JP2011197912A - Thin client system, integrity verification server, program, storage medium, and thin client communication relay method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a thin client system for completely eliminating an unauthorized access or a virus infection to a thin client server.SOLUTION: A remote access client application 213 of a client 101 issues a connection establishment request to an integrity verification server 103 (S907), a CPU of the integrity verification server 103 transmits a connection request to a thin client server 105 (S911). The remote access client application 213 transmits a remote access request to the integrity verification server 103 (S917), the CPU of the integrity verification server 103 transfers the request to the thin client server 105 (S921). The thin client server 105 transmits a reply to the integrity verification server 103 (S923), the CPU of the integrity verification server 103 transfers the reply to the remote access client application 213 (S925).

Description

  The present invention relates to a thin client system in which functions are aggregated in a server. In particular, it relates to authentication of a client used as a thin client.

In recent years, the introduction of a thin client system in which a client has only a minimum necessary function, and functions such as management of information resources such as confidential information and application processing are concentrated on a server is increasing. .
For example, in a quarantine network having a mechanism for inspecting a computer connected to a network, a verification server exists between a client and an application server.
Specifically, the verification server checks whether the client environment is not infected with a virus or whether the latest security patch is applied. If there is no problem, the IP ( (Internet Protocol) address allocation and the like are performed. The client can then access the application server.

  In addition, as a client authentication method in a thin client system using USB (Universal Serial Bus), an authentication server is installed between the client and the thin client server, and the integrity of the software configuration of the client, etc. is established in the authentication server. There is a mechanism to verify (Patent Document 1)

JP2009-175923

However, in the platform integrity verification system described in Patent Document 1, after successful authentication, the client directly accesses the thin client server. When this access method is permitted, there remains room for a terminal other than the client that has succeeded in authentication to illegally obtain only the information on successful authentication and access the thin client server.
In addition, if the thin client server has the integrity verification server function, a computer that has not been integrity verified will directly access the thin client server. There's a problem.

  The present invention has been made in view of the above-described problems, and an object thereof is to provide a thin client system and the like that can completely eliminate unauthorized access to a thin client server, virus infection, and the like.

  In order to achieve the above-described object, the first invention provides a client, an integrity verification server connected to the client via a network and performing integrity verification of the client, and the integrity verification via a network. A thin client system composed of a thin client server connected to the server, wherein the client includes an activation unit that activates a thin client operating system, and a request unit that requests a connection with the thin client server; Communication means for transmitting a request for the thin client server to the integrity verification server and receiving a reply from the thin client server from the integrity verification server, the integrity verification server comprising: Upon request, A connection means for establishing a connection between the client and the thin client server; a request for the thin client server is received from the client and transmitted to the thin client server; a reply is received from the thin client server; And a communication means for transmitting. By using the thin client system according to the first invention, data between the client and the thin client server can be monitored, and unauthorized access to the thin client server, virus infection, and the like can be completely eliminated.

  It is preferable that the integrity verification server further includes storage means for storing information for identifying the client whose integrity has been verified. Thereby, it is possible to avoid data transmission / reception between the client and the thin client server whose integrity has not been verified.

  The storage means preferably stores an access time from the client. As a result, the integrity verification server can effectively use resources by disconnecting a connection that has passed a predetermined time from the previous access time.

  The storage unit included in the integrity verification server may further store an IP address of the thin client server corresponding to the client. Thereby, the client can connect without knowing the IP address of the thin client server.

  A second invention is an integrity verification server connected to a client and a thin client server via a network, and establishes a connection between the client and the thin client server in response to a request from the client Connection means; and communication means for receiving a request for the thin client server from the client and transmitting the request to the thin client server, and receiving a reply from the thin client server and transmitting the request to the client. Is an integrity verification server. By using the integrity verification server according to the second invention, data between the client and the thin client server can be monitored, and unauthorized access to the thin client server, virus infection, and the like can be completely eliminated.

  The third invention is a program for causing a computer to function as the integrity verification server of the second invention. By installing the program according to the third invention in a computer, the integrity verification server of the second invention can be obtained.

  A fourth invention is a computer-readable storage medium storing a program that causes a computer to function as the integrity verification server of the second invention. The integrity verification server of the second invention can be obtained by installing the program recorded in the storage medium according to the fourth invention in a computer.

  According to a fifth aspect of the present invention, there is provided a client, an integrity verification server connected to the client via a network and performing integrity verification of the client, and a thin client server connected to the integrity verification server via the network A thin client communication relay method, wherein the client executes a startup step of starting a thin client operating system and a requesting step of requesting a connection with the thin client server, and the integrity verification server In response to a client request, a connection step for establishing a connection between the client and the thin client server is executed. The client transmits a request for the thin client server to the integrity verification server, and A communication step of receiving a reply from a client server from the integrity verification server, wherein the integrity verification server receives a request for the thin client server from the client and transmits the request to the thin client server; A communication method for receiving a reply from a thin client server and transmitting the reply to the client. With the thin client communication relay method according to the fifth aspect of the present invention, data between the client and the thin client server can be monitored, and unauthorized access to the thin client server, virus infection, etc. can be completely eliminated.

  According to the present invention, it is possible to provide a thin client system or the like that can monitor data between a client and a thin client server and can completely eliminate unauthorized access to the thin client server, virus infection, and the like.

1 is an overall configuration diagram of a thin client system according to an embodiment of the present invention. Block diagram of USB device 107 Block diagram of client 101 Block diagram of SIM (Subscriber Identity Module) 109 Block diagram of integrity verification server 103 Block diagram of the thin client server 105 A flowchart showing the startup process of the thin client OS 207 Flow chart showing integrity verification process Sequence diagram showing remote access processing The figure which shows an example of the authentication table 517 The figure which shows an example of the IP address table 519

  Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.

  The configuration of the thin client system according to the embodiment of the present invention will be described with reference to FIGS. FIG. 1 is an overall configuration diagram of a thin client system according to an embodiment of the present invention.

  As shown in FIG. 1, in the thin client system according to the embodiment of the present invention, a client 101 and an integrity verification server 103 are communicably connected via an external network 111 (for example, the Internet). Also, the integrity verification server 103 and the thin client server 105 are communicably connected via an internal network 113 (for example, a LAN (Local Area Network)). The internal network 113 may not be a LAN as long as it is a high security network.

The client 101 is connected to a USB device 107 that is a portable storage device. The USB device 107 is equipped with a SIM (Subscriber Identity Module) 109 that is a security token.
The security token means a portable device that can store data secretly and has a calculation function, such as an IC card, SIM, or USIM (Universal Subscriber Identity Module) that is widely used for employee ID cards.

FIG. 2 is a block diagram of the USB device 107.
The USB device 107 includes a driver chip 203 having a function for causing a computer to recognize a USB driver or flash memory as an external storage device, and a flash memory 205 for storing data.
The flash memory 205 stores an image file of a thin client OS (Operating System) 207 operating on the client 101. The thin client OS 207 includes an integrity verification client application 209 that is a program for executing an integrity verification process, a MAC (Message Authentication Code) key 211 as an encryption key used by the integrity verification client application 209, and a thin client OS 207. A remote access client application 213 that is a program for executing remote access processing to the client server 105 is included.

FIG. 3 is a block diagram of the client 101.
The client 101 includes a CPU (Central Processing Unit) 301, a RAM (Random Access Memory) 303 which is a main memory of the client 101, a ROM (Read Only Memory) 307 in which a BIOS (Basic Input / Output System) is mounted, A USB interface 309 for communicating with a USB device, a network interface 311 for network communication, and a large-capacity data storage device 313 as an auxiliary storage device are provided. In the RAM 303, an image file of the thin client OS 207 stored in the mounted USB device 107 is expanded.

  The data storage device 313 stores a client OS 315 that is booted when not used as a client of the thin client system.

FIG. 4 is a block diagram of the SIM 109.
As shown in FIG. 4, the SIM 109 includes a CPU 401, a RAM 403, a ROM 405 in which a computer program for operating the CPU is mounted, an ISO / 7816 standard UART (Universal Asynchronous Receiver Transmitter) 409, and electrical data stored therein. An EEPROM (Electronically Erasable and Programmable Read Only Memory) 411 is provided as a rewritable memory.

The EEPROM 411 stores a digital signature private key 413 and a MAC key 415 as encryption keys used in the integrity verification process.
Further, the ROM 405 verifies the MAC of the configuration certification message generated by the client 101 using the MAC key 415, and if the verification of the configuration certification message is successful, the digital signature of the configuration certification message is verified using the digital signature private key 413. A digital signature command 407 serving as a means for generating is implemented.

FIG. 5 is a block diagram of the integrity verification server 103.
As shown in FIG. 5, the integrity verification server 103 includes a CPU 501, a RAM 503, a ROM 505, a network interface 507 for network communication, and a large-capacity data storage device 509 (for example, a hard disk) as an auxiliary storage device. The data storage device 509 includes a digital signature public key 511 that is paired with the digital signature private key 413 stored in the SIM 109, an expected value 513 of the hash value of the thin client OS 207, and integrity for performing integrity verification. A verification server application 515, an authentication table 517 that holds information for specifying the authenticated client 101, and an IP table 519 that holds the IP address of the thin client server 105 are provided.

  When the integrity verification server 103 receives the configuration certification message and the digital signature from the client 101, the integrity verification server 103 uses the digital signature public key 511 stored in the data storage device 509 and follows the predetermined digital signature verification algorithm. By verifying the digital signature of the message, the validity of the SIM 109 that generated the digital signature is verified.

  When the integrity verification server 103 succeeds in verifying the digital signature of the configuration certification message, the integrity verification server 103 refers to the expected value 513 of the hash value of the thin client OS 207 to confirm whether the hash value included in the configuration certification message is correct. Thus, the validity of the configuration proof message is verified.

  When the configuration certification message includes the random number Rc and the random number Rs, the integrity verification server 103 refers to the random value Rc and the random number Rs stored in the RAM 503 in addition to the expected value 513 of the hash value of the thin client OS 207. Then, the validity of the configuration certification message is verified.

FIG. 6 is a block diagram of the thin client server 105.
The thin client server 105 includes a CPU 601, a RAM 603, a ROM 605, a network interface 607, and a data storage device 609.

Next, details of processing in the thin client system according to the embodiment of the present invention will be described with reference to FIGS.
FIG. 7 is a flowchart showing the startup process of the thin client OS 207.

  When the USB device 107 is attached to the client 101, the CPU 301 of the client 101 uses the USB interface 309 to exchange data with the USB device 107 to mount the USB device 107 attached to the client 101 ( S701).

  When the USB device 107 is mounted, the CPU 301 of the client 101 requests the USB device 107 to read the image file of the thin client OS 207 (S703), and the driver chip 203 of the USB device 107 stores the thin client stored in the flash memory 205. The image file of the OS 207 is transmitted to the client 101 (S705).

  When the image file of the thin client OS 207 is transmitted from the USB device 107, the CPU 301 of the client 101 expands the image file of the thin client OS 207 received from the USB device 107 in the RAM 303 and activates the thin client OS 207 (S707).

  When the thin client OS 207 is activated, the CPU 301 of the client 101 activates the integrity verification client application 209 (S709).

  FIG. 8 is a flowchart showing the integrity verification process.

  The CPU 301 of the client 101 activates the integrity verification client application 209, generates a random number Rc, and transmits a random number generation request message including the random number Rc to the integrity verification server 103 via the external network 111 (S801). Note that the CPU 301 of the client 101 holds the generated random number Rc in the RAM 303 of the client 101 until the integrity verification process is completed.

  When receiving the random number Rc from the client 101, the CPU 501 of the integrity verification server 103 generates a random number Rs, transmits the random number Rs to the client 101 (S803), and continues until the integrity verification processing is completed. Is stored in the RAM 503.

  When the CPU 301 of the client 101 receives the random number Rs from the integrity verification server 103, the random number Rs is stored in the RAM 303, and then the hash value is obtained from all the image files of the thin client OS 207 expanded in the RAM 303 according to a predetermined algorithm. The calculation is performed (S805), and a configuration proof message in which the hash value, the random number Rc, and the random number Rs are combined is generated (S807).

When generating the configuration proof message, the CPU 301 of the client 101 calculates the MAC of the configuration proof message using the MAC key 211 included in the thin client OS 207 according to a predetermined procedure.
When the CPU 301 of the client 101 calculates the MAC of the configuration certification message, the CPU 301 includes the configuration certification message and the MAC in the command message data, and transmits the command message of the digital signature command to the SIM 109, whereby the digital signature of the configuration certification message is transmitted. The generation is requested to the SIM 109 (S809).

  When the CPU 401 of the SIM 109 receives the command message of the digital signature command 407 including the configuration proof message and the MAC, it executes the digital signature command 407 and uses the same algorithm as the client 101 using the MAC key 415 stored in the EEPROM 411. Then, the MAC is calculated from the configuration certification message, and it is verified whether the MAC transmitted from the client 101 is the same as the calculated MAC (S811).

  The CPU 401 of the SIM 109 branches the process when the verification of the MAC of the configuration certification message succeeds or fails (S813). When the verification is successful, the CPU 401 executes a process of generating a digital signature of the configuration certification message (S815). Returns an error message indicating that the MAC verification has failed to the client 101 and ends the integrity verification process.

The CPU 401 of the SIM 109 generates a digital signature of the configuration certification message according to a predetermined digital signature generation algorithm, and returns the generated digital signature to the client 101.
When receiving the digital signature of the configuration certification message from the SIM 109, the CPU 301 of the client 101 transmits the configuration certification message and the digital signature to the integrity verification server 103 via the external network 111 (S817).

  When receiving the configuration certification message and the digital signature, the CPU 501 of the integrity verification server 103 uses the digital signature public key 511 stored in the data storage device 509 of the integrity verification server 103 according to a predetermined algorithm. The validity of the SIM 109 that generated the digital signature is verified by verifying the digital signature of the certification message (S819).

  When the CPU 501 of the integrity verification server 103 succeeds in verifying the digital signature of the configuration certification message, the CPU 501 refers to the Rc and Rs held in the RAM 503 and the expected value 513 of the hash value stored in the data storage device 509. The validity of the configuration certification message is verified by confirming that the Rc, Rs, and hash values included in the configuration certification message are correct.

  The CPU 501 of the integrity verification server 103 branches the process upon successful or unsuccessful verification of the configuration proof message (S821). When the verification is successful, the CPU 501 of the integrity verification server 103 sends the CPU 301 of the client 101 to the thin client server 105. Is allowed to access (S823). If it fails, the integrity verification process is terminated without allowing the client 101 to the thin client server 105.

FIG. 9 is a sequence diagram showing the remote access process.
In the following, for convenience, the remote access application 213 and the integrity verification client application 209 are described as processing subjects, but the hardware that actually performs the processing is the CPU 301 of the client 101.

  The integrity verification client application 209 of the client 101 issues a mode change request to the integrity verification server 103 (S901). The CPU 501 of the integrity verification server 103 switches from the integrity verification mode to the transfer mode, and notifies the integrity verification client application 209 of the completion of switching (S903). The integrity verification client application 209 activates the remote access client application 213 (S905). After being activated, the remote access client application 213 requests the integrity verification client application 209 to establish a connection with the thin client server 105 (S907).

Here, the connection establishment process will be described with reference to FIG.
FIG. 10 shows an example of the authentication table 517.
The CPU 501 of the integrity verification server 103 establishes a connection using the authentication table 517 stored in the data storage device 509.

As shown in FIG. 10, in the authentication table 517, the connection ID 1001 and the previous access time 1003 are stored in association with each other, and are stored in the data storage device 509 of the integrity verification server 103. The CPU 501 of the integrity verification server 103 generates a connection ID 1001 by combining, for example, a user ID and a random number after successful authentication processing of the client 101. The user ID is a unique ID that each client 101 has, and may be a unique ID in the SIM 109, for example. The connection ID 1001 is always given when accessing the integrity verification server 103 from the integrity verification client application 209.
The CPU 501 of the integrity verification server 103 transmits a connection ID 1001 when notifying the integrity verification client application 209 of access permission to the thin client server 105 after successful authentication processing of the client 101.
The integrity verification client application 209 assigns a connection ID 1001 when accessing the integrity verification server 103 thereafter.

  The previous access time 1003 is acquired by the CPU 501 of the integrity verification server 103 at the time of access from the integrity verification client application 209, is associated with the connection ID 1001 of the client 101 that has been accessed, and is held in the authentication table 517.

  When the integrity verification client application 209 is requested to establish a connection with the thin client server 105, the integrity verification client application 209 transmits a connection establishment request with the thin client server 105 and a connection ID 1001 to the integrity verification server 103 (S909). The CPU 501 of the integrity verification server 103 refers to the authentication table 517 to check whether or not the transmitted connection ID 1001 exists, and if there is a matching connection ID 1001 in the authentication table 517, the CPU 501 establishes a connection with the thin client server 105. A request is made (S911).

Further, the CPU 501 of the integrity verification server 103 can connect to the thin client server 105 by holding the IP address of the thin client server 105 in the IP table 519. That is, the client 101 can connect to the thin client server 105 even if the client 101 does not know the IP address of the thin client server 105.
FIG. 11 shows an example of the IP table 519.

As shown in FIG. 11, in the IP table 519, the user ID 1101 and the IP address 1103 of the thin client server 105 are stored in association with each other and held in the data storage device 509 of the integrity verification server 103.
When receiving a connection request from the integrity verification client application 209, the CPU 501 of the integrity verification server 103 refers to the IP table 519 and has a thin client server having an IP address associated with the user ID 1101 of the accessed client 101 A connection request is sent to 105.

  At this time, the CPU 601 of the thin client server 105 accepts only access from the integrity verification server 103. That is, the CPU 601 of the thin client server 105 holds the IP address of the integrity verification server 103 and does not accept access from other than that IP address.

  When the CPU 601 of the thin client server 105 determines that the access is from the IP address of the integrity verification server 103, it establishes a connection with the integrity verification server 103 and notifies the integrity verification server 103 of the establishment completion ( S913). The CPU 501 of the integrity verification server 103 notifies the integrity verification client application 209 of establishment of a connection with the thin client server 105 (S915), and thereafter, the integrity verification client application 209 makes a request from the remote access client application 213. Accept.

  The remote access client application 213 transmits a remote access request to the integrity verification client application 209, and the integrity verification client application 209 transfers the request and the connection ID 1001 to the integrity verification server 103 (S919). The CPU 501 of the integrity verification server 103 refers to the authentication table 517 and confirms whether the received connection ID 1001 is held in the authentication table 517. If held, the CPU 501 of the integrity verification server 103 determines that the access is from the authenticated client 101, updates the previous access time 1003 of the connection ID 1001, and updates the user ID 1101 of the client 101 from the IP table 519. The IP address 1103 of the thin client server 106 linked to is acquired, and the remote access request is transferred to the thin client server 105 (S921). If the received connection ID 1001 is not held in the authentication table 517, the CPU 501 of the integrity verification server 103 does not establish a connection and does not perform subsequent remote access processing.

  The CPU 601 of the thin client server 105 transmits reply information to the integrity verification server 103 in response to the request (S923). The reply information is, for example, difference data of bitmap display information in the case of a screen transfer type thin client system.

  The CPU 501 of the integrity verification server 103 transfers the reply information to the integrity verification client application 209 (S924), and the integrity verification client application 209 transfers the reply information to the remote access client application 213 (S925). Thus, the remote access client application 213 and the thin client server 105 do not communicate directly, but communicate with each other by relaying the integrity verification client application 209 and the integrity verification server 103. The remote access client application 213 updates the screen display of the client 101 based on the reply information received from the integrity verification client application 209.

  When the remote access client application 213 terminates the communication, the remote access client application 213 transmits the termination to the integrity verification client application 209 (S927), and the integrity verification client application 209 notifies the integrity verification server 103 of the termination (S929). ). The CPU 501 of the integrity verification server 103 deletes the connection ID 1001 from the authentication table 517 and notifies the thin client server 105 of disconnection (S931). Thereafter, the remote access client application 213 and the thin client server 105 communicate with each other. Can not do.

  As described above, since the integrity verification server 103 and the thin client server 105 continue to establish a connection even after the authentication processing is completed, data transmission / reception information between the client 101 and the thin client server 105 can be monitored.

Further, the CPU 501 of the integrity verification server 103 uses the authentication table 517 to disconnect a connection that has passed a predetermined time from the previous access time 1003. At this time, the CPU 501 of the integrity verification server 103 deletes from the authentication table 517 the connection ID 1001 that has passed a predetermined time from the previous access time 1003.
Thereby, in the idle state where the connection is connected but not used, the integrity verification server 103 can disconnect the connection. Further, for example, when the number of simultaneously connected clients of the thin client server 105 is limited, resources that are connected but not used are disconnected by the integrity verification server 103, so that resources can be used effectively.

  For example, when the thin client server 105 accessed by the client 101 is fixed, the CPU 501 of the integrity verification server 103 holds an IP table 519 generated in advance. On the other hand, when the thin client server 105 accessed by the client 101 is not fixed, the CPU 501 of the integrity verification server 103 selects the corresponding thin client server 105 and accesses the IP address 1103 and the client 101 when accessing from the client 101. May be associated with each other and held in the IP table 519.

As described above, in the embodiment of the present invention, the integrity verification server continues to establish a connection between the client and the thin client server after the integrity verification process, and monitors data transmission / reception. As a result, unauthorized access to the thin client server and virus infection can be completely eliminated.
In addition, when the client and the thin client server are directly connected, if there is a problem such as a power failure on the thin client server side or disconnection of the network cable, the connection is suddenly terminated without any particular message to the client. There is a possibility. However, by passing through the integrity verification server as in the embodiment of the present invention, the integrity verification server can send a message to the client even if there is a trouble on the thin client server side.
In the embodiment of the present invention, the integrity verification client application 209 and the remote access client application 213 are separate applications, but may be held in the client 101 as one application.

  The preferred embodiment of the thin client system according to the present invention has been described above with reference to the accompanying drawings, but the present invention is not limited to such an example. It will be apparent to those skilled in the art that various changes or modifications can be conceived within the scope of the technical idea disclosed in the present application, and these naturally belong to the technical scope of the present invention. Understood.

101 ......... Client 103 ......... Integrity Verification Server 105 ......... Thin Client Server 107 ......... USB Device 109 ......... SIM

Claims (8)

A thin client server connected to the client via the network and performing integrity verification of the client; and a thin client server connected to the integrity verification server via the network. A client system,
The client
Booting means for booting the thin client operating system;
Request means for requesting a connection with the thin client server;
Communication means for transmitting a request for the thin client server to the integrity verification server and receiving a reply from the thin client server from the integrity verification server;
Comprising
The integrity verification server
Connection means for establishing a connection between the client and the thin client server in response to a request from the client;
Communication means for receiving a request for the thin client server from the client and transmitting the request to the thin client server, receiving a reply from the thin client server and transmitting the request to the client;
A thin client system comprising: The integrity verification server includes storage means for storing information identifying the client whose integrity has been verified;
The thin client system according to claim 1, further comprising:   The thin client system according to claim 1, wherein the storage unit stores an access time from the client.   The thin client system according to claim 1, wherein the storage unit included in the integrity verification server further stores an IP address of the thin client server corresponding to the client. An integrity verification server connected to a client and a thin client server via a network,
Connection means for establishing a connection between the client and the thin client server in response to a request from the client;
Communication means for receiving a request for the thin client server from the client and transmitting the request to the thin client server, receiving a reply from the thin client server and transmitting the request to the client;
An integrity verification server comprising:   A program causing a computer to function as the server according to claim 5.   A computer-readable storage medium storing a program that causes a computer to function as the server according to claim 5. A thin client communication relay method by a client, an integrity verification server connected to the client via a network and performing integrity verification of the client, and a thin client server connected to the integrity verification server via a network There,
The client
A boot step to boot the thin client operating system;
A requesting step for requesting a connection with the thin client server;
Run
The integrity verification server
A connection step for establishing a connection between the client and the thin client server in response to a request from the client;
Run
The client
A communication step of sending a request for the thin client server to the integrity verification server and receiving a reply from the thin client server from the integrity verification server;
Run
The integrity verification server
A communication step of receiving a request for the thin client server from the client and transmitting the request to the thin client server, receiving a reply from the thin client server and transmitting the request to the client;
A thin client communication relaying method characterized in that:

Images