individual user. A process of reading a secret key, a process of encrypting a user ID and a password using a public key of the management server device, transmitting the encrypted user ID and password to the management server device via a communication network, and a process of closing the network transmitted from the management server device. A process of receiving an encryption key for communication with a communication terminal in the group and decrypting the same with a secret key of each user; A program for causing a computer to execute a process of encrypting communication information between communication terminals using the communication encryption key obtained and performing communication between communication terminals in a closed group. Medium.