JP2013131207A - Thin client system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a thin client system which reduces development labor and costs, and has high security.SOLUTION: In a thin client system 10, terminals 12 connect to an application server 20 via a virtual server unit 30. The thin client system 10 comprises a session management device 24 having the virtual server unit 30. The virtual server unit 30 comprises a plurality of virtual servers 32 in which a thin client OS runs. The session management device 24 comprises: an allocation management unit 34 for managing allocation of the respective virtual servers 32 to the terminals 12 by a round-robin system; a database 38 for storing first authentication information which enables the terminals 12 to connect to the virtual servers 32 and encrypted individual connection data which enables the terminals 12 to connect to the application server 20; and a control unit 26 for determining propriety of connection to the virtual servers 32 and connection to the application server 20.

Description

  The present invention relates to a thin client system in which a terminal connects to an application server via a virtual server unit.

  In recent years, with changes in work styles, thin clients have been used outside the company to realize a work environment similar to that in the company. In order to prevent leakage of in-house information and the like, a thin client using an authentication key for identifying a user is used (Patent Documents 1 and 2).

  In a server-based thin client, processing such as execution of an application is performed on a server by remote operation from a terminal that is a thin client, and a processing result by the server is displayed on the terminal.

JP 2010-92240 A JP 2010-211406 A

  However, in the server-based thin client, it is necessary to develop an application for connecting to the server for each OS provided in the terminal, or to modify the OS, which requires a labor and cost for development. there were.

  The present invention has been made in consideration of the above-described problems, and an object of the present invention is to provide a thin client system that reduces development effort and cost and has high security.

  A thin client system according to the present invention is a thin client system in which a terminal connects to an application server via a virtual server unit, and includes a session management device having the virtual server unit, and the virtual server unit includes a thin client An OS has a plurality of virtual servers, and the session management device has an allocation management unit that manages the allocation of each virtual server to the terminal in a round-robin manner, and for the terminal to connect to the virtual server A database storing first authentication information and encrypted individual connection data for connection to the application server, and the virtual server of the terminal based on the first authentication information stored in the database Whether the individual connection data is stored in the database. A control unit that determines whether or not the terminal can be connected to the application server based on the first authentication information. The control unit acquires second authentication information from the terminal and stores the first authentication information stored in the database. The authentication information is collated, and if it matches, the terminal is allowed to connect to the virtual server, and the control unit obtains a decryption password for decrypting the individual connection data from the terminal and stores it in the database When the individual connection data is decrypted by the decryption password, the application server can be remotely operated by the terminal.

  In the thin client system, the session management device sets a flag when the individual connection data is read by the terminal, and the individual connection data from another terminal while the terminal is connected to the virtual server. Is prohibited from being read.

  In the thin client system, when the terminal is a smartphone having a routing function, the terminal includes a memory that stores an application that is executed by a controller and receives an instruction from the session management device. Executes the application, receives a terminal authentication key acquisition command, which is authentication information for identifying the subscriber of the terminal, from the session management device, and transmits the terminal authentication key to the session management device, Acquired by the session management device.

  According to the thin client system of the present invention, it is possible to provide a thin client system with high security by reducing the development labor and cost by realizing the function of the thin client with a virtual server. Also, by assigning terminals to virtual servers in a round robin manner, virtual servers can be operated efficiently. Furthermore, the connection of the terminal to the virtual server is verified based on the authentication information stored in the database, and when the individual connection data stored in the database can be decrypted by the decryption password, By enabling the operation, the security of the thin client system can be increased.

  The session management device sets a flag when the individual connection data is read by the terminal, and prohibits reading of the individual connection data while the terminal is connected to the virtual server. As a result, it is possible to prevent spoofing access by an unauthorized acquirer of authentication information.

  Furthermore, when the terminal is a smartphone having a routing function, the terminal has a memory that stores an application that is executed by the controller and receives a command from the session management device, and the controller executes the application, A terminal authentication key acquisition command, which is authentication information for specifying a terminal subscriber, is received from the session management apparatus, and the terminal authentication key is transmitted to the session management apparatus, which is acquired by the session management apparatus. Thereby, it is possible to connect to the virtual server unit using the terminal authentication key of the terminal that cannot use the AT command in communication with the session management apparatus, and to remotely control the application server.

It is explanatory drawing of the thin client system which concerns on embodiment of this invention. It is explanatory drawing of an allocation management table. 3A and 3B are explanatory diagrams of the user information table. It is explanatory drawing of the process sequence of the thin client system which concerns on embodiment of this invention. It is explanatory drawing about the terminal which is a smart phone. It is explanatory drawing of the process sequence in case a terminal is a smart phone.

  Embodiments of the present invention will be described below with reference to the drawings. FIG. 1 is an explanatory diagram of a thin client system 10 according to an embodiment of the present invention, FIG. 2 is an explanatory diagram of an allocation management table 36, and FIGS. 3A and 3B are explanatory diagrams of a user information table 40. FIG. 4 is an explanatory diagram of a processing procedure of the thin client system 10 according to the embodiment of the present invention.

<Description of Configuration of Thin Client System 10>
The thin client system 10 includes terminals 12a to 12e, a public line 14, a VPN (Virtual Private Network) 16, a firewall 18, an application server 20, and a session management device 24.

  The terminals 12a to 12e (referred to collectively as “terminal 12” as appropriate) are terminals having a communication function, and the terminal 12e is a smartphone having a routing function equipped with a general-purpose OS. The public line 14 is a public line constituted by the Internet or the like. The firewall 18 is a firewall that prevents unauthorized access to the application server 20. The application server 20 is a server that performs processing such as application execution, file input / output, and data storage. The application server 20 is provided with a firewall 18 between the public line 14 and installed in a DMZ (demilitarized zone) 22.

  The session management device 24 includes a control unit 26, a communication unit 28, a virtual server unit 30, an allocation management unit 34, and a database 38. The application server 20 and the communication unit 28 are connected by a VPN (Virtual Private Network) 16 via a firewall 18.

  The control unit 26 is a control unit that performs overall control of the session management device 24. The communication unit 28 performs communication processing with the terminal 12 and communication processing with the application server 20.

  The virtual server unit 30 includes virtual servers 32a to 32c that are activated by the thin client OS. Each of the virtual servers 32a to 32c has an IP address and can be connected to the application server 20 alone. Further, in order from the highest priority of assignment to the terminal 12, virtual server 32a> virtual server 32b> virtual server 32c.

  The allocation management unit 34 includes an allocation management table 36 and manages connection of the terminal 12 to the virtual server unit 30 based on the allocation management table 36. The allocation management table 36 stores virtual server names and virtual server allocation states. The allocation management unit 34 permits connection to the virtual server unit 30 in a round robin manner.

  The database 38 is a database including a user information table 40 in which information regarding whether or not the terminal 12 can be connected to the virtual server unit 30 and whether or not the terminal 12 can be connected to the application server 20 is stored. Specifically, the user information table 40 includes a user ID and a user password, which are authentication information (first authentication information) for connecting to the virtual server unit 30, and a connection for connecting to the application server 20. An encrypted individual connection data such as a password, a decryption password for decrypting the encryption of the individual connection data, and a read state to the individual connection data are stored. As shown in FIGS. 3A and 3B, for example, for the terminal 12a, Ia, Pa, Sa, Da are used as user information in this order as a user ID, user password, individual connection data, and decryption password. It is stored in the table 40. Similarly, user IDs and the like are stored in the user information table 40 for the terminals 12b to 12d. In addition, about the terminal 12e, there are a case where a user password is not set as described later, and a case where the same user password as the user ID is set.

<Description of Operation of Thin Client System 10>
Next, the operation of the thin client system 10 will be described with reference to FIG. FIG. 4 is an explanatory diagram of a processing procedure of the thin client system 10 according to the embodiment of the present invention. Hereinafter, a case where the terminal 12a connects to the application server 20 will be described. The terminals 12b to 12d can be connected to the application server 20 in the same processing procedure.

  The user connects to the session management device 24 via the public line 14 by the terminal 12a (step S1). The control unit 26 of the session management device 24 uses the user ID and the authentication information (second authentication information) for connecting the terminal 12a to the virtual server unit 30 via the public line 14 from the communication unit 28. Send a request to enter the user password. The terminal 12a displays that the input is requested on the display screen. The user of the terminal 12 a inputs the user ID and user password, and the input user ID and user password are transmitted to the session management device 24. The control unit 26 acquires a user ID and a user password as authentication information (step S2).

  The allocation management unit 34 confirms the allocation status of the virtual server unit 30 based on the allocation management table 36, and allocates the virtual servers 32a to 32c to the terminal 12a (step S3). The virtual servers 32a to 32c are assigned by a round robin method. That is, after confirming the allocation status of the virtual servers 32a to 32c, the allocation management unit 34 allocates virtual servers that are not allocated to the terminals 12a in the order of connection requests according to the priority of allocation. The terminal 12a is assigned to the virtual server 32a, and is stored in the assignment management table 36 as assigned to the virtual server 32a (FIG. 2).

  The virtual server unit 30 includes only three virtual servers. For example, when the terminals 12 a to 12 c are connected to the virtual server unit 30, the terminal 12 d that is the fourth connection request cannot be connected to the virtual server unit 30. In such a case, after the connection of any terminal of the virtual server unit 30 is completed, the terminal 12d can connect to the terminated virtual server.

  The control unit 26 collates the user ID and user password transmitted from the terminal 12a with the user ID and user password of the terminal 12a stored in the user information table 40 of the database 38 (step S40). S4). If the user ID and the user password transmitted from the terminal 12a are Ia and Pa, respectively, the control unit 26 determines that the collation matches (step S4 YES), and the individual connection data (Sa) of the terminal 12a. In the database 38, the user information table 40 is flagged as the individual connection data has been read (FIG. 3B). In FIG. 3B, the flag is written as “read”. If the user ID and the user password do not match, it is requested to input the user ID and the user password again (NO in step S4).

  Further, the control unit 26 sets a flag when the individual connection data is read out, thereby prohibiting the reading of the same individual connection data by another person while the terminal 12a is connected to the virtual server 32a. This process can prevent spoofing access. That is, it is assumed that an unauthorized acquirer other than a regular user of the terminal 12a has illegally acquired the user ID and user password of the terminal 12a. When the unauthorized acquirer inputs and connects the user ID and user password of the terminal 12a, the processing procedure from step S1 to S3 can be advanced. However, even if the unauthorized acquirer has advanced the processing procedure from step S1 to S3, the legitimate user of the terminal 12a has already set a flag for reading the individual connection data. Reading of the individual connection data Sa by the acquirer is prohibited. These processes prevent spoofing access by an unauthorized acquirer.

  Since the individual connection data is encrypted, the control unit 26 transmits to the terminal 12a a request for input of a decryption password for decrypting the individual connection data. The terminal 12a displays that the input is requested on the display screen. The user of the terminal 12 a inputs the decryption password and transmits it to the session management device 24. The control unit 26 collates the decryption password transmitted from the terminal 12a with the decryption password of the terminal 12a stored in the user information table 40 of the database 38 (step S5).

  If the decryption password transmitted from the terminal 12a is Da, the control unit 26 determines that the verification is matched (YES in step S5), the individual connection data is decrypted, and the application server passes through the virtual server 32a. 20 uses are allowed. By permission to use the application server 20, the terminal 12a can remotely operate the application server 20 (step S6). If the decryption passwords do not match, it is requested to input the decryption password again (NO in step S5).

  Further, when the terminal 12a stops the connection to the virtual server unit 30, the allocation of the virtual server 32a is canceled, and the flag indicating reading of the individual connection data is returned to the state before reading.

  Next, a case where the terminal 12e connects to the application server 20 will be described. When a smartphone is used as the terminal, the authentication key stored in the portable terminal cannot be acquired from the external device. This is because a smartphone cannot perform control using an AT command from an external device such as a thin client.

  FIG. 5 is an explanatory diagram of the terminal 12e that is a smartphone, and FIG. 6 is an explanatory diagram of a processing procedure when the terminal is a smartphone.

  The terminal 12 e includes a controller 42, a USIM (Universal Subscriber Identity Module) 44, and a memory 48.

  The controller 42 is a control unit that performs overall control of the terminal 12e. The USIM 44 is a memory module in which a terminal authentication key 46, which is unique subscriber information for identifying a subscriber of the terminal 12e such as a telephone number, is stored. The memory 48 stores an application 50 that is executed by the controller 42 and that receives commands from the session management device 24 with a smartphone. The application 50 is, for example, a java application written in the java language.

  First, in the terminal 12e, the application 50 in the memory 48 is executed by the controller 44 (step S11). By executing the application 50, a command from the session management device 24 can be received by the terminal 12e, and a state in which activation of the daemon is permitted is formed.

  The user connects to the session management device 24 via the public line 14 by the terminal 12e (step S12).

  The control unit 26 transmits an instruction requesting the terminal authentication key 46 of the terminal 12e to the terminal 12e. In the terminal 12e, since the application 50 is executed, the controller 42 can accept a command from the control unit 26. The controller 42 receives the command and starts a daemon for acquiring the terminal authentication key 46. The controller 42 executes the started daemon, acquires the terminal authentication key 46 from the USIM 44, and transmits it to the session management device 24. The control unit 26 receives the terminal authentication key 46, and the acquisition is completed (step S13).

  Step S14 is basically the same as step S3 described above. Step S15 is the same as step S4, step S16 is the same as step S5, and step S17 is the same as step S6.

  However, in step S15, a part of processing procedure is different from step S4. The terminal authentication key 46 of the terminal 12e is treated as a user ID in the user information table 40. Here, since the terminal authentication key 46 is unique, the user password of the terminal 12e is not set in the user information table 40. Therefore, in step S4, if the user ID stored in the user information table 40 matches the terminal authentication key 46, the authentication information matches.

  When the terminal 12 is a smartphone, the terminal authentication key 46 is unique, and therefore the user ID and the user password may be set to be the same in the user information table 40. In such a case, the terminal authentication key 46 is handled as a user ID and a user password, and collation processing is performed.

  As described above, the thin client system 10 is a thin client system in which the terminal 12 is connected to the application server 20 via the virtual server unit 30, and includes the session management device 24 having the virtual server unit 30. The virtual server unit 30 includes a plurality of virtual servers 32 on which a thin client OS is activated. The session management device 24 includes an assignment management unit 34 that manages the assignment of each virtual server 32 to the terminal 12 in a round robin manner, authentication information for the terminal 12 to connect to the virtual server 32, and the application A database 38 having encrypted individual connection data for connection to the server 20, and whether or not the terminal 12 can be connected to the virtual server 32 based on the authentication information stored in the database 38. And a control unit 26 that determines and determines whether or not the terminal 12 can be connected to the application server 20 based on the individual connection data stored in the database 38. The control unit 26 obtains authentication information from the terminal 12, collates it with the authentication information stored in the database 38, and if it matches, permits the connection of the terminal 12 to the virtual server 32, When the control unit 26 obtains a decryption password for decrypting the individual connection data from the terminal 12, and the individual connection data stored in the database 38 can be decrypted by the decryption password, the terminal 12 enables remote control of the application server 20.

  According to the thin client system 10, by realizing the thin client function with the virtual servers 32a to 32c, it is possible to provide a thin client system with reduced development effort and cost and high security. Further, by assigning the terminal 12 to the virtual servers 32a to 32c by the round robin method, the virtual servers 32a to 32c can be efficiently operated. Furthermore, when the connection of the terminal 12 to the virtual servers 32a to 32c is verified based on the authentication information stored in the database 38, and the individual connection data stored in the database 38 can be decrypted by the decryption password, By enabling remote control of the application server 20 by the terminal 12, the security of the thin client system can be increased.

  The virtual server unit 30 also has a role as a relay server that relays between the terminal 12 and the application server 20. Furthermore, each of the virtual servers 32a to 32c is a virtual server that is started by the thin client OS and functions as a thin client.

  The session management device 24 sets a flag when the individual connection data is read by the terminal 12 and prohibits reading of the individual connection data while the terminal 12 is connected to the virtual server 32. As a result, it is possible to prevent spoofing access by an unauthorized acquirer of authentication information.

  Further, when the terminal 12 is a smartphone having a routing function, the terminal 12 includes a memory 48 that stores an application 50 that is executed by the controller 42 and receives commands from the session management device 24. , Executing the application 50, receiving from the session management device 24 an instruction to acquire the terminal authentication key 46, which is authentication information for identifying the subscriber of the terminal 12, and transmitting the terminal authentication key 46 to the session management device 24. Acquired by the session management device 24. Thereby, it is possible to connect to the virtual server unit 30 using the terminal authentication key 46 of the terminal 12e that cannot use the AT command in communication with the session management device 24, and to remotely control the application server 20. be able to.

  It should be noted that the present invention is not limited to the above-described embodiment, and various configurations can be adopted without departing from the gist of the present invention.

  For example, in the thin client system 10, the terminal 12 has five terminals 12 a to 12 e and the virtual server unit 30 has three virtual servers 32 a to 32 c, but if the number of terminals 12 is equal to or greater than the number of virtual servers 32. However, the present invention is not limited to this.

10 ... Thin client systems 12a to 12e ... Terminal 14 ... Public line 16 ... VPN
18 ... Firewall 20 ... Application server 22 ... DMZ
24 ... Session management device 26 ... Control unit 28 ... Communication unit 30 ... Virtual server units 32a to 32c ... Virtual server 34 ... Assignment management unit 36 ... Assignment management table 38 ... Database 40 ... User information table 42 ... Controller 44 ... USIM
46 ... Terminal authentication key 48 ... Memory 50 ... Application

Claims (3)

A thin client system in which a terminal connects to an application server via a virtual server unit,
A session management device having the virtual server unit;
The virtual server unit includes a plurality of virtual servers that are started by a thin client OS,
The session management device includes:
An allocation management unit that manages allocation of each virtual server to the terminal in a round-robin manner;
A database storing first authentication information for the terminal to connect to the virtual server and encrypted individual connection data for connecting to the application server;
Based on the first authentication information stored in the database, it is determined whether or not the terminal can be connected to the virtual server, and based on the individual connection data stored in the database, the terminal is connected to the application server. A control unit for determining whether or not connection is possible;
With
The control unit obtains second authentication information from the terminal, collates with the first authentication information stored in the database, and permits a connection of the terminal to the virtual server when they match.
When the control unit obtains a decryption password for decrypting the individual connection data from the terminal, and the individual connection data stored in the database can be decrypted by the decryption password, the application by the terminal A thin client system that enables remote operation of a server. The thin client system according to claim 1,
The session management device sets a flag when the individual connection data is read by the terminal, and prohibits reading of the individual connection data from other terminals while the terminal is connected to the virtual server. Thin client system characterized by The thin client system according to claim 1 or 2,
When the terminal is a smartphone having a routing function,
The terminal includes a memory in which an application that is executed by a controller and receives an instruction from the session management device is stored;
The controller executes the application, receives a terminal authentication key acquisition command, which is authentication information for identifying a subscriber of the terminal, from the session management apparatus, and transmits the terminal authentication key to the session management apparatus And the session management device obtains the thin client system.

Images