JP2004328230A - VPN environment introduction support system, terminal device and server device used in the system - Google Patents

Abstract

An object of the present invention is to provide a VPN environment introduction support system that enables even a user of a terminal device having no specialized knowledge of VPN introduction to easily introduce a VPN to the terminal device.
An internal network provided with a VPN gateway having a VPN function, and processing information relating to a VPN connection transmitted from a manager server are stored, and processing is executed based on an instruction from the manager server. Setting information for establishing a VPN session between the terminal device 20 including an agent for transmitting a processing result to the manager server 30 and the VPN gateway 12 as processing information, and establishing a VPN session based on the setting information An agent instruction unit 35 for transmitting an instruction to the agent of the terminal device 20 and a manager server 30 having a connection result database 36 for storing processing results received from the agent are connected via the Internet 40.
[Selection diagram] Fig. 1

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to a VPN environment introduction support system that supports the introduction of a VPN (Virtual Private Network) environment to a terminal device that remotely accesses an information terminal in a LAN (Local Area Network) connected to the Internet while ensuring security. The present invention relates to a terminal device and a server device used in this system.
[0002]
[Prior art]
For example, there is a method of using a dedicated line as a method of connecting a LAN built in a company from the outside while ensuring security. The method using the dedicated line has a problem that the cost for maintaining and managing the dedicated line is high, and the position where the dedicated line can be connected is fixed. However, in recent years, even when the Internet exists on a route connected to the LAN by the VPN technology, it is necessary to secure the security using the encryption technology and connect to the LAN from the outside as in the case of connecting with a dedicated line. Has become possible. In addition, since the processing is performed via the Internet, the cost can be reduced.
[0003]
Recently, a mobile phone having an Internet access function has become widespread, and a technique for using the mobile phone to connect to a LAN (intranet) connected to the Internet while ensuring security has been proposed. For example, when a terminal ID assigned to a device on the LAN is input from a mobile phone, the terminal ID between the VPN gateway and the gateway device on the LAN is controlled according to a command from a VPN session management server on the Internet. A VPN tunnel is set up, and when a terminal ID and a device name are input from a mobile phone to access a device on the corresponding LAN, the VPN session management server is replaced with a VPN by the VPN session management server. A system for performing proxy access via a tunnel is disclosed (for example, see Patent Document 1).
[0004]
[Patent Document 1]
JP-A-2002-232460 (page 1, FIG. 1)
[0005]
[Problems to be solved by the invention]
However, an information terminal in a LAN already equipped with a device for performing communication using a VPN, such as a VPN gateway, is connected to an information terminal outside the LAN that is planning to perform communication such as remote access using the VPN. When introducing a VPN environment to a terminal device, an operator must perform various complicated settings. For example, after the VPN client software is installed in the terminal device, setting information necessary for establishing a VPN session is input, a VPN session establishment operation is performed, the result is confirmed, and connection of a higher-level application to be used is performed. The operator has to manually perform multiple steps of checking the results. At this time, even if the setting information input to the terminal device is normal, depending on the Internet connection environment on the terminal device side, the VPN session may not be normally performed because the communication protocol necessary for establishing the VPN session is blocked. May not be established. When such a connection failure has occurred, the cause of the connection failure has been removed by performing a cause investigation by a specialized technician and changing the setting information of the terminal device according to the result.
[0006]
An operator who introduces a terminal device in a VPN environment is, in most cases, a user of the terminal device and does not have specialized knowledge on setting of a VPN. Therefore, when introducing a VPN environment to a terminal device, it is almost impossible for a worker who does not have specialized knowledge to identify the cause of a VPN connection failure or change setting information of the terminal device. was there. In addition, VPN setting by a specialized technician is a special operation compared to a simple operation such as a simple Internet connection of a terminal device, so that the cost is high, and for example, the introduction of a VPN environment to a home terminal device is hindered. There was also a problem that it became a factor.
[0007]
The prior art described in Patent Document 1 does not perform communication by performing VPN tunneling between a mobile phone (corresponding to a terminal device) and a gateway device on a LAN, and the VPN gateway replaces the mobile phone. In this case, VPN tunneling is performed to perform communication with a gateway device on a LAN, and there is no need to introduce a VPN environment into a mobile phone.
[0008]
The present invention has been made in view of the above, and is a VPN environment introduction support system capable of easily introducing a VPN to a terminal device even if a user of the terminal device does not have specialized knowledge about VPN introduction. And a terminal device and a server device used in the system.
[0009]
[Means for Solving the Problems]
In order to achieve the above object, a VPN environment introduction support system according to the present invention establishes a VPN connection with a regional network having a VPN gateway having a VPN function and communicates with a communication terminal in the regional network by establishing a VPN connection with the VPN gateway. And a server device that issues an instruction to the terminal device and supports VPN connection setting, is a VPN environment introduction support system connected via the Internet, wherein the terminal device includes: An agent for storing processing information relating to a VPN connection transmitted from the server device, executing a process based on an instruction from the server device, and transmitting a processing result to the server device; A VPN session is established with the VPN gateway as processing information. Agent instruction means for transmitting to the agent of the terminal device an instruction for establishing the VPN session based on the setting information, and a connection result database for storing the processing result received from the agent. It is characterized by having.
[0010]
BEST MODE FOR CARRYING OUT THE INVENTION
Preferred embodiments of a VPN environment introduction support system according to the present invention, and a terminal device and a server device used in the system will be described below in detail with reference to the accompanying drawings.
[0011]
FIG. 1 is a block diagram showing a configuration of an embodiment of a VPN environment introduction support system according to the present invention. The VPN environment introduction support system includes, for example, an internal network 10 such as a company, and a terminal device 20 existing outside the internal network 10 and trying to introduce a VPN environment to remotely access the internal network 10. A manager server 30 for supporting introduction of a VPN environment by the terminal device 20 is connected via the Internet 40.
[0012]
The organization network 10 is, for example, a LAN or a WAN (Wide Area Network) constructed in one company, and is connected to an application server 11 and an information terminal such as a terminal device (not shown). The application server 11 stores information related to the company and information related to work created by employees. Further, the in-house network 10 encrypts information transmitted from the internal information terminal to the outside, and decrypts the information transmitted from the outside to the internal terminal device by encrypting the information to the corresponding information terminal. It is connected to the Internet 40 via a VPN gateway 12 having a transmitting function.
[0013]
The terminal device 20 newly introduces a VPN environment, establishes a VPN session with the VPN gateway 12 of the organization network 10, and communicates with information terminals such as the application server 11 and terminals in the organization network 10. The terminal device that is going to be connected, and is connected to the outside of the in-house network 10. FIG. 2 is a diagram schematically illustrating a software configuration of the terminal device as functional blocks. The terminal device 20 includes an operating system (hereinafter, referred to as an OS) 21, VPN client software 22, and application software higher than the VPN client software (not shown).
[0014]
The OS 21 is a program for controlling the entire terminal device 20, and executes a connection confirmation test to the Internet 40 or the application server 11 in the organization network 10 in accordance with an instruction from a terminal instruction unit in the agent described later. , And returns the result to the terminal instruction unit.
[0015]
The VPN client software 22 is a program for making a VPN connection with the VPN gateway 12 and for confirming a connection for establishing a VPN session when introducing a VPN environment. It has a connection unit 24 and an agent 25.
[0016]
The VPN connection setting information storage unit 23 stores setting information necessary for establishing a VPN session with the VPN gateway 12 of the in-house network 10. The VPN connection unit 24 establishes a VPN session with the in-house network 10 having the VPN gateway 12 based on the setting information, transmits the encrypted information to the VPN gateway 12, and receives the encrypted information from the VPN gateway 12. It has the role of decrypting the encrypted information and passing it on to the higher-level application software.
[0017]
When introducing the VPN environment, the agent 25 performs connection settings such as a VPN session establishment and a connection confirmation based on an instruction from the manager server 30, and the manager connection unit 26, the terminal instruction unit 27, the connection test procedure information storage unit 28, It has a connection test result information storage unit 29.
[0018]
The manager connection unit 26 has a function of receiving setting information for establishing a VPN session and an instruction for setting a VPN connection from the manager server 30, and transmitting a processing result corresponding to the instruction to the manager server 30. Also, when the above instruction is for a VPN connection, it has a function of issuing a connection instruction to the VPN connection unit 24 and receiving the result.
[0019]
The connection test procedure information storage unit 28 stores a connection test procedure for examining the cause of a failure in establishing a VPN session, and a connection of higher-level application software used in the VPN connection of the terminal device 20 after the VPN session is established. The connection test procedure information such as the connection test procedure for confirming the result is stored. The connection test procedure information is sent from the manager server 30.
[0020]
The terminal instruction unit 27 issues an operation instruction to the OS 21 of the terminal device 20 or the VPN client software 22 when performing a VPN connection test based on the connection test procedure information stored in the connection test procedure information storage unit 28. Has functions.
[0021]
The connection test result information storage unit 29 stores a VPN session establishment result obtained by the VPN connection unit 24 and a connection result of higher-level application software obtained by the terminal instruction unit 27.
[0022]
Note that the terminal device 20 having such a function is required to communicate with another information terminal connected to the Internet 40, a program such as the OS 21 and the VPN client software 22, and a program for executing the program. And a control unit that controls the entire terminal device 20 according to a program.
[0023]
The manager server 30 gives an instruction for a VPN connection to the terminal device 20 that is about to introduce a VPN environment for performing a VPN connection with the VPN gateway 12 to support a VPN connection setting. Server. The manager server 30 includes a setting information database 31, a setting information registration unit 32, a connection test procedure information database 33, a connection test procedure information registration unit 34, an agent instruction unit 35, a connection result database 36, and a display unit 37.
[0024]
The setting information database 31 is a database that stores setting information related to setting of a VPN session between the terminal device 20 and the VPN gateway 12. The setting information includes, for example, the IP address of the VPN gateway 12, the key information for authentication between the VPN gateway 12 and the terminal device 20, the operation mode of the terminal device itself for the VPN connection, and the specification of DNS (Domain Name Server). And the like. The setting information registration unit 32 has a function of registering these setting information in the setting information database 31.
[0025]
After the VPN session is established between the terminal device 20 and the VPN gateway 12, the connection test procedure information database 33 establishes a connection procedure for connecting the upper application software to be used and confirming the result, and establishes the VPN session. If not, a connection test procedure for investigating the cause is stored. There are a number of possible causes of the inability to establish a VPN session, and it is impossible to identify the cause with only one connection test procedure. Therefore, a series of connection test procedures for isolating and specifying the cause of the inability to establish a VPN session are prepared. For example, a connection test procedure such as whether a route from the VPN gateway 12 on the terminal device 20 exists and whether a communication protocol used in the VPN is correctly passed between the terminal device 20 and the VPN gateway 12 are provided. By checking the results of the prepared connection test procedures, the cause of the failure can be specified. The connection test procedure information registration unit 34 has a function of registering the connection test procedure information in the connection test procedure information database 33.
[0026]
The connection result database 36 stores the result of the establishment of the VPN session by the agent 25 of the terminal device 20, the result of the connection confirmation between the terminal device 20 and the VPN gateway 12 when the VPN session cannot be established, and the connection result after the VPN session is established. Stores the result of confirming the connection with the host application software.
[0027]
The agent instruction unit 35 has a function of sending information to the agent 25 of the terminal device 20, receiving an instruction regarding VPN connection setting, and receiving a result of an instruction from the agent 25. More specifically, when establishing a VPN session, the setting information is extracted from the setting information database 31 and sent to the agent 25 of the terminal device 20, and an instruction to establish a VPN session is issued to the agent 25, and the result is transmitted to the agent 25. obtain. Further, the result of the instruction for establishing the VPN session is determined, and if the VPN session cannot be established, the connection test procedure information for investigating the reason why the VPN session cannot be established is extracted from the connection test procedure information database 33. If a VPN session can be established, the connection test procedure information for confirming the connection with the higher-level application software is extracted from the connection test procedure information database 33, and the agent 25 is instructed to execute these connection test procedures together with an instruction to execute these connection test procedures. Send in and get the result. The result information for the instruction received from the agent 25 is stored in the connection result database 36.
[0028]
The display unit 37 includes a display device such as a CRT (Cathode Ray Tube) or an LCD (Liquid Crystal Display) capable of displaying information such as a result of connection setting by the agent 25. By displaying the result of the VPN connection setting on the display unit 37, it is possible to confirm, for example, a connection test result when a VPN session cannot be established. Then, by confirming this by an administrator who has specialized knowledge regarding the VPN connection, it is possible to grasp the work required for the VPN connection setting of the terminal device 20. The display unit 37 may be a printing device such as a printer that prints information such as a result of connection setting.
[0029]
Next, a procedure of a support process for introducing a VPN environment to the terminal device 20 of the VPN environment introduction support system will be described. FIG. 3 is a flowchart illustrating a pre-processing procedure in the manager server before setting the VPN connection of the terminal device. First, a common key used for communication with the terminal device 20 is set by an administrator of the manager server 30 or the like (step S11). Next, setting information necessary for the terminal device 20 to execute a VPN connection with the VPN gateway 12 is stored in the setting information database 31 by the setting information registration unit 32 (step S12). The connection test procedure information defining the connection test procedure between the terminal device 20 and the VPN gateway 12 or the connection test procedure with the host application software of the terminal device 20 is stored in the connection test procedure information registration unit 34. The information is stored in the information database 33 (step S13), and the preprocessing ends.
[0030]
FIGS. 4 and 5 are flowcharts showing a processing procedure when a VPN environment is introduced to a terminal device in the VPN environment introduction support system. First, the user of the terminal device 20 installs the VPN client software 22 on the terminal device 20 (Step S21). After the installation is completed, the VPN client software 22 is started, and the agent 25 is called (step S22). Next, the agent 25 is activated by a call from the VPN client software 22 (step S23), and the agent 25 is notified of the common key corresponding to the common key performed on the manager server 30 in step S11 in FIG. Settings are made (step S24). After that, the URL (Uniform Resource Locator) of the manager server 30 is set (step S25), and the set URL is accessed via the manager connection unit 26, and communication between the agent 25 and the manager server 30 is started. (Step S26). Thereafter, communication encrypted using the common key set in steps S11 and S24 is performed between the agent 25 (terminal device 20) and the manager server 30.
[0031]
Upon receiving the access from the agent 25, the agent instruction unit 35 of the manager server 30 authenticates the agent 25 using the common key set in step S11 of FIG. 3 (step S27). Then, the agent instruction unit 35 sends the setting information stored in the setting information database 31 to the agent 25 (Step S28).
[0032]
The manager connection unit 26 of the agent 25 that has received the setting information instructs the VPN client software 22 to input (send) the setting information (step S29), and the VPN client software 22 executes the setting received from the manager connection unit 26. The information is stored in the VPN connection setting information storage unit 23 (Step S30). Then, after the elapse of the predetermined period, the manager connection unit 26 checks whether the setting information has been sent to the VPN connection setting information storage unit 23 as instructed (step S31), and reports the result to the manager server 30 (step S31). Step S32).
[0033]
When the agent instruction unit 35 of the manager server 30 receives from the agent 25 a result indicating that the setting information is not stored in the VPN connection setting information storage unit 23 as instructed (in the case of No in step S33), the setting is performed. The processing ends as information input failure. On the other hand, when the result indicating that the setting information is stored in the VPN connection setting information storage unit 23 as instructed is received from the agent 25 (in the case of Yes in step S33), the agent instruction unit 35 Then, a message instructing the establishment of the VPN session is transmitted (step S34).
[0034]
Upon receiving the message instructing the establishment of the VPN session, the manager connection unit 26 of the agent 25 gives an instruction to execute the operation of establishing the VPN session to the VPN connection unit 24 of the VPN client software 22 (step S35). Thereafter, the VPN connection unit 24 of the VPN client software 22 issues a VPN session establishment request message to the VPN gateway 12 of the in-house network 10 (Step S36). At this time, the VPN connection unit 24 establishes a VPN session to the VPN gateway 12 using the connection setting information stored in the VPN connection setting information storage unit 23.
[0035]
Upon receiving the VPN session establishment request message from the VPN connection unit 24 of the VPN client software 22 of the terminal device 20, the VPN gateway 12 transmits a response message as a result of the request message to the terminal device 20 (Step S37). Also, the VPN connection unit 24 of the terminal device 20 receives the response message (Step S38). Thereafter, the manager connection unit 26 of the agent 25 confirms the result of the response message received by the VPN connection unit 24 of the VPN client software 22 (Step S39), and reports the result to the manager server 30 (Step S40). Then, the agent instruction unit 35 of the manager server 30 stores the report received from the agent 25 in the connection result database 36 (Step S41).
[0036]
Next, the agent instruction unit 35 of the manager server 30 extracts necessary connection test procedure information from the connection test procedure information database 33 based on the result of the above step S41, and transmits it to the agent 25 (step S42). For example, in step S41, when a connection result indicating that a VPN session could not be established is received, a procedure for confirming whether or not a route from the terminal device 20 to the VPN gateway 12 is connected, A series of procedures such as a procedure for confirming whether or not the communication protocol of the Internet 40 runs between the device 20 and the VPN gateway 12 are extracted as connection test procedure information. If a connection result indicating that a VPN session has been established is received in step S41, a procedure for confirming whether or not connection with a higher-level application software is possible is extracted as connection test procedure information. .
[0037]
The manager connection unit 26 of the agent 25 stores the connection test procedure information received from the manager server 30 in the connection test procedure information storage unit 28 (Step S43). The terminal instruction unit 27 instructs the OS 21 or the VPN client software 22 to perform a connection test based on the connection test procedure information stored in the connection test procedure information storage unit 28 (step S44), and the OS 21 or the VPN client software 22 Executes a connection test according to the instruction (step S45). This result is stored in the connection test result information storage unit 29. Thereafter, the manager connection unit 26 confirms the result of the connection test stored in the connection test result information storage unit 29 (Step S46), and reports the result to the manager server (Step S47). The agent instruction unit 35 of the manager server 30 receives the result, stores it in the connection result database 36 (step S48), and ends the processing.
[0038]
In this manner, the processing result by the agent 25 of the terminal device 20 is stored in the connection result database 36 of the manager server 30. The connection result stored in the connection result database 36 is displayed on the display unit 37 according to a predetermined format.
[0039]
According to this embodiment, the VPN client software of the terminal device to introduce the VPN environment performs the VPN connection setting in accordance with the instruction from the manager server, and has an agent for collecting the result. Since a manager server for providing necessary information and instructions regarding the introduction of the VPN environment is provided, even the user of the terminal device 20 having no specialized knowledge about the VPN can easily introduce the VPN environment. Further, even if the VPN connection fails, predetermined processing is executed according to the connection test information for specifying the failure, the result is collected, and the result can be displayed on the display unit 37 of the manager server 30. Therefore, the manager of the manager server 30 can easily specify the cause of the failure of the terminal device 20 to introduce the VPN environment. As a result, for example, when a VPN session cannot be established, the location of a failure between the terminal device 20 or the terminal device 20 and the VPN gateway 12 can be specified, and the VPN connection setting of the terminal device 20 can be specified. It is possible for an administrator to know what to do for the purpose.
[0040]
【The invention's effect】
As described above, according to the present invention, the VPN client software of the terminal device to introduce the VPN environment has a VPN connection setting in accordance with an instruction from the manager server, and has an agent for collecting the result. Since the agent server is provided with a manager server for giving necessary information and instructions regarding the introduction of the VPN environment to the agent, even a user of a terminal device having no specialized knowledge about the VPN can easily introduce the VPN environment. Has an effect.
[Brief description of the drawings]
FIG. 1 is a block diagram showing a configuration of an embodiment of a VPN environment introduction support system according to the present invention.
FIG. 2 is a diagram schematically illustrating a software configuration of a terminal device as functional blocks.
FIG. 3 is a flowchart showing a pre-processing procedure in a manager server before setting a VPN connection of a terminal device.
FIG. 4 is a flowchart illustrating a processing procedure when a VPN environment is introduced to a terminal device in the VPN environment introduction support system (part 1).
FIG. 5 is a flowchart illustrating a processing procedure when a VPN environment is introduced to a terminal device in the VPN environment introduction support system (part 2).
[Explanation of symbols]
Reference Signs List 10 organization network, 11 application server, 12 VPN gateway, 20 terminal device, 21 OS, 22 VPN client software, 23 VPN connection setting information, 24 VPN connection unit, 25 agent, 26 manager connection unit, 27 terminal instruction unit, 28 Connection test procedure information storage section, 29 connection test result information storage section, 30 manager server, 31 setting information database, 32 setting information registration section, 33 connection test procedure information database, 34 connection test procedure information registration section, 35 agent instruction section, 36 connection result database, 37 display unit, 40 internet.

Claims (9)

A regional network having a VPN gateway having a VPN function, a terminal device that establishes a VPN connection with the VPN gateway to communicate with a communication terminal in the regional network, A VPN environment introduction support system connected via the Internet with a server device that supports the connection setting of
The terminal device includes an agent that stores processing information regarding a VPN connection transmitted from the server device, executes a process based on an instruction from the server device, and transmits a processing result to the server device,
The server device,
Agent instructing means for transmitting setting information for establishing a VPN session with the VPN gateway as the processing information, and an instruction for establishing the VPN session based on the setting information to an agent of the terminal device; ,
A connection result database storing the processing result received from the agent,
A VPN environment introduction support system comprising: The server device,
A connection test procedure information database that stores connection test procedure information defining a processing procedure for performing a VPN connection between the terminal device and the VPN gateway;
The agent instruction means, after receiving a processing result for the instruction to establish the VPN session, extracts the connection test procedure information corresponding to the processing result from the connection test procedure information database, and extracts the extracted connection test procedure information. 2. The VPN environment introduction support system according to claim 1, further comprising transmitting to the agent of the terminal device as the processing information. When a processing result that the VPN session cannot be established is received from the agent of the terminal device,
3. The VPN environment introduction support system according to claim 2, wherein the connection test procedure information is connection test procedure information in which a processing procedure for investigating a cause of the inability to establish the VPN session is defined. . When the processing result that the VPN session is established is received from the agent of the terminal device,
3. The VPN environment introduction support system according to claim 2, wherein the connection test procedure information is connection test procedure information in which a processing procedure for confirming a connection with an application using the VPN session is defined. . A VPN environment introduction support system in which a regional network provided with a VPN gateway having a VPN function and a server device for supporting introduction of a VPN environment to a terminal device which is trying to communicate with a communication terminal in the regional network are connected to the Internet. Terminal device used for
An agent for storing processing information relating to a VPN connection transmitted from the server device, executing a process relating to the VPN connection based on an instruction from the server device, and transmitting the processing result to the server device. Terminal device used in a VPN environment introduction support system that performs A server device that supports introduction of a VPN environment to a terminal device that is trying to communicate with an information terminal in a regional network connected to the Internet via a VPN gateway having a VPN function,
Agent instruction means for transmitting to the terminal device setting information for the terminal device to establish a VPN session with the VPN gateway, and an instruction to establish the VPN session based on the setting information;
A connection result database that stores a processing result for the instruction received from the terminal device,
A server device comprising: The server device,
A connection test procedure information database that stores connection test procedure information defining a processing procedure for performing a VPN connection between the terminal device and the VPN gateway;
The agent instruction unit, after receiving a processing result for the instruction to establish the VPN session from the terminal device, extracts the connection test procedure information extracted from the connection test procedure information database corresponding to the processing result, and The server device according to claim 6, wherein the server device transmits the procedure information to the terminal device together with an instruction to execute the procedure information. When a processing result that the VPN session cannot be established is received from the terminal device,
8. The server device according to claim 7, wherein the connection test procedure information is connection test procedure information defining a processing procedure for investigating a cause of the inability to establish the VPN session. When the processing result that the VPN session is established is received from the terminal device,
The server device according to claim 7, wherein the connection test procedure information is connection test procedure information that defines a processing procedure for confirming a connection with application software that uses the VPN session.

Images