JP3799420B2 - Secret communication control device - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to a secret communication control device used for LAN (Local Area Network) communication such as the Internet, and in particular, for LAN communication, a client (connected to a server) for the purpose of preventing information leakage / falsification on the network. The present invention relates to a secret communication technique for constructing a VPN (virtual dedicated communication network) that prevents a third party from eavesdropping between a terminal and a server, between a server and a server, and between a client and a client.
[0002]
[Prior art]
Conventionally, an encryption board as an expansion board mounted on a personal computer or server used as a client can be selected and used only from a plurality of encryption systems (including authentication and key exchange functions) previously installed in the encryption board. It is.
[0003]
Further, in conventional IPSec (Internet Protocal Security) communication, only encryption processing is executed on the host computer (computer that incorporates a LAN board and performs IPSec communication), and is not encrypted on the same bus. Plain text data and cipher text data were mixed and transmitted.
[0004]
[Problems to be solved by the invention]
The current encryption board is selected and used only from encryption methods preinstalled by the manufacturer, so the user cannot install and use a method according to their needs.
[0005]
Also, if plaintext and ciphertext are mixed on the same bus, the plaintext may be transmitted to the outside as it is, leaving the possibility of information leaking to a third party, which is a threat.
[0006]
In the present invention, in view of the above points, plain text data is provided so that the user side can implement and selectively use an arbitrary encryption method according to their needs, and the entire process of IPSec can be collectively processed on the LAN board. An object of the present invention is to provide a secret communication control device that prevents transmission between a client and a server and between a server and a server.
[0007]
Other objects and novel features of the present invention will be clarified in embodiments described later.
[0008]
[Means for Solving the Problems]
In order to achieve the above object, a secret communication control device according to the present invention includes an OS-installed LAN board attached to a server or a terminal connected to the server via a LAN, and the LAN board is used for encryption processing. A processor is installed, a processing engine required for secrecy / key exchange by IPSec can be set from the terminal or the server, can be exchanged to an arbitrary secrecy / key exchange method, and the entire process of IPSec is performed. Batch processing is performed on the OS-installed LAN board.
[0009]
DETAILED DESCRIPTION OF THE INVENTION
Embodiments of a secret communication control apparatus according to the present invention will be described below with reference to the drawings.
[0010]
FIG. 1 is an overall functional configuration diagram of an embodiment of a secret communication control apparatus according to the present invention, and FIG. 2 is a schematic processing flow for setting and changing policies and algorithms required for secrecy and key exchange by IPSec. FIG.
[0011]
In these drawings, the secret communication control device is constituted by a secret communication board A type or B type 10, a secret communication board C type 20, and a CA server (CA: Certificate Authority). Note that the CA server is not required when authentication by pre-key distribution is selected in IKE (IPSEC regulation for key exchange).
[0012]
The secret communication board A type or B type 10 is an OS-installed LAN board connected to the terminal device 40 (client or server), a processor for IPSec processing and IKE (key exchange specification in IPSec) processing, and a LAN. A controller is mounted and has an arbitrary exchange function of an encryption method [authentication method, common key, public key, and hash (compression method)] as enclosed by a dotted frame in the figure. It also has a random number generation function for encryption. The secret communication board A type is connected to the terminal device 40 through the PCI bus, and the B type is connected to the terminal device 40 through the USB.
[0013]
The secret communication board C type 20 includes a card reader, is connected to the terminal device 40 through an IC interface, and has an authentication method and an optional exchange function of a hash as surrounded by a dotted frame in the figure.
[0014]
The CA server 30 manages information related to public keys.
[0015]
The terminal device 40 has a function as, for example, a general personal computer, and includes a driver for an expansion boat, that is, a secret communication board A type or B type driver and a secret communication board C type driver.
[0016]
Here, an outline processing flow for setting and exchanging the encryption method and the like in FIG. 2 will be described as an example in which an encryption setting manager is provided separately from the user of each terminal device 40.
[0017]
In general, when using encryption and authentication, an encryption setting manager is set in addition to the user in order to manage setting information that should be kept secret. In the present embodiment, the encryption setting manager is positioned as the person responsible for the encryption method installed and the setting information to be kept secret.
[0018]
The encryption setting manager first determines an administrator-dedicated terminal (PC) and installs a driver program for the secret communication board A type or B type 10 and the secret communication board C type 20.
[0019]
The encryption setting manager connects the secret communication board A type or B type 10 and the secret communication board C type 20 to be set to the administrator dedicated terminal, and starts the management control program (storage medium such as a CD-ROM) 50, Implement the settings. FIG. 2 shows a schematic processing flow of this setting and exchange. Note that the administrator-dedicated terminal does not necessarily need to be connected to the LAN when used for setting the secret communication board A type or B type 10 and the secret communication board C type 20. .
[0020]
The encryption setting manager records (programs and saves) the encryption method used in IPSec and IKE in the storage medium 60 such as a floppy disk ("floppy" is a registered trademark) in FIG.
[0021]
The encryption method or the like recorded in the storage medium 60 (corresponding to the authentication method, common key, public key, and hash enclosed by a dotted frame in the figure) is read into the secret communication board A type or B type 10. In other words, a predetermined processing engine that is software for realizing secrecy (encryption, decryption) and key exchange by IPSec is set (implemented) in the secret communication board A type or B type 10.
[0022]
Similarly, the authentication method and hash recorded in the storage medium 60 are read into the C type. Each method can be read simultaneously.
[0023]
The secret communication board A type or B type 10 and C type 20 for which the setting of each algorithm has been completed is distributed to each terminal device 40 to the user.
[0024]
When changing the setting, the encryption setting manager collects each board of the user and sets it again.
[0025]
In this embodiment, a processor for cryptographic processing is mounted on a secret communication board A type or B type 10 used as a LAN board serving as an Internet communication interface, and a general-purpose OS is installed to facilitate handling of cryptographic software. By using the on-board LAN board, the user can mount and use an arbitrary encryption method according to their needs. In addition, by installing a general-purpose OS on the board, the development of cryptographic software can utilize a general-purpose development environment without using a special development environment. For example, the encryption setting manager programs policies and algorithms such as encryption and key exchange in the secret communication, and uses the OS on the secret communication control device (the secret communication board A type or B type 10 which is the OS-installed LAN board). By arbitrarily setting and changing, it is possible to use a wider range of encryption methods than conventional products.
[0026]
In addition, the encryption process is designed to be executed only on the board in order to invalidate the encryption process illegally due to an unauthorized operation of the user terminal device or to prevent operation in an inappropriate setting state. The entire process related to IPSec is configured to be processed by the board. That is, a function for performing secret communication based on IPSec, a function for performing authentication / key exchange prior to secret communication, a function for arbitrarily setting / changing algorithms such as encryption, and a cipher when using public key encryption All functions for creating keys and public key certificates can be processed on the secret communication board 10. By adopting such a configuration, it is possible to solve the above-described problems (the problem that the user cannot select an arbitrary encryption method and the problem that a plaintext may be transmitted to the outside). In addition, the burden on the host computer is reduced.
[0027]
Further, in this case, the IKE protocol using IPSec that encrypts each packet is adopted to ensure compatibility with the existing cryptographic processing apparatus and not to burden the user terminal apparatus with cryptographic processing. Therefore, there is an advantage that the user does not need to be aware of the confidential processing at the time of communication without reducing the processing speed of the terminal device.
[0028]
As another convenience, by using the IKE protocol using IPSec, a method according to necessity is selected from a plurality of methods read from the storage medium into the secret communication board A type or B type. It can be automatically selected for each address.
[0029]
Although the embodiments of the present invention have been described above, it will be obvious to those skilled in the art that the present invention is not limited to these embodiments, and various modifications and changes can be made within the scope of the claims.
[0030]
【The invention's effect】
As described above, the secret communication control apparatus according to the present invention includes an OS-installed LAN board attached to a terminal connected to a server via a LAN or a server, and the LAN board includes a processor for cryptographic processing. A processing engine that is installed and required for secrecy / key exchange by IPSec can be set from the terminal or the server, can be exchanged to an arbitrary secrecy / key exchange method, and the entire process of IPSec is performed by the OS. Batch processing on the installed LAN board. For this reason, an arbitrary concealment / key exchange method can be selected, and a wider range of encryption methods can be used as compared with the conventional products. In the present invention, since all processes related to IPSec are processed by the secret communication control device, the burden on the host computer side is reduced, and plaintext and ciphertext are mixed on the same bus inside the computer. Since there is no risk of encryption being analyzed, plaintext data is no longer transmitted between the client and server, and between the server and server, and information leakage to third parties can be prevented. The user has the convenience of being able to communicate without being conscious of confidentiality at all.
[Brief description of the drawings]
FIG. 1 is an overall functional configuration diagram of an embodiment of a secret communication control apparatus according to the present invention.
FIG. 2 is a schematic process flow diagram for setting and changing policies and algorithms such as encryption methods in the configuration of FIG. 1;
[Explanation of symbols]
10 secret communication board A type or B type 20 secret communication board C type 30 CA server 40 terminal device 50 management control program 60 recording medium

Claims (1)

A terminal connected to the server via a LAN or an OS-installed LAN board that is installed in the server, and the LAN board is equipped with a processor for cryptographic processing, which is necessary for secrecy and key exchange by IPSec. The secret communication control characterized in that the engine can be set from the terminal or the server, can be exchanged to any secret / key exchange method, and all processes of IPSec are collectively processed on the LAN board equipped with the OS. apparatus.

Images