JP2010278778A - Remote access system, method, and remote access authentication device - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a remote access system capable of remotely supplying electric power only to a computer allowed to a user, who remotely accesses an intranet, from the outside of the intranet. <P>SOLUTION: This remote access authentication device 10 of the remote access system 1 generates, upon receiving a log-in request from a terminal device 11, a magic packet including a MAC address of a computer 12 in a LAN 14 to which a user is allowed to remotely access, and broadcasts the magic packet to all computers 12 installed in the LAN if user authentication is successful after performing user authentication of the user who makes a log-in request. If receiving the magic packet, the computer 12 executes an operation for feeding the power when the magic packet is transmitted to its own device. <P>COPYRIGHT: (C)2011,JPO&INPIT

Description

  The present invention relates to the technical field of remote access for remotely operating a computer or a server, and more particularly to a technology for automatically turning on the power of a computer or server that is a remote access destination.

  With the low cost of computer devices and the development of network technologies such as the Internet, remote access to remotely operate computers and servers installed in private homes and businesses has become easy to implement.

  Remote access is highly demanded by both companies and individuals. In order to realize telework, companies can remotely access computers installed at their company's seats without being restricted by time or place. In addition, an individual is required to be able to remotely access a personal computer (hereinafter referred to as a PC) at home from the outside by using a netbook.

  Remote access is a well-established technology that can be easily implemented by installing a device such as a VPN device on a corporate intranet, but there are many improvements. One example is the power supply of the computer that is the remote access destination. One of the improvements in remote access is that it must always be on.

  For example, in a large company, each employee is assigned a PC, but when remote access is implemented to realize telework, all employees are not present in the office. It is desirable to be able to turn on the computer of the remote access destination when performing remote access because the power of the PC must be turned on at all times, power consumption is wasted, and there are security problems. .

  As a method for remotely turning on a computer via an intranet (Local Area Network), a method called WOL (Wake On Intranet) is already known. In WOL, a network adapter of a PC installed in an intranet is By transmitting a magic packet including the MAC address of the PC, the PC network adapter is powered on.

  However, the above-mentioned WOL does not correspond to remotely turning on the power of the PC in the intranet from outside the intranet. In Patent Document 1, using the WOL technology, the inside of the intranet can be accessed from outside the intranet. An invention for remotely turning on a PC is disclosed.

Japanese Patent No.3885792

  Certainly, if the invention disclosed in Patent Document 1 is used, the power of the PC in the intranet can be remotely turned on from the outside of the intranet, but the magic packet is transmitted from the terminal to the WOL device. Because it is required, the destination of the magic packet is determined by the user's operation, and it is possible to remotely turn on a PC that the user is not permitted to use regardless of whether it is intentional or not. There was a problem.

  In addition, the terminal device owned by the user needs to have a function of requesting the WOL device to send a magic packet. Further, when the magic packet destination receives the magic packet addressed to itself, it sends the magic packet. There was a problem that the operation of turning on the power was executed regardless of the original.

  Therefore, according to the present invention, when remotely accessing a computer in an intranet, the remote source computer does not need a function for requesting transmission of a WOL magic packet, and is further permitted to a user who remotely accesses the intranet. It is an object of the present invention to provide a remote access system and method that can be turned on remotely from outside the intranet, and a remote access authentication device necessary for the remote access system.

  1st invention which solves the subject mentioned above is a remote access system comprised at least from the some computer installed in an intranet, and the remote access authentication apparatus installed between the said internet and the said intranet, When the computer receives a message to remotely turn on the power, the computer has means for executing an operation to turn on the power when the message is addressed to the own device, and the remote access authentication device is connected to the intranet via the Internet. The user's identification data and authentication data are obtained from the terminal device remotely accessing the user, and the user authentication means for executing the user authentication and the user are permitted to access the user in association with the user identification information for each user. Little data specific to the computer If the user authentication is successful, the message including the unique data associated with the identification data of the user authenticated by the user is generated, and the message is transmitted to the computer in the intranet. A remote access system comprising power-on means for performing

  Further, the second invention is a remote access method for remotely accessing a computer installed in an intranet from the Internet, wherein a remote access authentication device installed between the Internet and the intranet is connected via the Internet. Step a for acquiring user identification data and authentication data from a terminal device remotely accessing the intranet and performing user authentication; and if user authentication is successful in step a, the remote access authentication device identifies the user for each user. Refer to the access table in which at least the unique data of the computer authorized for the user in association with the information is described, include the unique data associated with the identification data of the user authenticated by the user, and turn on the power remotely For Generating a message and transmitting the message to the computer in the intranet; and executing the operation of turning on the power when the computer specified by the message receives the message; , Are executed, a remote access method.

  Further, the third invention is a remote access authentication device installed between the Internet and an intranet, wherein user identification data and authentication data are acquired from a terminal device that remotely accesses the intranet via the Internet, and User authentication means for performing authentication, and for each user, refer to an access table in which at least the unique data of the computer that is permitted remote access for the user is described in association with the user identification information. If successful, the message generation unit includes power-on means for generating the message including unique data associated with identification data of a user who has been authenticated and transmitting the message to the computer in the intranet. Remote access authentication device .

  According to the above-described invention, the user who remotely accesses the intranet does not need to perform an operation of transmitting a power-on message (for example, magic packet) remotely, and the user who has succeeded in user authentication by the remote access authentication device. Since the message including the unique data of the computer authorized by the user is generated and transmitted to the computer in the intranet, the terminal device possessed by the user need not have a function of requesting transmission of the message.

  Further, since the computer that is the target of the message for turning on the power remotely is managed by the access table, the message is not transmitted to a computer other than the computer authorized by the user.

  In addition, user authentication is performed before the remote power-on message is sent to the computer to be turned on, so when the computer was turned on, the message was sent. The user will be indirectly guaranteed.

The figure explaining a remote access system. The flowchart for demonstrating the operation | movement procedure of RA authentication apparatus. The figure explaining an example of the login screen which a VPN apparatus transmits. The figure explaining an example of the record of an access table. The figure explaining an example of the user screen displayed on a terminal device.

  Now, embodiments of the present invention will be described in detail with reference to the drawings. FIG. 1 is a diagram illustrating a remote access system 1 according to the present embodiment.

  The remote access system 1 illustrated in FIG. 1 is a system to which SSL-VPN technology is applied, and is remotely connected to a computer 12 provided in the corporate LAN 14 from outside the LAN 14 that is an intranet managed by the company. A system built for access.

  The main device constituting the remote access system 1 shown in FIG. 1 is possessed by a user working in a company, and for example, a terminal device 11 such as a netbook (NetBook) and a plurality of devices installed in a LAN 14 of the company. As a message for remotely turning on the computer 12 which is installed between the computer 12 and the Internet 13 and the LAN 14, authenticates the user who remotely accesses, and is permitted to remotely access the user. A remote access authentication device 10 that transmits a magic packet of (Wake On LAN) (hereinafter referred to as “RA authentication device”; RA is an abbreviation of Remote Access), and a computer 12 in a corporate LAN 14 is connected to a router 14a. In this embodiment, the RA authentication device 10 includes the VPN device 100 and the VPN device 100. And the authentication device 110 connected to the.

  The terminal device 11 includes a browser compatible with SSL as software used for remote access, and a VPN for allowing the user to use an application other than a Web application for remote access. Software (here, RDAC: Remoto Desktop Active X Control) is installed as a browser plug-in.

  The authentication device 110 constituting the RA authentication device 10 uses the user identification data (here, user ID) and authentication data to authenticate the user who logs in to the VPN device 100, and when the user authentication is successful. The VPN device 100 has a function of transmitting to the VPN device 100 unique data (IP address or MAC address) of the computer 12 permitted by the user who has succeeded in user authentication. The VPN device 100 performs SSL communication between the terminal device 11 and the VPN device 100. In addition to general functions such as a function of encrypting with (Secure Sockets Layer), a function of mapping the IP address of the computer 12 requested for remote access from the terminal device 11 to an address on the Internet 13, a computer permitted by the user Create a WOL magic packet containing 12 Mac addresses And broadcasts to the computer 12 in the LAN 14, the ability to put is provided at the remote off the computer 12 that is permitted to the user.

  If the number of computers 12 permitted to a user is one, the VPN device 100 constituting the RA authentication apparatus 10 is a computer for the computer 12 that is uniquely determined by the user when the user logs in to the VPN device 100. Generate and send magic packets.

  Further, if there are a plurality of computers 12 permitted by the user, the VPN device 100 constituting the RA authentication apparatus 10 causes the user to select the computer 12 after logging in to the VPN device 100, and the computer 12 selected by the user. Generate and send a magic packet.

  Software for operating a general-purpose PC by remote access, such as a remote desktop of Windows (registered trademark), is installed in the computer 12. The network adapter of the computer 12 corresponds to WOL and has the network adapter. When a magic packet including the same MAC address as the MAC address is received, the network adapter performs an operation of turning on the computer 12.

  From here, the above-mentioned content is demonstrated in detail, explaining the operation | movement procedure of RA authentication apparatus 10. FIG. FIG. 2 is a flowchart for explaining the operation procedure of the RA authentication apparatus 10.

  The URL of the VPN device 100 constituting the RA authentication device 10 is known in advance by the user from the company side or stored in the browser of the terminal device 11, and the user uses the browser to set the URL of the VPN device 100. Access and make a login request to the VPN device 100 (S1).

  The VPN device 100 constituting the RA authentication device 10 supports access by the HTTPS protocol. When the VPN device 100 of the RA authentication device 10 is accessed from the browser of the terminal device 11, the browser of the terminal device 11 and the RA authentication device 10 The SSL procedure is executed between the VPN devices 100 (S2), and the communication between the browser of the terminal device 11 and the VPN device 100 of the RA authentication device 10 is encrypted.

  When the communication between the browser of the terminal device 11 and the RA authentication device 10 is encrypted by SSL, the VPN device 100 of the RA authentication device 10 includes a form for inputting the user ID and authentication data of the user who remotely accesses the RA device. A login screen for the user to log in to the VPN device 100 of the authentication device 10 is transmitted to the terminal device 11 (S3).

  FIG. 3 is a diagram for explaining an example of a login screen transmitted by the VPN device 100 of the RA authentication apparatus 10. In this embodiment, since only user authentication is performed, the login screen 2 transmitted by the VPN device 100 of the RA authentication device 10 includes a form 20 for inputting the user ID and authentication data of the user who logs in to the VPN device 100, 21, a login button 22 that is clicked when transmitting a user ID and authentication data to the VPN device 100 of the RA authentication device 10, a cancel button 23 when canceling the login of the RA authentication device 10 to the VPN device 100, and the like. Is included.

  The contents of the login screen transmitted from the VPN device 100 of the RA authentication device 10 to the terminal device 11 differ depending on the method used for user authentication and the like. When using OTP (One-Time Password) or a simple password for user authentication, FIG. As shown in FIG. 5, the login screen includes forms 20 and 21 for inputting an OTP and a password.

  In addition, biometric authentication can also be used for user authentication. At this time, a device (for example, a fingerprint reader) that reads user biometric data is connected to the terminal device 11, and the VPN device 100 of the RA authentication device 10 is connected to the terminal device 11. The login screen transmitted to the terminal device 11 includes a button for starting the device and reading the user's biometric data.

  Furthermore, when there are a plurality of LANs 14 in the company, the login screen transmitted by the VPN device 100 of the RA authentication apparatus 10 may include a form that allows the user to select the network name of the LAN 14 that the user accesses. .

  Returning to the description of FIG. The user ID and authentication data input by the user on the login screen transmitted from the VPN device 100 of the RA authentication device 10 to the terminal device 11 are obtained by, for example, clicking the login button 22 on the login screen 2 shown in FIG. , The data is transmitted from the terminal device 11 to the VPN device 100 of the RA authentication device 10 (S4).

  When the user ID and authentication data are transmitted, the VPN device 100 of the RA authentication device 10 transmits these data to the authentication device 110 of the RA authentication device 10 and makes a login request to the VPN device 100 of the RA authentication device 10. The user authentication of the user is delegated to the authentication device 110 of the RA authentication device 10, and the authentication device 110 of the RA authentication device 10 authenticates the user who made a login request to the VPN device 100 of the RA authentication device 10 (S5).

  Although all the functions required for the RA authentication device 10 such as a user authentication function can be provided in the VPN device 100 and the RA authentication device 10 can be configured only by the VPN device 100, it is more sophisticated such as the platform integrity of the terminal device 11. It is preferable to provide an authentication device 110 separately from the VPN device 100 so that the authentication can be performed.

  When the user authentication is delegated from the VPN device 100 of the RA authentication device 10, the authentication device 110 of the RA authentication device 10 refers to an access table in which reference data used for user authentication is stored, and the RA authentication device 10 The user ID and authentication data delivered from the VPN device 100 are authenticated.

  FIG. 4 is a diagram illustrating an example of an access table record stored in the authentication device 110 of the RA authentication device 10. In the record 3 of the access table shown in FIG. 4, reference data to be collated with the user authentication data in association with the user ID permitted to remotely access the LAN 14, and the computer 12 permitted to be remotely accessed by the user. In this embodiment, the unique data of the computer 12 includes the computer name, the IP address in the LAN 14, the MAC address of the network adapter, and the service name (here, remote desktop).

  Note that FIG. 4 shows unique data of one computer 12, and when the use of a plurality of computers 12 is permitted for one user, the computer 12 is associated with one user ID. Unique data is described for each.

  From here, it returns to description of FIG. When authenticating the user ID and authentication data delivered from the VPN device 100 of the RA authentication device 10, the authentication device 110 of the RA authentication device 10 refers to the access table and specifies the record in which the user ID is stored. The user authentication is performed by comparing the reference data of the record with the authentication data. When the user authentication is successful, in addition to the flag indicating the success result of the user authentication, all the unique data described in the record is at least The user authentication result including the response is returned to the VPN device 100 of the RA authentication device 10.

  The VPN device 100 of the RA authentication device 10 receives the user authentication result from the authentication device 110 of the RA authentication device 10, and if the user authentication result indicates successful user authentication, the computer included in the user authentication result Using the 12 unique data, a user screen including a list of the computers 12 permitted by the user is generated, and the user screen is transmitted to the terminal device 11 (S6).

  FIG. 5 is a diagram illustrating an example of a user screen displayed on the terminal device 11. The user screen 4 illustrated in FIG. 5 displays the user ID 40 of the user who has logged in to the VPN device 100 of the RA authentication apparatus 10 and, further, from the list of computers 12 permitted to the user (two in this case). A form 41 for selecting one computer 12, an access button 42 that is clicked when remotely accessing the selected computer 12, a log-off button 43 for logging off from the VPN device 100 of the RA authentication device 10, and a help button 44 is displayed.

  The form 41 shown in FIG. 5 displays the IP address of the computer 12 and the name of the service provided by the computer 12 (here, remote desktop) in association with the computer name of the computer 12. A computer 12 whose personal computer is “PC — 001” is a computer 12 at the user's own seat, and a computer 12 whose computer name is “Common_PC” is a shared computer 12 of the department to which the user belongs, and is provided by each computer 12. The service is remote desktop.

  From here, it returns to description of FIG. When the user screen is displayed on the terminal device 11, the user operates the terminal device 11 and selects one computer 12 (here, a personal computer) from among the computers 12 displayed on the user screen. When the access button 42 shown in FIG. 5 is clicked, a VPN connection request for the selected computer 12 is transmitted from the terminal device 11 to the VPN device 100 of the RA authentication device 10 (S7).

  The VPN device 100 of the RA authentication device 10 selects the unique data of the computer 12 selected by the user from the unique data of the computer 12 obtained from the authentication device 110 of the RA authentication device 10 and connects to the computer 12. VPN parameters such as the IP address on the Internet 13 that the terminal device 11 accesses, the IP address in the LAN 14 of the computer 12 and the tunnel name are determined, and the IP address in the LAN 14 can be mapped to the IP address in the LAN 14 Network settings are made as described above (S8).

  The VPN device 100 of the RA authentication apparatus 10 generates a magic packet including the Mac address described in the unique data of the computer 12 selected by the user after performing the network setting, and becomes the computer 12 installed in the LAN 14. The magic packet is broadcast to all via the router 14a (S9).

  The network adapter of the computer 12 (here, the personal computer) having the same MAC address as the MAC address included in the magic packet transmitted from the VPN device 100 of the RA authentication apparatus 10 performs an operation of turning on the computer 12. (S10), a response to the magic packet is transmitted to the VPN device 100 of the RA authentication device 10 (S11).

  Upon receiving the response to the magic packet, the VPN device 100 of the RA authentication device 10 transmits a VPN connection response including the VPN parameters and starting the RDAC to the terminal device 11 (S12), and the browser of the terminal device 11 sends the browser to the browser. The installed RDAC is activated, and the RDAC performs network setting using the VPN parameters received from the VPN device 100 of the RA authentication device 10 (S13), and between the terminal device 11 and the VPN device 100 of the RA authentication device 10 Then, the VPN is established (S14), and when the VPN is established, remote access from the terminal device 11 to the computer 12 becomes possible.

  The present invention is not limited to the embodiments described so far, and various modifications and changes can be made, and these are also within the equivalent scope of the present invention.

  If the magic packet cannot be broadcast from the VPN device 100 to the computer 12 due to the specifications of the VPN device 100 or the LAN 14, etc., the magic packet is broadcast using the invention disclosed in Japanese Patent Laid-Open No. 2008-85687. Equipment can also be provided.

  For example, in this embodiment, a device that broadcasts a magic packet is connected to the router 14a, and the VPN device 100 of the RA authentication apparatus 10 delegates the broadcast of the magic packet to the device, and the device passes through the router 14a. The magic packet may be broadcast.

1 Remote Access System 10 Remote Access Authentication Device (RA Authentication Device)
11 Terminal device 12 Computer in LAN 13 Internet 14 LAN

Claims (3)

A remote access system comprising at least a plurality of computers installed in an intranet and a remote access authentication device installed between the Internet and the intranet,
When the computer receives a message to turn on the power remotely, the computer includes means for performing an operation to turn on the power when the message is addressed to the own device.
The remote access authentication device acquires user identification data and authentication data from a terminal device that remotely accesses the intranet via the Internet, and performs user authentication on user authentication information and user identification information for each user. In association, referring to the access table in which at least the unique data of the computer to which remote access is permitted for the user is described and the user authentication is successful, the unique data associated with the identification data of the user authenticated by the user is included. Power generation means for generating the message and transmitting the message to the computer in the intranet;
A remote access system characterized by A remote access method for remotely accessing a computer installed in an intranet from the Internet,
A remote access authentication device installed between the Internet and the intranet acquires user identification data and authentication data from a terminal device that remotely accesses the intranet via the Internet, and performs user authentication;
If the user authentication is successful in step a, the remote access authentication device refers to an access table in which at least the specific data of the computer permitted for the user is described in association with the user identification information for each user. Generating a message for powering on remotely, including unique data associated with the identification data of the user authenticated by the user, and sending the message to the computer in the intranet; b
The computer identified by the message, when receiving the message, executing an operation of turning on the power; c.
Is executed, a remote access method. A remote access authentication device installed between the Internet and an intranet,
User authentication means for acquiring user identification data and authentication data from a terminal device remotely accessing the intranet via the Internet, and executing user authentication;
For each user, refer to the access table that describes at least the unique data of the computer that is allowed remote access for the user in association with the user identification information. Power-on means for generating the message including unique data associated with data and transmitting the message to the computer in the intranet;
A remote access authentication device comprising:

Images