Electronic device and communication method

Abstract

To provide an electronic device and communication method capable of improving security.SOLUTION: An electronic device includes a storage medium, a physical network interface card (NIC), and a processor. The processor functions as a first application on a host OS, a second application on a virtual OS, and a virtual NIC. The second application receives data from a device on the Internet via the virtual NIC and the physical NIC. The second application executes authentication processing for the first application. If the authentication for the first application is successful, the first application and the second application execute communication of the data via the virtual NIC and the physical NIC.SELECTED DRAWING: Figure 2

Description

[Technical field]

[0001] The present invention relates to an electronic device and a communication method. [Background technology]

[0002] The number of occasions when personal computers (PCs) receive data from devices such as web cameras via the Internet and use the received data is increasing. Devices connected to the Internet are exposed to threats such as computer viruses, so there is a demand for improved security.

[0003] Patent Document 1 discloses a network system including a host device connected to a home network that can connect to the Internet and a smart device connected to a virtual network that is logically separated from the home network. In this network system, the smart device is connected to the virtual network that is logically separated from the home network, and the smart device cannot be directly connected to the Internet, improving security. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] JP 2021-184532 A Summary of the Invention [Problem to be solved by the invention]

[0005] As described above, there is a demand for improved security in devices connected to the Internet.

[0006] An object of the present invention is to provide an electronic device and a communication method capable of improving security. [Means for solving the problem]

[0007] One aspect of the present invention includes a storage medium, a physical network interface card, a first application on a host OS (Operating System), a second application on a virtual OS, and a processor that functions as a virtual network interface card, wherein the second application performs encrypted communication with a device on the Internet via the virtual network interface card and the physical network interface card, receives data through the encrypted communication, and stores the data in the storage medium, the first application and the second application perform communication of authentication data via the virtual network interface card and the physical network interface card, the second application performs authentication processing of the first application based on the authentication data received from the first application, and if authentication of the first application is successful, the first application and the second application perform communication of the data stored in the storage medium via the virtual network interface card and the physical network interface card. An access permission to the data stored in the storage medium from the second application is set, and an access prohibition to the data stored in the storage medium from the first application is set. It is an electronic device.

[0009] In one embodiment of the present invention, the second application may process the data stored in the storage medium, and if authentication of the first application is successful, the first application and the second application may perform communication of the data processed by the second application via the virtual network interface card and the physical network interface card.

[0010] One aspect of the present invention is a communication method executed by a processor functioning as a first application on a host OS (Operating System), a second application on a virtual OS, and a virtual network interface card, the method including the steps of: the second application executing encrypted communication with a device on the Internet via the virtual network interface card and a physical network interface card, and receiving data through the encrypted communication; the second application storing the data in a storage medium; the first application and the second application executing communication of authentication data via the virtual network interface card and the physical network interface card; the second application executing authentication processing of the first application based on the authentication data received from the first application; and, if authentication of the first application is successful, the first application and the second application executing communication of the data stored in the storage medium via the virtual network interface card and the physical network interface card. an access permission from the second application to the data stored in the storage medium is set, and an access prohibition from the first application to the data stored in the storage medium is set It is a method of communication. Effect of the Invention

[0011] According to the present invention, the electronic device and the communication method can improve security. [Brief description of the drawings]

[0012] [Figure 1] 1 is a block diagram showing an example of a hardware configuration of an electronic device according to an embodiment of the present invention. [Diagram 2] 1 is a block diagram showing an example of a functional configuration of an electronic device according to an embodiment of the present invention. [Diagram 3] FIG. 2 is a diagram showing an example of communication performed by an electronic device according to an embodiment of the present invention. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0013] Hereinafter, an embodiment of the present invention will be described with reference to the drawings. FIG. 1 shows an example of a hardware configuration of an electronic device 10 according to an embodiment of the present invention. The electronic device 10 is a desktop or notebook PC, a tablet terminal, a smartphone, or the like. As shown in FIG. 1, the electronic device 10 has a communication unit 11, a display unit 12, an operation unit 13, a storage unit 14, and a control unit 15.

[0014] The communication unit 11 is a network interface card (NIC) that includes a communication circuit for connecting to the Internet via a LAN (Local Area Network). The communication unit 11 connects to the Internet and communicates with external devices on the Internet. The communication unit 11 may have a wireless communication function.

[0015] The display unit 12 is a display such as an LCD (Liquid Crystal Display), and displays various types of data and information.

[0016] The operation unit 13 has a keyboard, a mouse, buttons, etc. that the user operates to input information. The operation unit 13 outputs to the control unit 15 information corresponding to the operation performed by the user.

[0017] The storage unit 14 has a storage medium such as a hard disk drive (HDD), a solid state drive (SSD), a random access memory (RAM), or a read only memory (ROM), etc. The storage unit 14 stores data received from an external device, data generated by the control unit 15, and a program for realizing the functions of the control unit 15.

[0018] The control unit 15 includes a processor 150 such as a CPU (Central Processing Unit) or a GPU (Graphic Processing Unit), and an EC (Embedded Controller) 151. The control unit 15 controls each unit in the electronic device 10.

[0019] Fig. 2 shows an example of a functional configuration of the electronic device 10. As shown in Fig. 2, the electronic device 10 has, as its functional configuration, a host OS (Operating System) 20, a first application 21, a virtual OS 30, a second application 31, a virtual NIC 32, a physical NIC 40, and a storage medium 50.

[0020] The host OS 20 and the virtual OS 30 operate by the processor 150 executing the programs of the respective OSs stored in the storage unit 14. For example, the host OS 20 is Windows (registered trademark), and the virtual OS 30 is realized by using the virtual OS function of Windows (registered trademark).

[0021] The first application 21 runs on the host OS 20. The second application 31 runs on the virtual OS 30. The first application 21 and the second application 31 run when the processor 150 executes the programs of the respective applications stored in the storage unit 14.

[0022] The physical NIC 40 is a physical device corresponding to the communication unit 11. The physical NIC 40 is managed by the host OS 20. The first application 21 can connect to the Internet INT via the physical NIC 40.

[0023] The virtual NIC 32 is a virtual device managed by the virtual OS 30. The second application 31 can connect to the Internet INT via the virtual NIC 32 and the physical NIC 40. The first application 21 and the second application 31 communicate with each other via the virtual NIC 32 and the physical NIC 40. The communication between the first application 21 and the second application 31 is performed without passing through the Internet INT.

[0024] A device 60 such as a web camera is connected to the Internet INT. A second application 31 communicates with the device 60 via a virtual NIC 32 and a physical NIC 40, and receives data from the device 60. The communication between the second application 31 and the device 60 is encrypted by using a communication protocol such as HTTPS (Hytertext Transfer Protocol Secure) or SSH (Secure Shell).

[0025] The storage medium 50 is a physical device corresponding to the storage unit 14. The storage medium 50 stores data that the second application 31 receives from the device 60.

[0026] The virtual OS 30 constitutes a network separated from the Internet INT. The communication between the second application 31 and the device 60 is encrypted. The first application 21 cannot directly refer to the data stored in the storage medium 50, and acquires the data through communication via the virtual NIC 32 and the physical NIC 40. Before the communication of the data is executed, the second application 31 executes an authentication process for the first application 21. If the authentication of the first application 21 is successful, the first application 21 can acquire the data stored in the storage medium 50 from the second application 31. By configuring the electronic device 10 in this way, threats from the Internet can be avoided.

[0027] When the first application 21 requires data that has been modified from data stored in the storage medium 50, the second application 31 modifies the data stored in the storage medium 50. The first application 21 communicates with the second application 31 via the virtual NIC 32 and the physical NIC 40, and receives the modified data. Since an application running on the host OS 20 cannot directly modify data, even if an unauthorized program runs on the host OS 20, the effects of the program can be avoided.

[0028] The operation of the electronic device 10 will be described with reference to Fig. 3. Fig. 3 shows an example of communication performed by the electronic device 10.

[0029] (Step S200) The second application 31 connects to the device 60 via the virtual NIC 32 and the physical NIC 40 .

[0030] (Step S201) The second application 31 receives data held by the device 60 from the device 60 via the virtual NIC 32 and the physical NIC 40. For example, if the device 60 is a Web camera, the second application 31 receives video data from the device 60. In steps S200 and S201, encrypted communication is performed according to a communication protocol such as HTTPS or SSH. The second application 31 receives the encrypted data from the device 60.

[0031] (Step S202) The second application 31 decrypts the data received from the device 60. The second application 31 stores the decrypted data in the storage medium 50. The second application 31 may also encrypt the decrypted data and store the data in the storage medium 50.

[0032] (Step S203) The second application 31 sets access authority for data stored in the storage medium 50. At this time, the second application 31 permits access to the data from the second application 31 and prohibits access to the data from the first application 21. The second application 31 also prohibits access to the data from other applications running on the host OS 20.

[0033] (Step S100) When data stored in the storage medium 50 is required, the first application 21 sends an authentication request to the second application 31 via the virtual NIC 32 and the physical NIC 40. The authentication request includes authentication data necessary for the second application 31 to perform authentication processing.

[0034] (Step S204) The second application 31 receives an authentication request from the first application 21 via the virtual NIC 32 and the physical NIC 40 .

[0035] (Step S205) The second application 31 performs the authentication process by using the authentication data included in the authentication request. Three examples of the authentication process are described below.

[0036] In a first example, the authentication data is an ID and a password. A predetermined ID and a predetermined password are stored in the storage medium 50. Access to the ID and the password from the second application 31 is permitted, but access to the ID and the password from the first application 21 is prohibited. The first application 21 transmits an authentication request including the ID and the password as authentication data to the second application 31.

[0037] The second application 31 compares the ID included in the authentication request with a predetermined ID stored in the storage medium 50, and compares the password included in the authentication request with a predetermined password stored in the storage medium 50. If the two IDs match and the two passwords match, the second application 31 succeeds in authenticating the first application 21. In any other case, the second application 31 fails to authenticate the first application 21.

[0038] In the second example, an authentication process using RSA encryption is executed. The second application 31 holds in advance the public key of the first application 21. The first application 21 transmits to the second application 31 an authentication request including authentication data signed with the private key of the first application 21.

[0039] The second application 31 verifies the signature of the authentication data included in the authentication request by using the public key of the first application 21. If this verification is successful, the second application 31 succeeds in authenticating the first application 21. If this verification is unsuccessful, the second application 31 fails to authenticate the first application 21.

[0040] In a third example, a common key is used. The first application 21 and the second application 31 share the common key. The first application 21 generates a message authentication code by using predetermined data and the common key. The first application 21 sends an authentication request to the second application 31, which includes the message authentication code as authentication data.

[0041] The second application 31 generates a message authentication code by using the predetermined data and the common key. The second application 31 compares the message authentication code it generates with the message authentication code included in the authentication request. If the two message authentication codes match, the second application 31 successfully authenticates the first application 21. If the two message authentication codes do not match, the second application 31 fails to authenticate the first application 21.

[0042] (Step S206) If the authentication of the first application 21 is successful, the second application 31 transmits an authentication response indicating the result of the authentication process to the first application 21 via the virtual NIC 32 and the physical NIC 40 .

[0043] (Step S101) The first application 21 receives the authentication response from the second application 31 via the virtual NIC 32 and the physical NIC 40. If the authentication response indicates that authentication of the first application 21 has failed, the first application 21 cannot receive the data stored in the storage medium 50 from the second application 31.

[0044] (Step S102) If the authentication response indicates that authentication of the first application 21 has been successful, the first application 21 sends a data transmission request to the second application 31 via the virtual NIC 32 and the physical NIC 40 to request the second application 31 to transmit data stored in the storage medium 50.

[0045] (Step S207) The second application 31 receives a data transmission request from the first application 21 via the virtual NIC 32 and the physical NIC 40 .

[0046] (Step S208) The second application 31 reads data from the storage medium 50. If the data is encrypted, the second application 31 decrypts the data. For example, video data is stored in the storage medium 50, and the data transmission request includes data indicating a time range. The time range indicates a start time and an end time. The second application 31 generates processed data by extracting data corresponding to the time range from the video data. The second application 31 may generate processed data by performing image processing on the video data that changes the image quality of the video data. The image processing is brightness adjustment, edge enhancement, or the like.

[0047] (Step S209) The second application 31 transmits the processed data to the first application 21 via the virtual NIC 32 and the physical NIC 40 .

[0048] (Step S103) The first application 21 receives data from the second application 31 via the virtual NIC 32 and the physical NIC 40. Through the above procedure, the first application 21 can obtain the data stored in the storage medium 50.

[0049] As described above, the processor 150 functions as the first application 21 on the host OS 20, the second application 31 on the virtual OS 30, and the virtual NIC 32. The second application 31 performs encrypted communication with the device 60 on the Internet INT via the virtual NIC 32 and the physical NIC 40, receives data through the encrypted communication, and stores the data in the storage medium 50. The first application 21 and the second application 31 perform communication of authentication data via the virtual NIC 32 and the physical NIC 40. The second application 31 performs authentication processing of the first application 21 based on the authentication data received from the first application 21. If the authentication of the first application 21 is successful, the first application 21 and the second application 31 perform communication of data stored in the storage medium 50 via the virtual NIC 32 and the physical NIC 40. With the above configuration, the electronic device 10 can improve security.

[0050] An access permission is set for the second application 31 to access the data stored in the storage medium 50. An access prohibition is set for the first application 21 to access the data stored in the storage medium 50. Since the first application 21 cannot directly refer to the data stored in the storage medium 50, the influence of an unauthorized program operating on the host OS 20 can be avoided.

[0051] The second application 31 processes the data stored in the storage medium 50. If the authentication of the first application 21 is successful, the first application 21 and the second application 31 execute communication of the data processed by the second application 31 via the virtual NIC 32 and the physical NIC 40. Since the first application 21 does not directly process the data, the influence of an unauthorized program operating on the host OS 20 can be avoided.

[0052] Although an embodiment of the present invention has been described in detail above with reference to the drawings, the specific configuration is not limited to the above embodiment, and design modifications and the like that do not deviate from the gist of the present invention are also included. [Explanation of symbols]

[0053] 10 Electronic device, 11 Communication unit, 12 Display unit, 13 Operation unit, 14 Memory unit, 15 Control unit, 20 Host OS, 21 First application, 30 Virtual OS, 31 Second application, 32 Virtual NIC, 40 Physical NIC, 50 Storage medium

Claims

1. A storage medium; A physical network interface card; A processor that functions as a first application on a host OS (Operating System), a second application on a virtual OS, and a virtual network interface card; Equipped with the second application performs encrypted communication with a device on the Internet via the virtual network interface card and the physical network interface card, receives data through the encrypted communication, and stores the data in the storage medium; the first application and the second application communicate authentication data via the virtual network interface card and the physical network interface card; The second application performs an authentication process for the first application based on the authentication data received from the first application; If the authentication of the first application is successful, the first application and the second application execute communication of the data stored in the storage medium via the virtual network interface card and the physical network interface card; an access permission for the second application to access the data stored in the storage medium is set; Access to the data stored in the storage medium from the first application is prohibited. electronic equipment.

2. The second application processes the data stored in the storage medium; If the authentication of the first application is successful, the first application and the second application execute communication of the data modified by the second application via the virtual network interface card and the physical network interface card.

2. The electronic device according to claim 1.

3. A communication method executed by a processor functioning as a first application on a host OS (Operating System), a second application on a virtual OS, and a virtual network interface card, comprising: the second application executing encrypted communication with a device on the Internet via the virtual network interface card and the physical network interface card, and receiving data through the encrypted communication; the second application storing the data on a storage medium; said first application and said second application performing communication of authentication data via said virtual network interface card and said physical network interface card; the second application performing an authentication process for the first application based on the authentication data received from the first application; if the authentication of the first application is successful, the first application and the second application execute communication of the data stored in the storage medium via the virtual network interface card and the physical network interface card; Including, an access permission for the second application to access the data stored in the storage medium is set; Access to the data stored in the storage medium from the first application is prohibited. Communication methods.

Images