WO2012132697A1

WO2012132697A1 - Connection destination limitation system, connection destination limitation method, terminal setting control system, terminal setting control method, and program

Info

Publication number: WO2012132697A1
Application number: PCT/JP2012/054709
Authority: WO
Inventors: 治福本; 正浩上野; 拓朗新妻; 天峰馬; 惇木下; 純央緑川; 良輔栗原
Original assignee: 株式会社野村総合研究所
Priority date: 2011-03-28
Filing date: 2012-02-27
Publication date: 2012-10-04
Also published as: CN102822838B; CN102822838A

Abstract

A communication management server (11) executes a key-packet transmission AP (21) to intermittently perform multi-address transmission of key-packets to an internal network (4). A local terminal (15) (remote terminal (16)) executes a key-packet reception AP (23) to receive information which has been transmitted by multi-address transmission to the internal network (4), and sets a reception flag on the basis of the presence/absence of the reception of a key-packet from the communication management server (11). Further, the local terminal (15) (remote terminal (16)) executes a connection destination limitation AP (25) to determine whether or not the local terminal itself is physically connected to the internal network (4) on the basis of the reception flag. When it is determined that the local terminal itself is physically connected to the internal network (4), a connection process is executed for the logical connection request.

Description

Connection destination restriction system, connection destination restriction method, terminal setting control system, terminal setting control method, and program

The present invention relates to a system for managing network connections of terminals. In particular, the present invention relates to a connection destination restriction system that restricts a logical connection destination of a terminal. The present invention also relates to a terminal setting control system for controlling terminal settings according to a connected network.

Conventionally, PCs (Personal Computers) and personal digital assistants (Personal Digital) used in the company
Assistant), mobile phones, tablet terminals, smartphones (hereinafter simply referred to as “terminals”), and security issues have been pointed out. These terminals can be logically directly connected to the Internet, a home LAN (Local Area Network) or the like without any restrictions. Here, “logically directly connected to the Internet, home LAN, etc.” means that, for example, communication using TCP / IP (Transmission Control Protocol / Internet Protocol) is installed on an external server or home via the Internet. This means a connection mode in which the IP address and port number (address information) of another terminal is connected to the terminal, and the terminal is physically connected directly to a communication device installed in an external network (regardless of wired or wireless). Not included).

If the terminal is logically directly connected to the Internet or home LAN, it may not be possible to restrict access to websites on the Internet or detect that the anti-will software pattern file has not been updated. Risk increases. In addition, when a terminal is logically directly connected to the Internet, a home LAN, or the like, a communication trail cannot be acquired, so that it is easy to intentionally leak information.

For example, Patent Document 1 discloses the following network for the purpose of preventing a computer into which an illegal program such as a virus or spyware has entered while away from home from being connected to a secure network such as an in-house LAN. A connection control method is disclosed. (1) When the user terminal 10 is activated and attempts to connect to the in-house LAN, the connection to the network is temporarily stopped, and the user terminal 10 is compared with the environment in which the user terminal 10 was operated last time or with the in-house LAN environment. Is called. (2) If there is no change from the previous operating environment, the connection to the in-house LAN is restored as it is, but if it was determined that the connection was outside the in-house LAN during the previous operation, is the anti-virus software the latest version? After confirming, the virus is examined. (3) After the safety of the user terminal 10 is confirmed, the connection to the in-house LAN is restored. (4) If it is determined that the internal LAN environment is not established, the connection is made to the external network as it is.

Currently, the terminal receives many services via the network. Here, the network is an in-house LAN, an in-house WAN (Wide Area Network), a home LAN or the like (regardless of wired or wireless), and means a local computer network for connecting computers and communication devices. Such a local network is usually connected to the Internet.

An example of a service provided by a user belonging to an organization such as a company via a network (including via the Internet) is a mail transmission / reception service by a mail server, an OS (Operating System) patch update server. OS patch file update service by the virus, virus pattern file update service by the virus pattern update server, print output service by the print server (including multifunction devices and printers), Internet connection service by proxy server, by VPN (Virtual Private Network) server VPN connection service to company network. In order to receive these services, different software is usually installed on the terminal for each service.

By the way, when the user connects the terminal to a different network, it is necessary to change the setting information of the terminal in order to receive services via the network. Currently, it is necessary to change the setting information of the terminal for each individual software. Depending on the software, the user must manually change the setting information.

For example, a user whose working place changes from day to day, such as working at a head office, working at a branch office, or working from home, has a desire to receive a service without being aware of the network to which the terminal is connected. Specifically, even if the network to which the terminal is connected is changed, there is a demand to receive a service without manually changing the setting information or being asked to confirm the setting information from the terminal. .

Japanese Patent Application Laid-Open No. H10-228561 describes a technique that enables easy network switching. Specifically, the routing table is acquired intermittently, and it is determined from the gateway information of the default route described in the routing table whether or not a network change has occurred. When it is determined that the network has changed, it is determined whether or not the profile has already been registered. If the profile has been registered, the connection to the network is completed based on the profile, and the profile is registered. If not, create a new network profile and register it.

JP 2007-213550 A JP 2004-102464 A

However, the mechanism described in Patent Document 1 cannot prevent the terminal from being logically directly connected to the external network in the first place. In addition, at least website access restrictions on the Internet and acquisition of communication trails are not possible. Therefore, it is impossible to improve the situation where the security risk for the terminal is high and the situation where it is easy to intentionally leak information.

In the technique of Patent Document 2, there is a high possibility that an erroneous determination occurs in the network change determination process. For example, when a user takes a terminal connected to an in-house LAN home and uses it by connecting to a home LAN, the same private address (for example, 192.168.0.1) is used in both the in-house LAN and the home LAN gateway. ) Is set. In this case, since the gateway information of the default route described in the routing table matches, it is determined that there is no network change in the technique of Patent Document 2, and an erroneous determination occurs. As described above, the technique of Patent Document 2 cannot meet a user's desire to receive a service without being aware of the network to which the terminal is connected in a network such as an in-house LAN or a home LAN.

The present invention has been made in view of the above-described problems, and an object of the present invention is to provide a connection destination restriction system capable of preventing a terminal from being logically directly connected to an external server or the like. Etc. is to provide. Another object of the present invention is to provide a terminal setting control system and the like that can reliably receive a service via a network without being conscious of the network to which the terminal is connected.

In order to achieve the above-described object, the first invention includes a terminal physically connected to an internal network and an external network, and a communication management server physically connected to the internal network. The communication management server intermittently broadcasts permission information indicating that a logical connection request of the terminal is permitted to the internal network. A communication control unit for transmitting, and when the permission information is received by the communication control unit for receiving information broadcast to the internal network and the communication control unit of the terminal, Determines that it is physically connected to the internal network and determines that it is physically connected to the internal network. The request is a connection destination restriction system comprising a control unit for executing connection processing. According to the first invention, it is possible to prevent the terminal from being logically directly connected to an external server or the like.

The connection destination restriction system according to the first aspect of the present invention further includes a VPN server physically connected to the internal network, and the VPN server receives information broadcasted to the internal network. And when the permission information is received by the communication control unit of the VPN server, the control unit determines that it is physically connected to the internal network, and the communication of the terminal When the control unit determines that the control unit of the terminal is not physically connected to the internal network, the control unit transmits the VPN connection request to the VPN server, and When the communication control unit receives a VPN connection request from the terminal, the communication control unit transmits a determination result by the control unit of the VPN server to the terminal. When the communication control unit receives a determination result from the VPN server that the VPN server is physically connected to the internal network, the control unit of the terminal is connected to the valid VPN server. If it is determined that it is connected to the valid VPN server, it is desirable to execute VPN connection processing in response to the logical connection request. As a result, even when the terminal is physically connected to an external network, a logical connection request is executed by VPN connection processing while preventing the terminal from being directly connected to an external server or the like logically. can do.

In addition, the control unit of the terminal according to the first aspect of the invention always responds to the logical connection request and performs the VPN connection only by using address information of the VPN server stored in advance in the terminal. desirable. As a result, it is possible to prevent a user who uses the terminal outside the company from accessing a server other than a valid VPN server by using a network adapter different from that instructed by the administrator.

A second invention includes a terminal physically connected to an internal network and an external network, and a communication management server physically connected to the internal network, and a connection for restricting a logical connection destination of the terminal A connection restriction method in a destination restriction system, wherein the communication management server intermittently broadcasts permission information indicating permission of a logical connection request of the terminal to the internal network, The terminal receives information broadcast to the internal network, and when the terminal receives the permission information, the terminal determines that it is physically connected to the internal network, and the terminal A connection destination restriction method for executing a connection process in response to the logical connection request when it is determined that it is physically connected to the internal network. . According to the second invention, it is possible to prevent the terminal from being logically directly connected to an external server or the like.

A third invention is a terminal setting control system configured by a server and a terminal and for controlling the setting of the terminal, wherein the server uses a multicast address as identification information for identifying a network to which the server is connected. A communication control unit that transmits to a destination or a unicast address, and the terminal determines whether or not the identification information is received within a predetermined time, and if received, determines a network indicated by the identification information. A terminal setting control system comprising: a control unit that acquires setting information related to a service provided via a network based on a determination result, and updates the setting of the terminal based on the acquired setting information. According to the third invention, the user can reliably receive a service via the network without being aware of the network to which the terminal is connected.

The terminal according to a third aspect of the present invention further includes a communication control unit that broadcasts the request for the identification information to a network to which the terminal is connected, and the communication control unit of the server includes the identification When an information request is received, it is desirable to transmit the identification information only to the transmission source of the identification information request. As a result, when the number of terminals is relatively small, it is not necessary to waste network bandwidth.

In addition, the communication control unit of the server according to a third aspect of the invention relates to information about a location of a network to which the server is connected, information about a usage time of the terminal, and an operation mode of the terminal together with the identification information. It is desirable to transmit at least one of the information. As a result, it is possible to limit the use of each software, automatically shut down when the usage time elapses, or limit the use of power.

A fourth invention is a terminal setting control method in a terminal setting control system configured by a server and a terminal and controlling the setting of the terminal, wherein the server identifies the network to which the server is connected Transmitting information to a multicast address or a unicast address, the terminal determines whether or not the identification information is received within a predetermined time, and if received, determines a network indicated by the identification information; A terminal setting control method for acquiring setting information related to a service provided via a network based on a determination result, and updating the setting of the terminal based on the acquired setting information. According to the fourth aspect of the invention, the user can reliably receive services via the network without being aware of the network to which the terminal is connected.

A fifth invention is a computer-readable program, wherein the first computer transmits identification information for identifying a network to which the first computer is connected to a multicast address or a unicast address. The second computer determines whether or not the identification information is received within a predetermined time. If the second computer is received, the second computer determines a network indicated by the identification information, and passes the network based on the determination result. It is a program that acquires setting information related to a provided service and functions to update the setting of the second computer based on the acquired setting information. By the program of the fifth invention, the terminal setting control system of the third invention can be constructed, and the terminal setting control method of the fourth invention can be executed.

According to the present invention, it is possible to provide a connection destination restriction system that can prevent a terminal from being directly and logically connected to an external server or the like. As a result, it is possible to improve the situation where the security risk for the terminal is high and the situation where it is easy to intentionally leak information. Further, according to the present invention, it is possible to provide a terminal setting control system or the like that can reliably receive a service via a network without being conscious of the network to which the terminal is connected.

The figure which shows the outline of the connection restriction system 1 Hardware configuration diagram of computer 30 The figure which shows the structure of connection destination restriction | limiting AP25. The flowchart which shows the process implement | achieved by key packet transmission AP21 The flowchart which shows the process implement | achieved by key packet reception AP23 The flowchart which shows the process implement | achieved by connection destination restriction | limiting AP25 and VPN connection AP24. The flowchart which shows the process implement | achieved by communication trail management AP22 The figure which shows the outline of the terminal setting control system Computer hardware configuration diagram Example of head office setting information Example of branch office setting information An example of home setting information Flow chart showing the operation of the terminal in the case of unicast communication Flow chart showing operation of terminal setting control server in case of unicast communication Flow chart showing operation of terminal setting control server in case of multicast communication Flow chart showing operation of terminal in case of multicast communication Location packet example

Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.

<First Embodiment>
First, the configuration of the connection destination restriction system 1 according to the first embodiment will be described with reference to FIGS. 1 to 3. In the first embodiment, for example, a physical layer level connection in an OSI (Open Systems Interconnection) reference model is referred to as a “physical connection”. Further, for example, the connection from the data link layer to the application layer level in the OSI reference model is referred to as “logical connection”. In the connection destination restriction system 1 according to the first embodiment, a “logical connection” partner (for example, IP address and port number in the case of TCP / IP communication) is set to a secure network (for example, a company or the like). It is intended to be limited to computers installed in the internal network.

FIG. 1 is a diagram showing an outline of the connection destination restriction system 1. As shown in FIG. 1, in the first embodiment, an internal network 4, a communication management server 11, a business server 12, a firewall 13, a VPN (Virtual Private Network) server 14, a local terminal 15, etc. Is assumed to exist. In the first embodiment, it is assumed that the external network 5, the remote terminal 16, the external server 17, and the like exist outside the company 3.

For convenience of explanation, different symbols are attached to the local terminal 15 and the remote terminal 16, but the difference between them is only the location, and the hardware and software are the same. That is, when the local terminal 15 is taken outside the company 3, it becomes the remote terminal 16.

The configuration of the connection destination restriction system 1 that is indispensable for preventing the local terminal 15 (remote terminal 16) from being logically directly connected to an external server or the like includes the communication management server 11 and the local terminal 15 (remote terminal 16). ). The configuration of the connection destination restriction system 1 that is indispensable for the remote terminal 16 to execute a logical connection request by the VPN connection processing to the legitimate VPN server 14 includes the communication management server 11, the VPN server 14, and the remote Terminal 16.

Examples of the internal network 4 include an in-house LAN of a company or the like, and an in-house WAN (wide area network) in which LANs installed at a plurality of bases are connected by a dedicated line or the like. In FIG. 1, a firewall 13 is illustrated as a physical network device constituting the internal network 4. Examples of other network devices include routers (both wired and wireless), switches, hubs, and relay servers. The communication management server 11, business server 12, VPN server 14, and local terminal 15 are physically connected to the internal network 4. Here, the physical connection form may be wired or wireless. VPN (Virtual Private Network) is a service that can use a public line as if it were a dedicated line, and security equivalent to that of the internal network 4 is ensured.

Here, a hardware configuration of a computer for realizing the communication management server 11, the business server 12, the firewall 13, the VPN (Virtual Private Network) server 14, the local terminal 15 (remote terminal 16), the external server 17, and the like will be described. To do.

FIG. 2 is a hardware configuration diagram of the computer 30. Note that the hardware configuration in FIG. 2 is an example, and various configurations can be adopted depending on the application and purpose. The computer 30 is connected to a control unit 31, a storage unit 32, an input unit 33, a display unit 34, a communication control unit 35, and the like via a bus 36.

The control unit 31 includes a CPU (Central Processing Unit), a RAM (Random Access).
Memory) and the like. The CPU calls a program stored in the storage unit 32, a recording medium, etc. to a work memory area on the RAM, executes it, drives and controls each device connected via the bus 36, and realizes processing performed by the computer 30 To do. The RAM is a volatile memory, and temporarily stores a program, data, and the like loaded from the storage unit 32, the recording medium, and the like, and includes a work area used by the control unit 31 for performing various processes.

The storage unit 32 is a ROM (Read Only Memory), a flash memory, an HDD (Hard Disk Drive), or the like, and stores a program executed by the control unit 31, data necessary for program execution, and the like. As for programs, BIOS (Basic Input / Output System), boot loader, OS (Operating)
A control program corresponding to (System) and an application program for causing the control unit 31 to execute processing to be described later are stored. Each of these program codes is read by the control unit 31 as necessary, transferred to the RAM, read by the CPU, and executed as various means. The storage unit 32 may be an external storage device (USB memory, external hard disk, etc.) connected via a USB (Universal Serial Bus) or the like.

The input unit 33 inputs data and includes, for example, a keyboard, a pointing device such as a mouse, and an input device such as a numeric keypad. An operation instruction, an operation instruction, data input, and the like can be performed on the computer 30 via the input unit 33. The display unit 34 includes a display device such as a CRT monitor and a liquid crystal panel, and a logic circuit (such as a video adapter) for realizing the video function of the computer 30 in cooperation with the display device. The communication control unit 35 includes a communication control device, a communication port, and the like, and is a communication interface that mediates communication between the computer 30 and the internal network 4 or the external network 5. The communication control between the computers 30 is performed. As described above, the internal network 4 or the external network 5 may be wired or wireless. The bus 36 is a path that mediates transmission / reception of control signals, data signals, and the like between the devices.

Returning to the explanation of FIG. Each apparatus (terminal and server) shown in FIG. 1 may be one or plural. Each server may be realized by one casing (computer 30) or may be realized by a plurality of casings. For example, in the case of the communication management server 11, both the key packet transmission AP (application program) 21 and the communication trail management AP 22 may be installed in one casing, or may be installed in separate casings. good.

In the communication management server 11, a key packet transmission AP 21, a communication trail management AP 22, and the like are installed. The key packet transmission AP 21 is an application program for causing the communication management server 11 to execute processing shown in FIG. The control unit 31 of the communication management server 11 executes the key packet transmission AP 21 to allow permission information (hereinafter referred to as “key packet”) indicating that a terminal logical connection request is permitted to the internal network 4. .) Intermittently.

Specifically, the communication management server 11 intermittently transmits key packets by, for example, IP (Internet Protocol) level broadcast communication. In IP level broadcast communication, a key packet is transmitted by setting a transmission destination address to a special address called “broadcast address”. The key packet is not particularly limited, but for example, it is desirable to have different contents depending on the time zone, such as a one-time password. Further, for example, the key packet may be encrypted and transmitted, and only the legitimate VPN server 14 and the local terminal 16 can be decrypted.

As the broadcast address, for example, a so-called limited broadcast address or a directed broadcast address can be designated. The limited broadcast address is an IP address in which all bits are 1. For example, in the case of IPv4 (Internet Protocol version 4), “255.255.255.255” is the limited broadcast address. When broadcast communication is performed by specifying a limited broadcast address, a key packet is transmitted to all computers 30 in a network segment (a collision segment in the case of Ethernet (registered trademark)) to which a transmission source is connected. On the other hand, it is not transmitted to other network segments connected via the router. The directed broadcast address is an IP address in which all bits of the host address part are set to 1 without changing the network address part. For example, for a network address of “192.168.8.0” in IPv4, “192.168.0.255” in which the host address part (lower 8 bits) is all 1 is the directed broadcast address. . When broadcast communication is performed by specifying a directed broadcast address, a key packet is transmitted to all computers 30 having a specific network address (“192.168.8.0” in the above example).

The communication trail management AP 22 is an application program for causing the communication management server 11 to execute a part of processing shown in FIG. The control unit 31 of the communication management server 11 stores a communication trail log of the local terminal 15 (remote terminal 16) or the like by executing the communication trail management AP 22.

The business server 12 is a server for realizing each business performed by a company or the like. The business server 12 executes response processing in response to a request from the local terminal 15 (remote terminal 16). In addition, the business server 12 may execute a predetermined batch process at a predetermined time.

In the VPN server 14, a key packet reception AP 23, a VPN connection AP 24, and the like are installed. The key packet reception AP 23 is an application program for causing the VPN server 14, the local terminal 15 (remote terminal 16), and the like to execute processing shown in FIG. The control unit 31 of the VPN server 14 receives information broadcast to the internal network 4 by executing the key packet reception AP 23. Further, the control unit 31 such as the VPN server 14 sets the reception flag stored in the RAM or the like to “Y” (reception) or “N” (reception) based on whether or not the key packet is received from the communication management server 11. None).

The VPN connection AP 24 is an application program for causing the VPN server 14 to execute server-side processing in VPN connection and some processing shown in FIG. The control unit 31 of the VPN server 14 performs server-side processing in the VPN connection by executing the VPN connection AP 24. Further, the control unit 31 of the VPN server 14 determines whether or not it is physically connected to the internal network 4 based on the reception flag stored in the RAM or the like. In addition, when the VPN connection is established from the remote terminal 16, the control unit 31 of the VPN server 14 transmits a determination result as to whether or not it is connected to the internal network 4 to the remote terminal 16.

In the local terminal 15 (remote terminal 16), a key packet reception AP 23, a connection destination restriction AP 25, and the like are installed. The key packet reception AP 23 is as described above. That is, the control unit 31 of the local terminal 15 (remote terminal 16) receives the information broadcast to the internal network 4 by executing the key packet reception AP 23. Further, the control unit 31 of the local terminal 15 (remote terminal 16) sets the reception flag stored in the RAM or the like to “Y” or “N” based on whether or not the key packet is received from the communication management server 11. To do.

The connection destination restriction AP 25 is an application program for causing the local terminal 15 (remote terminal 16) to execute the client side processing in the VPN connection and a part of the processing shown in FIG. Whether the control unit 31 of the local terminal 15 (remote terminal 16) is physically connected to the internal network 4 based on the reception flag stored in the RAM or the like by executing the connection destination restriction AP 25 Determine whether or not. Further, when it is determined that the control unit 31 of the local terminal 15 (remote terminal 16) is physically connected to the internal network 4, the control unit 31 executes connection processing in response to a logical connection request. .

On the other hand, if the control unit 31 of the local terminal 15 (remote terminal 16) determines that it is not physically connected to the internal network 4, it makes a VPN connection to the VPN server 14. Further, the control unit 31 of the local terminal 15 (remote terminal 16) is valid based on the determination result (received from the VPN server 14) whether the VPN server 14 is physically connected to the internal network 4 or not. It is determined whether or not it is connected to the VPN server 14. When it is determined that the local terminal 15 (remote terminal 16) is connected to the valid VPN server 14, the control unit 31 executes a connection process in response to a logical connection request.

FIG. 3 is a diagram showing the configuration of the connection destination restricted AP 25. The connection destination restriction AP 25 includes an IP address 41 of the VPN server, a port number 42 of the VPN server, a connection determination program 43, a socket API (Application Programming Interface) 44, and the like. The IP address 41 of the VPN server and the port number 42 of the VPN server are stored, for example, in a setting file that can be read and written only by the administrator.

The connection determination program 43 performs a process for determining whether or not the logical connection request of the local terminal 15 (remote terminal 16) may be permitted (a part of the process shown in FIG. 6 to be described later). This program is executed by the remote terminal 16).

The socket API 44 is a library related to a computer network that enables communication between computers 30 and communication between processes on one computer 30. For example, in the case of TCP communication that is connection-type communication, the control unit 31 of the computer 30 that is a TCP client normally calls the socket function of the socket API 44 to generate a TCP socket, and the logical connection destination is the argument of the connect function. By specifying the address information (IP address and port number), communication with the connection destination is started. The logical connection destination is a computer 30 that is a TCP server.

Here, the local terminal 15 (remote terminal 16) in which the connection destination restriction AP 25 is installed always responds to a logical connection request from another program (for example, a device driver of a network adapter). It is desirable to have a mechanism in which 43 responds. By this mechanism, even if a user who uses the remote terminal 16 outside the company 3 tries to cheat using a network adapter different from that instructed by the administrator, the connection determination process by the connection destination restriction AP 25 is avoided. It is not possible.

In order to realize the above-described mechanism, for example, the connection determination program 43 describes a wrap function of each function included in the socket API 44. In addition, the wrap function of the connection determination program 43 is set to be executed when a socket function or a connect function is called from another program. In the wrap function of the connection determination program 43, when VPN connection is executed as a result of the connection determination process, the logical connection destination address information set as an argument by another program is discarded and defined in advance. The IP address 41 of the VPN server and the port number 42 of the VPN server are set as arguments and each function included in the normal socket API 44 is called. Accordingly, the computer 30 in which the connection destination restriction AP 25 is installed accesses only a predetermined single VPN server 14 when performing the VPN connection. Further, in the connection determination program 43, when not physically connected to the internal network 4, applications other than the connection destination restricted AP 25 have the VPN server IP address 41 and the VPN server port number 42 defined in advance. It also includes a function for preventing VPN connection using. This prevents an unauthorized application from performing unauthorized communication using the IP address 41 of the VPN server and the port number 42 of the VPN server.

When the connection destination restriction system 1 is actually operated, for example, the connection destination restriction AP 25 itself is stored as an OS in an external storage device, and when the local terminal 15 (remote terminal 16) is powered on, the external storage device A method is conceivable in which the OS (= connection destination restriction AP 25) stored in is set to be activated.

Returning to the explanation of FIG. The external server 17 is a WWW (World Wide Web) server on the Internet. The external server 17 executes response processing in response to an HTTP (HyperText Transfer Protocol) request from the local terminal 15 (remote terminal 16) or the like, and returns an HTTP response.

Next, details of processing in the connection destination restriction system 1 will be described with reference to FIGS. For example, the processes shown in FIGS. 5 and 6 (part of FIG. 6) are executed by the local terminal 15 (remote terminal 16). Therefore, the local terminal 15 (remote terminal 16) executes both processes almost simultaneously by multitasking (an OS mechanism that divides the CPU processing time into short units and makes it appear that multiple processes are performed simultaneously). To do. Other processes executed by a single device and overlapped in time series are similarly realized by multitasking.

FIG. 4 is a flowchart showing processing realized by the key packet transmission AP 21. The key packet transmission AP 21 is executed by the communication management server 11. The control unit 31 of the communication management server 11 broadcasts a key packet to the internal network 4 (S101). Then, the control unit 31 of the communication management server 11 waits for a predetermined time (S102) and repeats the process of S101.

FIG. 5 is a flowchart showing processing realized by the key packet reception AP 23. The key packet reception AP 23 is executed by the VPN server 14 and the local terminal 15 (remote terminal 16). The control unit 31 of the VPN server 14 and the local terminal 15 (remote terminal 16) monitors the key packet (S201) and checks whether the key packet is received within a predetermined time (S202).

When the key packet is received within the predetermined time (“Yes” in S202), the control unit 31 of the VPN server 14 and the local terminal 15 (remote terminal 16) sets its reception flag stored in the RAM or the like to “Y ”(S203) and repeat from S201.

On the other hand, when the key packet is not received within the predetermined time (“No” in S202), the control unit 31 of the VPN server 14 and the local terminal 15 (remote terminal 16) receives its own stored in the RAM or the like. The flag is set to “N” (S204), a forced disconnection process for forcibly disconnecting the connected communication by an interrupt is executed (S205), and the process is repeated from S201.

4 and 5, the VPN server 14 and the local terminal 15 that are physically connected to the internal network 4 periodically receive key packets and are physically connected to the internal network 4. It can be determined that

FIG. 6 is a flowchart showing processing realized by the connection destination restriction AP 25 and the VPN connection AP 24. The connection destination restriction AP 25 is executed by the local terminal 15 (remote terminal 16). The VPN connection AP 24 is executed by the VPN server 14. When the control unit 31 of the local terminal 15 (remote terminal 16) receives a logical connection request by a user operation or the like (S301), the control unit 31 checks a reception flag stored in its own RAM (S302).

When the own reception flag is “Y” (“Y” in S302), the control unit 31 of the local terminal 15 (remote terminal 16) determines that it is physically connected to the internal network 4 and performs logical In response to a typical connection request, the connection process is executed as it is (S303), and the process ends.

When its own reception flag is “N” (“N” in S302), the control unit 31 of the local terminal 15 (remote terminal 16) determines that it is not physically connected to the internal network 4, and VPN A connection request is transmitted to the VPN server 14 (S304). Here, as described above, the control unit 31 of the local terminal 15 (remote terminal 16) accesses the single VPN server 14 determined in advance.

The control unit 31 of the VPN server 14 transmits the reception flag stored in its own RAM or the like to the local terminal 15 (remote terminal 16) (S305). The control unit 31 of the local terminal 15 (remote terminal 16) confirms the reception flag of the VPN server 14 (S306).

When the reception flag of the VPN server 14 is “Y” (“Y” in S306), the control unit 31 of the local terminal 15 (remote terminal 16) determines that it is connected to the legitimate VPN server 14, and continues to the VPN. A connection process is executed (S307), and the process ends.

On the other hand, when the reception flag of the VPN server 14 is “N” (“N” in S306), the control unit 31 of the local terminal 15 (remote terminal 16) determines that it is not connected to the legitimate VPN server 14, Error processing is executed (S308), and the processing is terminated. In the error processing in S308, the control unit 31 of the local terminal 15 (remote terminal 16) indicates, for example, that it is not physically connected to the internal network 4 and that it is not connected to the valid VPN server 14. The message is displayed on the display unit 34.

The processing shown in FIG. 6 can prevent the terminal from being logically directly connected to the external server 17 or the like. In the case of the local terminal 15 (when the terminal is physically connected to the internal network 4), since the connection process is executed as it is, it is logically directly connected to the business server 12 and the like installed in the internal network 4. Can be connected. Further, in the case of the remote terminal 16 (when the terminal is physically connected to the external network 5), the VPN connection process is executed, so that the connection to the external server 17 or the like is always made via the VPN server 14. it can.

FIG. 7 is a flowchart showing processing realized by the communication trail management AP 22. The communication trail management AP 22 is executed by the communication management server 11.

FIG. 7 shows processing in the case of an HTTP request to the external server 17 as an example of a logical connection request. As a premise of the process shown in FIG. 7, it is assumed that the local terminal 15 (remote terminal 16) is executing the connection process (VPN connection process) shown in FIG. All logical connection requests by the local terminal 15 (remote terminal 16) are transmitted to the external server 17 via the communication management server 11.

In the case of the remote terminal 16, the VPN server 14 is routed before the communication management server 11. In order to make the explanation regarding the communication trail log acquisition process easier to understand, FIG. 7 shows the relay process of the VPN server 14. Is omitted. In the case of the remote terminal 16, the VPN server 14 may substitute the processing of the communication management server 11.

The control unit 31 of the local terminal 15 (remote terminal 16) transmits an HTTP request to the communication management server 11 (S401). In the case of the remote terminal 16, the HTTP request is always transmitted via the VPN server 14. The control unit 31 of the communication management server 11 stores the communication trail log (S402), and transmits an HTTP request to the external server 17 (S403).

The control unit 31 of the external server 17 executes an HTTP request response process (S404), and transmits an HTTP response to the communication management server 11 (S405). The control unit 31 of the communication management server 11 stores the communication trail log (S406), and transmits an HTTP response to the local terminal 15 (remote terminal 16) (S407). In the case of the remote terminal 16, the HTTP response is always transmitted via the VPN server 14. The control unit 31 of the local terminal 15 (remote terminal 16) displays a screen on the display unit 34 based on the HTTP response (S408).

7, all the communication trail logs of the local terminal 15 and the remote terminal 16 can be managed in an integrated manner. Then, by telling the user that all communication trail logs have been acquired regardless of whether they are in the company 2 or outside the company 3, intentional information leakage can be suppressed.

In the example shown in FIG. 7, the communication management server 11 performs only the process of acquiring the communication trail log. Further, the communication management server 11 detects the access restriction of the website on the Internet and the detection of the update omission of the pattern file of the anti-virus software. It can also be done. This can reduce the security risk for the terminal.

According to the connection destination restriction system 1 of the first embodiment, it is possible to prevent a terminal from being directly and logically connected to an external server or the like. As a result, it is possible to improve the situation where the security risk for the terminal is high and the situation where it is easy to intentionally leak information.

<Second Embodiment>
First, the configuration of the terminal setting control system according to the second embodiment will be described with reference to FIGS. 8 and 9. FIG. 8 is a diagram showing an outline of the terminal setting control system. The terminal setting control system 100 sets the terminal so that even if the user moves the terminal 105 to various places and the terminal 105 is connected to a network different from the previous time, the terminal 105 can receive a service via the network. It is a system to control. In the example shown in FIG. 8, the head office network 102a, the branch office network 102b, and the home network 103 are illustrated as different networks.

The head office network 102a and the branch office network 102b are configured as, for example, a LAN for each base or a WAN (wired or wireless) in which LANs installed at a plurality of bases are connected by a dedicated line or the like. For example, the network may be divided for each floor so that a plurality of networks exist in one base. The home network 103 is configured as, for example, a home LAN (whether wired or wireless). As a physical form of the LAN, for example, a wired LAN is a type combining Ethernet (registered trademark) and TCP / IP, and a wireless LAN is IEEE 802.11.

In the terminal setting control system 100, a terminal setting control server (head office terminal setting control server 104a, branch terminal setting control server 104b) is installed for each network (head office network 102a, branch office network 102b). However, there may be a network such as the home network 103 in which no terminal setting control server is installed. That is, the terminal 105 may be connected to a network where the terminal setting control server is installed (head office network 102a, branch office network 102b), or may be connected to a network where the terminal setting control server is not installed (home network 103). good.

Connected to the head office network 102a are a head office terminal setting control server 104a, a head office gateway 121a, a head office OS patch update server 122a, a head office virus update server 123a, a VPN server 124, a head office print server 125a, a terminal 105, and the like. Further, the branch office network 102b is connected to the branch terminal setting control server 104b, the branch gateway 121b, the branch OS patch update server 122b, the branch virus update server 123b, the branch print server 125b, the terminal 105, and the like. The home network 103 is connected to a home gateway 131, a home print server 132, and the like. Also, an external OS patch update server 111, an external virus pattern update server 112, and the like are connected to the Internet 109.

The terminal setting control server (head office terminal setting control server 104a, branch terminal setting control server 104b) transmits identification information for identifying a network to which the terminal setting control server is connected to a multicast address or a unicast address. Here, since the network is considered to be a place where the computer is located, a packet including identification information is hereinafter referred to as a “location packet”. Details of processing by the terminal setting control server will be described later with reference to FIGS. 14 and 15.

The terminal 105 determines whether or not the location packet has been received within a predetermined time. If it has been received, the terminal 105 determines the network indicated by the location packet, and is provided via the network based on the determination result. It acquires setting information regarding the service, and updates its own setting based on the acquired setting information. Thereby, even if the network is changed, the terminal 105 can surely receive the service via the network. Details of processing by the terminal 105 will be described later with reference to FIGS. 13 and 16.

The gateway of each network (head office gateway 121a, branch office gateway 121b, home gateway 131) is an entrance to the Internet 109. In the Internet 109, communication devices such as routers, computers installed as proxy servers, firewalls, and the like serve as gateways.

In the example shown in FIG. 8, an OS patch update server, a virus pattern update server, a VPN server, and a print server are illustrated as servers that provide services via the network. The outline of each server will be described below.

There are two types of OS patch update servers: an OS patch update server for organizations and an external OS patch update server 111. The OS patch update server for organization (head office OS patch update server 122a, branch OS patch update server 122b) provides an OS patch file update service to the terminal 105 in the network to which the OS patch update server is connected. On the other hand, the external OS patch update server 111 is installed by a company that provides an OS, and provides an OS patch file update service to all computers on which the target OS is installed.

Similarly, there are two types of virus pattern update servers: an organization virus pattern update server and an external virus pattern update server 112. The virus pattern update server for organizations (head office virus pattern update server 123a, branch virus pattern update server 123b) provides a virus pattern file update service to the terminal 105 in the network to which the virus pattern update server is connected. On the other hand, the external virus pattern update server 112 is installed by a company that provides antivirus software, and provides a virus pattern file update service to all computers on which the target antivirus software is installed. .

The VPN server 124 provides a VPN connection service to the head office network 102a. The VPN connection service is a service that can use a public line as if it were a dedicated line. With the VPN connection service, for example, even the terminal 105 connected to the home network 103 can access the computer of the head office network 102a while maintaining security.

The print server (head office print server 125a, branch office print server 125b, home printer server 132) provides a print output service to the terminal 105 in the network to which the print server is connected. The print server is not limited to a computer, and may be a multifunction machine, a printer, or the like.

FIG. 9 is a hardware configuration diagram of the computer. FIG. 9 shows the hardware configuration of a computer 140 that implements the various servers and terminals 105 illustrated in FIG. Note that the hardware configuration in FIG. 9 is an example, and various configurations can be adopted according to applications and purposes.

As shown in FIG. 9, the computer 140 is connected to a control unit 141, a storage unit 142, an input unit 143, a display unit 144, a communication control unit 145, and the like via a bus 146.

The control unit 141 includes a CPU, a RAM, and the like. The CPU calls a program stored in the storage unit 142, a recording medium, etc. to a work memory area on the RAM, executes it, drives and controls each device connected via the bus 146, and realizes processing performed by the computer 140 To do. The RAM is a volatile memory, and temporarily stores a program, data, and the like loaded from the storage unit 142, a recording medium, and the like, and includes a work area used by the control unit 141 for performing various processes.

The storage unit 142 is a ROM, flash memory, HDD (hard disk drive) or the like, and stores a program executed by the control unit 141, data necessary for program execution, and the like. As for the program, a control program corresponding to a BIOS, a boot loader, and an OS, and an application program for causing the control unit 141 to execute processing to be described later are stored. Each of these program codes is read by the control unit 141 as necessary, transferred to the RAM, read by the CPU, and executed as various means. The storage unit 142 may be a removable storage device (USB memory, external hard disk, etc.) connected via a USB or the like.

The input unit 143 inputs data and includes, for example, a keyboard, a pointing device such as a mouse, and an input device such as a numeric keypad. The user can perform an operation instruction, an operation instruction, data input, or the like on the computer 140 via the input unit 143. The display unit 144 includes a display device such as a liquid crystal panel, and a logic circuit (video adapter or the like) for realizing the video function of the computer 140 in cooperation with the display device. Note that the input unit 143 and the display unit 144 may be configured as a single unit, such as a touch panel display.

The communication control unit 145 has a communication control device, a communication port, and the like, is a communication interface that mediates communication between the computer 140 and the network, and performs communication control between other computers 140 via the network. The network may be wired or wireless. The bus 146 is a path that mediates transmission / reception of control signals, data signals, and the like between the devices.

Next, information used by the terminal 105 in the second embodiment will be described with reference to FIGS. The head office setting information, branch office setting information, and home setting information shown in FIGS. 10 to 12 may be stored in the storage unit 142 of the terminal 105 in advance. Alternatively, these pieces of information are stored in the storage unit 142 of another computer (for example, terminal setting control server), and the terminal 105 receives the information from another computer (for example, terminal setting control server) when necessary. May be.

FIG. 10 is an example of head office setting information. The head office setting information 151 is information indicating settings necessary for the terminal 105 connected to the head office network 102a to receive a service via the network. For example, the service name “OS patch file update service” is associated with “the computer name or IP address of the head office OS patch update server 122a” as a connection destination. Note that the connection destination is not set (“−”) to the terminal 105 connected to the head office network 102a because it is not necessary to provide the VPN connection service.

FIG. 11 is an example of branch office setting information. The branch setting information 152 is information indicating settings necessary for the terminal 105 connected to the branch network 102b to receive services via the network. For example, the service name “OS patch file update service” is associated with “the computer name or IP address of the branch OS patch update server 122b” as a connection destination. Note that the connection destination is not set (“-”) to the terminal 105 connected to the branch office network 102b because it is not necessary to provide the VPN connection service.

FIG. 12 is an example of home setting information. The home setting information 153 is information indicating settings necessary for the terminal 105 connected to the home network 103 to receive a service via the network. For example, the service name “OS patch file update service” is associated with “URL (Uniform Resource 更新 Locator) of the external OS patch update server 111” as a connection destination. Note that since the VPN connection service needs to be provided for the terminal 105 connected to the home network 2b, the connection destination is “the IP address and port number of the VPN server 124”.

Next, processing contents of the terminal setting control server and the terminal 105 in the second embodiment will be described with reference to FIGS. Hereinafter, when the head office terminal setting control server 104a and the branch office terminal setting control server 104b are not distinguished, they are referred to as “terminal setting control server 4”.

FIG. 13 and FIG. 14 show the processing contents of a method (unicast transmission method) for transmitting location packets by unicast. On the other hand, FIG. 15 and FIG. 16 show the processing contents of a method (multicast transmission method) for multicast transmission of location packets.

First, the unicast transmission method will be described. As shown in FIG. 13, the control unit 141 of the terminal 105 first broadcasts a location packet request to the network to which the terminal 105 is connected (S501). Broadcast transmission may be either a broadcast transmission method or a multicast transmission method.

On the other hand, as shown in FIG. 14, the control unit 141 of the terminal setting control server 4 monitors a request for a location packet after activation (S601). When receiving the request for the location packet (Yes in S602), the control unit 141 of the terminal setting control server 4 transmits the location packet to the unicast address (S603). More specifically, the control unit 141 of the terminal setting control server 4 transmits a location packet including identification information for identifying a network to which the control unit 141 is connected only to the transmission source of the request for the location packet.

Returning to the explanation of FIG. Next, in S502, the control unit 141 of the terminal 105 determines whether the location packet is received within a predetermined time after requesting the location packet. The control unit 141 of the terminal 105 proceeds to S503 when receiving (Yes in S502), and proceeds to S506 when not receiving (No in S502). When the terminal 105 is connected to the head office network 102a or the branch office network 102b, the terminal 105 receives a location packet from the head office terminal setting control server 104a or the branch office terminal setting control server 104b within a predetermined time. On the other hand, when the terminal 105 is connected to the home network 103, the terminal 105 does not receive the location packet.

In S503, the control unit 141 of the terminal 105 determines the network indicated by the received location packet. The control unit 141 of the terminal 105 proceeds to S504 when “head office” is indicated (the head office of S503), and proceeds to S505 when “branch office” is indicated (the branch office of S505).

In S504, the control unit 141 of the terminal 105 acquires the setting information 151 for the head office. Here, when the head office setting information 151 is stored in the storage unit 142 of the terminal 105 in advance, the control unit 141 of the terminal 105 extracts the head office setting information 151 from the storage unit 142. When the head office setting information 151 is stored in the storage unit 142 of the terminal setting control server 4, the control unit 141 of the terminal 105 receives the head office setting information 151 from the terminal setting control server 4.

Similarly, in S505, the control unit 141 of the terminal 105 acquires the branch setting information 152. In step S <b> 506, the control unit 141 of the terminal 105 acquires home setting information 153. The home setting information 153 needs to be stored in the storage unit 142 of the terminal 105 in advance.

In S507, the control unit 141 of the terminal 105 updates the setting of the terminal 105 based on the acquired setting information. For example, when the terminal 105 is connected to the head office network 102a and the head office setting information 151 is acquired in S504, the setting of the terminal 105 is updated based on the head office setting information 151.

Next, the multicast transmission method will be described. As illustrated in FIG. 15, the control unit 141 of the terminal setting control server 4 repeats the multicast transmission of the location packet (S701) and the standby for a predetermined time (S702) after the activation. More specifically, the control unit 141 of the terminal setting control server 4 intermittently transmits a location packet including identification information for identifying a network to which the terminal setting control server 4 is connected to the multicast address.

On the other hand, as shown in FIG. 16, the control unit 141 of the terminal 105 monitors the location packet after activation (S801). If a location packet is received within a predetermined time from the start of monitoring (Yes in S802), the process proceeds to S803, and if not received (No in S802), the process proceeds to S806. The details of S803 to S807 are the same as S503 to S507 shown in FIG.

When the number of networks to which the connection of the terminal 105 is permitted is 2, the terminal 105 performs only the determination process of whether or not to receive the location packet in S502 (or S802), and determines the setting information to be acquired. . On the other hand, if the number of networks to which connection of the terminal 105 is permitted is three or more, the terminal 105 also determines the network indicated by the location packet in S503 (or S803), and determines the setting information to be acquired. .

When the number of terminals 105 is relatively small, the unicast transmission method is used in order not to waste network bandwidth. On the other hand, when the number of terminals 105 is large, the multicast transmission method is effective. This is because when the number of terminals 105 is large, the multicast transmission method consumes less network bandwidth. That is, when the unicast address (terminal 105) increases, the network bandwidth may be compressed, so the adoption of the multicast transmission method is effective.

Here, two operation examples of the terminal setting control server 4 and the terminal 105 in the system configuration example of FIG. 8 will be described. Operation example 1 is a case where the user connects the terminal 105 to the head office network 102a. Operation example 2 is a case where the user connects the terminal 105 to the home network 103.

(Operation example 1)
When the terminal 105 is connected to the head office network 102a, the terminal 105 receives a location packet from the head office terminal setting control server 5a. Thereby, the terminal 105 acquires the head office setting information 151 and updates its own setting based on the head office setting information 151. As a result, the terminal 105 receives various services via the network from the following servers.
OS patch file update service: head office OS patch update server 122a
Virus pattern file update service: Headquarters virus pattern update server 123a
Print output service: Head office print server 125a

(Operation example 2)
Even if the terminal 105 is connected to the home network 103, the terminal 105 does not receive the location packet. Thereby, the terminal 105 acquires the home setting information 153 and updates its own setting based on the home setting information 153. As a result, the terminal 105 receives various services via the network from the following servers.
OS patch file update service: external OS patch update server 111
Virus pattern file update service: External virus pattern update server 112
Print output service: Home print server 132
-VPN connection service to the head office network 102a: VPN server 124

FIG. 17 is an example of a location packet. The location packet 161 can include various information in addition to identification information for identifying the network. FIG. 17 shows an example of a location packet 161 that includes four items of “identification information”, “location information”, “use time information”, and “operation mode information” as information classifications.

“Identification information” is a network identification number, for example, “001”, “002” or the like. “Location information” is information relating to the location of the network, such as “Head office 1st floor”, “A branch”, and the like. “Usage time information” is information relating to the usage time of the terminal 105, such as “no restriction”, “1 hour”, “3 hours”, and the like. The “operation mode information” is information related to the operation mode of the terminal 105, such as “no restriction”, “holiday mode”, “power saving mode”, and the like.

For example, the terminal 105 may place restrictions on the use of each software based on the “location information”. Further, the terminal 105 may be automatically shut down when the usage time passes based on the “use time information”. Further, the terminal 105 may limit the use of the power supply based on the “operation mode”.

As described above, according to the second embodiment, the terminal 105 determines whether or not the location packet is received and the network indicated by the location packet, and updates its own setting based on the setting information corresponding to the connected network. To do. As a result, even if the terminal 105 is connected to a network different from the previous one, the service via the network can be surely received. In addition, since the terminal 105 updates settings related to a plurality of services in an integrated and automatic manner, it is not necessary to deal with each piece of software, and it is not necessary for the user to manually change the setting information. Therefore, the user can surely receive the service via the network without being aware of the network to which the terminal is connected.

The preferred embodiments of the system for managing the network connection of the terminal according to the present invention have been described above with reference to the accompanying drawings, but the present invention is not limited to such examples. It will be apparent to those skilled in the art that various changes or modifications can be conceived within the scope of the technical idea disclosed in the present application, and these naturally belong to the technical scope of the present invention. Understood.

1 ......... Connection Destination Restriction System 4 ......... Internal Network 5 ......... External Network 11 ......... Communication Management Server 12 ......... Business Server 13 ......... Firewall 14 ......... VPN Server 15 ......... Local Terminal 16: Remote terminal 17: External server 21: Key packet transmission AP
22 …… Communication trail management AP
23 ... Key packet receiving AP
24 ... VPN connection AP
25 ……… Access restriction AP
101 ......... Terminal setting control system 102a ......... Head office network 102b ......... Branch office network 103 ......... Home network 104a ......... Head office terminal setting control server 104b ......... Branch terminal setting control server 104 ......... Terminal setting Control server 105 ……… Terminal

Claims

A connection destination restriction system that includes a terminal physically connected to an internal network and an external network, and a communication management server physically connected to the internal network, and restricts a logical connection destination of the terminal. ,
The communication management server
A communication control unit that intermittently broadcasts permission information indicating permission of the logical connection request of the terminal to the internal network;
Comprising
The terminal
A communication control unit for receiving information broadcast to the internal network;
When the permission information is received by the communication control unit of the terminal, it determines that it is physically connected to the internal network, and determines that it is physically connected to the internal network A controller that executes connection processing in response to the logical connection request;
A destination restriction system comprising:
The connection destination restriction system further includes a VPN server physically connected to the internal network,
The VPN server is
A communication control unit for receiving information broadcast to the internal network;
When the permission information is received by the communication control unit of the VPN server, a control unit that determines that it is physically connected to the internal network;
Comprising
When the communication control unit of the terminal determines that the communication control unit of the terminal is not physically connected to the internal network, the communication control unit transmits the VPN connection request to the VPN server,
Upon receiving a VPN connection request from the terminal, the communication control unit of the VPN server transmits a determination result by the control unit of the VPN server to the terminal,
When the communication control unit of the terminal receives a determination result indicating that the VPN server is physically connected to the internal network from the VPN server, the control unit of the terminal receives the valid VPN server. 2. The connection destination according to claim 1, wherein when it is determined that the connection is established, and it is determined that the connection is made to the valid VPN server, VPN connection processing is executed in response to the logical connection request. Limit system.
3. The connection destination restriction according to claim 2, wherein the control unit of the terminal always makes a response to the logical connection request and performs the VPN connection only by using address information of the VPN server stored in advance in the terminal. system.
Connection destination in a connection destination restriction system that has a terminal physically connected to the internal network and the external network, and a communication management server physically connected to the internal network, and restricts a logical connection destination of the terminal Restriction method,
The communication management server intermittently broadcasts permission information indicating that the terminal allows a logical connection request to the internal network,
The terminal receives information broadcast to the internal network;
When the terminal receives the permission information, it determines that it is physically connected to the internal network,
A connection destination restriction method for executing connection processing in response to the logical connection request when the terminal determines that the terminal is physically connected to the internal network.
A terminal setting control system configured by a server and a terminal and controlling the setting of the terminal,
The server
A communication control unit for transmitting identification information for identifying a network to which the server is connected to a multicast address or a unicast address;
With
The terminal
It is determined whether or not the identification information is received within a predetermined time. If the identification information is received, the network indicated by the identification information is determined, and setting information related to a service provided via the network is acquired based on the determination result. And a control unit for updating the setting of the terminal based on the acquired setting information,
A terminal setting control system.
The terminal
A communication control unit that broadcasts the request for the identification information to a network to which the terminal is connected;
Further comprising
The terminal setting control system according to claim 5, wherein the communication control unit of the server, when receiving the request for identification information, transmits the identification information only to a transmission source of the request for identification information.
The communication control unit of the server includes at least one of the identification information, information about a location of a network to which the server is connected, information about a usage time of the terminal, and information about an operation mode of the terminal. The terminal setting control system according to claim 5 which transmits.
A terminal setting control method in a terminal setting control system configured by a server and a terminal and controlling the setting of the terminal,
The server transmits identification information for identifying a network to which the server is connected to a multicast address or a unicast address,
The terminal determines whether or not the identification information is received within a predetermined time, and if it is received, determines the network indicated by the identification information, and relates to a service provided via the network based on the determination result A terminal setting control method for acquiring setting information and updating the setting of the terminal based on the acquired setting information.
A computer readable program comprising:
The first computer
Causing identification information for identifying a network to which the first computer is connected to function to transmit to a multicast address or a unicast address;
The second computer
It is determined whether or not the identification information is received within a predetermined time. If the identification information is received, the network indicated by the identification information is determined. Based on the determination result, setting information related to the service provided via the network is determined. A program for obtaining and functioning to update the setting of the second computer based on the obtained setting information.