JP7660156B2 - Electronic device and communication method - Google Patents

Description

The present invention relates to an electronic device and a communication method.

Personal computers (PCs) and other devices are increasingly receiving data from devices such as web cameras via the Internet and using the received data. As devices connected to the Internet are exposed to threats such as computer viruses, improved security is required.

Patent Document 1 discloses a network system that includes a host device connected to a home network that can connect to the Internet, and a smart device connected to a virtual network that is logically separated from the home network. In this network system, the smart device is connected to the virtual network that is logically separated from the home network, and the smart device cannot be directly connected to the Internet, improving security.

JP 2021-184532 A

As mentioned above, there is a demand for improved security in devices connected to the Internet.

The present invention aims to provide an electronic device and a communication method that can improve security.

One aspect of the present invention is an electronic device comprising: a storage medium; a physical network interface card; a first application on a host OS (Operating System); a second application on a virtual OS; and a processor that functions as a virtual network interface card, wherein the second application performs encrypted communication with a device on the Internet via the virtual network interface card and the physical network interface card, receives data through the encrypted communication, and stores the data in the storage medium, the first application and the second application perform communication of authentication data via the virtual network interface card and the physical network interface card, the second application performs authentication processing of the first application based on the authentication data received from the first application, and if authentication of the first application is successful, the first application and the second application perform communication of the data stored in the storage medium via the virtual network interface card and the physical network interface card, and access permission to the data stored in the storage medium from the second application is set, and access prohibition to the data stored in the storage medium from the first application is set .

In one aspect of the present invention, the second application may process the data stored in the storage medium, and if authentication of the first application is successful, the first application and the second application may communicate the data processed by the second application via the virtual network interface card and the physical network interface card.

One aspect of the present invention is a communication method executed by a processor functioning as a first application on a host OS (Operating System), a second application on a virtual OS, and a virtual network interface card, the communication method including the steps of: the second application executing encrypted communication with a device on the Internet via the virtual network interface card and a physical network interface card, and receiving data through the encrypted communication; the second application storing the data in a storage medium; the first application and the second application executing communication of authentication data via the virtual network interface card and the physical network interface card; the second application executing authentication processing of the first application based on the authentication data received from the first application; and, if authentication of the first application is successful, the first application and the second application executing communication of the data stored in the storage medium via the virtual network interface card and the physical network interface card, wherein access permission to the data stored in the storage medium from the second application is set, and access prohibition to the data stored in the storage medium from the first application is set .

According to the present invention, electronic devices and communication methods can improve security.

1 is a block diagram showing an example of a hardware configuration of an electronic device according to an embodiment of the present invention. 1 is a block diagram showing an example of a functional configuration of an electronic device according to an embodiment of the present invention. FIG. 2 is a diagram showing an example of communication performed by an electronic device according to an embodiment of the present invention.

Hereinafter, an embodiment of the present invention will be described with reference to the drawings. FIG. 1 shows an example of a hardware configuration of an electronic device 10 according to an embodiment of the present invention. The electronic device 10 is a desktop or notebook PC, a tablet terminal, a smartphone, or the like. As shown in FIG. 1, the electronic device 10 has a communication unit 11, a display unit 12, an operation unit 13, a memory unit 14, and a control unit 15.

The communication unit 11 is a network interface card (NIC) that incorporates a communication circuit for connecting to the Internet via a LAN (Local Area Network). The communication unit 11 connects to the Internet and communicates with external devices on the Internet. The communication unit 11 may have a wireless communication function.

The display unit 12 is a display such as an LCD (Liquid Crystal Display). The display unit 12 displays various data and information.

The operation unit 13 has a keyboard, mouse, buttons, etc. that the user operates to input information. The operation unit 13 outputs information according to the operation performed by the user to the control unit 15.

The storage unit 14 has a storage medium such as a hard disk drive (HDD), a solid state drive (SSD), a random access memory (RAM), or a read only memory (ROM). The storage unit 14 stores data received from an external device, data generated by the control unit 15, and programs for implementing the functions of the control unit 15.

The control unit 15 has a processor 150 such as a CPU (Central Processing Unit) or a GPU (Graphic Processing Unit), and an EC (Embedded Controller) 151. The control unit 15 controls each part within the electronic device 10.

Figure 2 shows an example of the functional configuration of electronic device 10. As shown in Figure 2, electronic device 10 has, as its functional configuration, a host OS (operating system) 20, a first application 21, a virtual OS 30, a second application 31, a virtual NIC 32, a physical NIC 40, and a storage medium 50.

The host OS 20 and the virtual OS 30 operate when the processor 150 executes the programs of each OS stored in the memory unit 14. For example, the host OS 20 is Windows (registered trademark), and the virtual OS 30 is realized by using the virtual OS function of Windows (registered trademark).

The first application 21 runs on the host OS 20. The second application 31 runs on the virtual OS 30. The first application 21 and the second application 31 run when the processor 150 executes the programs of each application stored in the memory unit 14.

The physical NIC 40 is a physical device that corresponds to the communication unit 11. The physical NIC 40 is managed by the host OS 20. The first application 21 can connect to the Internet INT via the physical NIC 40.

The virtual NIC 32 is a virtual device managed by the virtual OS 30. The second application 31 can connect to the Internet INT via the virtual NIC 32 and the physical NIC 40. The first application 21 and the second application 31 communicate with each other via the virtual NIC 32 and the physical NIC 40. The communication between the first application 21 and the second application 31 is performed without going through the Internet INT.

A device 60 such as a web camera is connected to the Internet INT. A second application 31 communicates with the device 60 via a virtual NIC 32 and a physical NIC 40, and receives data from the device 60. The communication between the second application 31 and the device 60 is encrypted by using a communication protocol such as HTTPS (Hytertext Transfer Protocol Secure) or SSH (Secure Shell).

The storage medium 50 is a physical device corresponding to the storage unit 14. The storage medium 50 stores data received by the second application 31 from the device 60.

The virtual OS 30 constitutes a network that is isolated from the Internet INT. Communication between the second application 31 and the device 60 is encrypted. The first application 21 cannot directly refer to the data stored in the storage medium 50, and acquires the data through communication via the virtual NIC 32 and the physical NIC 40. Before communication of the data is executed, the second application 31 executes authentication processing of the first application 21. If authentication of the first application 21 is successful, the first application 21 can acquire the data stored in the storage medium 50 from the second application 31. By configuring the electronic device 10 in this way, threats from the Internet can be avoided.

When the first application 21 requires data that has been modified from data stored in the storage medium 50, the second application 31 processes the data stored in the storage medium 50. The first application 21 communicates with the second application 31 via the virtual NIC 32 and the physical NIC 40, and receives the modified data. Because applications running on the host OS 20 cannot directly modify data, even if a malicious program runs on the host OS 20, the effects of that program can be avoided.

The operation of the electronic device 10 will be described with reference to FIG. 3. FIG. 3 shows an example of communication performed by the electronic device 10.

(Step S200)
The second application 31 connects to the device 60 via the virtual NIC 32 and the physical NIC 40 .

(Step S201)
The second application 31 receives data held by the device 60 from the device 60 via the virtual NIC 32 and the physical NIC 40. For example, if the device 60 is a Web camera, the second application 31 receives video data from the device 60. In steps S200 and S201, encrypted communication is performed according to a communication protocol such as HTTPS or SSH. The second application 31 receives the encrypted data from the device 60.

(Step S202)
The second application 31 decrypts the data received from the device 60. The second application 31 stores the decrypted data in the storage medium 50. The second application 31 may encrypt the decrypted data and store the data in the storage medium 50.

(Step S203)
The second application 31 sets access authority for data stored in the storage medium 50. At this time, the second application 31 permits access to the data from the second application 31 and prohibits access to the data from the first application 21. The second application 31 also prohibits access to the data from other applications operating on the host OS 20.

(Step S100)
When the data stored in the storage medium 50 is required, the first application 21 sends an authentication request to the second application 31 via the virtual NIC 32 and the physical NIC 40. The authentication request includes authentication data necessary for the second application 31 to execute authentication processing.

(Step S204)
The second application 31 receives an authentication request from the first application 21 via the virtual NIC 32 and the physical NIC 40 .

(Step S205)
The second application 31 performs the authentication process by using the authentication data included in the authentication request. Three examples of the authentication process are described below.

In a first example, the authentication data is an ID and a password. A specific ID and a specific password are stored in the storage medium 50. Access to the ID and its password from the second application 31 is permitted, but access to the ID and its password from the first application 21 is prohibited. The first application 21 sends an authentication request including the ID and password as authentication data to the second application 31.

The second application 31 compares the ID included in the authentication request with a specific ID stored in the storage medium 50, and compares the password included in the authentication request with a specific password stored in the storage medium 50. If the two IDs match and the two passwords match, the second application 31 succeeds in authenticating the first application 21. In any other case, the second application 31 fails to authenticate the first application 21.

In the second example, an authentication process using the RSA encryption method is performed. The second application 31 holds the public key of the first application 21 in advance. The first application 21 sends an authentication request to the second application 31, which includes authentication data signed with the private key of the first application 21.

The second application 31 verifies the signature of the authentication data included in the authentication request by using the public key of the first application 21. If this verification is successful, the second application 31 succeeds in authenticating the first application 21. If this verification fails, the second application 31 fails to authenticate the first application 21.

In a third example, a common key is used. The first application 21 and the second application 31 share the common key. The first application 21 generates a message authentication code by using predetermined data and the common key. The first application 21 sends an authentication request to the second application 31, the request including the message authentication code as authentication data.

The second application 31 generates a message authentication code by using the specified data and the common key. The second application 31 compares the message authentication code it generates with the message authentication code included in the authentication request. If the two message authentication codes match, the second application 31 successfully authenticates the first application 21. If the two message authentication codes do not match, the second application 31 fails to authenticate the first application 21.

(Step S206)
If the authentication of the first application 21 is successful, the second application 31 transmits an authentication response indicating the result of the authentication process to the first application 21 via the virtual NIC 32 and the physical NIC 40 .

(Step S101)
The first application 21 receives the authentication response from the second application 31 via the virtual NIC 32 and the physical NIC 40. If the authentication response indicates that authentication of the first application 21 has failed, the first application 21 cannot receive the data stored in the storage medium 50 from the second application 31.

(Step S102)
If the authentication response indicates that authentication of the first application 21 has been successful, the first application 21 sends a data transmission request to the second application 31 via the virtual NIC 32 and the physical NIC 40 to request the second application 31 to transmit data stored in the storage medium 50.

(Step S207)
The second application 31 receives a data transmission request from the first application 21 via the virtual NIC 32 and the physical NIC 40 .

(Step S208)
The second application 31 reads data from the storage medium 50. If the data is encrypted, the second application 31 decrypts the data. For example, video data is stored in the storage medium 50, and the data transmission request includes data indicating a time range. The time range indicates a start time and an end time. The second application 31 generates processed data by extracting data corresponding to the time range from the video data. The second application 31 may generate processed data by performing image processing on the video data to change the image quality of the video data. The image processing is brightness adjustment, edge emphasis, or the like.

(Step S209)
The second application 31 transmits the processed data to the first application 21 via the virtual NIC 32 and the physical NIC 40 .

(Step S103)
The first application 21 receives data from the second application 31 via the virtual NIC 32 and the physical NIC 40. Through the above procedure, the first application 21 can obtain the data stored in the storage medium 50.

As described above, the processor 150 functions as the first application 21 on the host OS 20, the second application 31 on the virtual OS 30, and the virtual NIC 32. The second application 31 performs encrypted communication with the device 60 on the Internet INT via the virtual NIC 32 and the physical NIC 40, receives data through encrypted communication, and stores the data in the storage medium 50. The first application 21 and the second application 31 perform communication of authentication data via the virtual NIC 32 and the physical NIC 40. The second application 31 performs authentication processing of the first application 21 based on the authentication data received from the first application 21. If the authentication of the first application 21 is successful, the first application 21 and the second application 31 perform communication of data stored in the storage medium 50 via the virtual NIC 32 and the physical NIC 40. With the above configuration, the electronic device 10 can improve security.

The second application 31 is permitted to access the data stored in the storage medium 50. The first application 21 is prohibited from accessing the data stored in the storage medium 50. Since the first application 21 cannot directly reference the data stored in the storage medium 50, it is possible to avoid the influence of unauthorized programs running on the host OS 20.

The second application 31 processes data stored in the storage medium 50. If authentication of the first application 21 is successful, the first application 21 and the second application 31 communicate the data processed by the second application 31 via the virtual NIC 32 and the physical NIC 40. Because the first application 21 does not directly process the data, it is possible to avoid the influence of unauthorized programs running on the host OS 20.

The above describes the embodiments of the present invention in detail with reference to the drawings, but the specific configuration is not limited to the above embodiments and includes design modifications within the scope of the present invention.

10 Electronic device, 11 Communication unit, 12 Display unit, 13 Operation unit, 14 Storage unit, 15 Control unit, 20 Host OS, 21 First application, 30 Virtual OS, 31 Second application, 32 Virtual NIC, 40 Physical NIC, 50 Storage medium

Claims (3)

A storage medium;
A physical network interface card;
A processor that functions as a first application on a host OS (Operating System), a second application on a virtual OS, and a virtual network interface card;
Equipped with
the second application performs encrypted communication with a device on the Internet via the virtual network interface card and the physical network interface card, receives data through the encrypted communication, and stores the data in the storage medium;
the first application and the second application communicate authentication data via the virtual network interface card and the physical network interface card;
The second application performs an authentication process for the first application based on the authentication data received from the first application;
If the authentication of the first application is successful, the first application and the second application execute communication of the data stored in the storage medium via the virtual network interface card and the physical network interface card;
an access permission for the second application to access the data stored in the storage medium is set;
An electronic device in which access to the data stored in the storage medium from the first application is prohibited. The second application processes the data stored in the storage medium;
2. The electronic device of claim 1, wherein if authentication of the first application is successful, the first application and the second application execute communication of the data processed by the second application via the virtual network interface card and the physical network interface card. A communication method executed by a processor functioning as a first application on a host OS (Operating System), a second application on a virtual OS, and a virtual network interface card, comprising:
the second application executing encrypted communication with a device on the Internet via the virtual network interface card and the physical network interface card, and receiving data through the encrypted communication;
the second application storing the data on a storage medium;
said first application and said second application performing communication of authentication data via said virtual network interface card and said physical network interface card;
the second application performing an authentication process for the first application based on the authentication data received from the first application;
if the authentication of the first application is successful, the first application and the second application execute communication of the data stored in the storage medium via the virtual network interface card and the physical network interface card;
Including,
an access permission for the second application to access the data stored in the storage medium is set;
Access to the data stored in the storage medium from the first application is prohibited.
Communication methods.

Images