JP2004078280A - Remote access mediation system and method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a remote access mediation system and method that allows reliable access to a target gateway device while ensuring security. <P>SOLUTION: The remote access mediation method is provided for a network environment including a gateway device for connecting a local network and the Internet, an authentication server for authenticating an access right to the gateway device, and a user terminal outside the local network and connected to the Internet. The authentication server saves authentication information about the gateway device, refers to the authentication information to determine whether the user terminal has an access right to the gateway device, and if determining that the user terminal has an access right to the gateway device, transmits to the user terminal, information necessary for the user terminal to access the gateway device. <P>COPYRIGHT: (C)2004,JPO

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to a remote access mediation system and method capable of maintaining a high level of security when accessing a local network from outside a local network via the Internet.
[0002]
[Prior art]
In order to access a device in the local network from outside the local network, that is, to perform a so-called remote access, an IP address of a gateway device that connects the external network such as the Internet to the local network is obtained, and It is necessary to access the gateway device by specifying an IP address, and then connect to a desired device via the gateway device. Therefore, a user who intends to perform remote access needs to know in advance the IP address of the gateway device of the local network where the device to be connected exists.
[0003]
On the other hand, when the IP address of the gateway device changes dynamically, that is, when the IP address is dynamically assigned to the gateway device using DHCP or the like, the IP address of the gateway device cannot be known in advance. In such a case, a method of notifying and registering the IP address of the gateway device on an accessible server at regular intervals or at a timing when the assignment is changed is often used so that remote access can be performed. Used.
[0004]
That is, the IP address of the gateway device is assigned to the other server periodically or at the timing when the assignment is changed. Is transmitted, and the IP address is stored and registered in another server.
[0005]
By doing so, even if the IP address of the gateway device changes dynamically, the user can access another server in which the IP address of the gateway device is registered, and thereby connect. In this case, the IP address of the gateway device required for the communication can be obtained.
[0006]
[Problems to be solved by the invention]
However, the above-described method is considered to be an unfavorable form from the viewpoint of security since the chance that a third party can know the IP address of the gateway device registered in another server increases.
[0007]
That is, by accessing another server in which the IP address of the gateway device is registered and knowing the IP address of the gateway device to be connected, the user accesses the local network using the same method as a regular user. There was a problem that could be done.
[0008]
An object of the present invention is to provide a remote access mediation system and method capable of securely accessing a target gateway device while ensuring security in order to solve the above problems.
[0009]
[Means for Solving the Problems]
In order to achieve the above object, a remote access mediation system according to the present invention includes a gateway device that connects a local network to the Internet, an authentication server that authenticates an access right to the gateway device, A remote access mediation system including a connected user terminal, wherein the authentication server stores an authentication information storage unit that stores authentication information of the gateway device, and a login information receiving unit that receives information related to login from the user terminal. An access right presence / absence determining unit that queries authentication information based on information related to login from the user terminal and determines whether the user terminal has access to the gateway device, and the user terminal accesses the gateway device. Is determined to have the right , The user terminal; and a session information transmission unit that transmits information to establish a session to access the gateway apparatus to the user terminal.
[0010]
With this configuration, access to the gateway device can be performed only when the authentication server determines that the access right to the gateway device is granted, so that the IP address of the gateway device to be connected can be unduly known. Unauthorized access by three parties can be eliminated, and even if the address of the gateway device changes dynamically, it is possible to access the local network while maintaining security.
[0011]
Further, in the remote access mediation system according to the present invention, the session information transmitting unit generates an access URL based on the one-time password and the network address acquired from the gateway device, and stores the generated access URL together with the one-time password. Preferably, it is transmitted to the user terminal.
[0012]
In the remote access mediation system according to the present invention, it is preferable that the authentication information includes at least a network address for specifying the gateway device and information for identifying a user terminal permitted to use the gateway device. This is because it is necessary to register in advance user terminals that can access the gateway device.
[0013]
Further, in the remote access mediation system according to the present invention, the network address is preferably a fixed address, or the network address is variable, and the network address for receiving the dynamic network address assigned to the gateway device from the gateway device. It is preferable to further include an acquisition unit. This is so that the network address of the gateway device can be fixed or variable.
[0014]
Further, a remote access mediation system according to the present invention includes a gateway device for connecting a local network to the Internet, an authentication server for authenticating an access right to the gateway device, and a user connected to the Internet outside the local network. A login information transmitting unit that transmits information related to login to a predetermined authentication server, a one-time password generated by the gateway device from the authentication server, and an authentication server. Characterized in that it includes a session establishment information receiving unit that receives the access URL generated in step (1), and an access right establishing unit that establishes an access right to the gateway device using the received one-time password and the access URL.
[0015]
With such a configuration, it is possible to maintain a higher security level.
[0016]
Further, the present invention is characterized by software that executes the function of the remote access mediation system as described above as a processing step of a computer, specifically, a gateway device that connects a local network and the Internet, A remote access mediation method provided in a network environment including an authentication server for authenticating an access right to a gateway device and a user terminal connected to the Internet outside a local network, wherein the authentication server comprises a gateway device Storing the authentication information of the user terminal, receiving the information on the login from the user terminal, and querying the authentication information based on the information on the login from the user terminal, and confirming whether the user terminal has the right to access the gateway device. Determining whether or not Transmitting, to the user terminal, information for establishing a session so that the user terminal can access the gateway device, when the user terminal is determined to have access right to the gateway device; and It is a computer-executable program that embodies such a process.
[0017]
With this configuration, by loading and executing the program on the computer, the access to the gateway device is enabled only when the authentication server determines that the access right to the gateway device is available. Unauthorized access by a third party who has learned the IP address of the device illegally can be eliminated, and even if the address of the gateway device changes dynamically, access to the local network can be maintained while maintaining security. It is possible to realize a remote access mediation system that can perform such operations.
[0018]
BEST MODE FOR CARRYING OUT THE INVENTION
(Embodiment 1)
Hereinafter, a remote access mediation system according to a first embodiment of the present invention will be described with reference to the drawings. FIG. 1 is a network configuration diagram in the remote access mediation system according to the first embodiment of the present invention.
[0019]
In FIG. 1, reference numeral 1 denotes a gateway device for connecting a local network 5 to an external Internet environment 4, and a local device 1 is connected to a content providing terminal 6 connected to the local network 5 via the gateway device 1. Access is made from the user terminal 3 located outside the network 5.
[0020]
The authentication server 2 first verifies the presence or absence of an access right to the gateway device 1 in order to determine whether or not to permit access from the user terminal 3 to the content providing terminal 6. The communication between the gateway device 1 and the authentication server 2 is not limited to using the HTTP protocol via the Internet, but may be in any form of communication such as dedicated inter-process communication.
[0021]
Next, FIG. 2 shows a configuration diagram of the authentication server 2 in the remote access mediation system according to the first exemplary embodiment of the present invention. 2, reference numeral 21 denotes an authentication information storage unit, 22 denotes a login information receiving unit, 23 denotes an access right presence / absence determining unit, and 24 denotes a session information transmitting unit.
[0022]
In the authentication information storage unit 21, at least information for identifying a gateway device on a local network to be remotely accessed is registered in advance. As the information for identifying the gateway device, the device ID of the gateway device or the like can be considered. It should be noted that information for identifying the remote terminal may be registered in order to further enhance security. As such information, a terminal ID or a serial number of the remote terminal can be considered.
[0023]
FIG. 3 is a diagram illustrating a data configuration example of the authentication information storage unit 21 in the remote access mediation system according to the first embodiment of the present invention. In the example shown in FIG. 3, the device ID and the device password of the gateway device are registered as the information for identifying the gateway device, and the terminal ID and the hardware serial number are registered as the information for identifying the remote terminal. I have. Of course, the present invention is not limited to these, and any information may be used as long as it can identify at least the gateway device.
[0024]
Then, when remote access is attempted using the user terminal 3, the information regarding the login input at the user terminal 3, that is, the device ID and the password of the gateway device are transmitted from the login information transmitting unit 31 of the user terminal 3, and the login information reception It is received at the unit 22. The received information about the login such as the device ID of the gateway device and the password is input to the access right presence / absence determining unit 23.
[0025]
The access right presence / absence determination unit 23 refers to the authentication information storage unit 21 based on the input information about the login, such as the device ID and password of the gateway device, and accesses the gateway device 1 to which the user terminal 3 attempts remote access. Is determined.
[0026]
Lastly, only when the access right presence / absence determination unit 23 determines that the user terminal 3 has the access right to the gateway device 1, the session information transmission unit 24 sends the user terminal 3 to the gateway device 1. The information required for the session will be transmitted.
[0027]
Various information can be considered as information necessary for a session to the gateway device. For example, when it is determined that the user has the access right, a URL for session establishment (access) in which a one-time password obtainable from the gateway device 1 is added to the IP address of the gateway device 1 to be connected is generated as a link. . It is also considered that access can be made only when the generated session establishment (access) URL name matches the connection information in the authentication server 2, that is, when it is determined that the user is a valid access right holder. Can be Of course, it is not limited to such a method.
[0028]
With such a configuration, even when a third party who has learned the IP address of the gateway device illegally attempts to access the gateway device, whether or not the access is from an accessible terminal is determined at the same time. As a result, unauthorized access by a third party can be prevented beforehand.
[0029]
Next, a flow of processing of a program in the authentication server 2 that realizes the remote access mediation system according to the first embodiment of the present invention will be described. FIG. 4 shows a flowchart of a program process in the authentication server 2 for realizing the remote access mediation system according to the first exemplary embodiment of the present invention.
[0030]
In FIG. 4, first, information for identifying the gateway device 1 is stored for each gateway device 1 (step S401).
[0031]
Next, login information for the gateway device 1 to which the remote access is to be connected is obtained (step S402), and compared with the stored information for identifying the gateway device 1 (step S403).
[0032]
For the gateway device 1 to be connected, if the login information for the gateway device 1 to be connected matches the stored information for identifying the gateway device 1 having the access right (step S403: Yes), In order to determine that the terminal used by the user has the right to access the gateway device 1 (step S404), and to establish a session between the terminal used by the user and the gateway device 1 Is transmitted (step S405).
[0033]
For the gateway device 1 to be connected, when the login information for the gateway device 1 to be connected does not match the stored information for identifying the gateway device 1 having the access right (step S403: No). It is determined that the terminal used by the user does not have the access right (step S406), and the user is denied access to the gateway device 1 (step S407).
[0034]
Hereinafter, an example of the remote access mediation system according to the first embodiment will be described. FIG. 5 shows an exemplary view of an initial screen provided by the authentication server 2 in the remote access mediation system according to the embodiment of the present invention.
[0035]
As shown in FIG. 5, first, a login screen is displayed on the user terminal 3 by the authentication server 2. What the user is required to enter on this screen is the device ID and password of the gateway device 1. Note that the password also needs to be stored in the authentication information storage unit 21 as in the case of the device ID.
[0036]
Then, when the device ID and the password are input and the user selects the confirmation button 51, the input device ID and the password are transmitted to the authentication server 2.
[0037]
The authentication server 2 queries the authentication information storage unit 21 based on the device ID and password of the gateway device 1 input by the user who has attempted remote access. If a combination of these pieces of information exists in the authentication information storage unit 21, it is determined that the user is an authorized user who has an access right to the designated gateway device 1, and the user is connected to the gateway device 1. The web page on which the link is described is displayed.
[0038]
The link on the web page includes not only the IP address of the gateway device 1 to be connected, but also information indicating that the user has been authenticated as having the access right via the authentication server 2. Will be added. For example, as shown in FIG. 6, not only the IP address of the gateway device 1 to be connected as a link is specified, but also a user having an access right via the authentication server 2 at a lower hierarchical level is authenticated. Add information that means that Then, when the user selects the link, the user terminal 3 establishes a session with the gateway device 1.
[0039]
At the time of establishing a session, the gateway device 1 extracts information added to a lower layer of the link, which means that the user has been authenticated as having the access right via the authentication server 2, and the access right is extracted. It is confirmed whether the user is authenticated. By doing so, even if a third party who has learned the IP address of the gateway device 1 illegally attempts to access the gateway device 1 by specifying the IP address, there is no information indicating that the authentication has been performed. , It is possible to reliably deny access.
[0040]
It is also conceivable that unauthorized use by a third party is more reliably denied by using user authentication together. In this case, the authentication information storage unit 21 includes information for identifying a user who has an access right to the gateway device 1, for example, a user ID and the like.
[0041]
Then, when it is determined that the user terminal 3 is a terminal having access right to the gateway device, it is determined whether the user using the user terminal 3 also has access right to the gateway device, Only when it is determined that the user has the access right, the use of the session is permitted. Therefore, as shown in FIG. 7, the authentication server 2 determines whether or not the user using the user terminal 3 has an access right to the gateway device, and only when it is determined that the user has the access right. A user authentication unit 71 that permits the use of the session will be added.
[0042]
As described above, according to the first embodiment, access to the gateway device is enabled only when the authentication server determines that the access right to the gateway device is granted. Unauthorized access by a third party who has learned the IP address illegally can be eliminated.
[0043]
(Embodiment 2)
Next, a remote access mediation system according to a second embodiment of the present invention will be described with reference to the drawings. FIG. 8 is a configuration diagram of the authentication server 2 in the remote access mediation system according to the second embodiment of the present invention. In the first embodiment, the case where the IP address of the gateway device is fixed is described. However, in the second embodiment, the IP address of the gateway device is not fixed and changes dynamically. The case will be described.
[0044]
First, as a case where the IP address of the gateway device is not fixed and dynamically changes, a case where a DHCP (Dynamic Host Configuration Protocol) is adopted may be used. In this case, a DHCP server is provided on the network to search for an unused IP address on the network and to automatically assign other TCP / IP setting information such as a subnet mask and a domain name.
[0045]
The gateway device 1 is provided with a network address transmission unit for transmitting the assigned dynamic IP address to the authentication server 2 at the timing at which the IP address is assigned or periodically. Is provided with a network address acquisition unit 81 that receives the assigned dynamic IP address transmitted from the gateway device.
[0046]
The network acquisition unit 81 registers and updates the received dynamic IP address assigned by the gateway device 1 in the authentication information storage unit 21 as needed, and refers to the reference every time a connection from the remote terminal to the gateway device 1 is attempted. Will be done. Subsequent processes are the same as those in the first embodiment, and thus detailed description is omitted.
[0047]
As described above, according to the second embodiment, as in the first embodiment, it is possible to eliminate unauthorized access by a third party who has learned the IP address of the gateway device to be connected illegally, Even when the IP address of the gateway device changes dynamically, it is possible to access the local network while maintaining security.
[0048]
As shown in FIG. 9, the program for realizing the remote access mediation system according to the embodiment of the present invention includes not only the portable recording medium 92 such as the CD-ROM 92-1 and the flexible disk 92-2 but also the communication The program may be stored in any of another storage device 91 provided at the end of the line, or a recording medium 94 such as a hard disk or a RAM of the computer 93. When the program is executed, the program is loaded and executed. .
[0049]
Also, as shown in FIG. 9, the authentication information data and the like generated by the remote access mediation system according to the embodiment of the present invention are portable recording media 92 such as a CD-ROM 92-1 and a flexible disk 92-2. Not only that, it may be stored in any other storage device 91 provided at the end of the communication line, or in a recording medium 94 such as a hard disk of a computer 93 or a RAM. It is read by the computer 93 when using the mediation system.
[0050]
【The invention's effect】
As described above, according to the remote access mediation system according to the present invention, since the access to the gateway device is enabled only when the authentication server determines that the access right to the gateway device is available, the remote server is a connection target. Unauthorized access by a third party who has learned the IP address of the gateway device illegally can be eliminated, and even if the address of the gateway device changes dynamically, it can be maintained in the local network while maintaining security. It becomes possible to access.
[Brief description of the drawings]
FIG. 1 is a network configuration diagram of a remote access mediation system according to a first embodiment of the present invention; FIG. 2 is a configuration diagram of an authentication server in the remote access mediation system according to the first embodiment of the present invention; FIG. 4 is a diagram illustrating an example of a data configuration of an authentication information storage unit in the remote access mediation system according to the first embodiment of the present invention. FIG. 4 is a flowchart of processing in an authentication server of the remote access mediation system according to the first embodiment of the present invention. FIG. 6 is an exemplary diagram of an initial screen in the remote access mediation system according to the embodiment of the present invention. FIG. 6 is an exemplary diagram of link generation in the remote access mediation system according to the embodiment of the present invention. FIG. 8 is a configuration diagram of an authentication server in an intermediary system. Configuration diagram of an authentication server in the access mediation system [9] exemplary diagram of a computer environment EXPLANATION OF REFERENCE NUMERALS
DESCRIPTION OF SYMBOLS 1 Gateway apparatus 2 Authentication server 3 User terminal 4 Internet 5 Local network 6 Content providing terminal 21 Authentication information storage unit 22 Login information reception unit 23 Access right existence determination unit 24 Session establishment information transmission unit 31 Login information transmission unit 32 Session establishment information reception Unit 51 Confirmation button 71 User authentication unit 81 Network address acquisition unit 91 Line destination storage device 92 Portable recording medium 92-1 such as CD-ROM or flexible disk CD-ROM
92-2 Flexible disk 93 Computer 94 Recording medium such as RAM / hard disk on computer

Claims (8)

A remote access mediation system including a gateway device for connecting a local network to the Internet, an authentication server for authenticating an access right to the gateway device, and a user terminal outside the local network and connected to the Internet. hand,
The authentication server,
An authentication information storage unit that stores authentication information of the gateway device,
A login information receiving unit that receives information related to login from the user terminal,
Inquiry of the authentication information based on information related to login from the user terminal, an access right presence / absence determination unit that determines whether the user terminal has an access right to the gateway device,
A session information transmitting unit configured to transmit, to the user terminal, information for establishing a session so that the user terminal can access the gateway device, when the user terminal is determined to have an access right to the gateway device; And a remote access mediation system comprising: In the session information transmitting unit, an access URL is generated based on the one-time password and the network address obtained from the gateway device, and the generated access URL is transmitted to the user terminal together with the one-time password. Item 2. The remote access mediation system according to Item 1. 3. The remote access mediation system according to claim 1, wherein the authentication information includes at least a network address specifying the gateway device and information for identifying the user terminal permitted to use the gateway device. 4. The remote access mediation system according to claim 3, wherein the network address is a fixed address. 4. The remote access mediation system according to claim 3, wherein the network address is variable, and further comprising a network address acquisition unit that receives the dynamic network address assigned to the gateway device from the gateway device. A remote access mediation system including a gateway device for connecting a local network to the Internet, an authentication server for authenticating an access right to the gateway device, and a user terminal outside the local network and connected to the Internet. hand,
The user terminal,
A login information transmitting unit that transmits information regarding login to the predetermined authentication server,
A session establishment information receiving unit that receives, from the authentication server, a one-time password generated by the gateway device and an access URL generated by the authentication server;
A remote access mediation system comprising: an access right establishing unit that establishes an access right to the gateway device using the received one-time password and the access URL. Provided in a network environment that includes a gateway device that connects a local network to the Internet, an authentication server that authenticates an access right to the gateway device, and a user terminal that is outside the local network and connected to the Internet. A remote access mediation method,
The authentication server,
Storing authentication information of the gateway device;
Receiving information regarding login from the user terminal;
Inquiring the authentication information based on information related to login from the user terminal, and determining whether the user terminal has an access right to the gateway device,
Transmitting, to the user terminal, information for establishing a session so that the user terminal can access the gateway device, when the user terminal is determined to have an access right to the gateway device. A remote access mediation method, characterized in that: Provided in a network environment that includes a gateway device that connects a local network to the Internet, an authentication server that authenticates an access right to the gateway device, and a user terminal that is outside the local network and connected to the Internet. A computer-executable program executed in the authentication server embodying a remote access mediation method,
Storing authentication information of the gateway device;
Receiving information on login from the user terminal;
Inquiring the authentication information based on information related to login from the user terminal, and determining whether the user terminal has an access right to the gateway device,
Transmitting, to the user terminal, information for establishing a session so that the user terminal can access the gateway device, when it is determined that the user terminal has access right to the gateway device. A computer-executable program characterized by the above-mentioned.

Images