JPH0993367A - Communication system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To secure high security by surely rejecting illegal access by a third party. SOLUTION: A terminal equipment 3 and a host computer 2 are connected to a public communication line 1 so as to connect simultaneously to a data communication line (a) and a line (b) for notifying a confirmation ID being a line other than the line (a). Then in the case of access to the host computer 2 from the terminal equipment 3 via the line (a), the confirmation ID is dynamically generated by production of a random number or the like for each access and the confirmation ID is informed to a pager terminal equipment 7 of the terminal equipment 3 through the line (b) registered in advance. When the confirmation ID displayed on the pager terminal equipment 7 is inputted from the terminal equipment 3, the host computer 2 permits formally the access for the terminal equipment 3.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a communication system for accessing a host machine from a remote terminal device via a public communication line, and more particularly to a communication system having a function of rejecting illegal access from outsiders. is there.

[0002]

2. Description of the Related Art Today, as shown in FIG. 8, an analog telephone line, a high-speed digital line, or an integrated services digital network (ISDN) is integrated.
A host computer 52 provided at a head office or the like is connected to a public communication line 51 such as a network using a line connection device 53 such as a modem or a terminal adapter, and a personal computer provided at a business office (hereinafter, A terminal device 54 such as a personal computer) is connected to the line connection device 55.
A communication system is constructed in which the host computer 52 is connected to the public communication line 51 via the public communication line 51 via the public communication line 51 from the remote terminal device 54.

In such a communication system using the public communication line 51, it is necessary to deny illegal access to the host computer 52 by an outsider in order to ensure security. As a method for rejecting illegal access, the following password method and callback method have been conventionally used.

In the password system, when the terminal device 54 accesses the host computer 52 in the above communication system, a password consisting of a combination of alphanumeric characters of about 4 to 8 digits is usually input together with an ID number, The host computer 52 is notified that the user is an authorized user. The host computer 52 permits access only to the terminal device 54 for which the correct password has been entered.

In the call back method, the host computer 52 is allowed to access the terminal device 54 in advance.
If a correspondence table between the line number (telephone number or ISDN number) and the ID number is registered and the terminal device 54 accesses the host computer 52 in the above communication system, the line is disconnected and then the The host computer 52 side makes a call to the terminal device 54 side to establish a line connection. As a result, the host computer 52
The access by the terminal device 54 whose line number is not registered is disabled.

[0006]

However, in the above password system, for example, if the password is mistaken three times in one access and the line is forcibly disconnected, another access is tried and password combinations are successively made. It is possible to try, and if such a combination is tried using a computer, it is finally possible to decipher the password. Therefore, it is difficult to ensure sufficient security only with the password.

Further, although the above-mentioned call-back method is effective for the fixed terminal device 54, it may be necessary to access from other than the registered line number, for example, during a business trip. In such a case, there is a problem that it cannot be dealt with.

As shown in FIG. 9, the terminal device 54 is connected to a mobile phone 57 via a digital interface (i / f) 56 and the telephone number of the mobile phone 57 is registered in the host computer 52 in advance. If you leave it, you can call back from a business trip destination. However, in this case, since a mobile phone is used for data transmission, there is a problem that high cost is required.

The present invention has been made in view of the above, and an object thereof is to provide a communication system capable of reliably denying illegal access from outsiders and ensuring high security. . Another object of the present invention is to provide a communication system that ensures high security and that can access a host computer from a non-specific location by using a wired public communication line. .

[0010]

A communication system according to a first aspect of the present invention is a system for accessing a host station from a terminal station on a public communication line through the public communication line. In addition, the following measures are taken.

That is, the terminal station and the host station are provided with two lines, a first line for data communication and a second line different from the first line for notifying the confirmation ID. Are connected to the public communication line so that they can be connected simultaneously. Then, the host station dynamically registers with the registering means for registering the line number of the terminal station corresponding to the second line, and dynamically at each access when the terminal station is accessed through the first line (for example, The confirmation ID generation means for generating a confirmation ID (by random number generation) and the confirmation ID generated by the confirmation ID generation means
The confirmation ID notifying means for transmitting to the terminal station through the second line having the line number of the terminal station registered in the registration means, and the terminal station through the first line after notifying the confirmation ID to the terminal station. It is determined whether or not the confirmation ID sent from the device matches the notified confirmation ID, and only if they match, the confirmation I that officially permits access to the terminal device is sent.
And D check means. In addition, the terminal station,
It has a confirmation ID receiving means for receiving a confirmation ID from the host station sent through the second line.

According to the above configuration, the host station dynamically generates a confirmation ID by random number generation or the like each time the terminal station is accessed through the first line.
This confirmation ID is notified to the terminal station through the second line registered in the host station in advance. Note that the above-mentioned first line and second line are different lines, two lines can be connected at the same time, and if the confirmation ID is notified through the second line, the connection of the first line is required. The state is retained.

The terminal station receives the confirmation ID sent from the host station through the second line, inputs the confirmation ID automatically or manually, and returns the confirmation ID to the host station through the first line.

Then, only when the confirmation ID as previously notified is sent from the terminal station, the host station officially authorizes access to the terminal station, and the wrong confirmation ID is sent.
Is denied, access is denied.

As described above, since the confirmation ID for finally determining whether or not to permit access is dynamically changed by random number generation or the like, the password should be decrypted.
It is almost impossible to try the access many times and decode the combination of the character strings of the confirmation ID using a computer. Therefore, it is possible to reliably prevent illegal access that cannot be prevented only with the password, and to ensure high security.

A communication system according to a second aspect of the present invention is the configuration of the first aspect of the invention, wherein the confirmation I of the terminal station is
The D receiving means is a pager terminal means for receiving information transmitted from the radio station of the pager system, and the confirmation ID transmitted from the host station through the second line is the terminal station via the radio station of the pager system. The pager terminal means is notified.

According to the above configuration, if the pager terminal means (the pager terminal itself or the modem having the pager terminal function) is carried, it can be accessed from an unspecified place within the communicable area of the pager system. It is possible to access the host station using the wired first line. In this case, only by using the pager system to notify the confirmation ID, the wired first line (analog telephone line or the like) can be used for actual data transmission. The cost can be kept lower than when using a mobile phone for access from an unspecified place as in the past.

[0018]

BEST MODE FOR CARRYING OUT THE INVENTION

[First Embodiment] The following will describe one embodiment of the present invention with reference to FIGS. 1 and 2.

The overall configuration of the network communication system according to this embodiment is shown in FIG. The host computer 2 provided in the head office or the like has two lines (the line a as the first line a
In order to be able to use the line b) as the second line at the same time, the line is connected to the analog telephone line, the high speed digital line, or the public communication line 1 such as ISDN via the two line connecting devices 4 and 5.

Both the line a and the line b may be analog telephone lines, or the line a may be IS.
Different protocols may be used, such as using a DN while using an analog telephone line as line b.

For the host computer 2 described above,
A terminal device 3 in a remote place such as a business office or a business trip destination can be connected to the public communication line 1 via the line connection device 6 and can be accessed using the line a. However, as described below,
Confirmation ID specified by the host computer 2 by the terminal device 3
If you do not enter, the system is not allowed to access.

As the above-mentioned line connection devices 4, 5, and 6,
A modem is used for analog telephone lines, and a terminal adapter or the like is used for ISDN.

As shown in FIG. 2, the host computer 2 has a pager terminal ID registration section 11 (registration means), a pager terminal ID reminder section 12, a pager terminal ID check section 13, and a confirmation ID generation section 14 (confirmation ID generation). Means), a confirmation ID transmission unit 15 (confirmation ID notification unit), and a confirmation ID check unit 16 (confirmation ID check unit). These 11 to 16 execute the operation program stored in the memory of the host computer 2,
Is a functional module achieved by the execution of the CPU.

The pager terminal ID registration unit 11 has a function of registering an ID number (referred to as a pager terminal ID) and a line number of a pager terminal 7 (see FIG. 1) carried by an operator who operates the terminal device 3. A pager terminal ID and line number correspondence table registered in a predetermined storage area of the memory of the host computer 2 are stored.

When the terminal device 3 on the public communication line 1 is accessed through the line a, the pager terminal ID urging unit 12 sends information for prompting the terminal device 3 to input the pager terminal ID. It is a thing.

The pager terminal ID check unit 13 is
When the pager terminal ID is received from the terminal device 3 through the line a, it is checked whether or not the pager terminal ID is registered in the pager terminal ID registration unit 11.

The confirmation ID generation unit 14 dynamically generates a different confirmation ID each time the pager terminal ID check unit 13 determines that the received pager terminal ID is registered in the system. An example of the generation of this confirmation ID is the generation of random numbers.

The confirmation ID transmission section 15 sends the confirmation ID.
The confirmation ID generated by the generation unit 14 is transmitted to the pager terminal 7 through a line b different from the line a. When transmitting to the pager terminal 7, the line number of the pager terminal 7 is acquired from the correspondence table of the pager terminal ID stored in the pager terminal ID registration unit 11 and the line number, and the call is made.

The confirmation ID check unit 16 determines whether or not the confirmation ID received from the terminal device 3 through the line a after the transmission of the dynamically generated confirmation ID matches the previously transmitted (specified) confirmation ID. This is to confirm.

The pager terminal 7 has a function of notifying the wearer of information (confirmation ID transmitted by the host computer 2) received from the wireless station of the pager system (for example, a notification function by display).

In the present embodiment, the host computer 2, the line connection device 4, and the line connection device 5 constitute a host station described in the claims. In addition, the terminal device 3, the line connection device 6, and the pager terminal 7
And constitute a terminal station described in the claims.

In the above configuration, the operation of the communication system, in particular, whether or not to permit access from the terminal device 3 in the host computer 2 will be described below.

A person who permits access to the host computer 2 carries a pager terminal 7 whose pager terminal ID is registered in advance in the host computer 2.

When the owner of the above-mentioned pager terminal 7 accesses the host computer 2 from a remote place such as a business trip destination, access is made using the line a from the terminal device 3 connected to the public communication line 1. To do.

In this case, the host computer 2 transmits the information requesting the input of the pager terminal ID to the accessed terminal device 3 through the line a. The pager terminal ID is displayed on the display of the terminal device 3 that has received this reminder information.
Is displayed. At this time, the holder of the pager terminal 7 inputs the ID number of the pager terminal 7.

Next, the host computer 2 confirms whether or not the input pager terminal ID is registered in the system. At this time, the input pager terminal I
If D is not registered in the system,
For example, the re-input of the pager terminal ID is permitted twice (the number of re-inputs can be arbitrarily set) thereafter, but if the pager terminal ID registered in the system is not input during that time, the line is forcibly disconnected.

On the other hand, when the input pager terminal ID is registered in the system, the line number (telephone number or ISDN number) corresponding to the pager terminal ID is associated with the pager terminal ID and the line number described above. Get from the table. Then, the host computer 2 transmits the confirmation ID to the pager terminal 7 through a line b different from this while keeping the connection state of the line a. Note that the line b is immediately disconnected when the transmission of the confirmation ID is completed.

The pager terminal 7 which has received the confirmation ID displays the confirmation ID on its display. After that, the owner of the pager terminal 7 confirms the confirmation ID displayed by the pager terminal 7.
Is input to the terminal device 3.

Next, in the host computer 2, the input confirmation ID is transmitted to the terminal device 3 and the confirmation I specified is transmitted.
Check if it matches D. At this time, if the input confirmation ID is not the designated confirmation ID, for example, the confirmation I is input twice (the number of re-inputs can be arbitrarily set) thereafter.
Re-input of D is accepted, but if the correct confirmation ID is not input during that time, the line is forcibly disconnected.

On the other hand, when the designated correct confirmation ID is input, the host computer 2 officially permits the terminal device 3 to access.

As described above, in the communication system of this embodiment, the terminal device 3 and the host computer 2 are connected to the line a for data communication and a line different from the line a for notifying the confirmation ID. The two lines with b are connected to the public communication line 1 so that they can be simultaneously connected. When the host computer 2 is accessed from the terminal device 3 through the line a, the host computer 2 dynamically generates a confirmation ID each time the access is made, and the confirmation ID is sent to the terminal device 3 through the line b that is registered in advance. Only when the confirmation ID as notified from the terminal device 3 is sent through the line a after the notification, the access is officially permitted to the terminal device 3.

In this way, when the confirmation ID for finally determining whether or not to permit access is dynamically changed by random number generation or the like, access is repeated many times so that the password is decrypted. It is almost impossible to try and decode the combination of the character strings of the confirmation ID by a computer.

It is possible to try to access the host computer 2 through the line a if it is a terminal device on the public communication line 1.
Even if an outsider does not know D, the pager terminal ID itself is a fixed character string, so it is possible to try the access many times and decode the combination of the pager terminal ID character strings using a computer. . However, when the pager terminal ID is decoded, an outsider who does not have the pager terminal 7 sends a confirmation ID sent using a line b different from the line a. It is impossible to know a different confirmation ID).

Therefore, in the communication system of the present embodiment, it is possible to reliably reject illegal access from outsiders and ensure high security.

Although the pager system is used in the above, it is also possible to use only a wired communication line without using the pager system. For example, a confirmation ID receiving device in which only an analog telephone line is used as the line b and the confirmation ID receiving means described in the claims is connected to the analog telephone line through a modem (not shown) instead of the pager terminal 7 Can be used. However,
In this case, since the installation place of the confirmation ID receiving means is fixed, it cannot be handled from an unspecified place such as a business trip destination.

On the other hand, as described above, the confirmation ID transmitted from the host computer 2 through the line b is
With the configuration in which the pager terminal 7 is notified via the radio station of the pager system, the host computer 2 is accessed from an unspecified location using the wired line a within the communicable area of the pager system. It is possible.

In the case of using the conventional callback method, a mobile phone must be used to enable access from an unspecified place, and a mobile communication line must be used for actual data transmission. However, high cost was required. On the other hand, in this embodiment, since the wired line a can be used for actual data transmission, the cost can be kept relatively low. In addition, in the case of data transmission using a mobile phone, communication may not be possible inside the building, etc., and the communicable range is relatively narrow, but a book that only uses the pager system to notify the confirmation ID. In the system of the embodiment, the range in which communication is possible is wider than when a mobile phone is used.

[Second Embodiment] The following will describe another embodiment of the present invention with reference to FIGS. 3 and 4. For convenience of description, members having the same configurations and functions as those of the members shown in the drawings of the first embodiment will be designated by the same reference numerals, and the description thereof will be omitted.

In this embodiment, as shown in FIG. 3, the terminal device 3 is connected to the public communication line 1 via the line connection device 20 with a pager terminal function (hereinafter, simply referred to as the line connection device 20). The other configurations are the same as those in the first embodiment. In this embodiment,
The terminal device 3 and the line connection device 20 constitute a terminal station described in the claims.

As shown in FIG. 4, the above line connection device 2
0 is a line connection unit 21 having the same function (modem function or terminal adapter function) as the line connection device 6 of FIG. 1 and the same function as the pager terminal 7 of FIG. 1 (information from the radio station of the pager system). The pager terminal unit 22 having a receiving function) and the display unit 23 for displaying the confirmation ID and the like received from the host computer 2 are provided.

A person who permits access to the host computer 2 carries the line connection device 20 whose pager terminal ID is registered in the host computer 2 in advance.

In this embodiment, by inputting the confirmation ID displayed on the line connection device 20 at the time of access from the terminal device 3, only the terminal device 3 using the line connection device 20 is permitted to access. Therefore, as in the case of the above-described first embodiment, illegal access from outsiders can be surely denied, and high security can be ensured.

[Third Embodiment] Still another embodiment of the present invention will be described with reference to FIGS. 3 and 5.
It is as follows. For convenience of explanation, members having the same configurations and functions as those shown in the drawings of the first and second embodiments will be designated by the same reference numerals, and the description thereof will be omitted.

In this embodiment, the terminal device 3 is connected to the public communication line 1 via the line connection device 20 'with a pager terminal function shown in FIG. 3 (hereinafter simply referred to as the line connection device 20').
The other configurations are the same as those in the first embodiment. In the present embodiment, the terminal device 3 and the line connection device 20 'constitute the terminal station described in the claims.

As shown in FIG. 5, the line connection device 2 described above is used.
Reference numeral 0'includes the above-mentioned line connection unit 21, the above-mentioned pager terminal unit 22, and the automatic input unit 24.

When the host computer 2 prompts the host computer 2 to input a pager terminal ID, the automatic input section 24 automatically inputs its own pager terminal ID without passing through the terminal device 3 and confirms it from the host computer 2. When the ID is received, the confirmation ID is automatically input without passing through the terminal device 3.

A person who permits access to the host computer 2 carries the line connection device 20 'whose pager terminal ID is registered in the host computer 2 in advance. A person who possesses this line connection device 20 'simply connects the terminal device 3 to the public communication line 1 by using the line connection device 20', and is special for rejecting illegal access when accessing the host computer 2. It is possible to quickly access the host computer 2 without performing any input operation.

The illegal access denial operation in the communication system is the same as that in the first embodiment, and the denial of illegal access from a person who does not have the line connecting device 20 'is surely denied, which is high. Security can be ensured.

[Fourth Embodiment] The following will describe still another embodiment of the present invention with reference to FIGS. 6 and 7.
It is as follows. For convenience of description, members having the same configurations and functions as those of the members shown in the drawings of the first embodiment will be designated by the same reference numerals, and the description thereof will be omitted.

In this embodiment, as shown in FIG. 6, the host computer 2 is connected to the public communication line 1 via the line connection device 30, and other configurations are the same as those in the first embodiment. It is the same. In the present embodiment, the host computer 2 and the line connection device 30 constitute the host station described in the claims.

As shown in FIG. 7, the line connection device 3 described above is used.
0 has the functional modules 11 to 16 (see FIG. 2) included in the host computer 2 in the first embodiment. Here, these 11 to 16 are functional modules achieved by the CPU of the line connection device 30 executing the operation program stored in the memory of the line connection device 30.

The line connection device 30 has the same function as the line connection device 4 and the line connection device 5 shown in FIGS. 1 and 2 (modem function or terminal adapter function, etc.).
A first line connecting section 31 and a second line connecting section 32 having
It has.

The line connection device 30 has the pager terminal ID check unit 13 and the confirmation ID check unit 1.
An access permission / rejection determination unit 33 that determines whether access is finally permitted or denied based on the check result of No. 6 is provided. This access permission / rejection determination unit 33
Is also a functional module achieved by the CPU executing the operation program stored in the memory of the line connection device 30. In the first embodiment, the functions included in the host computer 2 (see FIG. (Not shown).

That is, in the present embodiment, all the processing for rejecting the illegal access, which is performed by the host computer 2 in the first embodiment, is performed in the line connection device 30. Therefore, just by connecting the above-mentioned line connection device 30 to the line interface part of the conventional host computer, without making any special changes to the conventional system, as in the case of the above-mentioned first embodiment, the outsider can be securely connected. High security can be secured by denying illegal access from.

[0065]

As described above, in the communication system according to the first aspect of the present invention, the terminal station and the host station are the first for data communication.
And the first line is a different line and confirmed I
A registration means for connecting two lines to the D notification second line to the public communication line so that they can be simultaneously connected, and the host station registers the line number of the terminal station corresponding to the second line. And a confirmation ID generating means for dynamically generating a confirmation ID each time the terminal station is accessed through the first line, and a confirmation ID generated by the confirmation ID generating means in the registration means. Confirmation ID notifying means for transmitting to the terminal station through the second line of the registered line number of the terminal station, and after confirming the confirmation ID to the terminal station, it is sent from the terminal station through the first line. Confirmed ID
The terminal station is provided with a confirmation ID check means for judging whether or not it matches the notified confirmation ID, and officially authorizing access to the terminal device only when both match.
The configuration is provided with a confirmation ID receiving means for receiving the confirmation ID from the host station transmitted through the line.

Therefore, since the confirmation ID for determining whether or not to permit access is dynamically changed by random number generation or the like, the password is decrypted and the access is repeatedly tried and confirmed. It is almost impossible to decipher the combination of ID character strings using a computer, and it is possible to reliably prevent illegal access that cannot be prevented only with a password, so that it is possible to ensure high security. .

As described above, in the communication system of the second aspect of the present invention, in the configuration of the first aspect of the invention, the confirmation ID receiving means of the terminal station receives the information transmitted from the radio station of the pager system. Pager terminal means to
Confirmation I transmitted from the host station through the second line
The configuration D is notified to the pager terminal means of the terminal station via the wireless station of the pager system.

Therefore, in addition to the effect of the invention of claim 1, if the pager terminal means is carried, it is within the communicable area of the pager system, and if it is within the communicable area of the pager system, the wired public communication line is sent from an unspecified place The effect that it is possible to access the host station by using the (first line) is also obtained.

[Brief description of drawings]

FIG. 1 shows an embodiment of the present invention, and is a schematic overall configuration diagram of a communication system.

FIG. 2 is a block diagram showing a configuration of a main part of a host computer of the communication system of FIG.

FIG. 3 shows another embodiment of the present invention and is a schematic configuration diagram of a main part of a communication system.

4 is a block diagram showing a configuration of a main part of a line connection device with a pager terminal function of the communication system of FIG.

5 shows still another embodiment of the present invention, and is a block diagram showing another configuration example of the line connection device with a pager terminal function of the communication system of FIG.

FIG. 6 shows still another embodiment of the present invention, and is a schematic configuration diagram of a main part of a communication system.

7 is a block diagram showing a configuration of a main part of a line connection device of the communication system of FIG.

FIG. 8 is a schematic overall configuration diagram of a conventional communication system.

FIG. 9 is a schematic overall configuration diagram showing another configuration of a conventional communication system.

[Explanation of symbols]

 1 public communication line 2 host computer (host station) 3 terminal device (terminal station) 4 line connection device (host station) 5 line connection device (host station) 6 line connection device (terminal station) 7 pager terminal (terminal station, pager) Terminal means) 11 Pager terminal ID registration section (registration section) 12 Pager terminal ID reminder section 13 Pager terminal ID check section 14 Confirmation ID generation section (confirmation ID generation section) 15 Confirmation ID transmission section (confirmation ID notification section) 16 Confirmation ID Check unit (confirmation ID checking unit) 20 Pager terminal function-equipped line connection device (terminal station) 21 Line connection unit 22 Pager terminal unit (pager terminal unit) 23 Display unit 24 Automatic input unit 30 Line connection device (host station) 31 1 line connection unit 32 second line connection unit 33 access permission / rejection determination unit a first line b second Line

Claims (2)

[Claims] 1. In a communication system in which a terminal station on a public communication line accesses a host station through the public communication line, the terminal station and the host station are a first line for data communication,
Two lines different from the first line and a second line for confirmation ID notification are connected to a public communication line so that they can be simultaneously connected, and the host station connects to the second line. Registration means for registering the line number of the corresponding terminal station, and when accessed from the terminal station through the first line,
Through the confirmation ID generation means for dynamically generating the confirmation ID each time the access is made, and the confirmation ID generated by the confirmation ID generation means through the second line of the line number of the terminal station registered in the registration means. , Confirmation ID notifying means for transmitting to the terminal station, and whether or not the confirmation ID sent from the terminal station through the first line after notifying the confirmation ID to the terminal station is the same as the notified confirmation ID. And a confirmation ID check means for officially permitting access to the terminal device only when both are matched, and the terminal station receives the confirmation ID from the host station transmitted through the second line. A communication system comprising a receiving means. 2. The confirmation ID receiving means of the terminal station is a pager terminal means for receiving information transmitted from a radio station of the pager system, and the confirmation I transmitted from the host station through the second line.
2. The communication system according to claim 1, wherein D is notified to the pager terminal means of the terminal station via the wireless station of the pager system.