JP2010097510A - Remote access management system and method - Google Patents

Abstract

There is provided a remote access management system capable of setting user access authority in accordance with a place where a computer is used.
When a user 3 enters a company room 6 using a door gate 7, location information held by the door gate 7 is written in an IC card 8 possessed by the user 3. When the user 3 uses the computer 1 as a thin client terminal, the computer 3 reads the location information from the IC card 3 and transmits a message including the location information to the authentication server 2. The authentication server 2 refers to the access authority given in advance to the user 3 and sets the access authority of the user according to the location information received from the computer 3.
[Selection] Figure 1

Description

  The present invention relates to a technique for managing remote access to a server arranged in a security-managed network.

  Along with the development of network technology, in order to prevent the leakage and theft of corporate information, enterprises, etc. have information resources (applications) on the server side installed in the security-managed network by providing clients with the minimum functions. Thin client systems that concentrate data and data files) are becoming popular.

  When implementing a thin client system, a thin client operating system (OS: Operating System) that has only a minimum functionality in the hard disk of a computer used as a thin client terminal or an external storage device (for example, USB memory) owned by the user System) is stored, and the OS for the thin client is started on the computer.

  In this way, if a thin client OS is started, a general-purpose computer can be used as a thin client terminal. Therefore, a computer that can be used as a thin client terminal can be taken out as well as a computer installed in a company. A notebook computer can also be used as a thin client terminal.

  However, in the case of a notebook computer, the location where the notebook computer is used cannot be specified. For example, if a notebook computer is used outside a company such as an Internet cafe or a restaurant, the company has no relation to the company. Since confidential information may be leaked to the three parties, the access authority of the user who operates the computer cannot be set according to the location where the computer functioning as a thin client terminal is used.

As an invention for managing the access destination of a thin client terminal, for example, in Patent Document 1, in addition to the thin client OS, a list of access destinations (for example, URLs) accessible by the thin client terminal is represented by a hardware token ( For example, a device that is stored in a USB memory) and prohibits access to a destination other than the access destination described in the list is disclosed on the thin client terminal side. The access authority of the user who operates the computer cannot be set depending on the location where the computer functioning as a terminal is used.
JP 2008-165541 A

  Therefore, the present invention is to set the access authority of a user who operates a computer in a remote access system represented by a thin client system according to the place where the computer used for remote access is used. An object of the present invention is to provide a remote access management system and method.

  A first invention for solving the above-mentioned problem is a remote access management system for managing remote access to resources on a security-managed network, the remote access management system being arranged outside the network, A computer that remotely accesses a resource; and an authentication server that manages remote access of the computer. The computer includes location information acquisition means for acquiring location information of a user who operates the computer, and the location Authentication request means for transmitting an authentication request message including location information to the authentication server, wherein the authentication server refers to a location table that stores the address of the resource in association with the location information, and Included in the request message A remote access management system, characterized in that address in the location information comprises a remote access management means for setting the access rights to the resources that are tied to the user.

  According to the first invention described above, by setting the access authority of the user according to the location of the user, even if the same user uses the same computer, the location of the user is set. Accordingly, the resources that can be accessed by the user can be limited.

  Furthermore, the second invention is the remote access management system according to the first invention, wherein the remote access management system includes a door gate provided at a doorway of a room in a company, When unlocking the door when the user enters the room, the location information indicating the room where the door gate is installed is written in the IC card held by the user, and the door is unlocked when the user leaves the room. The location information acquisition means provided in the computer comprises means for reading the location information from the IC card possessed by the user. A remote access management system characterized by being.

  When managing remote access to resources in a corporate LAN (Local Area Network), as in the second aspect described above, the location information is written to the IC card at the door gate installed in the room, If the location information stored in the IC card is read by the computer, the location where the user is located, including inside and outside the company, can be easily specified, and the access of the user according to the location where the user is located Permission can be set.

  Furthermore, a third invention is the remote access management system according to the second invention, wherein the computer comprises user information acquisition means for acquiring at least a user ID from a user operating the computer, and the authentication request The means is means for including the user ID in the authentication request message, and the remote access management means of the authentication server stores the address of the resource in association with the user ID in addition to the location table. With reference to the user table, an access right to the resource in which an address is associated with the user ID included in the authentication request message and an address is associated with the location information included in the authentication request message. Remote access management characterized in that it is means for setting to the user It is a stem.

  As in the third aspect described above, if the authentication server has the user table indicating the resource to which the user has been given access authority in advance, remote access to the resource to which the user has no access authority Access can be prevented.

  Furthermore, a fourth invention is the remote access management system according to the third invention, wherein the user information acquisition means of the computer acquires the user password from the user in addition to the user ID. The authentication request means is means for including the password in the authentication request message, and the authentication server includes the user authentication means for verifying the password included in the authentication request message, and the user authentication means The remote access management system is characterized in that the remote access management means operates after successful verification of the password.

  According to the fourth aspect described above, the authentication server can authenticate the user, thereby preventing unauthorized remote access due to impersonation.

  Furthermore, a fifth invention is a remote access management method for managing remote access to resources in a security-managed network, wherein a computer that is arranged outside the network and remotely accesses the server is configured to Step a for acquiring location information of a user to operate, Step b for the computer to send an authentication request message including the location information to an authentication server for managing remote access of the computer, and the authentication server , Referring to a location table in which the address of the resource is stored in association with the location information, and access authority to the resource in which an address is associated with the location information included in the authentication request message. Step c is set for the user It is a remote access management method according to claim.

  According to the fifth aspect described above, the same effects as those of the first aspect described above can be obtained.

  As described above, according to the present invention described above, in the remote access system represented by the thin client system, the user access authority is set according to the place where the computer used for remote access is used. Can provide a remote access management system and method.

  An embodiment in which the present invention is applied to a thin client system will now be described in detail with reference to the drawings. FIG. 1 is a diagram for explaining a configuration of a remote access management system when applied to a thin client system.

  The remote access management system 9 of this embodiment is used as a thin client terminal, and is connected to a notebook computer 1 to which an IC card reader 17 is connected and a security managed LAN 5 (Loacal Area Network). The authentication server 2 is configured to include at least an authentication server 2 that manages remote access to resources in the LAN 5. In FIG. 1, as resources in the LAN 5, a server 50 a that stores information with a confidential level “0” and a confidential level “ A server 50b, which is a server storing information "1", a server 50c storing information whose security level is "2", and a server 50d storing information whose security level is "3"; Furthermore, a fire-all device 51 that separates the LAN 5 and the Internet 4 is illustrated.

  In addition, the user 3 who uses the remote access management system 9 of the present embodiment is connected to the USB memory 18 in which a thin client operating system (OS) is stored and the room 6 (for example, a satellite office) in the company. The IC card 8 used for unlocking the installed door gate 7 is possessed.

  The authentication server 2 constituting the remote access management system 9 in FIG. 1 is a Web server realized by using a RADIUS server or the like corresponding to the RADIUS (Radius: Remote Authentication Dial In User Service) protocol. A function of authenticating the user 3 accessing the resource of the user, a function of setting the access authority of the user 3, a function of managing the log of the user 3 accessing the resource in the LAN 5, and the like.

  The authentication server 2 illustrated in FIG. 1 has a function of referring to the access authority given in advance to the user 3 and setting the access authority of the user according to the location of the user 3, and in this embodiment, the user 3 The location information indicating the location is stored in the IC card 8 when the user 3 uses the door gate 7. The authentication server 2 identifies the location where the user 3 is located, including inside and outside the company, based on the location information transmitted from the computer 1, refers to the access authority given to the user 3 in advance, and the location where the user 3 is located Accordingly, the access authority of the user 3 is set.

  By setting the access authority of the user 3 according to the place where the user 3 is located, in the case of FIG. 1, even when the user 3 uses the computer 1 in the room 6, the user 3 can access the server 50 b. When remote access is permitted and the user 3 takes the notebook computer 1 outside the company and uses the computer 1 outside the company, the remote access to the server 50b can be prohibited.

  From here, the processing executed by the remote access management system 9 shown in FIG. 1 will be described, and also the description of the method according to the present invention. FIG. 2 is a flowchart showing a procedure of processing executed in the remote access management system 9.

  When the user 3 operates the computer 1 outside the LAN 5 to remotely access the resources in the LAN 5, the user 3 connects the USB memory 18 to the USB port of the computer 1 (S1 in FIG. 2), and the USB memory 18 Is started on the computer 1 (S2 in FIG. 2), and the computer 1 is used as a thin client terminal.

  When the thin client OS is activated, the computer 1 makes an access request to the authentication server 2 (S3 in FIG. 2). When the authentication server 2 receives the access request from the computer 1, the computer 1 requests the computer 1 that has made the access request. An authentication request is made (S4 in FIG. 2).

  When the computer 1 on which the thin client OS has been activated receives an authentication request from the authentication server 2, a screen for entering a user ID and password is displayed on the display before remote access to the authentication server 2. 3 is made to input a user ID and password, and the user ID and password input by the user 3 are acquired (S5 in FIG. 2).

  When the computer 1 acquires the user ID and password, the computer 1 displays a message indicating that the IC card 8 is necessary for remote access to the resources in the LAN 5, and the IC card reader 17 detects the IC card 8. Then, a command for reading the location information is transmitted to the IC card 8, and a request for transmitting the location information is sent to the IC card 8 (S6 in FIG. 2).

  When the IC card 8 receives a command for reading the location information, the IC card 8 transmits the location information to the computer 1 via the IC card reader 17 (S7 in FIG. 2), and the computer 1 receives the location information from the IC card 8. When the information is received, an authentication request message including a user ID, a password, and location information and conforming to a predetermined type is transmitted to the authentication server 2 and an authentication response is sent to the authentication server 2 (S8 in FIG. 2).

  Since the authentication request message transmitted from the computer 1 to the authentication server 2 includes confidential information such as a password, communication between the computer 1 and the authentication server volume 2 using a technology such as SSL (Secure Sockets Layer). It is advisable to take security measures such as encrypting the password or transmitting the hash value of the password.

  Upon receiving the authentication request message from the computer 1, the authentication server 2 first authenticates the user 3 who operates the computer 1 using the user ID and password included in the authentication request message (S9 in FIG. 2).

  The authentication server 2 stores the password of the user 3 associated with the user ID of the user 3, and the authentication server 2 is included in the authentication request message and the password associated with the user ID included in the authentication request message. The user 3 is authenticated by checking the password.

  When the user authentication is executed, the authentication server 2 branches the process according to the result of the user authentication (S10 in FIG. 2), and when the user authentication is successful, the process of permitting remote access to the resources in the LAN 5 is continued. If the user authentication fails, the authentication server 2 notifies the computer 1 of a message indicating that access to the resources in the LAN 5 is denied (S14 in FIG. 2), and this procedure ends.

  If the user authentication is successful, the authentication server 2 executes a process for setting the access authority of the user 3 (S11 in FIG. 2).

  The authentication server 2 stores the address (for example, IP address) of the resource to which the access authority is given to the user 3 in association with the user ID in order to execute the process of setting the access authority of the user 3 A user table and a location table that stores the addresses of resources that can be accessed remotely from the location specified by the location information in association with the location information held by the door gate 7 are provided.

  When the authentication server 2 executes the process of setting the access authority of the user 3, the user refers to the user table and the location table, the address is associated with the user ID included in the authentication request message, and the authentication request message A resource whose address is associated with the included location information is extracted, and access authority to the extracted resource is set for the user 3.

  When the access authority of the user 3 is set, the authentication server 2 transmits a message indicating the access permission to the LAN 5 including the extracted resource address to the computer 1 that has transmitted the authentication request message (S12 in FIG. 2). ).

  When the access permission to the LAN 5 is notified, the computer 1 starts remote access to one of the resources for which the remote access permission is indicated by the authentication server 2 (S13 in FIG. 2), and is illustrated in FIG. The procedure ends.

  In the procedure illustrated in FIG. 2, the location information used by the authentication server 2 for confirming the access authority of the user 3 is written in the IC card 8 by the door gate 7 used when the user 3 enters the room 6. When the user leaves the room 6, the location information is deleted from the IC card 8 by the door gate 7.

  FIG. 3 is a flowchart showing a procedure executed when the user 3 enters and leaves the room 6. The flow in FIG. 3A is executed when the user 3 enters the company room 6. In the procedure, the flow in FIG. 3B is a procedure executed when the user 3 leaves the company room 6.

  First, the procedure executed when the user 3 enters the company room 6 will be described with reference to FIG. When the user 3 enters the room 6 in the company, if the IC card 8 is brought close to the door gate 7 provided at the entrance of the room 6, the door gate 7 detects the IC card 8 (S20 in FIG. 3).

  When the door gate 7 detects the IC card 8, a request for writing the location information held by the door gate 7 is transmitted to the IC card 8, thereby requesting the IC card 8 to write the location information (FIG. 3). S21).

  When the IC card 8 receives the command for writing the location information, the IC card 8 writes the location information into the memory (S22 in FIG. 3), and returns a message indicating that the writing is completed to the door gate 7, and the door gate 7 Is received from the IC card 8, the door is unlocked (S23 in FIG. 3).

  Next, the procedure executed when the user 3 leaves the company room 6 will be described with reference to FIG. When the user 3 leaves the room 6 in the company, if the IC card 8 is brought close to the door gate 7 provided at the entrance of the room 6, the door gate 7 detects the IC card 8 (S30 in FIG. 3).

  When the door gate 7 detects the IC card 8, a request for deleting the location information is sent to the IC card 8 by transmitting a command to the IC card 8 to delete the location information held by the IC card 8 ( (S31 in FIG. 3).

  When the IC card 8 receives the command to delete the location information, the IC card 8 deletes the location information from the memory of the IC card 8 (S32 in FIG. 3), and returns a message indicating that the deletion is completed to the door gate 7, Upon receiving the message from the IC card 8, the door gate 7 unlocks the door (S33 in FIG. 3).

  In this way, the authentication server 2 sets the access authority given to the user 3 in advance according to the location of the user 3, so that the authentication server 2 can be used even if the same user 3 uses the same computer 1. Depending on the location of the user 3, the resource that the user 3 can remotely access can be changed.

  For example, in FIG. 1, the authentication server 2 associates the location information held by the door gate 7 installed in a room 6 (for example, a satellite office) with the addresses of two servers, the server 50b and the server 50a. If the access authority of the server 50a is stored in association with information indicating that the location information is not stored in the IC card 8, the access authority of both the server 50b and the server 50a is given. When the user 3 is using the notebook computer 1 in the room 6, the access authority to the server 50b and the server 50a is set to the user 3, and when using the computer 1 outside the company, the server 50a The access right to the user 3 can be set for the user 3.

  From here, the computer 1 and the authentication server 2 which comprise the access management system shown in FIG. 1 are demonstrated in detail, referring a figure.

  4 is a block diagram of the computer 1, FIG. 4A is a hardware block diagram, and FIG. 4B is a functional block diagram.

  As shown in FIG. 4A, the computer 1 is realized by a general-purpose computer 1, and the computer 1 includes, as hardware, a CPU 10 (Central Processing Unit), a RAM 11 (Random Access Memory), and a hard disk as a data storage device. 12, a network interface circuit 13, a display 14, a keyboard 15, a pointing device 16 (for example, a mouse), and an IC card reader 17.

  Furthermore, as illustrated in FIG. 4B, in the present embodiment, the thin client OS stored in the USB memory 18 is activated on the computer 1 so that the computer 1 has the configuration shown in FIG. As a means realized by the computer 1 program using the hardware shown in FIG. 2, user information acquisition means 100 that operates when executing S3 of FIG. 2, and location information that operates when executing S4 of FIG. An acquisition unit 101, an authentication request unit 102 that operates when executing S6 of FIG. 2, and a remote access unit 103 that operates when executing S11 of FIG.

  The user information acquisition unit 100 of the computer 1 acquires the user ID and password input by the user 3 to the computer 1 using the keyboard 15 and the pointing device 16 and stores the user ID and password in the RAM 11. The location information acquisition unit 101 controls the IC card reader 17 connected to the computer 1 and reads the location information stored in the IC card 8 electrically connected to the IC card reader 17. , Means for executing processing for storing the location information read from the IC card 8 in the RAM 11.

  Further, the authentication request means 102 of the computer 1 includes the user ID, password, and location information stored in the RAM 11 of the computer 1 and transmits an authentication request message conforming to a predetermined type to the authentication server 2, 2 is a means for executing a process for requesting authentication to the remote access means 103. When the remote access means 103 receives a message indicating access permission from the authentication server 2, the remote access means 103 remotely accesses any resource indicated by the address indicated by the message. Is a means for executing.

  5 is a block diagram of the authentication server 2, FIG. 5 (a) is a hardware block diagram, and FIG. 5 (b) is a functional block diagram.

  As shown in FIG. 5A, the authentication server 2 is realized by a general-purpose server. The authentication server 2 includes, as hardware, a CPU 20 (Central Processing Unit), a RAM 21 (Random Access Memory), and a data storage device. A hard disk 22, a network interface circuit 23, a display 24, a keyboard 25, and a pointing device 26 (for example, a mouse) are provided.

  Further, as illustrated in FIG. 5B, in order to function as the authentication server 2 according to the present invention, the authentication server 2 is realized by a computer program using the hardware illustrated in FIG. The user authentication means 200 that executes user authentication using the user ID and password included in the authentication request message transmitted from the computer 1 and the access authority given in advance to the user 3 are referred to as the user 3 Remote access management means 201 for setting the access authority of the user 3 according to the location of the user 3.

  Further, the hard disk 22 of the authentication server 2 stores, as a data table, a user table 202 in which a password of the user 3 and an address of a resource to which the user 3 is authorized to access are stored in association with the user ID of the user 3. And a location table 203 that stores resources that can be remotely accessed from the room specified by the location information in association with the location information held by the door gate 7.

  When receiving the authentication request message from the computer 1, the user authentication means 200 provided in the authentication server 2 acquires the password associated with the user ID included in the authentication request message from the user table 202, and the authentication request message The user authentication is executed by collating the password included in the password with the password acquired from the user table 202.

  Further, when the user authentication unit 200 succeeds in user authentication, the remote access management unit 201 of the authentication server 2 refers to the user table 202 and the location table 203 and associates an address with the user ID included in the authentication request message. And, after extracting the resource whose address is associated with the location information included in the authentication request message, and setting the access authority to the extracted resource to the user 3, the access permission including the address of the extracted resource is included. Is sent to the computer 1 that sent the authentication request message.

  From here, the effect of this invention is demonstrated. As described above, the authentication server 2 refers to the access authority previously given to the user 3 and determines the user's access authority according to the location of the user 3 so that the same user 3 uses the same computer 1. Even so, according to the location of the user 3, the resources in the LAN 5 that the user 3 can remotely access can be changed.

  FIG. 6 is a diagram showing an example of the location table stored in the hard disk 22 of the authentication server 2. In the location position table shown in FIG. 6, four location information items, that is, location location information 1 to location location information 4, are stored. Further, if location information is not stored in the IC card 8, or False is stored as information used when the authentication server 2 does not receive the location information, such as when using the computer 1 to which the card reader 17 is not connected.

  The room 6 in which the door gate 7 storing the location information 1, the location information 2, the location information 3 and the location information 4 is installed is a company meeting room, satellite office, security room A and security room, respectively. B.

  Further, in the location table shown in FIG. 6, the address of the server 50 a is linked to the location information 1 as the address of the resource in the LAN 5, and the addresses of the servers 50 a and 50 b are added to the location information 2. 3, the addresses of the server 50a, the server 50b, and the server 50c are linked, and the location information 4 is linked with the addresses of the server 50a, the server 50b, and the server 50d.

  Based on the location table shown in FIG. 6, when the user 3 who is authorized to access all the servers 50a to 50d in the company is in the meeting room, only the server 50a can be accessed. When the user 3 is present in the satellite office, the server 50a and the server 50b can be accessed. When the user 3 is present in the security room A, the server 50a, the server 50b and the server 50c are accessible. When the user 3 is present in the security room B, the server 50a, the server 50b, and the server 50d can be accessed.

  When the user 3 takes the computer 1 out of the office and uses it, or when using the computer 1 to which the IC card reader 17 is not connected, such as a computer installed in an Internet cafe, the computer 1 is Since the location information cannot be acquired from the IC card 8, the user 3 can access only the server 50a.

The figure explaining the structure of a remote access management system. The flowchart which showed the procedure of the process performed with a remote access management system. The flowchart which showed the procedure performed when a user enters / leaves a room. The block diagram of a computer. The block diagram of an authentication server. The figure which showed an example of the location position table.

Explanation of symbols

1 Computer 2 Authentication Server 3 User 4 Internet 5 LAN
50a to 50d Server 6 installed in LAN 6 Corporate room 7 Door gate 8 IC card 9 Remote access management system

Claims (5)

  A remote access management system for managing remote access to resources on a security-managed network, the remote access management system being located outside the network and remotely accessing the resources, and a remote of the computer An authentication server that manages access, and the computer sends a location information acquisition unit that acquires location information of a user who operates the computer, and an authentication request message including the location information to the authentication server. Authentication request means for transmitting, wherein the authentication server refers to a location table in which the address of the resource is stored in association with the location information, and an address is stored in the location information included in the authentication request message. Tying Remote access management system characterized in that it comprises a remote access management means for setting the access rights of the resource that is to the user.   The remote access management system according to claim 1, wherein the remote access management system includes a door gate provided at a doorway of a room in a company, and the door gate unlocks the door when the user enters the room. When locking, the location information indicating the room where the door gate is installed is written in an IC card possessed by the user, and when the door is unlocked when the user leaves the room, the location information is stored in the IC card. Remote access management comprising: a lock control means for deleting from the card, wherein the location information acquisition means provided in the computer is means for reading the location information from the IC card possessed by the user system.   The remote access management system according to claim 2, wherein the computer includes user information acquisition means for acquiring at least a user ID from a user operating the computer, and the authentication request means includes the authentication request message in the authentication request message. Means for including a user ID, wherein the remote access management means of the authentication server refers to a user table associated with the user ID and stores the address of the resource in addition to the location table, and the authentication request A means for setting an access right to the resource in which an address is associated with the user ID included in the message and an address is associated with the location information included in the authentication request message; Remote access management system characterized by   4. The remote access management system according to claim 3, wherein the user information acquisition unit of the computer is a unit that acquires the password of the user from the user in addition to the user ID, and the authentication request unit is the In the means for including the password in an authentication request message, the authentication server comprises the user authentication means for verifying the password included in the authentication request message, and after the user authentication means has succeeded in verifying the password, The remote access management system, wherein the remote access management means operates. A remote access management method for managing remote access to resources in a security-managed network, wherein a computer located outside the network and remotely accessing the server obtains location information of a user operating the computer Step a to acquire, Step b in which the computer transmits an authentication request message including the location information to an authentication server that manages remote access of the computer, and the authentication server linked to the location information Then, referring to the location table storing the address of the resource, step c is executed to set the access authority to the resource associated with the location information included in the authentication request message for the user. Is characterized by Over door access management method.

Images