JP2012222678A - Access control system and access control method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an access control system and an access control method, which enable firm and secure access to a diversity of home appliances connected to a home network from an external network.SOLUTION: When an access request requesting for access to a home appliance 14 is transmitted from a remote terminal 15, a HGW 13 corresponding to the home appliance performs a FW setting so as to open a port to be used for a VPN to thereby establish the VPN between the remote terminal 15 and the HGW 13, performs a NAT setting or a reverse proxy setting so as to transfer the access request reaching an address on the VPN to a target home appliance and causes the access request made by the remote terminal to transition from a management page to the target home appliance 14 via the established VPN.

Description

  The present invention relates to an access control system and an access control method for accessing a home device connected to a home network from a remote terminal arranged in an external network.

  At present, the necessity and importance of home gateways (hereinafter referred to as HGWs) are increasing with the spread of the Internet and the progress of home networks in which home devices in end-user homes are connected by a network.

  HGW cross-connects home devices to each other by performing address conversion and data transfer across various standards such as PC devices, AV devices, telephone devices, white goods devices, etc. In addition to communication between each home device in the home network, it also has a function of bridging communication between them and the Internet.

  Such an HGW is arranged in the end user's house, and a firewall function (hereinafter referred to as FW) for restricting access (including reverse access) from the Internet side to the end user's house or a private address as a global address. As a system having a NAPT (Network Address Port Translation) function for conversion (including reverse conversion), there is an access control system described in Patent Document 1.

  The access control system described in Patent Document 1 is a system for accessing a home device connected to a home network from a remote terminal arranged in an external network, and after an access request is transmitted from the remote terminal. The address of the external network connected to the external network is acquired.

  With this configuration, even when the address on the external network side of the home gateway (hereinafter referred to as HGW) arranged at the boundary between the external network and the home network is dynamically changed. The access from the remote terminal can be reliably transferred to the home gateway, and the access to the home device by the user can be ensured.

  In addition, since it is not necessary for the home device to use UPnP technology in order to control the FW of the HGW or to set the NAPT, it is not necessary for the home device to support UPnP. Devices that are subject to access control.

JP 2011-3957 A

  The access control system described in Patent Document 1 performs NAPT / FW control on a single port, and is a protocol in a higher layer of the network hierarchy defined by the OSI reference model (for example, HTTP: Hyper). This is a technology for directly accessing a home device from a remote terminal using Text Transfer Protocol.

  For this reason, in this access control system, in order to execute access from a remote terminal to a home device with high security quality, it is conceivable to connect by SSL (Secure Socket Layer). There is a problem that it is necessary to install a server certificate, and there is a cost for issuing the server certificate. Although it is conceivable to use a unique certificate here, there was a problem that the security quality deteriorated, such as being indistinguishable from guiding to other spoofing sites.

  The access control system described in Patent Document 1 is a technique for accessing a home device from the outside using NAPT / FW. If the home device has a specification that denies access from other than the LAN, the home control device is used. There was a problem that the device could not be accessed.

  The present invention has been made in view of the above problems, and an access control system and an access control method capable of reliably and safely accessing various home devices connected to a home network from an external network. It is an issue to provide.

  An access control system of the present invention for solving the above problem is an access control system for accessing a home device connected to a home network from a remote terminal having a VPN client function arranged in an external network. , Arranged in the external network, storing an identifier of the home device in a storage means, and displaying a management page for selecting a target home device from the connected home devices on the remote terminal, The identifier of the target home device selected by the storage unit is retrieved from the storage means so that a VPN can be established between the home gateway located at the boundary between the external network and the home network and the remote terminal. Contains information about the port used when establishing a VPN. A firewall setting request for setting the table information of the firewall is transmitted to the home gateway, and the access request reaching the address on the VPN in the home gateway after the VPN is established is transferred to the selected target home device. As described above, a reception server for transmitting a NAT setting request for setting NAT table information or a reverse proxy setting request for performing reverse proxy setting, and an access restriction from the reception server / home device to the home device / reception server are defined. Based on the access control list, it is determined whether the reception server that transmitted the firewall setting request, the NAT setting request or the reverse proxy setting request can access the target home device. Knowledge A home gateway connected to the same home network as the target home device is identified based on a home gateway identifier list that can search for a home gateway from a child, and the firewall setting request or the NAT setting request is specified to the identified home gateway. Or an access control server that relays a reverse proxy setting request via a dedicated network, and an access that receives the firewall setting request, NAT setting request, or reverse proxy setting request relayed from the access control server via a dedicated network. When the control server communication unit and the firewall setting request are received, the external network side address set in itself is acquired, and the NAT setting request or reverse proxy setting request is obtained. When receiving the information acquisition unit for acquiring the address on the VPN at the home gateway, and broadcasting the home network using the identifier of the target home device when receiving the NAT setting request or the reverse proxy setting request A table of the firewall using a home device communication unit that acquires a local address of the target home device, an address on the external network side set in the device when the firewall setting request is received, and information on the port When the information is set and the NAT setting request or reverse proxy setting request is received, the home gateway determines the port number to wait on the VPN, and then determines the address on the VPN at the home gateway. Transmission from the remote terminal by using the port number and the local address of the target home device to set according to the NAT setting request or reverse proxy setting request, and the set firewall table information A home gateway having a VPN server function unit that establishes a VPN with the home gateway in response to a VPN establishment request made, and the reception server has an address on the VPN and a determined port number in the home gateway A URI or RDP file is generated using, a link to the URI or RDP file is generated, and an access request from the remote terminal is transferred from the management page to the target home device via the established VPN It is characterized by making it.

  The access control method of the present invention is an access control method for accessing a home device connected to a home network from a remote terminal having a VPN client function arranged in the external network, and is arranged in the external network. The received reception server stores the identifier of the home device in a storage unit, and displays a management page for selecting a target home device from the connected home devices on the remote terminal, thereby selecting The identifier of the target home device is retrieved from the storage means so that the VPN can be established between the home gateway located at the boundary between the external network and the home network and the remote terminal. Firewall that contains information about the port to use when establishing A step of transmitting a firewall setting request for setting table information to the home gateway, and an access control server based on an access control list defining access restrictions from the receiving server / home device to the home device / receiving server. Determining whether or not the reception server that sent the firewall setting request can access the target home device, and if it is accessible, based on the home gateway identifier list that can search the home gateway from the identifier of the home device, Identifying a home gateway connected to the same home network as the target home device, relaying the firewall setting request to the identified home gateway via a dedicated network, and access control of the home gateway A communication unit that receives the firewall setting request relayed from the access control server via a dedicated network; and the information acquisition unit of the home gateway sets the firewall setting request when it receives the firewall setting request. The external network side address being acquired, and the home gateway setting unit, when receiving the firewall setting request, the external network side address and the port information set to the self And setting the firewall table information using the firewall server function unit of the home gateway according to the VPN establishment request transmitted from the remote terminal according to the set firewall table information. And establishing NAT table information so that the accepting server forwards the access request reaching the address on the VPN in the home gateway to the selected target home device after establishing the VPN. A NAT setting request for transmitting or a reverse proxy setting request for performing reverse proxy setting, and access control in which the access control server defines access restrictions from the receiving server / home device to the home device / receiving server Based on the list, it is determined whether or not the receiving server that transmitted the NAT setting request or reverse proxy setting request can access the target home device, and if it is accessible, the home gateway can be searched from the home device identifier. Home gateway identifier Identifying a home gateway connected to the same home network as the target home device based on a list, and relaying the NAT setting request or reverse proxy setting request to the identified home gateway via a dedicated network; The access control server communication unit of the home gateway receives the NAT setting request or reverse proxy setting request relayed from the access control server via a dedicated network; and the information acquisition unit of the home gateway includes: A step of acquiring an address on the VPN set in the home gateway when receiving a NAT setting request or a reverse proxy setting request; and a home device communication unit of the home gateway, the NAT setting request or reverse proxy setting When receiving a request, broadcasting to a home network using the identifier of the target home device to obtain a local address of the target home device; and a setting unit of the home gateway, the NAT setting request or reverse proxy When receiving a setting request, the home gateway determines a port number waiting on the VPN, and then uses the address on the VPN and the determined port number and the local address of the target home device to set the NAT setting. A request or a setting corresponding to a reverse proxy setting request, and the reception server generates a URI or RDP file using the address on the VPN and the determined port number in the home gateway, and the URI or RDP file Generating a link to the network, and transitioning an access request from the remote terminal from the management page to the target home device via the established VPN.

  According to the access control system and the access control method of the present invention, it is possible to securely and safely access various home devices connected to the home network from the external network.

1 is an overall view showing a configuration of an access control system according to an embodiment of the present invention. It is a block diagram which shows the structure of HGW of the access control system by one Embodiment of this invention. It is a sequence diagram which shows operation | movement of the access control system by one Embodiment of this invention. It is explanatory drawing which shows the screen transition of the display part of the remote terminal using the access control system by one Embodiment of this invention. It is another explanatory drawing which shows the screen transition of the display part of the remote terminal using the access control system by one Embodiment of this invention. It is another explanatory drawing which shows the screen transition of the display part of the remote terminal using the access control system by one Embodiment of this invention.

  Hereinafter, an embodiment will be described with reference to the drawings.

  FIG. 1 is a diagram showing an overall configuration of an access control system according to the present embodiment.

  The access control system 1 accesses the home devices 14a to 14d connected to the home networks 32 of the end user homes A and B from the remote terminal 15 via the external network 30 by using the NAT (Network Address Translation) function. The access control system includes an application server group 10 including a first application server 10a and a second application server 10b as an accepting server, an access control server 11, an HGW address management server 12, a first HGW 13a, and a second HGW 13b. The HGW group 13 includes a dedicated network 31.

  In addition, each server and HGW which comprise such an access control system 1 can be comprised by computers provided with arithmetic processing units, such as CPU, and memory | storage devices, such as memory, and each function process is carried out by a program. Executed.

  The remote terminal 15 for using the access control system 1 is equipped with remote access client software for accessing the home devices 14a to 14d via the external network 30 and a VPN (Virtual Private Network). A VPN connection tool for establishing a VPN as a client is installed in the OS.

  Such a program is stored in a storage device, and can be recorded on a recording medium or provided through a network.

  Hereinafter, the functions and processing flow of the access control system 1 will be described individually and specifically, and the operations and effects of the present embodiment will be described.

  The application server group 10 is connected to an external network 30 which is a widely used wide area network such as the Internet, and the identifiers of home devices connected to the home networks 32a and 32b of the end user homes A and B are set. It has a function of storing in the storage unit.

  Further, when there is an access request from the remote terminal 15, the home device identifier (or the name of the home device) stored in the storage unit and the home device access method (specifically, remote access, Or remote desktop connection), a home device centralized management page can be displayed on the remote terminal 15.

  The home device centralized management page is a page that collectively manages devices of various different vendors connected to the home networks 32 of a plurality of end user homes A and B, and is displayed on the screen. .

  The remote terminal 15 is a terminal used by an end user to remotely control access to the home devices 14a to 14d. For example, a PC, a mobile phone, a TV, or the like is used as an example. 14a to third home device 14d) are target devices whose access is controlled by the end user.

  Further, the first application server 10a and the second application server 10b of the application server group 10 store the identifier of the home device (hereinafter referred to as the target home device) selected by the end user operating the remote terminal 15 in the storage unit. FW setting request for setting FW table information including port information used when establishing the VPN so that a VPN can be established with the home gateway corresponding to the target home device. And a NAT setting request or reverse proxy setting request for setting NAT table information of the HGW 13 so as to transfer the access request reaching the address on the VPN of the HGW 13 to the target home device after the VPN is established. It has a function.

  Further, when the FW table information of the HGW 13 is set (changed or added) based on the FW setting request, the address and port number on the external network side of the HGW 13 are used between the remote terminal 15 and the HGW 13. VPN is established, and NAT table information of the HGW 13 is set (changed or added) based on the NAT setting request or reverse proxy information is set (changed or added) based on the reverse proxy setting request. If a URI or RDP file is generated based on the address on the VPN of the HGW 13 and the standby port number on the VPN, and a link to the generated URI or RDP file is generated and redirection is possible Performs redirect and unifies access request from remote terminal 15 to home device It has a function to transition through the VPN to the target home devices from the management page.

  Note that the application servers 10a and 10b can also perform login authentication using pre-registered end user information and passwords when accessed from the remote terminal 15.

  The access control server 11 is a server that manages communication between the application servers 10a and 10b and the home network 32, and communication (action relay) from the application servers 10a and 10b to the home devices 14a to 14d and the home device 14a. To 14d to the application servers 10a and 10b (notify relay), an access control list (to be referred to as ACL hereinafter) in which permission / denial is set, identifiers of the home devices 14a to 14d, identifiers of the HGWs 13a and 13b Are stored in association with an HGW identifier list (hereinafter referred to as HIL).

  Further, based on the ACL, it is determined whether or not the application server 10a, 10b that has transmitted the FW setting request or the NAT setting request or the reverse proxy setting request can access the target home device. The HGW 13 of the same home network as the target home device is searched based on the HGW 13 to the HGW address management server 12 arranged in a closed and secure dedicated network 31 such as an NGN (Next Generation Network) network. And the function of relaying the FW setting request or the NAT setting request to the address of the HGW 13 obtained from the inquiry result.

  The HGW address management server 12 allocates addresses to the HGWs 13 a and 13 b connected to the dedicated network 31 and manages the allocated HGW 13 addresses on the dedicated network side in association with the identifiers of the HGW 13. It has a function of transmitting the address of the HGW 13 in response to an inquiry from.

  The HGWs 13a and 13b are connected to the external network 30, the dedicated network 31, and the home networks 32a and 32b, and have a router function, NAT function, FW function, and VPN server function.

  Further, as shown in FIG. 2, the HGWs 13a and 13b receive the FW setting request, NAT setting request or reverse proxy setting request, and VPN establishment request relayed via the dedicated network 31, and the access control server communication unit 131, An HGW information acquisition unit that acquires an address on the external network 30 set to itself when receiving an FW setting request, and acquires an address on the VPN when receiving a NAT setting request or a reverse proxy setting request after establishing a VPN 132, a home device communication unit 133 that broadcasts to the home network 32 using the identifier of the target home device when a NAT setting request or reverse proxy setting request is received after the VPN is established, and acquires a local address of the target home device. , Received FW setting request FW setting for opening a port for use in VPN connection is sometimes performed, and after determining the port number to be waited on the external network 30 side when receiving the NAT setting request after establishing the VPN, the address on the VPN in the HGW 13 and Using the port number on the VPN and the local address of the target home device, the NAT / FW setting unit 134 that performs settings according to the NAT setting request, and the external network 30 when the reverse proxy setting request is received after the VPN is established After determining the port number to wait on the side, use the VPN address and port number on the HGW 13 and the local address of the target home device to make settings according to the reverse proxy setting request, and access control by the set reverse proxy settings Do reverse proxy Function unit 135, VPN server function unit 136 that establishes a VPN as a VPN server when a VPN establishment request is received, and NAT / FW that performs access control by FW setting and NAT setting set by NAT / FW setting unit 134 And a functional unit 137.

  The access control server communication unit 131, the HGW information acquisition unit 132, the home device communication unit 133, the NAT / FW setting unit 134, and the reverse proxy function unit 135 that constitute the HGWs 13a and 13b are OSGi (Open It is implemented in a bundle using the Services Gateway initiative) framework.

  By mounting in bundles in this way, each bundle can be easily distributed and updated using the OSGi framework, so that various home devices can be supported.

  In the present embodiment, the application servers 10a and 10b and the access control server 11 will be described as independent devices. However, depending on the operation mode, the functions of both servers can be integrated into one device.

  Next, a processing flow of the access control system 1 will be described. FIG. 3 is a diagram showing a processing flow of the access control system.

  First, in step S1, when there is an access request (web connection with a web browser) to the home device at the end user's home from the remote terminal 15 to the first application server 10a, login authentication is performed and the first The application server 10 a causes the home device centralized management page for selecting home devices arranged in the end user's home to be output on the screen of the remote terminal 15.

  Thereby, the end user operating the remote terminal 15 can select a desired home device in the end user's home.

  In step S2, after a predetermined home device 14 is selected by the end user (hereinafter, the first home device 14a is selected), the first application server 10a is selected by the selected first home device 14a. A screen for selecting an available access method, specifically, a display for selecting “remote access” or “remote desktop connection” is output to the home device centralized management page.

  In step S3, the first application server 10a retrieves the identifier of the selected first home device 14a from the storage unit, and establishes the FW setting request identifier for establishing the VPN, and the port information used in the VPN. The identifier of the first application server 10a that is the transmission source, the identifier of the first home device 14a that is the transmission destination, and the source address of the remote terminal 15 are specified, and the FW setting request packet describing these specification information is relayed To the access control server 11.

  In step S4, the access control server 11 that has received the FW setting request packet uses the identifier of the first application server 10a and the identifier of the first home device 14a described in the packet based on the ACL setting contents. In the case where transmission is possible, the identifier of the HGW 13 associated with the identifier of the first home device 14a is acquired from the HIL, and the HGW is specified (here, , The identifier of the first HGW 13a is acquired).

  Thereafter, the identifier of the first HGW 13a is transmitted to the HGW address management server 12 via the dedicated network 31, and the address on the dedicated network side in the first HGW 13a is acquired.

  Then, the received FW setting request packet is relayed to the first HGW 13a of the acquired address.

  In step S5, after receiving the FW setting request packet relayed by the access control server 11 via the dedicated network 31 by the access control server communication unit 131 of the first HGW 13a, the HGW information acquisition unit 132 performs its own external network 30 side. Get the address set in.

  Then, the NAT / FW setting unit 134 sets the FW so as to open the port used in the VPN described in the FW setting request packet. At this time, using the source address of the remote terminal 15 described in the FW setting request packet, setting is performed so that the NAT / FW function unit 137 accepts only the VPN establishment request from the remote terminal 15.

  When the FW setting is successful, the address and the standby port number on the external network 30 side of the first HGW 13a are returned to the first application server 10a via the dedicated network 31.

  In step S6, the first application server 10a notifies the remote access client software of the remote terminal 15 as a VPN client of the address and standby port number of the returned first HGW 13a to the remote terminal 15 as a VPN client. A VPN establishment request is transmitted using the connection tool, and the VPN establishment function is received by the VPN server function unit 136 and the NAT / FW function unit 137 of the HGW 13a. A VPN is established between the terminal 15 and the first HGW 13a.

  Next, in order for the first application server 10a to set the NAT or the reverse proxy, the identifier of the NAT setting request for accessing the home device 14a or the identifier of the reverse proxy setting and the first application server 10a that is the transmission source The identifier and the identifier of the first home device 14a that is the transmission destination are designated, the standby port number of the HGW 13 is designated as necessary, and a NAT setting request packet or reverse proxy setting request packet in which these designation information is described It transmits to the access control server 11 to relay.

  In step S7, the access control server 11 that has received the NAT setting request packet or the reverse proxy setting request packet uses the identifier of the first application server 10a and the identifier of the first home device 14a described in the packet, It is determined whether or not the destination is a destination that can be transmitted based on the setting contents of the ACL, and if transmission is possible, the identifier of the HGW 13 associated with the identifier of the first home device 14a is acquired from the HIL (here Then, it is assumed that the identifier of the first HGW 13a has been acquired).

  Thereafter, the identifier of the first HGW 13a is transmitted to the HGW address management server 12 via the dedicated network 31, and the address on the dedicated network side in the first HGW 13a is acquired.

  Then, the received NAT setting request packet or reverse proxy setting request packet is relayed to the first HGW 13a of the acquired address.

  In step S8, after receiving the NAT setting request packet or the reverse proxy setting request packet relayed by the access control server 11 via the dedicated network 31, the access control server communication unit 131 of the first HGW 13a, the HGW information acquisition unit 132 The address set on its own VPN is acquired.

  Then, the home device communication unit 133 makes an inquiry to the home network 32 by broadcast using the identifier of the first home device 14a described in the NAT setting request packet or the reverse proxy setting request packet, and the first home device 14a Get local address.

  Thereafter, when the standby port number of the HGW 13 is specified in the NAT setting request packet or the reverse proxy setting request packet, the port number is specified, and when not specified or specified in advance, the port number according to the specification is specified. Alternatively, any one of the randomly determined port numbers is used as a standby port number on the VPN of the first HGW 13a, and a packet that has reached the determined standby port number is an address on the VPN acquired by the HGW information acquisition unit 132. , The local address of the first home device 14a acquired by the home device communication unit 133, so that it can be transferred to the first home device 14a described in the NAT setting request packet or the reverse proxy setting request packet. The FW setting unit 134 Or performs the setting table information (additional changes or), reverse proxy function unit 135 performs a reverse proxy settings. In this setting, the port number of the first home device 14a is set using any one of a port number obtained by an inquiry to the home device, a predefined port number, or a randomly determined port number. Is done. If it is determined randomly, the determined port number is notified separately to the first home device 14a, and the first home device 14a waits for communication from the remote terminal 15 at the port number.

  When the setting is successful, the address on the VPN of the first HGW 13a and the standby port number on the VPN are returned to the first application server 10a via the dedicated network 31.

  In step S9, the first application server 10a generates a URI or RDP file based on the returned information, generates a link to the URI or RDP file, and performs redirection if redirection is possible. The access request from the terminal 15 is shifted from the home device unified management page to the first home device 14a.

  In step S10, the end user waits as it is or clicks a link displayed on the screen, so that the VPN established from the remote terminal 15 to the HGW 14a on the external network 30 and the NAT setting or reverse proxy on the HGW 14a are established. By setting, access control to the first home device 14a is performed by the NAT / FW function unit 137 or the reverse proxy function unit 135, and communication between the remote terminal 15 and the first home device 14a becomes possible.

  Finally, in step S11, after the access to the first home device 14a is completed, the setting information set in steps S5 and S8 is changed to NAT based on the timeout process or the user's explicit instruction from the home device unified management page. Delete from / FW table information.

  By using the access control system described above, for example, 1) remote access to a home device using a web browser using http / https 2) remote control to a home device using a web browser and a remote desktop connection Desktop connection 3) It is possible to provide services such as DLNA (Digital Living Network Alliance) content viewing using a Web browser and software capable of reproducing moving image files.

  First, the screen transition in the case of 1) is shown in FIG.

  In this remote access, after selecting a home device, the NAT / FW setting unit 134 performs FW setting for VPN connection via the access control server communication unit 131 of the HGW 13, and after establishing the VPN, the NAT / FW In this access method, NAT is set by the setting unit 134 or reverse proxy is set by the reverse proxy function unit, and redirected after the setting is completed to directly access the home device via the VPN.

  First, the home device centralized management page for selecting a home device is displayed on the screen of the remote terminal 15 (transition Sa1), followed by an access method that can be used by the selected home device (transition Sa2). ).

  By selecting the remote access, a home device management screen or a screen for selecting file browsing is displayed (transition Sa3), and by selecting the start of file browsing, the FW setting of the HGW 13 and the access control server 11 are selected. VPN establishment is performed, and further NAT setting or reverse proxy setting is performed.

  Here, a new window is started up, and “setting” is displayed during FW setting, VPN establishment, NAT setting or reverse proxy setting (transition Sa4), and this is displayed after the setting is completed. (Transition Sa5).

  After that, by redirecting or by clicking a designated place on the screen and following the link, the home device page is displayed via the VPN, and the home device file can be browsed (transition Sa6). ).

  When the browsing of the file ends, the page is closed (transition Sa7), and the screen returns to the transition Sa3 screen (transition Sa8).

  Thereafter, by selecting the end of file browsing, all processing ends (transitions Sa9 and Sa10).

  Next, the screen transition in the case of 2) is shown in FIG.

  In this remote desktop connection, after selecting a home device, the NAT / FW setting unit 134 performs FW setting for VPN connection via the access control server communication unit 131 of the HGW 13, and after establishing the VPN, The NAT setting by the FW setting unit 134 or the reverse proxy setting by the reverse proxy function unit is performed, and after the setting is completed, the external network 30 side in the NAT on the VPN is made to be accessible via the VPN. Generate an RDP file describing the listening port number and address on the VPN, or the listening port and VPN address on the external network 30 side in the reverse proxy on the VPN, and generate a page describing the URL to the RDP file To home equipment It is an access method for direct access in remote desktop.

  First, a home device centralized management page for selecting a home device is displayed on the screen of the remote terminal 15 (transition Sb1), and subsequently, an access method that can be used by the selected home device is displayed (transition Sb2). ).

  By selecting the RDP connection, a screen for selecting the start / end of the RDP connection is displayed (transition Sb3). By selecting the start of the RDP connection, the FW setting of the HGW 13 and the VPN settings are made via the access control server 11. Establishment is performed, and further NAT setting or reverse proxy setting is performed.

  Here, a new window is launched, and “setting” is displayed during FW setting, VPN establishment, NAT setting or reverse proxy setting (transition Sb4), and after the setting or RDP file is generated The page describing the link to the RDP file is displayed (transition Sb5).

  After that, by clicking the designated location displayed, the external program is activated, and it becomes possible to access the home device via a remote desktop connection via VPN (transition Sb6).

  When the connection to the home device is terminated, the page is closed (transition Sb7), and the screen returns to the transition Sb3 screen (transition Sb8).

  Thereafter, by selecting the end of the RDP connection, all the processes are completed (transitions Sb9 and Sb10).

  Finally, the screen transition in the case of 3) is shown in FIG.

  In this content viewing, after selecting the home device, the content list that can be provided is obtained by following the hierarchy up to the content of the home device via the access control server communication unit 131 and the home device communication unit 133 of the HGW 13. Later, the FW setting is performed by the NAT / FW setting unit 134 via the access control server communication unit 131, and after establishing the VPN, the NAT setting by the NAT / FW setting unit 134 or the reverse proxy setting by the reverse proxy function unit After the setting is completed, the standby port number on the external network 30 side in the NAT on the VPN and the address on the VPN, or the external network on the reverse proxy on the VPN so that the contents of the home device to be accessed can be accessed 30 side standby To redirection to generate a link that describes the address on the bets and VPN, the access method for direct access through the VPN to the content of the home device.

  First, the home device centralized management page for selecting a home device is displayed on the screen of the remote terminal 15 (transition Sc1), and then an access method and the like that can be used with the selected home device are displayed (transition Sc2). ).

  Here, by selecting content viewing, the access control server communication unit 131 and the home device communication unit 133 search and acquire content that can be viewed by the selected home device from the home device and display the content (transition Sc3). .

  Here, when “video” is selected and “all videos” is further selected (transition Sc4), a screen for selecting start / end of video 1 to video 3 that can be provided by the home device is displayed ( Transition Sc5), for example, when the start of video 1 is selected, FW setting and VPN establishment of the HGW 13 are performed via the access control server 11, and further NAT setting or reverse proxy setting is performed.

  Here, a new window is launched, and it is displayed that “setting is in progress” during FW setting, VPN establishment, NAT setting or reverse proxy setting (transition Sc6), and after the link to HGW 13 is generated, A page describing the link is displayed (transition Sc7).

  Thereafter, redirection is performed or an external program is activated by clicking a designated location displayed, and content viewing via the VPN becomes possible (transition Sc8).

  When the content viewing ends, the page is closed (transition Sc9), and the screen returns to the transition Sc5 (transition Sc10).

  Thereafter, by selecting the end of the video 1, all the processes are completed (transitions Sc11 and Sc12).

  According to the present embodiment, the HGW information acquisition unit 132 acquires the address on the external network side connected to the external network 30 after the access request is transmitted from the remote terminal 15, and thus the external of the HGW 13 is performed by dynamic DNS. Even when the address on the network side is changed, the access from the remote terminal 15 can be reliably transited to the HGW 13 and the access to the home device 14 by the user can be made more reliable.

  According to the present embodiment, the home device communication unit 133 broadcasts to the home network using the identifier of the home device to be accessed, and acquires the address of the home device. In other words, communication with the home device Therefore, it is not necessary for the home device to support UPnP, and a device that is widely spread can be used as a target for access control.

  According to the present embodiment, authentication is performed at the time of login to the application server 10, and NAT / FW setting of the HGW 13 is performed via the closed and secure dedicated network 31, so that the risk of impersonation and eavesdropping is reduced. be able to.

  According to the present embodiment, since the connection between the remote terminal and the home device via the external network is performed via the secure VPN, the risk of impersonation or eavesdropping can be reduced.

  According to the present embodiment, since the HGW functions as a VPN server and establishes a VPN with a remote terminal that is a VPN client, the protocol of the home device connected to the HGW is not limited, and various models A wide range of services compatible with home devices can be centrally managed.

  In addition, some home devices are set not to accept access other than from the local network. For such home devices, the reverse proxy setting can be used from the remote terminal via the external network. Easy and secure access.

  According to the present embodiment, the access control server communication unit 131, the HGW information acquisition unit 132, the home device communication unit 133, and the NAT / FW setting unit 134 are implemented in a bundle using the OSGi framework. Therefore, it is possible to easily cope with the expansion of home devices and functions in the future.

DESCRIPTION OF SYMBOLS 1 ... Access control system 10 ... Application server group 10a, 10b ... Application server 11 ... Access control server 12 ... HGW address management server 13 ... HGW group 13a, 13b ... HGW
DESCRIPTION OF SYMBOLS 14 ... Home equipment group 14a-14d ... Home equipment 15 ... Remote terminal 30 ... External network 31 ... Dedicated network 32a, 32b ... Home network 131 ... Access control server communication part 132 ... HGW information acquisition part 133 ... Home equipment communication part 134 ... NAT / FW setting unit 135... Reverse proxy function unit 136... VPN server function unit 137. NAT / FW function unit

Claims (2)

In an access control system for accessing a home device connected to a home network from a remote terminal having a VPN client function arranged in an external network,
An identifier of the home device is stored in the storage means and is stored in the external network, and a management page for selecting a target home device from the connected home devices is displayed on the remote terminal, thereby An identifier of the selected target home device is retrieved from the storage means so that a VPN can be established between the home gateway located at the boundary between the external network and the home network and the remote terminal. A firewall setting request for setting firewall table information including port information used when establishing a VPN is transmitted to the home gateway, and after the VPN is established, an access that has reached an address on the VPN in the home gateway Transfer the request to the selected target home device. As to the reception server for transmitting a reverse proxy setting request for performing NAT setting request or reverse proxy configuration for setting the NAT table information,
Based on an access control list that defines access restrictions from the reception server / home device to the home device / reception server, the reception server that has transmitted the firewall setting request, the NAT setting request, or the reverse proxy setting request to the target home device. Judge whether access is possible, and if access is possible, identify a home gateway connected to the same home network as the target home device based on a home gateway identifier list from which the home gateway can be searched from the home device identifier An access control server that relays the firewall setting request, the NAT setting request or the reverse proxy setting request to the identified home gateway via a dedicated network;
An access control server communication unit that receives the firewall setting request or NAT setting request or reverse proxy setting request relayed from the access control server via a dedicated network, and is set in itself when the firewall setting request is received. An information acquisition unit that acquires an address on the external network side and acquires an address on the VPN in the home gateway when the NAT setting request or reverse proxy setting request is received; and the NAT setting request or reverse proxy setting request When receiving the firewall setting request, the home device communication unit broadcasts to the home network using the identifier of the target home device and obtains the local address of the target home device. When the firewall table information is set using the external network side address and the port information set in the server, and when the NAT setting request or reverse proxy setting request is received, the home gateway In response to the NAT setting request or reverse proxy setting request using the address on the VPN in the home gateway and the determined port number and the local address of the target home device after determining the port number waiting on the VPN in FIG. And a VPN server function unit that establishes a VPN with the home gateway according to a VPN establishment request transmitted from the remote terminal based on the set firewall table information. And an arm gateway,
The reception server generates a URI or RDP file using an address on the VPN in the home gateway and the determined port number, generates a link to the URI or RDP file, and sends an access request from the remote terminal. An access control system, wherein a transition is made from a management page to the target home device via an established VPN. In an access control method for accessing a home device connected to a home network from a remote terminal having a VPN client function arranged in an external network,
The reception server arranged in the external network stores the identifier of the home device in a storage unit, and displays a management page for selecting a target home device from the connected home devices on the remote terminal Thus, the identifier of the target home device selected can be retrieved from the storage means so that a VPN can be established between the home gateway and the remote terminal located at the boundary between the external network and the home network. Sending a firewall setting request for setting firewall table information including port information used when establishing the VPN to the home gateway;
Whether or not the reception server that has transmitted the firewall setting request can access the target home device based on an access control list that defines an access restriction from the reception server / home device to the home device / reception server. A home gateway connected to the same home network as the target home device based on a home gateway identifier list that can be searched from the home device identifier based on the home gateway identifier. Relaying the firewall setting request to the home gateway via a dedicated network;
The access control server communication unit of the home gateway receives the firewall setting request relayed from the access control server via a dedicated network;
The information acquisition unit of the home gateway acquires an address on the external network side set in itself when the firewall setting request is received;
The setting unit of the home gateway sets the table information of the firewall using the external network side address and the port information set to the self when the firewall setting request is received;
The VPN server function unit of the home gateway establishes a VPN with the home gateway according to a VPN establishment request transmitted from the remote terminal according to the set firewall table information;
A NAT setting request or reverse proxy for setting NAT table information so that the reception server transfers an access request reaching the address on the VPN in the home gateway after the VPN is established to the selected target home device. Sending a reverse proxy setup request to configure,
The reception server that has transmitted the NAT setting request or the reverse proxy setting request based on an access control list in which the access control server defines an access restriction from the reception server / home device to the home device / reception server. The home gateway connected to the same home network as the target home device based on the home gateway identifier list from which the home gateway can be searched from the home device identifier. Relaying the NAT setting request or reverse proxy setting request to the specified home gateway via a dedicated network;
The access control server communication unit of the home gateway receives the NAT setting request or reverse proxy setting request relayed from the access control server via a dedicated network;
The information acquisition unit of the home gateway acquires an address on the VPN set in itself when receiving the NAT setting request or the reverse proxy setting request;
When the home device communication unit of the home gateway receives the NAT setting request or reverse proxy setting request, it broadcasts to the home network using the identifier of the target home device to acquire the local address of the target home device. Steps,
When the setting unit of the home gateway receives the NAT setting request or the reverse proxy setting request, after determining the port number to wait on the VPN in the home gateway, the address on the VPN and the determined port number Using the local address of the target home device to perform settings according to the NAT setting request or reverse proxy setting request;
The reception server generates a URI or RDP file using the address on the VPN in the home gateway and the determined port number, generates a link to the URI or RDP file, and sends an access request from the remote terminal. Transition from the management page to the target home device via the established VPN;
An access control method comprising:

Images