JP2009277024A - Connection control method, communication system and terminal - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a technique in which a single terminal controls connections to a plurality of network systems while ensuring security. <P>SOLUTION: During the activation of a first program to remote-control a connected device 230, if the startup of a second program to remote-control a connected device 330 is detected and the window name of the second program detected is stored in a storage means, a thin client 100 disconnects from the connected device 230, stores first screen information from the connected device 230 displayed on a display means in the storage means, then connects to the connected device 230 according to connection information for connection to the connected device 330 stored in the storage means, and displays the first screen information stored in the storage means together with second screen information sent from the connected device 230 on the display means. <P>COPYRIGHT: (C)2010,JPO&INPIT

Description

  The present invention relates to a communication system composed of a plurality of network systems, and more particularly to a technique for controlling connection to the plurality of network systems using a thin client.

  In mission-critical business systems that handle highly confidential information, it is common to construct an independent network without being connected to the Internet in consideration of the risk of information leakage. Users who use the core system handle terminals for the core system and internal office terminals such as e-mail and the Internet. Therefore, it is necessary to install multiple terminals in the office space, and there is a problem that the office space cannot be used effectively. It was. Further, even if it is not necessarily a mission-critical business system that handles highly confidential information, the same problem has arisen in an environment where it is necessary to use a plurality of network systems.

  As a method for sharing and using a terminal in such a plurality of closed network systems, a method in which a plurality of communication devices are mounted on a terminal has been conventionally employed. In this method, since data can be exchanged between network systems via a terminal, there is a problem of security vulnerability. In addition, a method that uses a terminal switch to share input devices and display devices to effectively use the work space has been used in the past, but this method cannot be used at the same time and the cable connection is complicated. Therefore, there arises a problem that the layout cannot be freely changed.

  As means for solving the above problem, there is a method of constructing a plurality of virtual environments on one terminal and assigning them as terminals of each system. Furthermore, as disclosed in Patent Document 1, there is a method of controlling a data exchange between virtual environments and using a plurality of network systems at the same time while ensuring security in a basic environment that emulates a virtual environment.

JP 2006-201845 A

However, the technology for constructing the virtual environment has the following problems.
First, in this technology, a plurality of networks are connected via terminals that are shared and used. If there is a security hole in the operating system of the basic environment that constructs the virtual environment, there is a problem of security vulnerability that allows each system to exchange data.

  Furthermore, there is a problem that the upper limit of the number of network systems that can be connected simultaneously is limited to the maximum number of communication devices that can be installed in the terminal. In order to add a network system as a connection destination, it is necessary to add a communication device to the terminal. Therefore, the addition cannot be performed flexibly.

  An object of the present invention is to provide a technique for controlling connection to a plurality of network systems while ensuring confidentiality with a single terminal.

  In order to achieve the above object, a communication system according to the present invention includes at least a plurality of terminals and a plurality of information processing apparatuses connectable to the terminals via a network.

Each of the plurality of terminals is
Means for monitoring the activation of the second program for remotely operating the second information processing apparatus during the activation of the first program for remotely operating the first information processing apparatus;
Storage means for storing a window name of the second program and connection information necessary for connecting to the second information processing apparatus;
Means for detecting that the second program is activated, and means for comparing the window name of the second program with the window name stored in the storage means;
As a result of the collation, when both the window names match, a means for transmitting a connection interruption request to the first information processing apparatus via the network;
Means for disconnecting the connection to the first information processing apparatus and storing the first screen information from the first information processing apparatus displayed on the display means in the storage means;
Means for reading out the connection information from the storage means and transmitting a connection request to the second information processing apparatus based on the connection information via the network;
Means for receiving a connection permission notification from the second information processing apparatus via the network;
Means for connecting to the second information processing apparatus and transmitting input information of the input means to the second information processing apparatus via the network;
Means for receiving second screen information as a processing result of the input information from the second information processing apparatus via the network;
And a means for displaying the first screen information stored in the storage means together with the received second screen information on the display means.

In addition, the second information processing apparatus
Means for receiving the connection request from the terminal via the network;
Means for transmitting the connection permission notification to the terminal via the network;
Means for receiving the input information from the terminal via the network;
And means for processing the received input information to generate the second screen information and transmitting it to the terminal via the network.

  According to the present invention, connection to a plurality of network systems can be controlled while ensuring confidentiality with a single terminal. As a result, it is possible to use a plurality of systems while referring to them at the same time, so that an improvement in user convenience can be expected.

  Hereinafter, embodiments of the present invention will be described.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.

  FIG. 1 is a diagram illustrating a configuration of an entire communication system including a plurality of network systems. In FIG. 1, 100 is a thin client shared and used, 130 is an authentication device, 150 is a wireless LAN communication device connected to the thin client 100, 01 is a closed network system, and 02 is a closed network. Shows the system. Reference numeral 200 denotes a wireless LAN communication apparatus of the system 01, 210 denotes a wireless LAN base station of the system 01, 220 denotes an authentication server of the system 01 that authenticates a user of the thin client 100, and 230 denotes a connection destination apparatus of the system 01. Similarly, 300 is a wireless LAN communication apparatus of system 02, 310 is a wireless LAN base station of system 02, 320 is an authentication server of system 02, and 330 is a connection destination apparatus of system 02.

  FIG. 2 is a block diagram illustrating configurations of the thin client 100 and the authentication device 130. The thin client 100 includes: a wireless LAN communication unit 101 that controls wireless LAN communication; a remote operation unit 102 that remotely operates the connection destination device 230 or the connection destination device 330; a connection destination switching control unit 103 that switches a connection destination network; Display means 104 for displaying information on the client screen, operation detection means 105 for monitoring user operations, authentication ticket verification means 106 for verifying the expiration date of the authentication ticket stored in the temporary storage area, information necessary for reconnection Is temporarily stored. When the thin client 100 establishes a connection to the connection destination device 230 or the connection destination device 330, the thin client 100 stores the system connection information necessary for reconnection in the temporary storage area 123. The system connection information necessary for reconnection is set in the system ID 111 for identifying the connection destination system, the authentication ticket 112 that proves that it has the authority to connect to the connection destination device 230 or the connection destination device 330, and the thin client 100 itself. It includes an IP address 113, a wireless communication encryption key 114 set in the wireless LAN communication means 101, a connection destination device IP address 115, and a window name 116 of the remote operation application when the connection is established. The temporary storage area 123 is an area secured on the volatile memory of the thin client 100. When the thin client 100 is stopped / restarted, all the system connection information stored in the temporary storage area 123 is cleared. The authentication device 130 includes an electronic certificate 131 that proves that the user is authorized, a password 132 that only the authorized user knows, setting information for connecting to the system 01, and settings for connecting to the system 02. Register information in advance. The setting information for connecting to the system 01 includes a system ID 133 for identifying the system 01, an IP address 134 of the system 01 network set in the thin client 100 itself, a wireless communication encryption key 135 of the system 01, and an authentication server IP of the system 01 An address 136 is included. Similarly, the setting information for connecting to the system 02 includes a system ID 137, an IP address 138, a wireless communication encryption key 139, and an authentication server IP address 140.

  FIG. 3 is a block diagram illustrating configurations of the wireless LAN base station 210, the authentication server 220, and the connection destination device 230. The wireless LAN base station 310, the authentication server 320, and the connection destination device 330 have the same configurations as the wireless LAN base station 210, the authentication server 220, and the connection destination device 230, respectively.

  The wireless LAN base station 210 includes a wireless LAN communication unit 211 and a wireless communication encryption key 212, and performs wireless communication with the thin client 100 and encrypts communication to prevent eavesdropping on communication. The authentication server 220 includes an authentication database 224 that stores information for authenticating the user of the thin client 100 and an authentication ticket issuing unit 225 that issues an authentication ticket. The authentication database 224 includes an electronic certificate 223 for verification with information transmitted from the thin client 100, a password 222, and a connection destination apparatus IP address 221 to which the thin client 100 is connected. The connection destination device 230 includes an authentication ticket verification unit 231 that verifies the validity of the authentication ticket of the thin client 100 and a remote operation unit 232 that allows the thin client 100 to perform a remote operation.

  Next, a method of newly connecting to the connection destination device 230 of the system 01 will be described with reference to the flowcharts of FIGS. 4, 5, and 6. When the user starts the system connection program, the authentication apparatus outputs a list of system IDs set in advance to the new client 100, and the thin client 100 displays the system list on the system selection screen using the display unit 104 ( Step 400). When the user selects the system 01 on the system selection screen, the thin client 100 transmits the system ID 111 selected by the user to the authentication device, and requests information on the system 01 (step 401). The authentication apparatus outputs system 01 information corresponding to the transmitted system ID 111 to the thin client 100, and the thin client 100 displays the output system 01 information on the display means 104 (step 402).

  FIG. 10 is a diagram illustrating an example of a system selection screen. The user confirms the connection destination system with the registration information 802 displayed on the display unit 104. When the user presses the connection button 803, the thin client 100 determines whether or not a system ID corresponding to the system 01 exists in the temporary storage area 123 (step 403). When the system ID exists in the temporary storage area 123 (step 404), the connection destination apparatus IP address 115 and the authentication ticket 112 corresponding to the system ID stored in the temporary storage area 123 are read out, and the connection destination apparatus IP address is read out. The authentication ticket 112 is transmitted to the connection destination device 230 corresponding to 115 (step 417). If the result of determination in step 403 is that there is no system ID in the temporary storage area (step 404), the thin client 100 displays a password entry screen on the display means 104 (step 405).

  FIG. 11 is a diagram illustrating an example of a password input screen. When the user inputs a password and presses an OK button 902, the thin client 100 outputs the password input from the screen to the authentication device 130 (step 406), and the authentication device 130 verifies the password 132 (step 407). ). When the password is verified (step 408), the authentication apparatus 130 provides the thin client 100 with the electronic certificate 131, the password 132, the authentication server IP address 136 corresponding to the system ID 133, the IP address 134 set for the thin client 100, and the wireless The wireless communication encryption key 135 set in the LAN communication means 101 is output (step 409). The thin client 100 sets the output IP address 134 and the wireless communication encryption key 135 in the wireless LAN communication means 101 (step 410). A wireless communication encryption key 212 identical to the wireless communication encryption key 135 is set in advance in the wireless LAN communication unit 211 of the wireless LAN base station 210. Communication between the thin client 100 and the wireless LAN base station 210 performs communication encryption using a common encryption key.

  After step 410, the thin client 100 transmits the electronic certificate 131 and the password 132 to the authentication server 220 corresponding to the authentication server IP address 136 (step 411). The authentication server 220 collates the received electronic certificate / password with the electronic certificate 223 and password 222 of the authentication database 224 (step 412). When collation cannot be performed (step 413), the screen returns to the password input screen (step 405). If the password is verified as a result of the determination in step 413, the authentication server 220 reads the connection destination device IP address 221 from the authentication database 224 (step 414), and generates an authentication ticket by the authentication ticket issuing means 225 (step 415). ). The input information for generating the authentication ticket is set in advance as the IP address of the connection source thin client 100, the IP address of the connection destination device 230, and the time information (hour: minute: second :) when generating the authentication ticket. Including lifetime. The authentication server transmits the generated authentication ticket and the connection destination device IP address 221 together to the thin client 100 (step 416).

  The thin client 100 transmits the received authentication ticket to the connection destination device 230 corresponding to the connection destination device IP address 221 (step 417). The connection destination device 230 uses the authentication ticket verification unit 231 to check whether the connection source / connection destination IP address included in the authentication ticket matches the IP address used for actual communication. Further, it is confirmed that the expiration date of the authentication ticket has not expired (step 418). If the validity of the authentication ticket cannot be confirmed (step 419), the screen returns to the password input screen (step 405). When the validity of the authentication ticket is confirmed (step 419), the connection destination device 230 notifies the thin client 100 that remote operation is permitted (step 420).

  The thin client 100 that has received the remote operation permission stores the connection information of the system 01 in the temporary storage area 123 (step 421). The connection information of the system 01 includes the system ID selected by the user in step 400, the IP address and wireless communication encryption key output by the authentication device in step 409, the authentication ticket acquired in step 416 and the connection destination device IP address, The window name of the remote operation program established in step 420 is included. When the system 01 information is already stored in the temporary storage area 123, the existing system 01 information is overwritten with new system 01 information. After the system information is stored in the temporary storage area, a remote connection request is transmitted from the thin client 100 to the connection destination device 230 (step 422), and the remote connection is accepted by the connection destination device 230 to start remote operation connection. (Step 423).

  When the remote operation connection is started, the operation detection unit 105 of the thin client 100 monitors the user's operation (step 424). When the user terminates the remote operation program, the operation detection means 105 acquires the window name of the terminated program (step 425). The window name of the terminated program and the remote operation program window name 116 saved in the temporary storage area 123 are collated (step 426). If collation cannot be performed (step 427), the process returns to the user operation monitoring (step 427). Step 424). As a result of the determination in step 426, when the window name of the terminated program is compared with the window name 116 (step 427), the communication with the connection destination device 230 is disconnected and the connection information of the system 01 corresponding to the window name 116 is obtained. Delete from the temporary storage area (step 428). The connection information of the system 01 includes a system ID 111, an IP address 113, a wireless communication encryption key 114, an authentication ticket 112, a connection destination device IP address 115, and a remote operation program window name 116. Even if the thin client 100 is abnormally terminated by a method other than the above, all the system connection information stored in the temporary storage area 123 is cleared when the thin client 100 is stopped and restarted. With the above procedure, a new connection is made to the connection destination device 230 of the system 01, and disconnection is performed after the remote operation is completed.

  Next, a method for newly connecting to the connection destination device 330 of the system 02 while being connected to the connection destination device 230 of the system 01 will be described. It is assumed that the connection destination device 230 of the system 01 is currently being operated remotely. It is assumed that connection information of the system 02 is not stored in the temporary storage area 123. Basically, it is the same as the method of newly connecting, except that the screen information of the remote operation program of the system 01 is temporarily stored immediately before switching the connection to the system 02. According to the flowchart of FIG. 7 describing the procedure for temporarily storing the screen information in accordance with FIGS. 4, 5, and 6, the system 02 is newly connected to the connection destination device 230 of the system 01. A method for connecting to the connection destination device 330 will be described.

  The procedure from Step 400 to Step 409 is the same from the procedure in which the connected system 01 user starts the system connection program and selects the system 02 until the authentication device 130 outputs the information on the system 02. In step 409, an electronic certificate 131, password 132, authentication server IP address 140 corresponding to the system ID 137, IP address 138 set in the thin client 100, and wireless communication encryption key 139 set in the wireless LAN communication unit 101 are received from the authentication device 130. When output from the authentication device 130, the thin client 100 requests the connection destination device 230 to interrupt the connection (step 500). The connection destination device 230 accepts the connection interruption (step 501). The thin client 100 temporarily saves the screen information of the remote operation program displayed on the display means 104 (step 502). The thin client 100 disconnects the communication of the connection destination device 230 (step 503). Further, the thin client 100 sets the IP address 138 and the wireless communication encryption key 139 output from the authentication device 130 in step 409 to the wireless LAN communication unit 101 (step 504). Subsequent procedures are connected to the connection destination device 330 of the system 02 in the same manner as the procedures after step 411. With the above procedure, a new connection can be made to the connection destination device 330 of the system 02 while being connected to the connection destination device 230 of the system 01.

  Further, a method of switching the connection destination network system according to a user operation will be described with reference to the flowcharts of FIGS. Assuming that the connection destination is switched, it is assumed that the connection destination device 230 of the system 01 is currently being remotely operated. Further, it is assumed that the connection is made to the connection destination device 330 of the system 02 until just before the connection to the connection destination device 230 of the system 01, and the connection information of the system 02 is stored in the temporary storage area 123. The connection information of the system 02 includes a system ID 117, an authentication ticket 118, an IP address 119, a wireless communication encryption key 120, a connection destination device IP address 121, and a remote operation program window name 122.

  The thin client 100 monitors the user's operation with the operation detection unit 105 (step 601). When the user changes the active window of the thin client 100, the operation detection unit 105 acquires the active window name (step 602). If the connection destination switching control means 103 of the thin client 100 collates the activated window name with the window name of the remote operation program stored in the temporary storage area 123 and cannot perform collation (step 603), it continues. Returning to user operation monitoring (step 601). If the activated window name matches with the window name 122 as a result of the determination in step 604, the system ID 117 and the authentication ticket 118 corresponding to the window name 122 are read from the temporary storage area (step 605). The expiration date of the read authentication ticket 118 is confirmed by the authentication ticket verification means 106 (step 606). If the authentication ticket has expired (step 607), the screen returns to the password input screen (step 405).

  If the authentication ticket is within the expiration date (step 607), the connection interruption is transmitted to the connection destination device 230 (step 608). The connection destination device 230 accepts the connection interruption (step 609). The thin client 100 temporarily saves the screen information of the remote operation program displayed on the display means 104 (step 610). The thin client 100 disconnects the communication of the connection destination device 230 (step 611).

  Subsequently, the thin client 100 reads the IP address 119, the wireless communication encryption key 120, and the connection destination device IP address 121 corresponding to the system ID 117 (step 612). Further, the thin client 100 sets the IP address 119 and the wireless communication encryption key 120 in the wireless LAN communication unit 101 (step 613). The authentication ticket 118 is transmitted to the connection destination device 330 corresponding to the read connection destination device IP address 121 (step 614).

  The connection destination device 330 checks whether the connection source / connection destination IP addresses included in the authentication ticket match the IP addresses used for actual communication. Further, it is confirmed that the expiration date of the authentication ticket has not expired (step 615). If the authentication ticket is valid (step 616), the thin client 100 is notified that remote operation is permitted (step 617). A request for remote connection is transmitted from the thin client 100 to the connection destination device 330 (step 618), and the remote connection is started when the connection destination device 330 accepts the remote connection (step 619). The thin client 100 displays the screen information from the connection destination device 230 on the display unit 104 together with the screen information from the connection destination device 230 temporarily stored in Step 610. The connection destination device can be switched according to the user's operation by the above procedure.

  FIG. 12 shows an example of the thin client 100 that simultaneously launches a plurality of remote operation applications. In FIG. 12, the window of the system 02 connection screen 905 is active, and the thin client 100 is being connected to the connection destination device 330 of the system 02. The window of the system 01 connection screen 904 is inactive, and the thin client 100 is not connected to the connection destination device 230 of the system 01. However, since the thin client 100 displays the screen from the connection destination device 230 when the connection is interrupted, the user of the thin client 100 operates the connection destination device 330 while referring to the screen of the connection destination device 230. can do.

  The first embodiment has been described above. According to the first embodiment, it is possible to control connection to a plurality of network systems while ensuring confidentiality with a single terminal. As a result, it is possible to use a plurality of systems while referring to them at the same time, so that an improvement in user convenience can be expected. Further, since the number of network systems that can be connected does not depend on the physical configuration of the shared terminal, it can be added flexibly.

  The second embodiment is an embodiment in which the connection destination device has an authentication function without using an authentication server / authentication ticket. Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.

  FIG. 13 is a diagram illustrating a configuration of the entire communication system including a plurality of networks. In FIG. 13, 1100 is a thin client to be shared and used, 1130 is an authentication device, 1150 is a wireless LAN communication device connected to the thin client 1100, 101 is a closed network system, and 102 is a closed network. Shows the system. 1200 is a wireless LAN communication apparatus of the system 101, 1210 is a wireless LAN base station of the system 101, and 1220 is a connection destination apparatus of the system 101.

  Similarly, 1300 is a wireless LAN communication device of the system 102, 1310 is a wireless LAN base station of the system 102, and 1320 is a connection destination device of the system 102.

  FIG. 14 is a block diagram illustrating configurations of the thin client 1100 and the authentication device 1130. The thin client 1100 includes a wireless LAN communication unit 1101 for controlling wireless LAN communication, a remote operation unit 1102 for remotely operating the connection destination device 1220 or the connection destination device 1320, a connection destination switching control unit 1103 for switching a connection destination network, A display unit 1104 for displaying information on the client 1100 screen, an operation detection unit 1105 for monitoring user operations, and a temporary storage area 1123 for temporarily storing information necessary for reconnection are provided.

  When the thin client 1100 establishes a connection with the connection destination device 1220 or the connection destination device 1320, the thin client 1100 stores system connection information necessary for reconnection in the temporary storage area 1123. The system connection information necessary for reconnection includes a system ID 1111 for identifying the connection destination system, an IP address 1112 set for the thin client 1100 itself, a wireless communication encryption key 1113 set for the wireless LAN communication means, and a connection destination device IP address 1114. The window name 1115 of the remote operation application when the connection is established is included.

  The temporary storage area 1123 is an area secured on the volatile memory of the thin client 1100. When the thin client 1100 stops and restarts, all the system connection information stored in the temporary storage area 1123 is cleared. The authentication device 1130 includes an electronic certificate 1131 that proves that the user is authorized, a password 1132 that only the authorized user knows, setting information for connecting to the system 101, and settings for connecting to the system 102. Register information in advance. The setting information for connecting to the system 101 includes a system ID 1133 for identifying the system 101, an IP address 1134 of the system 101 network set in the thin client 1100 itself, a wireless communication encryption key 1135 of the system 101, and a connection destination device of the system 101 IP address 1136 is included.

  Similarly, the setting information for connecting to the system 102 includes a system ID 1137, an IP address 1138, a wireless communication encryption key 1139, and a connection destination device IP address 1140.

  FIG. 15 is a block diagram illustrating configurations of the wireless LAN base station 1210 and the connection destination device 1220. The wireless LAN base station 1310 and the connection destination device 1320 have the same configuration as the wireless LAN base station 1210 and the connection destination device 1220, respectively. The wireless LAN base station 1210 includes a wireless LAN communication unit 1211 and a wireless communication encryption key 1212. The wireless LAN base station 1210 performs wireless communication with the thin client 1100 and encrypts communication to prevent eavesdropping on communication. The connection destination device 1220 includes an electronic certificate verification unit 1221 that verifies the validity of the electronic certificate of the thin client 1100, a remote operation unit 1222 that performs remote operation from the thin client 1100, and a user for authenticating the user of the thin client 1100. An authentication database 1223 for storing information and connection information 1226 which is an area secured on the volatile memory of the connection destination device 1220 are provided. The authentication database 1223 includes an electronic certificate 1224 and a password 1225 for collating with information transmitted from the thin client 100. The connection information 1226 includes a thin client IP address 1227.

  Next, a method of newly connecting to the connection destination device 1220 of the system 101 will be described with reference to the flowcharts of FIGS. 16, 17, and 18. When the user starts the system connection program, the authentication apparatus 1130 outputs a list of system IDs set in advance to the sink client 1100, and the thin client 1100 displays the system list on the system selection screen using the display unit 1104. (Step 1400). When the user selects the system 101 on the system selection screen, the thin client 1100 transmits the system ID selected by the user to the authentication device 1130 and requests information on the system 101 (step 1401). The authentication apparatus 1130 outputs the system 101 information corresponding to the transmitted system ID to the thin client 1100, and the thin client 1100 displays the output system 01 information on the display unit 1104 (step 1402).

  FIG. 22 is a diagram illustrating an example of a system selection screen. The user confirms the connection destination system with the registration information 1802 displayed on the display unit 1104. When the user presses the connection button 1803, the thin client 1100 displays a password input screen on the display unit 1104 (step 1403).

  FIG. 23 is a diagram illustrating an example of a password input screen. When the user inputs a password and presses an OK button 1902, the thin client 1100 outputs the password input from the screen to the authentication device 1130 (step 1404), and the authentication device 1130 collates with the password 1132 (step 1405). ). When the password is verified (step 1406), the authentication apparatus gives the thin client 1100 an electronic certificate 1131, password 1132, connection destination apparatus IP address 1136 corresponding to the system ID 1133, IP address 1134 set in the thin client 1100, wireless The wireless communication encryption key 1135 set in the LAN communication unit 1101 is output (step 1407).

  The thin client 1100 sets the output IP address 1134 and wireless communication encryption key 1135 in the wireless LAN communication unit 1101 (step 1408). In the wireless LAN communication unit 1211 of the wireless LAN base station 1210, the same wireless communication encryption key 1212 as the wireless communication encryption key 1135 is set in advance. Communication between the thin client 1100 and the wireless LAN base station 1210 encrypts communication using a common encryption key.

  After step 1408, the thin client 1100 transmits the electronic certificate 1131 and the password 1132 to the connection destination device 1220 corresponding to the connection destination device IP address 1136 (step 1409). The connection destination device 1220 collates the received electronic certificate / password with the electronic certificate 1224 and password 1225 in the authentication database 1223 (step 1410). If the verification is not possible (step 1411), the screen returns to the password input screen (step 1403).

  If the password is verified as a result of the determination in step 1411, the connection destination device 1220 notifies the thin client 1100 that remote operation is permitted (step 1412). The thin client 1100 that has received the permission for remote operation stores the connection information of the system 101 in the temporary storage area 1123 (step 1413). The connection information of the system 101 includes the system ID selected by the user in step 1400, the IP address and wireless communication encryption key output by the authentication device 1130 in step 1407, the connection destination device IP address, and the remote operation established in step 1412 Contains the window name of the program. When the system 101 information is already stored in the temporary storage area 1123, the existing system 101 information is overwritten with the new system 101 information.

  After the system information is stored in the temporary storage area 1123, when a request for remote connection is transmitted from the thin client 1100 to the connection destination device 1220 (step 1414), the connection destination device 1220 adds the thin client IP address 1227 to the connection information 1226. The time at the time of connection is stored (step 1415), and the remote connection is started (step 1416). When the remote operation connection is started, the operation detection unit 1105 of the thin client 1100 monitors the user's operation (step 1417). When the user ends the remote operation program, the operation detection unit 1105 acquires the window name of the ended program (step 1418). The window name of the terminated program and the remote operation program window name 1115 stored in the temporary storage area 1123 are collated (step 1419). If collation cannot be performed (step 1420), the process returns to the user operation monitoring (step 1420). Step 1416). As a result of the determination in step 1419, when the window name of the terminated program is checked against the window name 1115 (step 1420), a communication disconnection request is sent to the connection destination device 1220 (step 1421).

  The connection destination device 1220 receives the disconnection notification and deletes the connection information 1226 (step 1422). The thin client 1100 deletes the connection information of the system 101 corresponding to the window name 1115 from the temporary storage area and disconnects the connection (step 1423). The connection information of the system 101 includes a system ID 1111, an IP address 1112, a wireless communication encryption key 1113, a connection destination device IP address 1114, and a remote operation program window name 1115. Even if the thin client 1100 is abnormally terminated by a method other than the above, all the system connection information stored in the temporary storage area 1123 is cleared when the thin client 1100 is stopped and restarted. Further, the connection information 1226 of the connection destination device 1220 is also cleared after a predetermined time. With the above procedure, a new connection is made to the connection destination device 1220 of the system 101, and disconnection is performed after the remote operation is completed.

  Next, a method for newly connecting to the connection destination of the system 102 while connected to the connection destination device 1220 of the system 101 will be described. As a premise, it is assumed that the connection destination device 1220 of the system 101 is currently being remotely operated. It is assumed that connection information of the system 102 is not stored in the temporary storage area 1123. Basically, this is the same as the method of newly connecting, but the point that the screen information of the remote operation program of the system 101 is temporarily stored immediately before switching the connection to the system 102 is different. In accordance with the flowchart of FIG. 19 describing the procedure for temporarily storing the screen information in accordance with the above-described FIGS. 16, 17, and 18, the system 102 is newly connected to the connection destination device 1220 of the system 101. A method for connecting to the connection destination will be described.

  The procedure from Step 1400 to Step 1407 is the same from the procedure in which the user of the connected system 101 activates the system connection program and selects the system 102 until the authentication device 1130 outputs the information on the system 102. In step 1407, the authentication apparatus 1130 sends the electronic certificate 1131, password 1132, connection destination apparatus IP address 1140 corresponding to the system ID 1137, IP address 1138 set in the thin client 1100, and wireless communication encryption key 1139 set in the wireless LAN communication means 1101. Is output from the authentication device 1130, the thin client 1100 requests the connection destination device 1220 to interrupt the connection (step 1500). The connection destination device 1220 accepts the connection interruption (step 1501).

  The thin client 1100 temporarily saves the screen information of the remote operation program displayed on the display unit 1104 (step 1502). The thin client 1100 disconnects communication with the connection destination device 1220 (step 1503). Further, the thin client 1100 sets the IP address 1138 and the wireless communication encryption key 1139 output from the authentication device 1130 in step 1407 in the wireless LAN communication unit 1101 (step 1504). Subsequent procedures are connected to the connection destination device 1320 of the system 102 in the same manner as the procedures after step 1409. With the above procedure, a new connection is made to the connection destination device 1320 of the system 102 while being connected to the connection destination device 1220 of the system 101.

  Further, a method of switching the connection destination network system according to a user operation will be described with reference to the flowcharts of FIGS. When switching connection destinations, it is assumed that the connection destination device 1220 of the system 101 is currently being remotely operated. Further, it is assumed that the connection is made to the connection destination device 1320 of the system 102 until just before the connection to the connection destination device 1220 of the system 101, and the connection information of the system 102 is stored in the temporary storage area 1123. The connection information of the system 102 includes a system ID 1116, an IP address 1117, a wireless communication encryption key 118, a connection destination device IP address 1119, and a remote operation program window name 1120.

  The thin client 1100 monitors the operation of the user by the operation detection unit 1105 (step 1601). When the user changes the active window of the thin client 1100, the operation detection unit 1105 acquires the active window name (step 1602). If the connection destination switching control unit 1103 of the thin client 1100 collates the activated window name with the window name of the remote operation program stored in the temporary storage area 1123 and cannot perform collation (step 1603), it continues. Returning to user operation monitoring (step 1601).

  If it is determined in step 1604 that the activated window name matches the window name 1120, the connection destination apparatus 1220 is requested to interrupt the connection (step 1605). The connection destination device 1220 accepts the connection interruption (step 1606).

  The thin client 1100 temporarily saves the screen information of the remote operation program displayed on the display unit 1104 (step 1607). The thin client 1100 disconnects communication with the connection destination device 1220 (step 1608). Subsequently, the thin client 1100 reads the IP address 1117, the wireless communication encryption key 1118, and the connection destination device IP address 1119 corresponding to the system ID 1116 (step 1609). Further, the thin client 1100 sets the IP address 1117 and the wireless communication encryption key 1118 in the wireless LAN communication unit 1101 (step 1610). Then, the thin client 1100 makes a connection request to the connection destination device 1320 (step 1611).

  The connection destination device 1320 collates the IP address of the connection information with the thin client 1100 (step 1612). If the IP address of the connection information matches that of the thin client 1100 (step 1613), the thin client 1100 is notified that remote operation is permitted (step 1614). A request for remote connection is transmitted from the thin client 1100 to the connection destination device 1320 (step 1615), and the remote connection is started when the connection destination device 1320 accepts the remote connection (step 1616). The thin client 1100 displays the screen information from the connection destination device 1220 and the screen information from the connection destination device 1320 on the display unit 1104 together with the screen information temporarily stored in Step 1607. The connection destination device can be switched according to the user's operation by the above procedure.

  The second embodiment has been described above. According to the second embodiment, it is possible to control connection to a plurality of network systems while ensuring confidentiality with a single terminal. As a result, it is possible to use a plurality of systems while referring to them at the same time, so that an improvement in user convenience can be expected. Further, since the number of network systems that can be connected does not depend on the physical configuration of the shared terminal, it can be added flexibly.

It is a figure which shows the communication system whole structure which concerns on Example 1 of this invention. It is a block diagram which shows the structure of a thin client and an authentication apparatus. 3 is a block diagram illustrating configurations of an authentication server 220 and a connection destination device 230. FIG. 10 is a flowchart showing a procedure for newly connecting to a connection destination device 230; Similarly, it is a flowchart showing a procedure for newly connecting to the connection destination device 230. Similarly, it is a flowchart showing a procedure for newly connecting to the connection destination device 230. 10 is a flowchart illustrating a procedure for newly connecting to another connection destination device 330 from a state in which the connection destination device 230 is connected. It is a flowchart which shows the procedure which switches a connecting point apparatus according to a system user's operation. Similarly, it is a flowchart showing a procedure for switching the connection destination device according to the operation of the system user. It is a figure which shows the example of a system selection screen. It is a figure which shows the example of a password input screen. It is a figure which shows displaying the screen from several connection destination apparatuses (230,330) simultaneously. It is a figure which shows the whole communication system structure which concerns on Example 2 of this invention. 2 is a block diagram illustrating configurations of a thin client 1100 and an authentication device 1130. FIG. 10 is a block diagram illustrating a configuration of a connection destination device 1220. FIG. 10 is a flowchart showing a procedure for newly connecting to a connection destination device 1220. Similarly, it is a flowchart showing a procedure for newly connecting to the connection destination device 1220. Similarly, it is a flowchart showing a procedure for newly connecting to the connection destination device 1220. 18 is a flowchart showing a procedure for newly connecting to another connection destination device 1320 from a state of being connected to the connection destination device 1220. It is a flowchart which shows the procedure which switches a connecting point apparatus according to a system user's operation. Similarly, it is a flowchart showing a procedure for switching the connection destination device according to the operation of the system user. It is a figure which shows the example of a system selection screen. It is a figure which shows the example of a password input screen.

Explanation of symbols

DESCRIPTION OF SYMBOLS 100 ... Thin client 130 ... Authentication apparatus 150 ... Wireless LAN communication apparatus 200 ... Wireless LAN communication apparatus 210 ... Wireless LAN base station 220 ... Authentication server 230 ..Connection destination device, 300 ... Wireless LAN communication device, 310 ... Wireless LAN base station, 320 ... Authentication server, 330 ... Connection destination device, 1130 ... Authentication device, 1100 ... Thin client, 1150 ... wireless LAN communication device, 1200 ... wireless LAN communication device, 1210 ... wireless LAN base station, 1220 ... connection destination device, 1300 ... wireless LAN communication device, 1310 ... Wireless LAN base station, 1320... Connection destination device.

Claims (7)

A connection control method in an information processing system including a plurality of terminals and a plurality of information processing devices connectable to the plurality of terminals via a network,
The terminal
Detecting the activation of the second program for remotely operating the second information processing apparatus during the activation of the first program for remotely operating the first information processing apparatus;
When the window name of the detected second program is stored in the storage means, the first information processing apparatus is disconnected from the first information processing apparatus and displayed on the display means Storing the first screen information from the storage means,
Connecting to the second information processing device based on connection information for connecting to the second information processing device stored in the storage means;
The connection control method, wherein the first screen information stored in the storage unit is displayed on the display unit together with second screen information transmitted from the second information processing apparatus. A connection control method in an information processing system including a plurality of terminals and a plurality of information processing devices connectable to the plurality of terminals via a network,
The terminal
Monitoring the activation of the second program for remotely operating the second information processing apparatus during the activation of the first program for remotely operating the first information processing apparatus;
When the activation of the second program is detected, the window name of the second program is collated with the window name stored in the storage means,
As a result of the collation, when both the window names match, a connection interruption request is transmitted to the first information processing apparatus via the network.
Disconnecting the connection to the first information processing apparatus, storing the first screen information from the first information processing apparatus displayed on the display means in the storage means,
Read connection information necessary to connect to the second information processing device from the storage means, and transmit a connection request to the second information processing device based on the connection information via the network,
Receiving a connection permission notification from the second information processing apparatus via the network;
Connecting to the second information processing apparatus, transmitting the input information of the input means to the second information processing apparatus via the network;
Receiving second screen information, which is a processing result of the input information, from the second information processing apparatus via the network;
Displaying the first screen information stored in the storage unit together with the received second screen information on the display unit;
The second information processing apparatus
Receiving the connection request from the terminal via the network;
Sending the connection permission notification to the terminal via the network;
Receiving the input information from the terminal via the network;
A connection control method comprising: processing the received input information to generate the second screen information and transmitting the second screen information to the terminal via the network. The storage means further stores information indicating whether or not the user has authority to connect to the second information processing apparatus,
When the terminal determines that the two window names match as a result of the collation and has the authority to connect to the second information processing apparatus based on the authority information stored in the storage means The connection control method according to claim 2, wherein the connection information is read from the storage unit, and a connection request is transmitted to the second information processing apparatus based on the connection information via the network. A communication system including a plurality of terminals and a plurality of information processing devices connectable to the plurality of terminals via a network,
Each of the terminals
Means for monitoring the activation of the second program for remotely operating the second information processing apparatus during the activation of the first program for remotely operating the first information processing apparatus;
Storage means for storing a window name of the second program and connection information necessary for connecting to the second information processing apparatus;
Means for detecting that the second program is activated, and means for comparing the window name of the second program with the window name stored in the storage means;
As a result of the collation, when both the window names match, a means for transmitting a connection interruption request to the first information processing apparatus via the network;
Means for disconnecting the connection to the first information processing apparatus and storing the first screen information from the first information processing apparatus displayed on the display means in the storage means;
Means for reading out the connection information from the storage means and transmitting a connection request to the second information processing apparatus based on the connection information via the network;
Means for receiving a connection permission notification from the second information processing apparatus via the network;
Means for connecting to the second information processing apparatus and transmitting input information of the input means to the second information processing apparatus via the network;
Means for receiving second screen information as a processing result of the input information from the second information processing apparatus via the network;
Means for displaying the first screen information stored in the storage means together with the received second screen information on the display means;
The second information processing apparatus
Means for receiving the connection request from the terminal via the network;
Means for transmitting the connection permission notification to the terminal via the network;
Means for receiving the input information from the terminal via the network;
Means for processing the received input information to generate the second screen information and transmitting it to the terminal via the network. The storage means further stores information indicating whether or not the user has authority to connect to the second information processing apparatus,
When the terminal determines that the two window names match as a result of the collation and has the authority to connect to the second information processing apparatus based on the authority information stored in the storage means The communication system according to claim 4, wherein the connection information is read from the storage unit, and a connection request is transmitted to the second information processing apparatus via the network based on the connection information. A terminal that can be connected to a plurality of information processing apparatuses via a network,
Means for monitoring the activation of the second program for remotely operating the second information processing apparatus during the activation of the first program for remotely operating the first information processing apparatus;
Storage means for storing a window name of the second program and connection information necessary for connecting to the second information processing apparatus;
Means for detecting that the second program is activated, and means for comparing the window name of the second program with the window name stored in the storage means;
As a result of the collation, when both the window names match, a means for transmitting a connection interruption request to the first information processing apparatus via the network;
Means for disconnecting the connection to the first information processing apparatus and storing the first screen information from the first information processing apparatus displayed on the display means in the storage means;
Means for reading out the connection information from the storage means and transmitting a connection request to the second information processing apparatus based on the connection information via the network;
Means for receiving a connection permission notification from the second information processing apparatus via the network;
Means for connecting to the second information processing apparatus and transmitting input information of the input means to the second information processing apparatus via the network;
Means for receiving second screen information as a processing result of the input information from the second information processing apparatus via the network;
A terminal for displaying the first screen information stored in the storage unit together with the received second screen information on the display unit. The storage means further stores information indicating whether or not the user has authority to connect to the second information processing apparatus,
When the terminal determines that the two window names match as a result of the collation and has the authority to connect to the second information processing apparatus based on the authority information stored in the storage means The terminal according to claim 6, wherein the connection information is read from the storage unit, and a connection request is transmitted to the second information processing apparatus based on the connection information via the network.

Images