JP2005242547A - Remote service execution method, remote client, and remote service server - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide user-friendly a remote operation service wherein security is enhanced by restricting access from an external network to a user. <P>SOLUTION: This remote service execution method has an authentication information transmission means 105 for requesting execution of service, and an authentication means 104 for performing permission decision of the execution of the service. When the execution of the service is permitted, the authentication information transmission means 105 transmits address information about a remote operation task 106 performing operation of the remote service 103 to the authentication means 104. A remote access permission message transmission means 108 receives the address information from the authentication means 104, and transmits a service permission message to the remote operation task 106 to start the remote operation. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

  The present invention mainly relates to a remote service execution method, a remote client, and a remote service server for remotely using a service with restricted access.

  With the spread of the Internet, many services that exchange various information via networks have appeared. Devices and applications that use networks, such as commercial services using the Web, e-mails, IP telephones, and Internet home appliances, are becoming various and increasing. While the convenience of easily obtaining necessary information and controlling devices using a network increases, the damage caused by unauthorized access is also increasing. Under such circumstances, a firewall that restricts access from the external network to the internal network of the house is an essential function. Under a firewall environment, access from a device connected to an external network to the internal network is prohibited, while access from the internal network to the external network is permitted. However, there is a demand for using the service of the internal device from the external network device.

As a means for solving such a request, when accessing an internal network service from an external network, there is a relay means for relaying permitted access to the internal network service after an authentication process (see Patent Document 1). ).
JP 2001-350718 A

  However, in the conventional configuration such as Patent Document 1, for example, when there is an environment where there is a service with high remote operation traffic such as transmission of video information, or when there are many home devices and services performing remote operation, There was a problem that the load on the relay means may increase and the service may not be supported.

  The present invention solves the above-mentioned problems, and does not give a special function to the firewall device, and places a processing load on a specific functional unit even in an environment where there are many types of services or an environment where the traffic of remote operation is large. An object of the present invention is to provide a remote operation device and method capable of responding to services without being concentrated.

  In order to solve the conventional problems, the remote service execution method of the present invention executes the remote service from the remote client for one or a plurality of remote services that are permitted to be executed only by a specific remote client. In the remote service execution method, the remote client transmits address information and authentication data for executing the remote service, and executes the remote service requested by the remote client based on the authentication data. A step of determining whether to permit execution, a step of notifying the remote service of the address information when the execution of the remote service is permitted, and a remote client from the remote service based on the address information. It is characterized in being composed of a step of setting a communication path with.

  In addition, the remote client of the present invention provides an address for executing the remote service in a remote client that executes the remote service with respect to one or a plurality of remote services that are permitted to be executed only by a specific remote client. It comprises authentication information transmitting means for transmitting information and authentication data, and remote operation means for executing a remote service using a communication path set from the remote service.

  Further, the remote service server of the present invention is a remote service server that permits execution of only one or a plurality of remote services only to a specific remote client, and receives address information for the remote client to execute the remote service, The remote access permission message transmitting means for setting a communication path with the remote client based on the address information is provided.

  According to the remote service execution method of the present invention, the access from the external network is restricted by the firewall, and the remote operation service can be provided only to the authorized user by the authentication unit in the security protected environment. Further, when the service is permitted by the authentication unit, the address information of the remote operation task for performing the remote service operation is transmitted to the authentication unit, and the authentication unit transmits the address information to the remote The remote access permission message transmission means transmits the service, and the remote access permission message transmission means sets a communication path by sending a service permission message to the remote operation task and starts remote operation from the remote operation task. Therefore, it is possible to construct an environment in which each authorized remote terminal and each remote service communicate directly, and the processing load can be distributed.

  Embodiments of the present invention will be described below with reference to the drawings.

(Embodiment 1)
FIG. 1 is a configuration diagram of a remote service system according to Embodiment 1 of the present invention. In FIG. 1, reference numeral 101 denotes a remote client that performs a remote operation, and the remote client 101 can communicate with various devices via a network. Reference numeral 102 denotes a firewall that prohibits external access to the internal network. 103 and 109 are remote services existing in the internal network of the firewall 102. Reference numeral 104 denotes an authentication unit that determines whether to permit the use of the services for the remote services 103 and 109. Authentication information for determining whether to permit the use of the remote services 103 and 109 is transmitted to the remote client 101, an authentication information transmitting means 105 for requesting determination, a remote operation task 106 for executing remote operation, There is task generation means 107 that determines the address where the remote operation task operates and generates the remote operation task 106. The remote service 103 includes a remote access permission message transmission unit 108 that transmits a service permission message to the remote operation task 106 when the authentication unit 104 permits the execution of the service. Further, the remote service 109 includes a remote access permission message transmission unit 110 that transmits a service permission message to the remote operation task 106 when the authentication unit 104 permits the execution of the service.

  Messages exchanged between the authentication information transmission unit 105 and the authentication unit 104 are realized by a secure communication path by encryption.

  The authentication unit 104 manages authentication information, types of services to be permitted, and address information of access destinations of the respective services.

  FIG. 2 is an example of an authentication information management table managed by the authentication unit 104. The authentication unit 104 manages a list of permitted authentication IDs as authentication information. In the example of FIG. 2, each of “ID1”, “ID2”, “ID3”, and “ID4” indicates an authentication ID that permits authentication. The type of service to be permitted is managed in correspondence with each authentication ID. In the table, “S1”, “S2”, etc. each indicate an identifier indicating the type of service. For example, S1 corresponds to a recording reservation operation to a recording device connected to the network, and S2 corresponds to a power operation of an air conditioner connected to the network.

  FIG. 3 is an example of address information of the access destination to the remote service managed by the authentication unit 104. For example, the IP address and port number of the access destination are managed for each type of remote service.

  FIG. 4 shows an operation sequence diagram of the remote operation device shown in FIG. Hereinafter, the operation of the remote operation device will be described with reference to FIGS.

  When the remote client 101 performs a remote operation of the remote service 103, first, the authentication information transmission unit 105 transmits a message requesting a list of services together with the authentication ID to the authentication unit 104 (arrow of S401 in FIG. 4). . Upon receiving the message, the authentication unit 104 checks whether or not the corresponding authentication ID exists in the authentication information management table, and if it exists, transmits a list of services to be permitted (arrow S402 in FIG. 4). For example, when “ID1” is transmitted, the service types “S1, S2, S3” permitted by “ID1” are transmitted in a list. The authentication information transmission means 105 selects a service from the list of transmitted services (S403 in FIG. 4). The authentication information transmission unit 105 transmits the type of the selected service to the authentication unit 102 (S404 in FIG. 4), and the authentication unit 104 determines permission of the service and transmits the determination result to the authentication information transmission unit 105 (FIG. 4). 4 S405). When the service is permitted, the authentication information transmission unit 105 requests the task generation unit 107 to determine an address of the remote operation task, for example, a port number (S406 in FIG. 4). Then, a remote operation task at the determined address is generated (S407 in FIG. 4). The authentication information transmission unit 105 transmits the generated address information of the remote operation task to the authentication unit 104 (S408 in FIG. 4), and the authentication unit 104 that has received the address information permits remote access of the selected remote service 103. Address information is transmitted to the message transmitting means 108 (S409 in FIG. 4). This address information is, for example, an IP address and a port number. The remote access permission message transmission means 108 that has received the address information transmits a service permission message to the address of the address information together with key information for encrypting the message for remote operation. Since this message is communication from the internal network of the firewall to the external network, it can pass through the firewall and the communication path with the remote operation task 106 can be set from the remote service 103 side (S410 in FIG. 4). Using the communication path thus set, the remote operation task 106 performs a remote operation on the remote service 109 (S411 in FIG. 4).

  According to such a configuration, the authentication information transmission unit 105, the authentication unit 104, and the remote access permission message transmission unit 108 are provided, and for the access permitted for authentication, the address information of the remote operation task is notified by the authentication information transmission unit 105, The remote access permission message transmission means 108 can automatically provide a remote operation service only to authorized access by transmitting a permission message to the notified address. Furthermore, each authorized remote terminal and each remote service can communicate directly, and the processing load can be distributed.

  In addition, by encrypting information exchanged between the authentication information transmitting unit 105 and the authentication unit 104, a remote service can be provided more securely.

  Further, by providing a function for transmitting key information for encrypting information exchanged between the remote operation task 106 and the remote service 103 from the remote access permission message transmission means 108, it is possible to realize concealment of the remote operation information.

  In the operation sequence diagram of the present embodiment, the authentication information transmitting unit 105 first transmits the service list request S401 and acquires the service list information (S402), but this procedure is not necessarily essential. In some cases, information on services that can be used by the authentication information transmitting unit 105 is stored in advance.

  The authentication information transmitted together with the service selection information is for identifying the authentication information transmitting means 105 that intends to use the service, and is the authentication ID value itself stored as a list by the authenticating means 104. Not always. For example, a case where a session ID permitted for authentication is used as authentication information after performing an authentication procedure using an authentication ID is also included.

  The authentication unit is not included in the remote service server, and may be configured as an independent authentication server, or the remote services 103 and 109 and the authentication unit 104 may configure the remote service server. When the remote service server and the authentication server are independent from each other, the address information is communicated between the remote service server and the authentication server, so that the remote services 103 and 109 and the authentication unit 104 constitute the remote service server. An effect is obtained.

(Embodiment 2)
FIG. 5 shows an operation sequence diagram of the remote operation device according to the second embodiment of the present invention.

  In FIG. 5, the same procedures as those in FIG. (S401 to S410 in FIG. 5) Upon receiving the service permission message in the same procedure as in FIG. 4, the remote operation task 106 requests a detailed service list from the remote service 103 in which the remote access permission message transmitting means 108 exists. (S501 in FIG. 5). The remote service 103 stores a list of detailed services that can be provided.

  FIG. 6 is an example of a list of detailed services that can be provided and stored in the remote service 103. The remote service 103 transmits a list of detailed services as shown in FIG. 6 to the remote operation task 106 (S502 in FIG. 5). In the remote operation task, the service information selected from the detailed service list is transmitted to the remote task 103 (S503 in FIG. 5). In accordance with the type of the designated service, the remote access permission message transmission unit 110 of the corresponding remote task 109 is notified of the IP address and port number of the remote operation task (S504 in FIG. 5). The remote access permission message transmission unit 110 transmits a service permission message to the notified address of the remote operation task, and secures a communication path with the remote operation task 106 (S505 in FIG. 4). Using the communication path thus set, the remote operation task 106 executes a remote operation (S506 in FIG. 4).

  According to such a configuration, the remote service 103 provides a list of detailed services to the remote operation task 106 and provides a function of notifying the remote service 109 that executes the selected service of the address information of the remote operation task 106. A set of services permitted by authentication can be distributed and managed by a plurality of remote services of the internal device, and management management can be hierarchically managed while avoiding centralization of management information in the authentication means 104.

  The remote operation device and method according to the present invention have an authentication unit and a remote access permission message transmission unit, and are useful when using a service of an internal device whose security is protected by a firewall in an external network.

Configuration diagram of a remote operation device according to an embodiment of the present invention The figure which shows the example of the authentication information management table managed by the authentication means 104 in embodiment of this invention The figure which shows the example of the address information of the access destination to the remote service managed by the authentication means 104 in embodiment of this invention The figure which shows the operation | movement sequence of the remote operation apparatus in Embodiment 1 of this invention. The figure which shows the operation | movement sequence of the remote operation apparatus in Embodiment 2 of this invention. The figure which shows the example of the list of the detailed services which can be provided and memorize | stored in the remote service 103 in Embodiment 2 of this invention

Explanation of symbols

DESCRIPTION OF SYMBOLS 101 Remote client 102 Firewall 103,109 Remote service 104 Authentication means 105 Authentication information transmission means 106 Remote operation task 107 Task generation means 108,110 Remote access permission message transmission means

Claims (10)

In a remote service execution method for executing the remote service from the remote client with respect to one or a plurality of remote services that are allowed to be executed only by a specific remote client,
Transmitting the address information for the remote client to execute the remote service and authentication data;
Determining whether to permit execution of a remote service requested by the remote client based on the authentication data;
Notifying the remote service of the address information when permitting execution of the remote service;
A remote service execution method comprising: setting a communication path from the remote service to the remote client based on the address information. 2. The remote service execution method according to claim 1, wherein the address information is an IP address and a port number of the remote client. 2. The remote service execution method according to claim 1, wherein information exchanged between the remote client and the remote service is encrypted. In the step of setting a communication path with the remote client, the remote service transmits key information, and the remote client encrypts and decrypts transmission / reception data during service execution using the key information. The remote service execution method according to claim 1. The remote service execution method according to claim 1, further comprising: notifying the remote client of a list of services that can be permitted to the remote client based on the authentication data. Requesting execution of another remote service managed by the remote service that sets the communication path after the remote client sets the communication path with the remote service;
A remote service that sets the communication path, notifying the address information of the remote client to the other remote service;
The remote service execution method according to claim 1, further comprising: setting a communication path with the remote client from the other remote service. In a remote client that executes the remote service for one or more remote services that are allowed to be executed only by a specific remote client,
Authentication information transmitting means for transmitting address information for executing the remote service and authentication data;
Remote operation means for executing a remote service using a communication path set from the remote service. In a remote service server that allows only one specific remote client to execute one or more remote services,
The remote service comprising: remote access permission message transmission means for receiving address information for the remote client to execute the remote service and setting a communication path with the remote client based on the address information server. The remote client receives address information for executing the remote service and authentication data, and determines whether to allow the remote client to execute the remote service based on the authentication data; The remote service server according to claim 8, further comprising an authentication unit that transmits the address information to the remote access permission message transmission unit when the execution of the remote service is permitted. A remote service system comprising the remote client according to claim 7 and the remote service server according to claim 9.

Images