WO2022164201A1

WO2022164201A1 - Private network access control device for enabling user terminal of internet network to access private network in order to execute remote service, and control method thereof

Info

Publication number: WO2022164201A1
Application number: PCT/KR2022/001397
Authority: WO
Inventors: 김태영; 김태현; 진성근
Original assignee: 대구대학교 산학협력단; 주식회사 크래프트엑스
Priority date: 2021-01-27
Filing date: 2022-01-26
Publication date: 2022-08-04

Abstract

The present invention relates to a private network access control device for enabling a user terminal of an Internet network to access a private network in order to execute a remote service, and a control method thereof. The control method comprises the steps of: logging in to a user terminal having accessed a portal through an Internet network; obtaining user information about the user terminal in response to logging in of the user terminal; changing a configuration of a router connecting the Internet network and the private network, using the user information; and providing a remote service located in the private network to the user terminal by using the router.

Description

Private network access control apparatus and method for controlling the same, allowing a user terminal of the Internet network to access a private network to execute a remote service

The present invention relates to an apparatus for controlling access to a private network that allows a user terminal of an Internet network to access a private network to execute a remote service, a system including the same, and a method for controlling the same.

Terminals are assigned a public IP (Internet Protocol) from an Internet Service Provider (ISP) or a private IP assigned from a Network Address Translator (NAT) to access the network.

The NAT device controls a plurality of terminals to access an external network using one public IP allocated from the ISP. More specifically, the NAT device is an address translator of a communication network used to convert a private IP address into a public IP address. To this end, the NAT device classifies the terminals using the private IPs allocated differently within the network, and allows the terminals to access the external network while sharing the public IP.

There are two purposes of using a NAT device. First, it can save the public IP address of the Internet, and second, it can protect users' own private network connected to the public network of the Internet from intruders.

Since public IP addresses on the Internet are limited, it is necessary to share them as much as possible. Using NAT, a private IP address can be used and converted into a public IP address so that a large number of public IP addresses can be used together. You can save it by doing this.

By installing a firewall between the public Internet and the private network, it can be used as a basic means of protecting the user's communication network from external attacks. At this time, when NAT is set on a router, which is a device that connects to an external communication network, that is, the Internet network, the router notifies only the public IP address assigned to it to the outside, and only uses the private IP address internally, and converts them when necessary. . Therefore, in order for an external intruder to attack, it is impossible to attack because the internal private IP address of the private network must be known, so the internal network can be protected.

Meanwhile, with the development of virtualization technology, in order to efficiently use server (or host) resources or networks, a plurality of virtual machines are installed inside the server. For such server virtualization, a Linux-based Kernel-based Virtual Machine (KVM) hypervisor, a Windows-based VmWare hypervisor, and the like are used.

However, when a virtual machine is used as described above, the operator must set port forwarding information in response to a firewall, a NAT device, and the like. In particular, when a private IP is assigned to a virtual machine, the operator must continuously update the settings.

SUMMARY OF THE INVENTION The present invention aims to solve the above and other problems.

One object of the present invention is to propose an apparatus, system and method for efficiently accessing a remote service existing in a private network or a cloud computing internal network by a terminal from the outside.

An embodiment of the present invention for realizing the above problems relates to a control method of a private network access control apparatus.

The control method may include: logging in to a user terminal accessing a portal through an Internet network; obtaining user information about the user terminal in response to the user terminal logging in; changing settings of a router connecting the Internet network and the private network using the user information; and providing a remote service located in the private network to the user terminal using the router.

According to an embodiment, the changing of the router configuration includes: setting a destination address of a packet transmitted from the user terminal to the private network as a private network IP address of a node in which the remote service is located; and setting a destination address of a packet sent by the remote service to the user terminal as an Internet network IP address of the user terminal.

According to an embodiment, the user information may include the Internet network IP address of the user terminal, remote service information to be used by the user terminal, and a private network IP address of a node in which the remote service is located.

According to an embodiment, the portal may be operated in a server connected to the private network, and the address of the portal may be fixed to a specific address accessible from the Internet network to the private network.

According to an embodiment, the control method may include: discovering a first user terminal and a second user terminal that exist in the private network and access the remote service; disposing the remote service providing node differently as a first node corresponding to the first user terminal and a second node corresponding to the second user terminal; and providing the remote service to the first user terminal through the first node and providing the remote service to the second user terminal through the second node.

An embodiment of the present invention relates to a system including a private network access control device that allows a user terminal of an Internet network to access a private network to execute a desktop service.

The system includes a plurality of hosts providing different remote services; a router connected to the hosts by a private network and configured to connect the private network to an Internet network; and a private network access control device connected to the hosts through the private network and configured to change the settings of the router so that a user terminal connected to the private network can use a remote service provided by at least one of the hosts.

The effects of the private network access control device and its control method for allowing the user terminal of the Internet network to access the private network to execute a remote service according to the present invention will be described as follows.

According to the present invention, a user terminal can quickly and efficiently access a remote service existing in a private network or an internal cloud computing network from the outside.

1A and 1B are diagrams illustrating a network environment including a NAT device and a firewall;

2 is a diagram for explaining a port forward method;

3 is a diagram for explaining a method of using a relay server in a private network;

4 is a view for explaining a system including a private network access control device according to an embodiment of the present invention;

5 is a flowchart illustrating a control method according to an embodiment of the present invention;

Hereinafter, the embodiments disclosed in the present specification will be described in detail with reference to the accompanying drawings, but the same or similar components are assigned the same reference numerals regardless of reference numerals, and redundant description thereof will be omitted. The suffixes "module" and "part" for components used in the following description are given or mixed in consideration of only the ease of writing the specification, and do not have distinct meanings or roles by themselves. In addition, in describing the embodiments disclosed in the present specification, if it is determined that detailed descriptions of related known technologies may obscure the gist of the embodiments disclosed in this specification, the detailed description thereof will be omitted. In addition, the accompanying drawings are only for easy understanding of the embodiments disclosed in this specification, and the technical idea disclosed herein is not limited by the accompanying drawings, and all changes included in the spirit and scope of the present invention , should be understood to include equivalents or substitutes.

Terms including ordinal numbers such as first, second, etc. may be used to describe various elements, but the elements are not limited by the terms. The above terms are used only for the purpose of distinguishing one component from another.

When a component is referred to as being “connected” or “connected” to another component, it may be directly connected or connected to the other component, but it is understood that other components may exist in between. it should be On the other hand, when it is said that a certain element is "directly connected" or "directly connected" to another element, it should be understood that the other element does not exist in the middle.

The singular expression includes the plural expression unless the context clearly dictates otherwise.

In the present application, terms such as “comprises” or “have” are intended to designate that a feature, number, step, operation, component, part, or combination thereof described in the specification exists, but one or more other features It is to be understood that this does not preclude the possibility of the presence or addition of numbers, steps, operations, components, parts, or combinations thereof.

The terminal may be divided into a mobile/portable terminal and a stationary terminal according to whether the terminal can be moved. Again, the mobile terminal can be divided into a handheld terminal and a vehicle mounted terminal according to whether the user can carry it directly.

The terminal described in this specification includes a mobile phone, a smart phone, a laptop computer, a digital broadcasting terminal, a personal digital assistant (PDA), a portable multimedia player (PMP), a navigation system, a slate PC, A tablet PC, an ultrabook, a wearable device, for example, a watch-type terminal (smartwatch), a glass-type terminal (smart glass), a head mounted display (HMD), etc. may be included.

Those skilled in the art will readily appreciate that the configuration according to the embodiment described in this specification may also be applied to a fixed terminal such as a digital TV, a desktop computer, a digital signage, or a server.

The remote service refers to a service in which a user terminal accesses a specific computing device through an Internet network to use resources of the computing device or to control the computing device. A typical example of a remote service is Remote Desktop Services.

Remote Desktop Services (RDS) is one of the components of Microsoft Windows that allows users to take control of a remote computer or virtual machine that is connected to a network. Remote Desktop Services (RDS) is Microsoft's implementation of Thin Client, which allows full computer desktops running Windows software, Remote Desktop Services (RDS), to connect to remote client machines that support Remote Desktop Protocol (RDP). With Remote Desktop Services (RDS), only the software user interfaces are sent to the client system. All input from the client system is sent to the server, where the software execution takes place. This is in contrast to application streaming systems such as Microsoft's App-V, where computer programs are streamed to the requesting client and run on a streaming machine.

The Linux camp provides Virtual Network Computing (VNC) services. Virtual Network Computing (VNC) is a graphical desktop sharing system that uses the RFB protocol to remotely control another computer in a computer environment. It provides a method to update the graphic screen through a network by sending keyboard and mouse events from one computer to another. In addition, various companies provide their own remote desktop services.

1A and 1B are diagrams illustrating a network environment including a NAT device and a firewall.

Referring to FIG. 1A , various types of hosts 6 , 8 , 10 , and 12 are located in an internal network, and the hosts 6 , 8 , 10 , and 12 are connected to a router ( 4) (or switch). And, the first terminal 20 is connected to the internal network (16).

The first host 6 is set to a first type (Type-1). Here, the first type means a host to which a public IP is allocated.

The second host 8 is set to a second type (Type-2). Here, the second type means a host including a virtual machine (VM) therein by a NAT type provided by an operating system (OS).

The third host 10 is set to a third type (Type-3). Here, the third type means a host connected to the internal network 16 via the NAT device 14 .

The fourth host 12 is set to a fourth type (Type-4). Here, the fourth type refers to a host connected to the internal network 16 via the NAT device 14 and including a virtual machine (VM) therein by the NAT type provided by the operating system (OS).

The internal network is connected to an external network (eg, the Internet, etc.) via the firewall 2 . The firewall 2 protects the internal network from the external network by controlling only the session that meets the policy set in advance from the external network to be communicated to the internal network. For example, the second terminal 30 located outside the firewall 2 may block communication with the internal network by the packet filtering function of the firewall 2 .

Meanwhile, the above-described first host 6 is assigned a public IP. The second host 8 is allocated one public IP, and virtual machines (VM) located therein are allocated a private IP. The third host 10 and the fourth host 12 connected to the NAT device 14 are assigned a private IP. Additionally, virtual machines (VMs) included in the fourth host 12 are allocated a different private IP from the fourth host 12 .

The first terminal 20 connected to the internal network 16 can communicate with the first host 6 assigned a public IP. However, even in the first terminal 20 connected to the internal network 16 , the virtual machines (VM) of the second host 8 using the private IP, the third host 10 and the fourth host 12 Communication with virtual machines (VMs) is not allowed.

On the other hand, since public IP has limited available resources and high management and maintenance costs, a private IP is generally used for network configuration. However, when configuring a network using a private IP, the operator must set port forwarding information for remote access such as telnet or ssh. In addition, when remote access such as telnet or ssh is required from an external network, the operator must additionally set a firewall permission policy, which limits network utility.

Referring to FIG. 1B , an apparatus for controlling port forwarding according to an embodiment of the present invention may include

hosts

106 , 108 , 110 , 112 , a router 104 , and an internal forwarder 140 .

Hosts

106 , 108 , 110 , 112 , router 104 and internal forwarding unit 140 are connected by internal network 116 (internal network formation).

The first host 106 is set to a first type (Type-1). Here, the first type means a host to which a public IP is allocated.

The second host 108 is set to a second type (Type-2). Here, the second type refers to a host including virtual machines VM-1 and VM-2 (or first virtual machines) therein by a NAT type provided by an operating system (OS). Such a second host 108 includes a forwarding agent (FA). The forwarding agent FA transfers the access information to be provided by the second host 108 to the internal forwarding unit 140 . For example, the forwarding agent (FA) of the second host 108 may transmit connection information that can be connected to the virtual machines VM-1 and VM2 of the second host 108 to the internal forwarding unit 140 . have.

On the other hand, although the forwarding agent (FA) is illustrated as being separately included in the host for convenience of description, the present invention is not limited thereto. For example, the forwarding agent (FA) may be deleted, and the operation of the forwarding agent (FA) may be performed in the corresponding host. For example, the forwarding agent (FA) may be implemented as a program or the like.

The third host 110 is set to a third type (Type-3). Here, the third type means a host connected to the internal network 116 via the NAT device 114 . Such a third host 110 includes a forwarding agent (FA). The forwarding agent FA transmits access information to be provided by the third host 110 to the internal forwarding unit 140 .

The fourth host 112 is set to a fourth type (Type-4). Here, the fourth type is connected to the internal network 116 via the NAT device 114, and virtual machines (VM-1', VM-2') inside by the NAT type provided by the operating system (OS). (or second virtual machines) means a host. Such a fourth host 112 includes a forwarding agent (FA).

The forwarding agent FA transmits the access information to be provided by the fourth host 112 to the internal forwarding unit 140 . For example, the forwarding agent FA of the fourth host 112 may transmit connection information that can be connected to the virtual machines VM-1' and VM-2' to the internal forwarding unit 140 .

Meanwhile, although FIG. 1B shows four hosts 106 to 112 formed in different types for convenience of description, the present invention is not limited thereto. For example, one or more types of hosts included in the internal network of the present invention may be configured, and the number of hosts may be variously configured.

A router 104 (or a switch) connects the internal network with any external network. For example, the router 104 is connected to the Internet via the firewall 102 , and accordingly, the internal network may be connected to any external network (or terminal, etc.) via the Internet.

The internal forwarding unit 140 sets port forwarding information in response to access information from a forwarding agent (FA) included in each of the hosts 108 to 112 . That is, the internal forwarding unit 140 automatically sets port forwarding information in response to the access information of the forwarding agent (FA). In this case, the first terminal 120 connected to the internal network 116 may be connected to the second host 108 to the fourth host 112 in response to the port forwarding information set in the internal forwarding unit 140 . have.

Meanwhile, the first host 106 to which the public IP is assigned can communicate with the first terminal 120 without a separate port forwarding.

Accordingly, although it has been described that the internal forwarding unit 140 does not generate separate port forwarding information in relation to the first host 106 , the present invention is not limited thereto. For example, port forwarding information of the first host 106 may be set in the internal forwarding unit 140 to be connected to an external network via the firewall 102 .

The firewall 102 protects the internal network from the external network by controlling only a session meeting a policy set in advance from the external network to be communicated to the internal network. For example, the second terminal 130 located outside the firewall 102 may block communication with the internal network by the packet filtering function of the firewall 102 .

Meanwhile, even if the internal forwarding unit 140 is included in the port forwarding control device as shown in FIG. 1B , it is difficult for the second terminal 130 located outside the firewall 102 to access the internal network.

The present invention provides a method for a terminal located outside to use a desktop service existing in an internal network.

For example, the port forwarding control apparatus according to another embodiment of the present invention includes hosts 106 ′, 108 , 110 , 112 , a router 104 , an internal forwarding unit 140 , and an external forwarding unit 150 . can do.

Each of

hosts

106', 108, 110, 112 includes a forwarding agent (FA). The forwarding agent (FA) included in each of the

hosts

106', 108, 110, and 112 transmits the access information of the

host

106', 108, 110, and 112 to the internal forwarding unit 140. forward to

The internal forwarding unit 140 sets port forwarding information (or internal port forwarding information) in response to access information from the forwarding agent (FA). Then, the internal forwarding unit 140 transmits the port forwarding information to the external forwarding unit 150 .

The external forwarding unit 150 is located outside the firewall 102 . Such an external forwarding unit 150 sets port forwarding information (or external port forwarding information) based on the port forwarding information from the internal forwarding unit 140 .

The external forwarding unit 150 transmits the packet from the second terminal 130 to the internal forwarding unit 140 in response to the port forwarding information stored therein. The internal forwarding unit 140 may supply the packet transferred from the external forwarding unit 150 to the specific host 106' to any one of 112 in response to the port forwarding information stored therein.

On the other hand, as cloud-based services are activated, desktop services that virtualize personal computers and use them by placing them inside the cloud are expanding. However, the cloud network is basically managed as a private network and blocked from the outside, and desktop services operating inside the cloud operate using the IP address allocated for the private network. Although it is possible to use services outside the private network through the Internet within the private network, it is difficult for users in the external Internet network to access the desktop service inside the private network. In order to solve this difficulty, port forwarding or a method of using a relay server inside a private network has been provided.

FIG. 2 is a diagram for simplifying the port forward method described above with reference to FIGS. 1A and 1B .

In the past, at home or at work, there was usually only one computer and there was no smartphone, so even if you installed the Internet, you could connect to the Internet to your computer with a modem. In recent years, each family member uses a computer or uses a wired/wireless router to access the Internet using a smartphone. If you simply use the Internet, the router does not cause any problems, but if I build any service or server, the router becomes a big problem.

To use the Internet, you must have an IP address that is used worldwide. Since IP is a unique value, it does not have duplicate addresses. However, the current IP system is insufficient to allocate IPs to all devices in the world. IPv4, which consists of 4 numbers from 0 to 255, can allocate only 4,294,967,296 (about 4.2 billion) addresses to the power of 2, 32. Therefore, a separate private network is established for devices that do not need a network worldwide.

The above-mentioned Internet-capable IP is called a public IP. These public IPs are unique values and are assigned to each device using the Internet. However, some IP bands are not used in these public IPs. The 10.x.x.x bands, the 172.16~31.x.x bands, and the 192.168.x.x bands are all unused. This IP band is used only in a private network (or private network) that a company or individual will establish separately. A private network is a local network, not the global Internet, and is used when the Internet is not necessary. In order to build such a private network, a DHCP server and a router are required, but the personal equipment that combines these functions is a router.

The role of the router is to establish a private network for all devices connected to the router. Because it is a private network, the private IP band is used instead of the public IP band mentioned above. The mainly used IP band is 192.168.x.x. As such, a device with an IP address starting with 192.168 requires a device with a public IP address to access the Internet. The router is assigned a public IP while creating a private network. So, all devices connected to the router must go through the router to access the Internet.

In order to access the Internet from Terminal 1 to one router, it must go through the router. If it is assumed that the web server of terminal 1 is opened to port 80, it is impossible to inform the IP of terminal 1 in order for others to access the web server of terminal 1 through the Internet. Because private IP bands are used here and there, they do not point to specific devices like public IPs. So, you need to inform the public IP of the router. The connection to port 80 of the public IP ends when it reaches the router. This is because the router cannot determine which port among

terminals

1, 2, and 3 to send the connection of port 80 that has entered the public IP. Therefore, it is necessary to configure the router to connect the port 80 coming from the public IP to port 80 of terminal 1, and this is called port forwarding.

When port forwarding is used, the remote access desktop service existing inside the private network allocates a different port for each computer for remote access. The router managing the private network can allow the connection to access the private network from the outside by forwarding all packets that connect to a pre-determined port from the outside for remote access to the desktop service using the pre-determined IP. However, this method is inconvenient in that a port is allocated for each computer, and a user who wants to access the allocated port from the outside must also know as previously agreed information.

3 is a diagram for explaining a method of using a relay server in a private network.

The method of using the relay server inside the private network is the method suggested by Microsoft (patent application No. 10-2004-0039190), which provides a desktop service that the user terminal can access through the portal, and when the user terminal selects a specific desktop service, the inside of the private network This is a method that relays traffic between an external user terminal and an internal desktop service by creating a thread for the server in the server to receive the user's traffic and the desktop service traffic inside the private network. Since this method takes a method in which the internal server receives both traffic and relays it again, there is a disadvantage that the efficiency may be greatly reduced if a lot of load is concentrated at once.

4 is a diagram for explaining a system including a private network access control apparatus according to an embodiment of the present invention, and FIG. 5 is a flowchart for explaining a control method according to an embodiment of the present invention.

The private network access control device performs a function of allowing a user terminal located outside the private network to access a computing device located in the private network through the Internet network and use a remote service for the computing device. The remote service may include various functions, but for convenience of description, the remote desktop service will be exemplified.

In a cloud environment, the remote desktop service usually exists inside a private network and can be accessed by the method described above. However, the current cloud network is becoming increasingly complex with a structure in which the private network environment is surrounded by double or triple layers, and the need to improve performance in a simpler and more efficient way is increasing in this environment.

To solve this problem, the user terminal performs membership registration through a login portal operated by the private network access control device inside the private network (S510).

User information including remote desktop service information that the user terminal intends to use when signing up for membership and a private network IP address of a node in which the remote desktop service is located may be stored in the memory of the private network access control device.

Next, the user terminal accesses the server accessible to the private network through the login portal operated by the server inside the private network, and performs login (S530). The address of the login portal is fixed to a specific address that can access the private network, and a portal that provides a specific service can be installed inside the private network using a known method. Since the IP address that can access the portal service is known externally, anyone can access it.

When the user terminal is logged in, it is possible to know who the user accessed through the portal is, and the IP information used by the user can be obtained through the user packet. Since the remote desktop service is provided in a one-to-one correspondence with a specific user, by using user information, it is also possible to identify the remote desktop service corresponding to the user. Using internal management information, you can find out which cloud computing node the corresponding remote desktop service is currently deployed on, and you can know the IP address of the corresponding computing node or the IP address represented for access (usually a gateway or router address). have. Therefore, by using the logged-in user information, it is possible to know the IP address of the user terminal, the remote desktop service for users inside the private network, the IP address of the cloud computing node where the service is deployed, and information about the access path.

Next, the private network access control apparatus provides the remote desktop service by changing the configuration information of the router (or gateway) connecting the private network and the outside using the obtained IP address of the user terminal as follows ( S550 ).

The packet transmitted from the user terminal to the private network is delivered into the private network by using the IP address of the computing node where the corresponding remote desktop service is located inside the private network as the destination address. The packet sent by the Remote Desktop Service to the user can be transmitted outside the private network with the IP address of the user terminal as the destination in the same way as the method currently used in NAT.

The host provides the remote desktop service to the user terminal through the router whose settings are changed (S570).

If a plurality of user terminals exist in the same private network, they may have the same starting address. In order to prepare for this case, when a plurality of user terminals with the same starting address access the remote desktop service existing inside the private network, the computing node providing the remote desktop service is arranged differently or the service is provided through a container having a different address. By providing the service, it is possible to provide a service smoothly using the NAT that is already in use without any additional device or operation.

More specifically, the private network access control apparatus searches for a first user terminal and a second user terminal that exist in the private network and access the remote desktop service, and provides a node providing the remote desktop service to the first user terminal. disposing differently to a corresponding first node and a second node corresponding to the second user terminal, and providing the remote desktop service to the first user terminal through the first node, and through the second node The step of providing the remote desktop service to the second user terminal may be additionally performed.

The classic method is port forwarding, but this method has a limitation in that traffic with a specific port coming from the outside can be sent to only one server inside the NAT.

For this reason, Microsoft has proposed a new method. The method presented by Microsoft is a method of receiving all connections with a server program, reading the traffic, and then sending it back to the server. According to this method, the traffic consists of a read part and a sending part.

The method proposed in the present invention is not to read and then forward it, but to change the address value of the traffic according to a predetermined rule according to the user so that the remote desktop user terminal can directly send the traffic to its own server. At this time, the user and the address value are mapped 1:1, and the information is predetermined when the user terminal creates a user account or an administrator creates an account.

Microsoft's method takes a delay because it reads and sends back and requires a complicated program, but this is not necessary because the present invention only changes the address value. Accordingly, according to the present invention, a user terminal can quickly and efficiently access a remote desktop service existing in a private network or an internal cloud computing network from the outside.

The present invention described above can be implemented as computer-readable code (or application or software) on a medium in which a program is recorded. The above-described control method of the diagnostic system may be realized by a code stored in a memory or the like.

The computer-readable medium includes all kinds of recording devices in which data readable by a computer system is stored. Examples of computer-readable media include Hard Disk Drive (HDD), Solid State Disk (SSD), Silicon Disk Drive (SDD), ROM, RAM, CD-ROM, magnetic tape, floppy disk, optical data storage device, etc. There is also a carrier wave (eg, transmission over the Internet) that includes implementation in the form of. In addition, the computer may include a processor or a processor. Accordingly, the above detailed description should not be construed as restrictive in all respects but as exemplary. The scope of the present invention should be determined by a reasonable interpretation of the appended claims, and all modifications within the equivalent scope of the present invention are included in the scope of the present invention.

Claims

performing log-in to a user terminal accessing the portal through an Internet network;

obtaining user information about the user terminal in response to the user terminal logging in;

changing settings of a router connecting the Internet network and the private network using the user information; and

and providing a remote service located in the private network to the user terminal using the router.
According to claim 1,

Changing the settings of the router includes:

setting a destination address of a packet transmitted from the user terminal to the private network as a private network IP address of a node in which the remote service is located; and

and setting a destination address of a packet sent by the remote service to the user terminal as an Internet network IP address of the user terminal.
3. The method of claim 2,

The user information is

The method of controlling a private network access control apparatus, characterized in that it includes the Internet network IP address of the user terminal, remote service information to be used by the user terminal, and a private network IP address of a node in which the remote service is located.
The method of claim 1,

The portal is operated in a server connected to the private network, and the address of the portal is fixed to a specific address that can be accessed from the Internet network to the private network.
According to claim 1,

discovering a first user terminal and a second user terminal existing in the private network and accessing the remote service;

disposing the remote service providing node differently as a first node corresponding to the first user terminal and a second node corresponding to the second user terminal; and

and providing the remote service to the first user terminal through the first node and providing the remote service to the second user terminal through the second node. control method.
a plurality of hosts providing different remote services;

a router connected to the hosts by a private network and configured to connect the private network to an Internet network; and

and a private network access control device connected to the hosts through the private network and configured to change the settings of the router so that a user terminal connected to the private network can use a remote service provided by at least one of the hosts. private network access control system.