JP2011100207A - Remote access device, program, method and system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To allow access without rewriting URL even when URL is dynamically generated, and to perform access to a server in a remote network by a simple method. <P>SOLUTION: A remote access device includes: a reception setting part 50 for putting data from a user agent which performs data communication based on a prescribed communication protocol, in a receivable state; a user agent management part 54 for creating the other proxy setting which is different from the proxy setting of a user agent, and for making the user agent refer to the other proxy setting; an access management part 52 for downloading and storing an access permission list including URL whose access is permitted for each user from a connection server; and an access control part 53 for determining whether connection destination included in a communication request generated based on the operation of a user is included in the access permission list, and for, when the connection destination is included in the access permission list, transmitting the request to an internal server. <P>COPYRIGHT: (C)2011,JPO&INPIT

Description

  The present invention relates to a remote access device, a remote access program, a remote access method, and a remote access system that provide access from a client device connected to the Internet to a server operating in an isolated network.

  Conventionally, a remote access technology for selectively accessing a web server group from an isolated network such as an intranet in a company via the Internet is known.

  As such a remote access technology, for example, there is a reverse proxy server method as shown in Patent Document 1. In this method, a reverse proxy server is installed at the boundary between the isolated network and the Internet, and the client PC accesses the URL of the reverse proxy server via the Internet. The administrator of the isolated network registers a WEB server that allows access via the Internet with the reverse proxy server. The registration to the reverse proxy server is performed by a pair of a URL of a WEB server that permits access via the Internet and a URL of the reverse proxy server for accessing the URL via the reverse proxy server. The reverse proxy server transfers the HTTP request from the client PC to the WEB server operating in the isolated network, and transfers the HTTP response from the WEB server to the client PC. The reverse proxy server and the client PC communicate securely using the Internet by using encrypted communication using HTTPS.

  As another conventional remote access technique, there is a VPN connection method as described in Patent Document 2. In this VPN connection method, a VPN router is installed at the boundary between the isolated network and the Internet, a VPN client is installed on the client PC, and a virtual network is configured between the VPN router and the VPN client (via the Internet). By doing so, the same state as when the client PC is connected to a part of the isolated network is realized.

  The VPN client encrypts an IP datagram serving as an HTTP request addressed to the WEB server from the client PC, and transmits it as another IP datagram or a TCP stream to the VPN router via the Internet. The VPN router extracts the IP datagram addressed to the WEB server from the received IP datagram or TCP stream, and transmits it to the WEB server. The HTTP response from the WEB server is transmitted to the client PC through the reverse route.

  Another conventional remote access technology is a TCP tunnel method. In this TCP tunnel method, a tunneling server is installed at the boundary between the isolated network and the Internet, and the tunneling client is operated on the client PC, so that an HTTP request from the client PC is used using a TCP stream between the tunneling client and the tunneling server. And HTTP responses from WEB servers running in the quarantine network.

When the client PC sends an HTTP request to the service port provided by the tunneling software running in its own node, the tunneling client encrypts the contents of the TCP stream of the HTTP request and sends it to the tunneling server using another TCP stream. Send to. The tunneling server receives communication from the tunneling client, decrypts the content, and transfers it to the WEB server by another TCP stream.
JP 2004-295166 A JP 2002-232460 A

However, the reverse proxy server method described in Patent Document 1 has the following problems.
In the reverse proxy server method, the URL of the WEB server is not disclosed, and the client PC accesses the URL provided by the reverse proxy server. The reverse proxy server transfers the HTTP request from the client PC to the WEB server. For example, when the URL of the reverse proxy server is “http: //reverse.proxy.server/path1” and the URL of the Web server is “http: //a.server/path2”, the client PC Send an HTTP request to: //reverse.proxy.server/path1. The reverse proxy server transmits this HTTP request to http: //a.server/path2. Conversely, when there is a URL including the host name of the WEB server in the HTTP response from the WEB server, the reverse proxy server rewrites it with the URL of the reverse proxy server. This is because the client PC cannot access the URL even if it receives a URL such as http: //a.server/path2 including the host name on the isolated network.

  However, in the current Web server, when a URL is dynamically changed, a method of generating a URL by executing a JavaScript (registered trademark) program by including a JavaScript (registered trademark) program in an HTTP response is generally performed. ing. In this case, since the JavaScript (registered trademark) program is executed by the Web browser on the client PC that has received the HTTP response, the URL cannot be rewritten by the reverse proxy server that transfers the HTTP response. There was a problem that the server could not be accessed. If the user can access via the reverse proxy server via the Internet, the JavaScript (registered trademark) program on the Web server must be changed, which increases the load during operation. In addition, if this Web server is a product provided by a third party, such a change may not be made in the first place.

In addition, the VPN connection method described in Patent Document 2 has the following problems.
There is a problem that it is necessary to install a VPN client on the client PC and set connection with the VPN router in advance, which is troublesome. Depending on the network environment, the client PC may be connected to another isolated network and connected to the Internet via a proxy server. In such a case, the client PC connects to the Internet via a proxy server. In this case, since the proxy server operates as an application gateway (HTTP gateway), it cannot process the VPN protocol, so that the VPN client cannot communicate with the VPN router.

  Further, since the VPN client and the VPN router are network layer transfer mechanisms, they are higher than the network layer, such as selectively permitting access in units of URLs or setting URLs permitting access for each user. In order to perform a process that can be controlled only in the hierarchy, a security device such as a firewall must be separately installed between the VPN router and the WEB server, and there is a problem that it takes time and labor to install hardware.

  Furthermore, during the operation of the VPN client, the default route of the IP datagram transmitted from the client PC is a virtual interface implemented by the VPN client, and all IP datagrams are transferred to the isolated network. For this reason, there is a problem that the WEB server operating on the Internet cannot be directly accessed from the client PC while the VPN client is operating.

The TCP tunnel method has the following problems.
In the TCP tunnel method, when a client PC connects to a tunneling server via a proxy server, the general setting of the proxy server does not allow relaying of an encrypted TCP stream other than HTTPS. There was a problem that the server could not be accessed.

  Also, even when the client PC connects directly to the Internet without going through a proxy server, the WEB browser running on the client PC uses a URL in the format http://127.0.0.1/path or http: // localhost / path. Since the HTTP request is transmitted to the tunneling client using the same method as in the reverse proxy server method, it is necessary to rewrite the URL for accessing the Web server, and the load during operation cannot be increased or accessed. There was a problem.

  Therefore, the present invention makes it possible to access without rewriting the URL even if the URL is dynamically generated, and in a simple manner without installing client software, etc. It is an object of the present invention to provide a remote access device that allows an internal server to access.

The remote access device of the present invention accesses an internal server through a connection server installed in a network and a demilitarized zone, and can receive data from a user agent that performs data communication based on a predetermined communication protocol. A reception setting means for setting
Create another proxy setting different from the proxy setting of the user agent, and allow access to each user from the user agent management means for allowing the user agent to refer to the other proxy setting and the connection server. Whether or not the access permission list includes the access management means that downloads and holds the access permission list including the URL, and the connection destination included in the communication request generated based on the operation of the user. Access control means for transmitting the request to the internal server when the connection destination is included in the access permission list.

  In the remote access device of the present invention, the reception setting means can also search for an unused port, and receive data from a user agent using an unused port found as a result of the search. It is characterized by making it a state.

  In the remote access device of the present invention, the access management means transmits user authentication information to the connection server, and downloads the access permission list when the connection server authenticates. To do.

  The remote access device according to the present invention is characterized in that the access control means performs communication with the connection server using HTTPS.

  In the remote access device of the present invention, the IP address used by the user agent is a loopback address in the other proxy setting.

  According to the present invention, the connection destination of a communication request is switched to either an internal server connected via a connection server or another server on a network such as the Internet using an access permission list. Therefore, the remote access device can access either server.

  Further, according to the present invention, since communication between the client PC and the connection server uses HTTPS, the remote access device connects to the Internet via a proxy server (in general settings, it does not relay encrypted communication other than HTTPS). There is an effect that it can be used even if it is.

  Further, according to the present invention, since the HTTP communication is transferred in the application layer, not in the data transmission / reception in the network layer like VPN, it is not necessary to install the VPN client. In addition, according to the present invention, since the setting management unit automatically performs setting for operation, there is an effect that manual setting is not required.

It is a figure which shows the structure of the remote access system which is embodiment of this invention. It is a figure which shows the structure of the communication processing part of embodiment of this invention. It is a figure which shows the access permission list | wrist of embodiment of this invention. It is a flowchart which shows the flow of the process of embodiment of this invention. It is a figure which shows the example before the change of the proxy setting in the embodiment of this invention, and the example after a change.

Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.
FIG. 1 shows the overall configuration of a remote access system according to an embodiment of the present invention. The remote access system 100 includes a client PC 1, a proxy server 2, a network 3, a firewall 11, a connection server 12, a firewall 21, and Web servers 22 and 23.

  The client PC 1 is a general-purpose computer that is connected to the network 3, for example, the Internet via the proxy server 2, and accesses the Web servers 22 and 23 according to user operations. The client PC 1 includes a communication processing unit 31 and a web browser 32. The user operates the client PC 1 to connect to the Web servers 22 and 23 through the Web browser 32. The client PC 1 may be, for example, a personal computer used by a user at home or on the go, or may be a mobile phone or a portable information terminal.

The Web browser 32 is an example of a user agent that transmits and receives data through a network using a predetermined protocol, and HTTP (HyperText) according to proxy settings described later.
The so-called HTTPS communication encrypted by Transfer Protocol (Transfer Protocol) or SSL (Secure Sockets Layer) is performed. In the present embodiment, the Web browser 32 is used for explanation, but a user agent using another communication protocol may be used.

  The communication processing unit 31 performs HTTP communication with the Web browser 32 via the connection server 12 using an unused TCP port of the client PC 1. During HTTP communication, the communication processing unit 31 creates a proxy setting (proxy setting 2) for causing the Web browser 32 to transmit an HTTP request to the communication processing unit 31 and starts the Web browser 32, as will be described later. Sometimes, the Web browser 32 refers to the proxy setting 2 and itself performs HTTP communication with reference to the original proxy setting (proxy setting 1). The communication processing unit 31 may be introduced by downloading a file necessary for the user, or may be introduced by connecting a recording medium such as a USB memory to the client PC 1. Note that the communication processing unit 31 stores the URL of the connection server in advance, or is set as appropriate by the user.

  The network 3 is, for example, the Internet and a public network for connecting to it by dial-up or optical fiber.

  The connection server 12 is connected to the network 3 via the firewall 11 and permits access from the client PC 1 based on the access permission list 13. The access permission list 13 is recorded in a storage device (not shown) of the connection server 12 and is referred to as necessary. The connection server 12 and the firewall 11 are installed in a demilitarized zone 41 (DMZ) located at the boundary between the isolated network 42 and the network 3.

  When the connection server 12 receives an HTTP request from the client PC 1 to the Web servers 22 and 23, the connection server 12 determines whether or not the Web server that is the request destination is permitted to be accessed by the user. Only when the access is permitted, the connection server 12 transmits an HTTP request to the Web servers 22 and 23. Further, the connection server 12 receives the processing results from the Web servers 22 and 23 in response to the transmitted HTTP request and responds to this to the client PC 1.

  The demilitarized zone 41 is a network segment that relays between the network 3 and the isolated network 42. The demilitarized zone 41 is independent of the network 3 and the isolated network 42 by the firewalls 11 and 21. This demilitarized zone 41 is provided for the purpose of blocking unauthorized access from the external network 3.

  The Web servers 22 and 23 are connected to the connection server 12 and the firewall 11 via the firewall 21, execute necessary processing based on an HTTP or HTTPS request from the client PC 1, and send the result to the client Return to PC1. Both the Web servers 22 and 23 and the firewall 21 are installed inside the isolation network 42. The isolation network 42 is, for example, a network constructed in a company, and is configured by a LAN, a WAN, or the like.

  FIG. 2 shows a module configuration of the communication processing unit 31 of the client PC 1. The communication processing unit 31 includes modules of a setting management unit 51, an access management unit 52, and an access control unit 53.

  The setting management unit 51 creates proxy settings for allowing the Web browser 32 to transmit an HTTP request to the communication processing unit 31, and causes the Web browser 32 to refer to the proxy settings when the Web browser 32 is activated. It comprises a user agent management unit 54 and a reception setting unit 50 that enables the communication processing unit 31 to receive the HTTP request. The access management unit 52 downloads, from the connection server 12, the access permission list 13 including URLs that are permitted to be accessed for each user, and holds and manages this. The access control unit 53 determines whether or not the access destination URL included in the HTTP request generated based on the user operation is included in the access permission list 13, and the connection destination URL is included in the access permission list 13. If it is included, the HTTP request is transmitted to the internal server.

  FIG. 3 shows an example of the access permission list 13 held by the connection server 12. In the access permission list 13 of FIG. 2, for example, for a user whose user ID is “aaaaa1”, “http://web1.service1.net:8080/path1.html” and “http: // web1 .service2.net: 8080 / dir1 / "is allowed access. Similarly, access to “http://web1.service1.net:8080/path1.html” is permitted for a user whose user ID is “bbbbb1”. Similarly, for a user whose user ID is “bbbbb2”, “http://web1.service1.net:8080/path1.html” and “http://web1.service3.net:8080/dir1 ”Is permitted.

  FIG. 4 is a flowchart for explaining the operation of the remote access system 100 of this embodiment. First, the user activates the communication processing unit 31 in the client PC 1. The communication processing unit 31 may be activated by a user clicking on an icon on a display connected to the client PC 1 or may be activated by a user connecting a recording medium such as a USB memory to the client PC 1. Also good.

  When the communication processing unit 31 is activated in step 401, in step 402, the communication processing unit 31 requests the user to input authentication information such as an ID and a password. The user inputs the ID and password. The communication processing unit 31 transmits the input authentication information to the connection server 12.

  In step 420, the connection server 12 performs authentication when receiving the authentication information, and transmits an authentication result to the communication processing unit 31.

  In step 403, the communication processing unit 31 determines whether or not the authentication result is appropriate. If the authentication result is not appropriate, an error is notified and the process is terminated. On the other hand, if the authentication result is appropriate, the process proceeds to step 404.

In step 404, the reception setting unit 50 of the communication processing unit 31 searches for an unused TCP port, and uses the port and the IP address so that the communication processing unit 31 can receive a communication request from the web browser 32. To do. As the IP address, an IP address assigned to the client PC 1 on which the communication processing unit 31 operates or a virtual IP address (loopback address) representing itself can be used.
For security reasons, it is desirable to use a loopback address that cannot receive a communication request from another computer. Therefore, the following description will be made assuming that a loopback address is used.

In step 406, the user agent management unit 54 of the communication processing unit 31 creates a proxy setting for causing the Web browser 32 to transmit an HTTP request to the communication processing unit 31. Specifically, the user agent management unit 54 uses the values (unused TCP port number and loopback address) used to make the communication request from the Web browser 32 receivable in step 404, Proxy setting 2 shown in FIG. 5B is created. Here, the IP address of the proxy to be used is set to “127.0.0.1”, and the port number is set to nnnn. “127.0.0.1” is a loopback address in IPv4, and nnnn is an unused TCP port number found in step 404.

  As will be described later, when the communication processing unit 31 starts up the Web browser 32, the Web browser 32 refers to the created proxy setting 2 according to the startup parameters. As a result, the Web browser 32 has conventionally performed HTTP communication using the 8080 port of the proxy server “proxy.tokyobbb.co.jp”. Instead, the communication processing unit uses the nnnn number port. All HTTP communications are performed through 31. That is, for the Web browser 32, the communication processing unit 31 operates as a proxy server.

  In this embodiment, the IP address of proxy setting 2 is set to “127.0.0.1”, but may be “localhost”, or “:: 1” (0: 0: 0: 0) in IPv6. : 0: 0: 0: 1). Further, if another loopback address is determined by the OS, that value may be used.

  In step 407, the access management unit 52 of the communication processing unit 31 further downloads the access permission list 13 from the connection server 12. At this time, an access permission list relating only to the user authenticated by the connection server 12 is downloaded. For example, as shown in FIG. 3, for a user whose user ID is “aaaaa1”, “http://web1.service1.net:8080/path1.html” and “http: //web1.service2” .net: 8080 / dir1 / "is downloaded.

  In step 408, the user agent management unit 54 of the communication processing unit 31 activates the web browser 32. At this time, by giving a startup parameter, the Web browser 32 refers to the proxy setting 2 instead of the proxy setting 1. The web browser 32 transmits an HTTP request to the communication processing unit 31 according to the user's processing. This HTTP request includes the user ID of the user.

  In step 409, when the access control unit 53 of the communication processing unit 31 receives the HTTP request from the web browser 32, in step 410, the access control unit 53 refers to the downloaded access permission list 13, and the connection destination URL included in the HTTP request is downloaded. It is determined whether or not it is included in the access permission list 13.

  To give a specific example with reference to FIG. 3, when the user ID is “aaaaa1”, the connection destination URL included in the HTTP request is “http://web1.service1.net:8080/path1.html”. Is determined to be included in the access permission list 13.

  At this time, the URL of the access permission list is compared with the URL included in the HTTP request from the beginning, and if the former is included in the latter (including complete match), it is determined that it is included in the access permission list.

  Specifically, when the user ID is “aaaaa1” and the connection destination URL included in the HTTP request is “http://web1.service1.net:8080/dir1/path2.html”, According to FIG. 3, it is determined that it is included in the access permission list 13. This is because the part of “http://web1.service1.net:8080/dir1” matches, so that the URL is determined to be in the access permission list 13 regardless of the value thereafter.

  As another specific example, when the user ID is “bbbbb2”, the connection destination URL included in the HTTP request is “http://web1.service1.net:8080/path1.html”. 3, it is determined that it is included in the access permission list 13. On the other hand, the connection destination URL included in the HTTP request is “http://web1.service1.net:8080/path2.html” or “http://web1.service1.net:8080/dir1/path1.html” It is determined that the access permission list 13 does not exist. When the URL of the access permission list specifies up to the file name, it is determined that it is included in the access permission list only when there is a complete match.

  The Web browser 32 can directly access the URLs of the Web servers 22 and 23 operating in the isolated network 42. That is, even when the Web servers 22 and 23 provide a service in which a URL is generated on the client PC 1 by a script engine such as JavaScript (registered trademark), the user can modify the Web server without correcting it. Can be accessed.

  In step 410, when the access destination URL included in the HTTP request is included in the access permission list 13 in step 410, the access control unit 53 of the communication processing unit 31 encrypts the HTTP request in accordance with the HTTPS protocol in step 412. To send an HTTP request and a user ID to the connection server.

  On the other hand, when the connection destination URL of the HTTP request is not included in the access permission list 13 in step 410, in step 411, the communication processing unit transmits the HTTP request as it is to the connection destination URL included in the HTTP request. At this time, the user ID is not included in the transmitted HTTP request.

  In step 421, the connection server 12 receives the encrypted HTTP request from the communication processing unit, decrypts it, and in step 422, searches and references the access permission list by the user ID included therein, In the same manner as in 410, it is determined whether or not the connection destination URL included in the HTTP request is in the access permission list.

  In step 422, when the user ID is not included in the HTTP request, or when the user ID is not in the access permission list 13, it is returned to the communication processing unit 31 that it cannot be accessed as an unauthorized HTTP request.

  In step 422, when the user ID is in the access permission list 13, in step 424, the connection server 12 transmits the HTTP request to the connection destination URL included in the HTTP request, that is, the Web server 22 or 23. Accordingly, the HTTP request transmitted from the client PC 1 is transmitted to the communication processing unit 31, the network 3, the demilitarized zone 41, the firewall 21, and the Web server 22 or 23. In response to the received HTTP request, the processing result is returned from the Web server 22 or 23 to the communication processing unit 31 through the firewall 21, the demilitarized zone 41, and the network 3.

  As described above, according to the present invention, the Web browser can directly access the URL of the Web server operating in the isolated network. That is, even when the Web server provides a service in which a URL is generated on the client PC by a script engine such as JavaScript (registered trademark), the user can access without correcting the Web server side. Can do.

  According to the present invention, the transmission destination of the HTTP request using the access permission list is any one of the Web server connected via the connection server and the other Web server on the network such as the Internet. The client PC can access either Web server.

  Further, according to the present invention, since communication between the communication processing unit and the connection server uses HTTPS, it can be used even when the client PC is connected to the Internet via a proxy server.

  Further, according to the present invention, since the HTTP communication is transferred in the application layer, not in the data transmission / reception in the network layer like VPN, it is not necessary to install a program like a VPN client in the client PC. That is, according to the present invention, the execution file corresponding to the communication control unit and necessary libraries may be arranged on the client PC and executed. Therefore, the present invention can be used even when the user does not have administrator authority. Further, in the present invention, since the communication processing unit automatically performs setting for operation, manual setting is not required.

  The above-described embodiment is an example, and the embodiment of the present invention is not limited to this. For example, a proxy server with proxy setting 1 may be set as a JavaScript (registered trademark) program. Further, the present invention can be implemented even in an environment without the proxy server 2. In this case, no value related to the proxy server is set in the proxy setting 1, and the communication processing unit 31 that refers to the proxy setting 1 directly connects to the network 3.

  Further, the communication processing unit 31 and the web browser 32 may be in different computers. In this case, the function of the user agent management unit 54 of the communication management unit 31 is introduced into the computer that executes the Web browser 32.

  In step 404 of FIG. 4, the reception setting unit 50 performs reception setting of the communication request using the IP address (192.68.0.1 etc.) assigned to the client PC on which it operates and a free TCP port. The value is transmitted to the user agent management unit 54 on the computer of the Web browser. The user agent management unit 54 creates the proxy setting 2 using it, and causes the Web browser 32 to refer to the proxy setting 2 according to the startup parameters when the Web browser 32 is started.

1 Client PC (Remote Access Device)
DESCRIPTION OF SYMBOLS 12 Connection server 13 Access permission list 31 Communication processing part 32 Web browser 50 Reception setting part 51 Setting management part 52 Access management part 53 Access control part 54 User agent management part

Claims (8)

A remote access device that accesses an internal server through a connection server installed in a network and a demilitarized zone,
A reception setting means for enabling reception of data from a user agent that performs data communication based on a predetermined communication protocol;
User agent management means for creating another proxy setting different from the proxy setting of the user agent and making the user agent refer to the other proxy setting;
An access management means for downloading and holding an access permission list including URLs that are permitted to be accessed for each user from the connection server;
It is determined whether or not a connection destination included in a communication request generated based on an operation of the user is included in the access permission list. When the connection destination is included in the access permission list, An access control means for transmitting a request to the internal server.   2. The reception setting unit searches for an unused port, and sets a state in which data from a user agent can be received using an unused port found as a result of the search. Remote access device.   3. The remote access according to claim 1, wherein the access management means transmits user authentication information to the connection server, and downloads the access permission list when the connection server authenticates. apparatus.   4. The remote access apparatus according to claim 1, wherein the access control means performs communication with the connection server using HTTPS.   5. The remote access device according to claim 1, wherein, in the other proxy setting, an IP address used by the user agent as a proxy server is set as a loopback address. 6. A remote access program for accessing an internal server through a connection server installed in a network and a demilitarized zone,
A reception setting means for enabling reception of data from a user agent that performs data communication based on a predetermined communication protocol;
User agent management means for creating another proxy setting different from the proxy setting of the user agent and making the user agent refer to the other proxy setting;
An access management means for downloading and holding an access permission list including URLs that are permitted to be accessed for each user from the connection server;
It is determined whether or not a connection destination included in a communication request generated based on an operation of the user is included in the access permission list. When the connection destination is included in the access permission list, An access control means for transmitting a request to the internal server. A remote access method for accessing an internal server through a connection server installed in a network and a demilitarized zone,
A reception setting step for enabling reception of data from a user agent that performs data communication based on a predetermined communication protocol;
A user agent management step for creating another proxy setting different from the proxy setting of the user agent and causing the user agent to refer to the other proxy setting;
An access management step of downloading and holding an access permission list including URLs permitted to be accessed for each user from the connection server;
It is determined whether or not a connection destination included in a communication request generated based on an operation of the user is included in the access permission list. When the connection destination is included in the access permission list, An access control step of transmitting a request to the internal server. A remote access system for accessing an internal server installed in an isolated network from a client through a connection server installed in a network and a demilitarized zone,
The client
A reception setting means for enabling reception of data from a user agent that performs data communication based on a predetermined communication protocol;
User agent management means for creating another proxy setting different from the proxy setting of the user agent and making the user agent refer to the other proxy setting;
An access management means for downloading and holding an access permission list including URLs that are permitted to be accessed for each user from the connection server;
It is determined whether or not a connection destination included in a communication request generated based on an operation of the user is included in the access permission list. When the connection destination is included in the access permission list, Access control means for transmitting a request to the internal server;
The connection server is
Means for holding the access permission list and transmitting the access permission list to the client for each user in response to a request from the client;
The communication request from the client transmitted when the connection destination is included in the access permission list is transmitted to the internal server based on the access permission list held in the connection server. Remote access system.

Images