JP2009258813A - Communication control method and thin client system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a communication control method for inhibiting the connection of a remote machine which has been lost or stolen to a local machine and to provide a thin client system for executing the same. <P>SOLUTION: The thin client system is provided with a portable terminal 11 which can be connected through a network to a management server 5. for the portable terminal, the management server 5 is provided with: a storage part for storing information necessary for user authentication and information showing the address of an information processor and the assignment state of an information processor in association with one another; and a control means having a means for receiving the assignment inhibition request of the address of the information processor from the portable terminal through the network and a means for changing the assignment state of the address of the information processor associated with the information necessary for user authentication included in the assignment inhibition request of the address of the received information processor to assignment inhibition by referring to the storage part, and for notifying the portable terminal of the result through the network. <P>COPYRIGHT: (C)2010,JPO&INPIT

Description

  The present invention relates to a technology for prohibiting a connection from a lost or stolen thin client terminal to a connection destination device in a thin client system having a thin client terminal and a connection destination device of the thin client terminal.

  In recent years, companies are introducing thin client systems from the viewpoint of preventing information leakage. In the thin client system, a blade PC (Personal Computer) (hereinafter referred to as a local machine) installed in an in-house office or in-house server room or the like using a thin client terminal (hereinafter referred to as a remote machine) at hand is used inside and outside the company. By remotely operating the computer, various application programs and data installed in the local machine can be used (for example, see Patent Document 1). By using a HDD (Hard Disk Drive) -less PC as the remote machine, the possibility of information leakage due to loss or theft of the remote machine is reduced. On the other hand, for the local machine, a blade-type PC having a higher degree of integration, a server computer that provides a simulated PC environment with software, or the like is used.

  In the above thin client system, since a remote machine is connected to a local machine via the Internet network outside the company, VPN (Virtual Private Network) technology for performing secure data communication on the Internet network or disclosure on the VPN Cryptographic techniques such as key cryptography are used. Further, in the thin client system described in Patent Document 1, an authentication device such as Key Mobile in which information for identifying an individual is stored and a local machine are assigned to each user, and a plurality of users share a remote machine. As a result, each user is assigned to each user using a remote machine installed at the business trip destination or the like by carrying only the authentication device when traveling to a business trip destination or customer destination. Because it can access the local machine, security can be enhanced. However, a user usually carries a remote machine and an authentication device in the same carrying device such as a bag. For this reason, this bag may be left on the go and lost or stolen. In this case, if a remote machine that has been lost or stolen has knowledge of the thin client system and is in the hands of a person who knows the password, this person pretends to be a legitimate user from the remote machine to the local machine. Information may be leaked by connecting to. Therefore, a countermeasure when the remote machine is lost or stolen is desired.

  For example, a technique described in Patent Document 2 is known as a technique for preventing leakage of information handled by a remote machine when the remote machine is lost or stolen. In this patent document 2, a management server specifies a host PC that is a connection destination device of a remote machine based on mobile terminal specifying information from a mobile terminal, and the address information of the specified host PC is stored in the mobile terminal. It is described that the remote machine can connect to the specified host PC based on this address information.

Japanese Patent No. 04001297 JP 2007-243344 A

  However, in the technique described in Patent Document 2, a mobile terminal is required to connect to a host PC from a remote machine, and the system configuration is complicated.

  The object of the present invention is that a remote machine can be connected to a local machine without using a mobile terminal, and is lost or stolen using the mobile terminal only when the remote machine is lost or stolen. To provide a communication control method capable of prohibiting connection from a remote machine to a local machine, and a thin client system for implementing the communication control method.

  A thin client system comprising a plurality of information processing devices that can be connected to each other via a network, a management server that manages the information processing devices, and a plurality of thin client terminals, and further connected to the management server via the network It further has a possible portable terminal.

In the thin client system, the portable terminal is
Means for transmitting a connection request together with information necessary for user authentication to the management server via the network, means for receiving a user authentication result from the management server via the network, and after receiving the user authentication result, the information Means for transmitting a processing device address assignment prohibition request to the management server via the network, and means for receiving a response to the information processing device address assignment prohibition request from the management server via the network. It is characterized by having control.

In addition, the management server for this mobile terminal
A storage unit that stores information necessary for the user authentication, an address of the information processing apparatus, and information indicating an allocation state of the information processing apparatus in association with each other;
Based on means for receiving information necessary for the user authentication from the portable terminal via the network, information necessary for the received user authentication and information necessary for the user authentication stored in the storage unit A means for performing user authentication, a means for notifying the mobile terminal of the authentication result when the user authentication is established as a result of the user authentication, and a request for prohibiting assignment of an address of the information processing apparatus from the mobile terminal. Means for receiving via the network, and allocation of information processing apparatus address associated with information required for user authentication included in the received address allocation prohibition request of the information processing apparatus with reference to the storage unit A control unit having means for changing the status to prohibit allocation and notifying the mobile terminal to that effect via the network. And features.

In the thin client system, the portable terminal is
Means for transmitting a connection request together with information necessary for user authentication to the management server via the network, means for receiving a user authentication result from the management server via the network, and after receiving the user authentication result, the information Means for transmitting a power-off request for the processing device to the management server via the network, means for receiving a response to the power-off request for the information processing device from the management server via the network, and after receiving the response, Means for transmitting an address assignment prohibition request for the information processing apparatus to the management server via the network, and means for receiving a response to the address assignment prohibition request for the information processing apparatus from the management server via the network It has the control part which has.

In addition, the management server for this mobile terminal
A storage unit that stores information necessary for the user authentication, an address of the information processing apparatus, and information indicating an allocation state of the information processing apparatus in association with each other;
A means for receiving information necessary for user authentication from a portable terminal via the network, a user based on the received information necessary for user authentication and information necessary for the user authentication stored in the storage unit A means for performing authentication, a means for notifying the mobile terminal of the authentication result via the network when the user authentication is established as a result of the user authentication, a request for powering off the information processing apparatus from the mobile terminal to the network Means for receiving via the network, means for transmitting a power-off request to the information processing device via the network, and detecting that the information processing device is turned off, the information processing device is turned off by the portable terminal. Means for transmitting the information to the information processing apparatus via the network, and a request for prohibiting assignment of the address of the information processing apparatus from the portable terminal. Means for receiving via the network, and the address allocation state of the information processing apparatus associated with the information required for the user authentication included in the received address allocation prohibition request of the information processing apparatus with reference to the storage unit And a control unit having means for notifying the mobile terminal via the network that the allocation is prohibited.

The information processing apparatus includes:
It has a control part which has a means to receive the power-off request from the management server via the network, and a means to turn off the power of the information processor in response to the power-off request.

  According to the present invention, normally, a remote machine can be connected to a local machine without using a portable terminal, and the lost or stolen terminal is used only when the remote machine is lost or stolen. It is possible to provide a communication control method capable of prohibiting connection from a remote machine to a local machine, and a thin client system for implementing the communication control method. Thereby, security can be further strengthened.

(Example 1)
Hereinafter, a first embodiment of the present invention will be described in detail with reference to the drawings.

  FIG. 1 is a diagram showing an overall configuration of a thin client system to which the first embodiment of the present invention is applied.

  The thin client system of this embodiment includes a plurality of authentication devices 1 and remote machines (information processing apparatuses) 2, a VPN server 4, a management server 5, a plurality of local machines (thin client terminals) 6, and a firewall 9. And a mobile terminal 11.

  The authentication device 1 can be attached to and detached from the remote machine 2. The remote machine 2 is connected to a LAN (Local Area Network) 3 constructed in a hotel, a station or the like. The VPN server 4 is connected to a LAN 7 constructed in a company or the like. The management server 5 and the plurality of local machines 6 are connected to a LAN 8 constructed in a company or the like. Further, a firewall exists between the LAN 7 and the LAN 8. By this firewall, communication between the internal system having the VPN server 4, the management server 5, and the local machine 6 and the outside can be controlled, and the safety of the internal system can be maintained. The external system having the authentication device 1 and the remote machine 2 and the internal system having the VPN server 4, the management server 5, the plurality of local machines 6 and the firewall 9 are connected to each other via a WAN (Wide Area Network) 10. It is configured to be possible. Further, the mobile terminal 11 is configured to be connectable to an internal system via the mobile terminal company 12 and the WAN 10.

  FIG. 2 is a diagram illustrating the configuration of the authentication device 1. The authentication device 1 includes an IC chip 111 and a USB adapter 112 for connecting to the remote machine 2. The IC chip 111 stores a processor 113, an authentication program 114, a PIN (Personal Identification Number) code (password or password) 115, a user ID 116, connection information 117, and authentication information 118. . The authentication program 114 receives the PIN code input to the remote machine 2 from the local machine 2 and collates the received PIN code with the PIN code 115 stored in the IC chip 111 so that the owner of the authentication device 1 (user ) Authentication program. The user ID 116 is information necessary when the remote machine 2 makes an address allocation request for the local machine 6 to the management server 5. The connection information 117 is information such as the IP address of the VPN server 4 necessary for the remote machine 2 to connect to the VPN server 4 and the IP address necessary for the remote machine 2 to connect to the management server 5. The authentication information 118 is information such as an electronic certificate necessary for PKI (Public Key Infrastructure) authentication at the time of VPN encrypted communication. The authentication device 1 may be configured so that a flash memory can be externally attached, and a part of the data in the IC chip 111 may be stored in the flash memory.

  FIG. 3 is a diagram illustrating a configuration of the remote machine 2. The remote machine 2 includes a CPU (Central Processing Unit) 201, a RAM (Random Access Memory) 202 functioning as a work area for the CPU 201, a NIC (Network Interface Card) 3 for connecting to the LAN 3, and a flash ROM (Read Only). Memory) 204, video card 205, I / O connector 206 for connecting the keyboard and mouse, USB port 207 for connecting the authentication device 1, and BUS connecting these units 201-207. And a power source 209.

  The flash ROM 204 stores a BIOS (Basic Input / Output System) 210. After the power supply 209 is turned on, the CPU 201 first accesses the flash ROM 204 and executes the BIOS 210 to recognize the system configuration of the remote machine 2.

  The flash ROM 204 stores at least an OS (Operating System) 211, a VPN client program 212, an authentication program 213, a management server connection program 214, and a remote control program 215.

  The OS 211 is a program for the CPU 201 to control the respective units 202 to 209 of the remote machine 2 to execute the VPN client program 212, the authentication program 213, the management server connection program 214, and the remote control program 215. The CPU 201 loads the OS 211 from the flash ROM 204 to the RAM 202 and executes it in accordance with the BIOS 210. Thereby, the CPU 201 comprehensively controls each unit 202 to 209 of the remote machine 2.

  The VPN client program 212 is a program for the remote machine 2 to perform VPN encrypted communication with the VPN server 4.

  The authentication program 213 is a program that performs PKI authentication.

  The management server connection program 214 is a program for connecting to the management server 5.

  The remote control program 215 is a program for connecting to the local machine 6 and communicating with the local machine 1. After connecting to the local machine 1, the remote control program 215 transmits input information such as a keyboard and a mouse to the local machine 1, and also displays video information (display desktop screen) indicating the processing result of the input information from the local machine 1. Receive and display on the display.

  FIG. 4 is a diagram showing the configuration of the VPN server 4. The VPN server 4 includes a CPU 401, a RAM 402 functioning as a work area for the CPU 401, a NIC 403 for connecting to the LAN 7, an HDD 404, a video card 405, a flash ROM 406, an I / O for connecting a keyboard and a mouse. A bridge 408 that relays the connector 407 and the BUS that connects these units 401 to 407 and a power source 409 are provided.

  The flash ROM 406 stores a BIOS 414. After the power supply 409 is turned on, the CPU 401 first accesses the flash ROM 406 and executes the BIOS 414 to recognize the system configuration of the VPN server 4.

  The HDD 404 stores at least an OS 410, an authentication program 411, a VPN manager program 412, and authentication information 413 such as an electronic certificate used at the time of PKI authentication.

  The OS 410 is a program for the CPU 401 to control the respective units 402 to 409 of the VPN server 4 to execute the authentication program 411 and the VPN manager program 412. The CPU 401 loads the OS 410 from the HDD 404 to the RAM 402 and executes it in accordance with the BIOS 414. Thereby, the CPU 401 comprehensively controls each unit 402 to 409 of the VPN server 4.

  When receiving a VPN connection request from the remote machine 2 or the portable terminal 11, the authentication program 411 uses the authentication information transmitted from the mote machine 2 or the portable terminal 11 and the authentication information 413 stored in the HDD 404 to perform PKI authentication. It is a program to do.

  The VPN manager program 412 is a program for performing VPN encrypted communication with the remote machine 2 or the portable terminal 11 after PKI authentication (authentication is established) by the authentication program 411.

  FIG. 5 is a diagram illustrating the configuration of the management server 5. The management server 5 includes a CPU 501, a RAM 502 that functions as a work area for the CPU 501, a NIC 503 for connecting to the LAN 8, an HDD 504, a video card 505, a flash ROM 506, and an I / O for connecting a keyboard and mouse. It has a bridge 508 that relays the connector 507 and the BUS that connects these units 501 to 507, and a power source 509.

  The flash ROM 506 stores a BIOS 514. After the power source 509 is turned on, the CPU 501 first accesses the flash ROM 506 and executes the BIOS 514 to recognize the system configuration of the management server 5.

  The HDD 504 stores at least an OS 510, a local machine allocation and power control program 511, a mobile terminal remote operation program 512, and a user related information table 513.

  The OS 510 is a program for the CPU 501 to control the respective units 502 to 509 of the management server 5 and execute the local machine allocation and power control program 511 and the portable terminal remote operation program 512. In accordance with the BIOS 514, the CPU 501 loads the OS 510 from the HDD 504 to the RAM 502 and executes it. Thereby, the CPU 501 comprehensively controls each unit 502 to 509 of the management server 5.

  The local machine assignment and power supply control program 511 is a program for controlling the assignment of the local machine 6 to the user and the power activation of the local machine 6. When the local machine allocation and power supply control program 511 receives the address allocation request of the local machine 6 together with the user ID from the remote machine 2 via the network 10, the local machine allocation and power control program 511 refers to the user related information table 513 to determine the presence or absence of the user ID. . As a result of the determination, if there is a user ID (authentication success), the local machine allocation and power control program 511 reads the IP address of the local machine 6 associated with the user ID from the user related information table 513, and this destination Based on the IP address indicating the information, control for transmitting a power-on request to the local machine 6 via the network 10 is performed. Then, the local machine allocation and power supply control program 511 monitors the activation of the local machine 6 and, when detecting the activation of the local machine 6, transfers the IP address of the local machine 6 to the remote machine 2 that is the address allocation request source. Control to notify via the network 10 is performed. If there is no user ID (authentication failure) as a result of the determination, the local machine allocation and power supply control program 511 notifies the remote machine 2 that has made the authentication failure to the remote machine 2 that is the address allocation request source via the network 10. Control.

  The portable terminal remote operation program 512 is a program for controlling the lost remote machine 2 so that it cannot be connected to the local machine 6. When the mobile terminal remote operation program 512 receives a connection request together with the user ID from the mobile terminal 11 via the network 10, the mobile terminal remote operation program 512 refers to the user related information table 513 to determine the presence or absence of the user ID. As a result of the determination, if there is a user ID (authentication success), control is performed to notify the connection request source mobile terminal 11 via the network 10 that the authentication has been successful. When the mobile terminal remote operation program 512 receives an address assignment prohibition request from the mobile terminal 11 via the network 10 after notification of successful authentication, the remote control program 512 for the mobile terminal refers to the user related information table 513 and corresponds to the local user ID. The status of the IP address of the machine 6 is changed to the assignment prohibition state, and the processing result is transmitted to the requesting mobile terminal 11 via the network 10.

  In the user related information table 513, as shown in FIG. 6, information indicating the user ID 520, the IP address 521 of the local machine 6 assigned to the user, and the assignment status (status) 522 of the IP address are associated with each other. Has been remembered.

  FIG. 7 is a diagram showing the configuration of the local machine 6. The local machine 6 includes a CPU 601, a RAM 602 that functions as a work area for the CPU 601, a NIC 603 for connecting to the LAN 8, an HDD 604, a video card 605 that generates desktop video information, a flash ROM 606, a keyboard and a mouse. It has a bridge 608 that relays the I / O connector 607 for connection, BUS that connects these units 601 to 607, and a power source 609.

  The flash ROM 606 stores a BIOS 613. After the power source 609 is turned on, the CPU 601 first accesses the flash ROM 606 and executes the BIOS 613 to recognize the system configuration of the local machine 6.

  The HDD 604 stores at least an OS 610, a remote control agent program 611, and a plurality of application programs 612. The OS 610 is a program for the CPU 601 to execute the remote control agent program 611 and the application program 612 by comprehensively controlling the units 602 to 609 of the local machine 6.

  In accordance with the BIOS 613, the CPU 601 loads the OS 610 from the HDD 604 to the RAM 602 and executes it. As a result, the CPU 601 comprehensively controls the units 602 to 609 of the local machine 6.

  The remote control agent program 611 is a program for enabling the local machine 6 to be remotely operated from the remote machine 2. The CPU 601 loads the remote control agent program 611 from the HDD 604 to the RAM 602 and executes it in accordance with the OS 610. As a result, the CPU 601 receives and processes the input information sent from the remote machine 2 and controls to transmit the processing result to the remote machine 2 via the network 10.

  The application program 612 includes programs such as general-purpose web browsers, word processors, and spreadsheets. When the CPU 601 receives an application activation request from the remote machine 2 via the network 10 according to the OS 610, the CPU 601 loads the requested application program 612 from the HDD 604 to the RAM 602 and executes it, and remotely executes the execution result via the network 10. Control to transmit to the machine 2 is performed.

  FIG. 8 is a diagram illustrating a configuration of the mobile terminal 11. The portable terminal 11 includes a CPU 1101, a voice unit 1102, a transmission / reception unit 1103, a memory card interface 1104, a flash ROM 1105, a display unit 1106, a keypad 1107, and a power source 1108.

  The flash ROM 1105 stores a BIOS 1110. After the power supply 1108 is turned on, the CPU 1101 first accesses the flash ROM 1105 and executes the BIOS 110 to recognize the system configuration of the mobile terminal 11.

  The flash ROM 1105 includes at least an OS 1111, an authentication program 1112, a VPN client program 1113, a remote connection program 1114, a management server remote operation program 1115, authentication information 1116, connection information 1117, and a user ID 118. It is remembered.

  The OS 1111 is a program for the CPU 1101 to control the units 1102 to 1108 of the portable terminal 11 to execute the authentication program 1112, the VPN client program 1113, the remote connection program 1114, and the management server remote operation program 1115.

  The authentication program 1112 is a program for performing PKI authentication using authentication information 1116 of the mobile terminal 11 and authentication information 413 from the VPN server 4.

  The VPN client program 1113 is a program for performing VPN encrypted communication with the VPN server 4.

  The remote connection program 1114 is a program for connecting to the VPN server 4 and the management server 2. When the remote connection program 1114 is started, a connection information setting screen for inputting information necessary for connecting to the VPN server 4 and the management server 2 is displayed on the display unit 1106.

  FIG. 9 is a diagram illustrating an example of a connection information setting screen. This connection information setting screen includes a connection information setting field 1120 and a connection start instruction field 1121 for instructing start of connection to the VPN server 4 and the management server 5. The connection information setting field 1120 further includes an IP address setting field 1122 of the VPN server 4, and an IP address of the management server 5 and a user ID setting field 1123 required when accessing the management server 5. The input IP address of the VPN server 4 and the IP address of the management server 5 and the user ID are stored in the flash ROM 1105 (connection information 1117, user ID 1118). When an operation for instructing the start of connection is performed by the user, the remote connection program 1114 performs control to sequentially connect to the VPN server 4 and the management server 5 based on the authentication information 1116, connection information 1117, and user ID 1118.

  The management server remote operation program 1115 is executed after the remote connection program 1114 is executed, and is a program for controlling transmission of an address assignment prohibition request of the local machine 6 to the management server 5. When the management server remote operation program 1115 is activated, a management server remote operation screen for instructing prohibition of address assignment of the local machine 6 is displayed on the display unit 1106.

  FIG. 10 is a diagram illustrating an example of the management server remote operation screen. The management server remote operation screen includes an assignment prohibition instruction field 1131 for instructing prohibition of address assignment of the local machine 6, a field 1132 for displaying a response to the address assignment prohibition request of the local machine 6 from the management server 2, and this screen And an end instruction field 1133 for ending the operation. When an operation for instructing the address allocation prohibition of the local machine 6 is performed by the user, the management server remote operation program 115 performs a control to transmit an address allocation prohibition request of the local machine 6 to the management server 5 via the network 10.

  FIG. 11 is a diagram showing a processing procedure for connecting to the local machine 6 using the authentication device 1 and the remote machine 2 in the thin client system of this embodiment. This process is originally executed by the CPU according to the program. However, here, in order to simplify the description, the CPU is simply described as the execution subject.

  When the authentication device 1 is connected to the remote machine 2, the CPU 201 of the remote machine 2 displays a PIN code input form on the display connected to the video card 205. The CPU 201 receives the PIN code input by the user, transmits it to the authentication device 1, and requests user authentication (step S101, step 102).

  The processor 113 of the authentication device 1 performs user authentication using the PIN code received from the remote machine 2 and the PIN code 115 stored in the IC chip 111 (step 103). If the user authentication is successful, the processor 113 stores the user ID 116 stored in the IC chip 111, connection information 117 such as an IP address for connecting to the VPN server 4 and the management server 5, and an electronic certificate necessary for PKI authentication. Authentication information 118 such as a certificate is transmitted to the remote machine 2 (step 104).

  Thereafter, PKI authentication is performed between the remote machine 2 and the VPN server 4 based on the connection information 117 and the authentication information 1119 for connecting to the VPN server 4 received from the authentication device 1, and the VPN is established ( Step 105).

  Next, the CPU 201 of the remote machine 2 transmits an address assignment request for the local machine 6 together with the user ID 116 to the management server 5 via the network 10 (step 106).

  When the CPU 501 of the management server 5 receives the address assignment request of the local machine 6 together with the user ID via the network 10, the CPU 501 determines whether or not the user ID exists with reference to the user related information table 513. As a result of the determination, if the user ID is present (authentication success, step 107), the CPU 501 reads the IP address of the local machine 6 associated with the user ID from the user related information table 513, and based on this IP address. A power activation request is transmitted to the local machine 6 via the network 10 (step 108). Then, the CPU 501 monitors the activation of the local machine 6 and when detecting that the local machine 6 has been activated (step 109), the CPU 501 assigns the IP address of the local machine 6 to the remote machine 2 that is the address allocation request source. Notification is made via the network 10 (step 110). As a result of the determination, if there is no user ID (authentication failure), the CPU 501 notifies the address allocation request source remote machine 2 via the network 10 that the authentication has failed.

  The CPU 201 of the remote machine 2 transmits the IP address from the management server 5 to the authentication device 1 (step 111).

  The processor 113 of the authentication device 1 registers the IP address received from the remote machine 2 in the IC chip 111.

  Thereafter, a communication path is established between the remote machine 2 and the local machine 6 (step 113), and the CPU 201 of the local machine 2 transmits keyboard and mouse input information to the local machine 6 via the network 10, and the local machine 2 The CPU 601 of the machine 6 transmits video information indicating the processing result of the input information to the local machine 2 via the network 10 (Step 114, Step 115, Step 116).

  In step 103, the user authentication is performed using the PIN code. However, any information necessary for the user authentication may be used. For example, the user authentication may be performed using the user ID and the PIN code. Similarly, in step 107, user authentication is performed using the user ID, but any information necessary for user authentication may be used. For example, the user authentication is performed using the PIN code or the user ID and the PIN code. Anyway.

  FIG. 12 is a diagram showing a processing procedure for connecting to the local machine 6 using the mobile terminal 11 in the thin client system of this embodiment. This process is originally executed by the CPU according to the program. However, here, in order to simplify the description, the CPU is simply described as the execution subject.

  When the IP address of the VPN server 4, the IP address of the management server 5, and the user ID that is the authentication information for the management server 5 are input (FIG. 9) (step 201), the CPU 1101 of the mobile terminal 11 stores the input information. Stored in the flash ROM 1105 (connection information 1117, user ID 1118). Thereafter, PKI authentication is performed between the mobile terminal 11 and the VPN server 4 based on authentication information 1116 such as an electronic certificate necessary for PKI authentication and connection information 1117 such as an IP address of the VPN server 4, and VPN Is established (step 202).

  Next, the CPU 1101 of the portable terminal 11 transmits a connection request together with the user ID to the management server 5 via the network 10 (step 203).

  When the CPU 501 of the management server 5 receives the connection request together with the user ID via the network 10, the CPU 501 determines whether or not the user ID exists with reference to the user related information table 513. As a result of the determination, if the user ID exists (authentication success) (step 204), the CPU 501 notifies the authentication result to the mobile terminal 11 via the network 10 (step 205).

  When the CPU 1101 of the portable terminal 11 receives the authentication result via the network 10, it displays the management server remote operation screen shown in FIG. 10 on the display unit 1106. The received authentication result is displayed in the processing result display field 1132. Next, when an instruction to prohibit the address assignment of the local machine 6 is given by the user, the CPU 1101 receives an address assignment prohibition request signal for the local machine 6 (step 206), and sends it to the management server 5 via the network 10 together with the user ID. (Step 207).

  When the CPU 501 of the management server 5 receives the address assignment prohibition request of the local machine 6 together with the user ID from the mobile terminal 11 via the network 10, the CPU 501 refers to the user related information table 513 and corresponds to the user ID 520 (FIG. 6). The status (522) of the IP address (521) of the local machine 6 is changed to the allocation prohibited state (step 208), and the processing result is notified to the requesting mobile terminal 11 via the network 10 (step 209). .

  The CPU 1101 of the portable terminal 11 displays the received information in the processing result display field 1132 of the management server remote operation screen.

  With the above operation, since the status of the IP address of the local machine 6 associated with the user ID in the user related information table 513 is in the allocation prohibited state, the connection from the remote machine 2 to the local machine 6 can be prohibited. . Therefore, security can be further strengthened.

  In step 204, the user authentication is performed using the user ID. However, any information necessary for the user authentication may be used. For example, the user authentication is performed using the PIN code or the user ID and the PIN code. May be.

  FIG. 13 is a flowchart showing processing in the management server 5. This process is originally executed by the CPU 501 in accordance with a program. However, here, in order to simplify the description, the CPU is simply described as the execution subject.

  When receiving the request signal (step 301), the CPU 501 determines whether the received request signal is a connection request from the portable terminal 11 or an address allocation request for the local machine 6 from the remote machine 2 (step 302). As a result of the determination, in the case of a connection request from the portable terminal 11, the CPU 501 refers to the user related information table 513 to determine whether there is a user ID included in the connection request (step 303). As a result of the determination, if the user ID is present, the CPU 501 notifies the portable terminal 11 of the authentication result (authentication success) via the network 10 (step 304).

  Next, when the CPU 501 receives the address assignment prohibition request for the local machine 6 together with the user ID from the portable terminal 11 via the network 10 (step 305), the user ID 520 (FIG. 6) is referred to the user related information table 513. The status (522) of the IP address (521) of the local machine 6 associated with is changed to the assignment prohibited state (step 306), and the processing result is notified to the portable terminal 11 via the network 10 (step 307).

  If there is no user ID as a result of the determination in step 303, the CPU 501 notifies the authentication result (authentication failure) to the mobile terminal 11 via the network 10 (step 308).

  If the result of determination in step 302 is an address allocation request for the local machine 6 from the remote machine 2, the CPU 501 refers to the user related information table 513 to determine whether there is a user ID included in this address allocation request. (Step 309). As a result of the determination, if the user ID is present, the CPU 501 reads the IP address of the local machine 6 associated with the user ID from the user related information table 513, and issues a power activation request based on the IP address. The data is transmitted to the machine 6 via the network 10 (step 310). Then, the CPU 501 monitors the activation of the local machine 6 and when detecting that the local machine 6 has been activated (step 311), the CPU 501 assigns the IP address of the local machine 6 to the remote machine 2 that is the address allocation request source. Notification is made via the network 10 (step 312).

  If the result of determination in step 309 is that there is no user ID (authentication failure), the CPU 501 notifies the remote machine 2 of the address assignment request source via the network 10 that authentication has failed (step 313). .

As described above, since the status of the IP address of the local machine 6 associated with the user ID in the user related information table 513 is in the allocation prohibited state, the connection from the remote machine 2 to the local machine 6 is established. Can be prohibited. Therefore, security can be further strengthened.
(Example 2)
In the first embodiment, in FIG. 11, every time the authentication device 1 is connected to the remote machine 2, the remote machine 2 always makes an address allocation request for the local machine 6 to the management server 5 via the network 10. Was described as an example. However, in FIG. 11, once the IP address of the local machine 6 is registered in the authentication device 1, when the authentication device 1 is connected to the remote machine 2, the local machine 6 to which the remote machine 2 is connected is powered on. If it is in the state, it is assumed that the remote machine 2 can connect to the local machine 6 without going through the management server 5 based on the IP address registered in the authentication device 1. In the second embodiment, this case will be described with reference to FIGS. 15 and 16.

  FIG. 15 is a diagram illustrating an example of a management server remote operation screen according to the second embodiment. The management server remote operation screen includes an assignment prohibition instruction field 1131 for instructing prohibition of address assignment of the local machine 6 shown in FIG. 10, and a field 1132 for displaying a response to the address assignment prohibition request of the local machine 6 from the management server 2. In addition to the end instruction field 1133 for ending the operation of the screen, a power-off instruction field 1134 for instructing the power-off (OFF) of the local machine 6 is provided.

  FIG. 16 is a diagram illustrating a processing procedure for connecting to the local machine 6 using the mobile terminal 11 in the thin client system of the second embodiment. This process is originally executed by the CPU according to the program. However, here, in order to simplify the description, the CPU is simply described as the execution subject. The same processing parts as those in the first embodiment are denoted by the same reference numerals as those in the first embodiment.

  When the IP address of the VPN server 4, the IP address of the management server 5, and the user ID that is the authentication information for the management server 5 are input (step 201, the CPU 1101 of the portable terminal 11 stores the input information in the flash ROM 1105. (Connection information 1117, user ID 1118) Thereafter, based on the authentication information 1116 such as an electronic certificate necessary for PKI authentication and the connection information 1117 such as the IP address of the VPN server 4, the portable terminal 11 and the VPN server 4, PKI authentication is performed and VPN is established (step 202).

  Next, the CPU 1101 of the portable terminal 11 transmits a connection request together with the user ID to the management server 5 via the network 10 (step 203).

  When the CPU 501 of the management server 5 receives the connection request together with the user ID via the network 10, the CPU 501 determines whether or not the user ID exists with reference to the user related information table 513. As a result of the determination, if the user ID is present (authentication success) (step 204), the CPU 501 notifies the authentication result to the portable terminal 11 via the network 10 (step 205).

  When the CPU 1101 of the portable terminal 11 receives the authentication result via the network 10, it displays the management server remote operation screen shown in FIG. 10 on the display unit 1106. The received authentication result is displayed in the processing result display field 1132. Next, when the user instructs to power off the local machine 6, the CPU 1101 receives a power off request for the local machine 6 (step 401), and transmits this request to the management server 5 via the network 10 together with the user ID. (Step 402).

  The CPU 501 of the management server 5 reads the IP address (521) of the local machine 6 associated with the user ID (FIG. 6-520) with reference to the user related information relation table 513, and based on this IP address, the local machine 6 sends a power-off request via the network 10 (step 403). The CPU 501 monitors the power-off of the local machine 6 and, when detecting that the power of the local machine 6 is cut off (step 404), notifies the portable terminal 11 of the result via the network 10 (step 405).

  The CPU 1101 of the portable terminal 11 displays the received information in the processing result display field 1132 of the management server remote operation screen.

  Next, when the user is instructed to prohibit address allocation of the local machine 6 (1131), the CPU 1101 receives an address allocation prohibition request signal of the local machine 6 (step 206), and sends it through the network 10 together with the user ID. It transmits to the management server 5 (step 207).

  When the CPU 501 of the management server 5 receives the address assignment prohibition request of the local machine 6 together with the user ID from the mobile terminal 11 via the network 10, the CPU 501 refers to the user related information table 513 and corresponds to the user ID 520 (FIG. 6). The status (522) of the IP address (521) of the local machine 6 is changed to the allocation prohibited state (step 208), and the processing result is notified to the requesting mobile terminal 11 via the network 10 (step 209). .

  The CPU 1101 of the portable terminal 11 displays the received processing result in the processing result display field 1132 of the management server remote operation screen.

  With the above operation, the portable terminal 11 transmits a power-off request for the local machine 6 to the management server 5 to cut off the power of the local machine 6, and after the power is turned off, the portable machine 11 sends the local machine 6 to the management server 5. Since the address assignment prohibition request 6 is transmitted and the address assignment of the local machine 6 can be controlled to be prohibited, the connection from the lost or stolen mote machine 2 to the local machine 6 can be prohibited. Therefore, security can be further strengthened.

1 is a diagram illustrating an overall configuration of a thin client system to which a first embodiment of the present invention is applied. 2 is a diagram illustrating a configuration of an authentication device 1. FIG. 2 is a diagram illustrating a configuration of a remote machine 2. FIG. 2 is a diagram showing a configuration of a VPN server 4. FIG. 2 is a diagram illustrating a configuration of a management server 5. FIG. It is a figure which shows the structure of the user related information table 513. FIG. 2 is a diagram showing a configuration of a local machine 6. FIG. 2 is a diagram illustrating a configuration of a mobile terminal 11. FIG. It is a figure which shows the example of a connection information setting screen. It is a figure which shows the example of a management server remote operation screen. It is a figure which shows the process sequence which connects to the local machine 6 using the authentication device 1 and the remote machine 2 in the thin client system of 1st embodiment. In the thin client system of 1st embodiment, it is a figure which shows the process sequence connected to the local machine 6 using the portable terminal 11. FIG. 5 is a flowchart showing processing in the management server 5. Similarly, it is a flowchart showing processing in the management server 5. It is a figure which shows the example of the management server remote operation screen of 2nd embodiment. It is a figure which shows the process sequence which connects to the local machine 6 using the portable terminal 11 in the thin client system of 2nd embodiment.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 ... Authentication device, 2 ... Remote machine, 3 ... LAN, 4 ... VPN server, 5 ... Management server, 6 ... Local machine, 7 ... LAN. 8 ... LAN, 9 ... firewall, 10 ... WAN, 11 ... mobile terminal, 12 ... mobile terminal company.

Claims (4)

A communication control method in a thin client system having a plurality of information processing devices that can be connected to each other via a network, a management server that manages the information processing devices, and a plurality of thin client terminals,
A mobile terminal that can be connected to the management server via the network,
A connection request is sent to the management server together with information necessary for user authentication via the network,
Receiving a user authentication result from the management server via the network;
After receiving the user authentication result, send an address assignment prohibition request of the information processing apparatus to the management server via the network,
Receiving a response to the information processing apparatus address assignment prohibition request from the management server via the network;
The management server is
Receiving information necessary for the user authentication from the mobile terminal via the network;
Perform user authentication based on the received information necessary for user authentication and information necessary for user authentication stored in the storage unit of the management server,
As a result of the user authentication, when the user authentication is established, the authentication result is notified to the portable terminal via the network,
Receiving an address prohibition request for the information processing apparatus from the mobile terminal via the network;
Change the address assignment state of the information processing apparatus associated with the information necessary for the user authentication included in the received address assignment prohibition request of the information processing apparatus with reference to the storage unit to the assignment prohibition, and to that effect To the portable terminal via the network. A communication control method in a thin client system having a plurality of information processing devices that can be connected to each other via a network, a management server that manages the information processing devices, and a plurality of thin client terminals,
A mobile terminal that can be connected to the management server via the network,
A mobile terminal that can be connected to the management server via the network,
A connection request is sent to the management server together with information necessary for user authentication via the network,
Receiving a user authentication result from the management server via the network;
After receiving the user authentication result, a request to turn off the information processing apparatus is transmitted to the management server via the network.
Receiving a response to the information processing apparatus power-off request from the management server via the network;
After receiving the response, send an address allocation prohibition request of the information processing apparatus to the management server via the network,
Receiving a response to the information processing apparatus address assignment prohibition request from the management server via the network;
The management server is
Receiving information necessary for the user authentication from the mobile terminal via the network;
Perform user authentication based on the information necessary for the received user authentication and the information necessary for the user authentication stored in the storage unit of the management server,
As a result of the user authentication, when the user authentication is established, the authentication result is notified to the portable terminal via the network,
Receiving a power-off request of the information processing apparatus from the mobile terminal via the network;
Sending a power-off request to the information processing apparatus via the network;
Upon detecting that the information processing apparatus is powered off, the mobile terminal transmits information that the information processing apparatus is powered off via the network,
Receiving an address prohibition request for the information processing apparatus from the mobile terminal via the network;
Change the address assignment state of the information processing apparatus associated with the information necessary for the user authentication included in the received address assignment prohibition request of the information processing apparatus with reference to the storage unit to the assignment prohibition, and to that effect To the mobile terminal via the network,
The information processing apparatus includes:
Receiving the power-off request from the management server via the network;
A communication control method, wherein the information processing apparatus is turned off in response to the power-off request. A thin client system having a plurality of information processing devices that can be connected to each other via a network, a management server that manages the information processing devices, and a plurality of thin client terminals,
A portable terminal that can be connected to the management server via the network;
The portable terminal is
Means for transmitting a connection request together with information necessary for user authentication to the management server via the network, means for receiving a user authentication result from the management server via the network, and after receiving the user authentication result, the information Means for transmitting a processing device address assignment prohibition request to the management server via the network, and means for receiving a response to the information processing device address assignment prohibition request from the management server via the network. Having a control unit,
The management server
A storage unit that stores information necessary for the user authentication, an address of the information processing apparatus, and information indicating an allocation state of the information processing apparatus in association with each other;
A means for receiving information necessary for user authentication from a portable terminal via the network, a user based on the received information necessary for user authentication and information necessary for the user authentication stored in the storage unit A means for performing authentication, a means for notifying the mobile terminal of the authentication result when the user authentication is established as a result of the user authentication, a request for prohibiting assignment of an address of the information processing apparatus from the mobile terminal, Means for receiving via a network, and an address assignment state of the information processing device associated with the information required for the user authentication included in the address assignment prohibition request of the information processing device received with reference to the storage unit And a control unit having means for notifying the mobile terminal via the network to that effect. A featured thin client system. A thin client system having a plurality of information processing devices that can be connected to each other via a network, a management server that manages the information processing devices, and a plurality of thin client terminals,
A portable terminal that can be connected to the management server via the network;
The portable terminal is
Means for transmitting a connection request together with information necessary for user authentication to the management server via the network, means for receiving a user authentication result from the management server via the network, and after receiving the user authentication result, the information Means for transmitting a power-off request for the processing device to the management server via the network, means for receiving a response to the power-off request for the information processing device from the management server via the network, and after receiving the response, Means for transmitting an address assignment prohibition request for the information processing apparatus to the management server via the network, and means for receiving a response to the address assignment prohibition request for the information processing apparatus from the management server via the network A control unit having
The management server
A storage unit that stores information necessary for the user authentication, an address of the information processing apparatus, and information indicating an allocation state of the information processing apparatus in association with each other;
Based on means for receiving information necessary for the user authentication from the portable terminal via the network, information necessary for the received user authentication and information necessary for the user authentication stored in the storage unit Means for performing user authentication, means for notifying the mobile terminal of the authentication result when the user authentication is established as a result of the user authentication, and sending a power-off request of the information processing apparatus from the mobile terminal to the network Means for receiving via the network, means for transmitting a power-off request to the information processing device via the network, and detecting that the power source of the information processing device has been cut off, Means for transmitting a disconnection notice via the network, and sending an address assignment prohibition request for the information processing device from the portable terminal to the network. Means for receiving via a work, and address assignment state of information processing apparatus associated with information required for user authentication included in said received address assignment prohibition request of information processing apparatus with reference to said storage unit And a control unit having means for notifying the mobile terminal via the network to that effect,
The information processing apparatus includes:
A thin client system comprising: a control unit having means for receiving the power-off request from the management server via the network; and means for cutting off the power of the information processing apparatus in response to the power-off request .

Images