JP2014053731A - Remote controlled device, remote controller, remote control support device, remote control system and remote control method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To perform remote control for PBX with high security at a timing required by a remote site.SOLUTION: An NMS device stores presence or absence of a remote control request, and a remote controlled PBX inquires presence or absence of a remote control request periodically. When the presence of a remote control request is replied, the PBX forms and transmits an information notice signal including information for making a remote controller connectable with the PBX, and a firewall device switches to an internal state for passing a control request signal when passing the information notice signal. The information notice signal arrives at the remote controller via the NMS device, and the remote controller forms a control request signal for requesting remote control, based on the information included in the information notice signal, and transmits that signal to the PBX.

Description

  The present invention relates to a remote control target device, a remote control device, a remote control support device, a remote control system, and a remote control method. For example, when controlling a PBX (Private Branch eXchange) from a remote location via the Internet. It can be applied.

  Conventionally, when a PBX is controlled from a remote location via the Internet, a firewall device that can communicate only with a predetermined communication port (TCP port or UDP port) number is provided between the Internet and the PBX from the viewpoint of ensuring security. It was installed in between and the PBX was controlled from a remote location.

  Incidentally, a firewall device capable of communicating only a predetermined communication port number is described in Patent Document 1, and setting of a communicable communication port number is described in Non-Patent Document 1.

JP 2012-34334 A

IETF / RFC1700

  However, in the above configuration, since the port number is determined, unauthorized access and manipulation can be performed by investigating and discovering the port number that can be communicated by many unspecified users on the Internet by means such as port scanning. Exposed to security threats.

  Therefore, a PBX connected to the Internet can communicate with a remote site by making a communication request from the PBX to the remote site via the Internet without setting a firewall device so that a specific port number can be communicated from the remote site. Informal port numbers are also reported. Here, it is general that the communicable port number to be notified changes randomly. As a result, the above-described problem is solved, but since it is a communication request from the PBX, remote control cannot be executed at the timing required by the remote base which is the original purpose.

  When a firewall device is installed, the firewall device may confirm whether or not a connection request is required with the IP address of the connection source in addition to whether or not a connection request is required based on the port number. However, the use of remote control is used by the system administrator from various places including the whereabouts, and the connection source often fluctuates. Therefore, remote control cannot be executed at the timing required by the system administrator (remote base).

  Therefore, a remote control system and a remote control method capable of executing remote control on a remote control target device with high security at a timing required by a remote base are desired, and a device constituting such a remote control system is desired. It is rare.

  A first aspect of the present invention is a remote control system in which a remote control device remotely controls a remote control target device having a firewall device via a network. (1) The remote control target device, the remote control device and the network are connected to each other. A remote control support device that can be connected via the remote control support device, the remote control support device comprising: (1-1) request presence / absence storage means for storing the presence / absence of a remote control request; and (1-2) the remote control target device. In response to an inquiry from the user, when a request for remote control is stored, inquiry response means for returning the presence of the request, and (1-3) the remote control device can be connected to the remote control target device. Transfer means for transferring an information notification signal from the remote control target device to which the information is incorporated, and (2) the remote control target device includes: 2-1) Inquiry means for inquiring the remote control support device whether or not there is a request for remote control; (2-2) When the presence of a remote control request is returned from the remote control support device, the information notification signal is sent And (3) the remote control device forms a control request signal for requesting remote control based on the information included in the received information notification signal, and (4) The firewall device includes a control request permission unit that switches to an internal state that allows the control request signal to pass when the information notification signal is passed. It is characterized by that.

  The second aspect of the present invention is a remote control method in which a remote control device remotely controls a remote control target device having a firewall device via a network. (1) The request presence / absence storage means of the remote control support device is a remote control. (2) The inquiry means of the remote control target device inquires of the remote control support device whether there is a request for remote control, and (3) the response means of the remote control support device In response to the inquiry, when the request for remote control is stored, the presence of the request is returned. (4) When the information notification transmission means of the remote control target device returns the presence of the request for remote control. The remote control device forms and transmits an information notification signal including information that can be connected to the remote control target device, and (5) controls the firewall device When the request permission means passes the information notification signal, the request permission means switches to an internal state that allows the control request signal to pass. (6) The transfer means of the remote control support device transfers from the remote control target device to the remote control device. (7) The control request transmitting means of the remote control device forms the control request signal for requesting remote control based on the information included in the received information notification signal. And transmitting to the remote control device.

  According to a third aspect of the present invention, there is provided the remote control target device, the remote control device, and the network provided in a remote control system in which the remote control device remotely controls the remote control target device having the firewall device via the network. A remote control support device that can be connected via the remote control request device, comprising: (1) a request presence / absence storage means storing remote control request presence / absence; and (2) a remote control request in response to an inquiry from the remote control target device. Inquiry response means for returning the presence of a request when (3) is stored, and (3) the remote control target device including information that allows the remote control device to connect to the remote control target device And a transfer means for transferring an information notification signal to the remote control device.

  A fourth aspect of the present invention is a remote control target device in a remote control system in which a remote control device having a firewall device is remotely controlled by a remote control device via a network. (1) The remote control target device and the remote control Inquiry means for inquiring whether or not there is a request for remote control to a remote control support apparatus connectable to the apparatus via the network, and (2) when the presence of a remote control request is returned from the remote control support apparatus It is characterized by comprising information notification transmitting means for forming and transmitting a notification signal.

  According to a fifth aspect of the present invention, in the remote control device in a remote control system in which a remote control device remotely controls a remote control target device having a firewall device via a network, the remote control target device, the remote control device, and the network A control request signal for forming a control request signal for requesting remote control based on information included in the information notification signal received from the remote control support device connectable via the remote control device, and transmitting the request to the remote control device Means are provided.

  According to the present invention, remote control can be executed on a remote control target device with high security at a timing required by a remote base.

It is a block diagram which shows the whole structure of the remote control system of embodiment. It is each part sequence diagram which shows the characteristic operation | movement in the remote control system of embodiment. It is explanatory drawing which shows the format of the signal transmitted / received between the apparatuses in the remote control system of embodiment.

(A) Main Embodiment An embodiment of a remote control target device, a remote control device, a remote control support device, a remote control system, and a remote control method according to the present invention will be described below with reference to the drawings. The remote control target device of the embodiment is a PBX.

  As will be described in detail below, the features of the embodiment will be briefly described. In order to realize teaching the remote control device of the address (IP address and port number) opened by the PBX in the Internet where the firewall device is interposed. The PBX regularly monitors the NMS device, and the firewall device allows subsequent signals by the stateful inspection function for the passage of the periodic monitoring signal.

(A-1) Configuration of Embodiment FIG. 1 is a block diagram showing an overall configuration of a remote control system according to the embodiment.

  In FIG. 1, in the remote control system 1 of the embodiment, a PBX 2 that is a remote control target device and a remote control device 3 are opposed to each other with the Internet 4 interposed therebetween. Firewall devices 5 and 6 are installed near the Internet 4 of the PBX 2 and the remote control device 3, respectively. In this embodiment, an NMS (Network Management System; network management system) device 7 is also a component (remote control support device) of the remote control system 1.

  In terms of hardware, the PBX 2 includes a LAN interface 10 (which may be a detachable LAN communication card) that enables LAN communication, and a hardware configuration for executing software (CPU, memory, etc .; not shown) ), A large-capacity storage device (not shown) for storing a large amount of data such as station data, etc., and the CPU mounted on the PBX 2 executes software (PBX software) 11 for operating the PBX. ing.

  Although the PBX software 11 is not shown, functionally, when an inquiry means for inquiring the NMS device 7 about the presence or absence of a request for remote control and the presence of a request for remote control from the NMS device 7 are returned, Information notification transmission means for forming and transmitting an information notification signal.

  The remote control device 3 corresponds to an information processing device such as a personal computer having the LAN interface 12, and transmits a signal according to the operation of the system administrator or receives the signal toward the system administrator. Or to display. In the case of this embodiment, the remote control device 3 registers in advance the NMS device 7 that supports remote control.

  Although not shown, the remote control device 3 functionally forms a control request signal for requesting remote control based on the information included in the received information notification signal and addresses the remote control device 3 to the remote control device. Control request transmitting means for transmitting the information.

  Each of the firewall devices 5 and 6 has a configuration of an existing firewall device.

  The firewall device 5 has software (FW software) 13 for restricting communication from the Internet 4 to the LAN, and this FW software 13 is used for communication when a connection request from the LAN to the Internet 4 is made. It also has a function of automatically assigning TCP / UDP ports. Further, the FW software 13 can set whether or not a connection request from the Internet 4 can be made for each TCP / UDP port number. Furthermore, the firewall device 5 is compatible with the stateful inspection function.

  Although the firewall device 5 may or may not have a NAT (Network Address Translator) function, the firewall device 5 will be described below as having the NAT function.

  Although not shown, the firewall device 5 functionally includes a control request permission unit that switches to an internal state that allows the control request signal to pass when the information notification signal is passed.

  In terms of hardware, the NMS device 7 has a communication unit (not shown), a hardware configuration for executing software (CPU, memory, etc .; not shown), and the mounted CPU is software. (NMS software) 14 is executed. The NMS software 14 analyzes and processes each information notification in order to manage the operational status (normal / failure, etc.) of the PBX 2 and other devices.

  Although not shown, the NMS device 7 functionally stores a request presence / absence storage means for storing the presence / absence of a request for remote control and a request for remote control in response to an inquiry from the PBX 2. Sometimes, an inquiry response means for returning the presence of a request, and a transfer means for transferring an information notification signal from the PBX 2 to the remote control apparatus 3 that includes information that allows the remote control apparatus 3 to connect to the PBX 2 Is provided.

(A-2) Operation of Embodiment Next, the operation (remote control method) of the remote control system 1 of the embodiment, particularly the operation that enables the remote control device 3 to access the PBX 2 via the firewall device 5 will be described. To do.

  When the system administrator performs remote control of the PBX 2 using the remote control device 3, a connection from the remote control device 3 to the PBX 2 is usually attempted. However, the connection request may be rejected by the firewall device 5. At such time, the characteristic operation in the remote control system 1 of the embodiment is executed.

  FIG. 2 is a sequence diagram of each part showing a characteristic operation, and FIG. 3 is an explanatory diagram showing a format of a signal exchanged between apparatuses. Note that the signal that appears in the following description is an IP packet.

  When the connection request rejection transmitted by the firewall device 5 is received, the system administrator operates the remote control device 3 to connect to the NMS device 7 registered in advance, and after connection, A control request signal S1 for remote control for the PBX 2 is transmitted to the NMS device 7 (step 100). When the NMS device 7 receives the control request signal S1, the NMS software 14 receives the control request flag provided for each control device identifier (IP address or port number of the firewall device 5 or PBX 2). Data is registered with the control request flag F relating to PBX2 defined as the control target by the control request signal S1 being ON (step 101).

  On the other hand, the PBX 2 of this embodiment transmits a periodic monitoring signal S2 to the NMS device 7 in order to perform periodic monitoring in a short cycle (for example, 1 second) (step 102). The regular monitoring signal S2 naturally passes through the firewall device 5 and reaches the NMS device 7. FIG. 3A shows the configuration of the periodic monitoring signal S2. The periodic monitoring signal S2 is described in the request type header (Header) of the common part as “server status inquiry (the server here means the NMS device 7)”, and any information is inserted in the data part. Not.

  When the NMS device 7 receives the periodic monitoring signal S2, the NMS software 14 extracts and extracts the transmission source information (IP address or port number of the firewall device 5 or PBX 2) set in the periodic monitoring signal S2. It is checked whether data registration related to the control request flag F is performed using the transmission source information as an identifier (step 103).

  If the data is not registered in relation to the control request flag F, the illustration is omitted, but the NMS device 7 ignores the reception of the periodic monitoring signal S2 or relates to the control request flag F. Then, a signal including that the data has not been registered is returned to the transmission source PBX 2.

  On the other hand, when the data is registered in relation to the control request flag F, the NMS device 7 performs periodic monitoring + control request signal S3 including registration data related to the control request flag F with respect to the PBX 2. Is transmitted (step 104). FIG. 3B shows a configuration of the periodic monitoring + control request signal S3. The periodic monitoring + control request signal S3 is described as “server status response + control request” in the request type header of the common part, and data registered in association with the control request flag F is inserted in the data part. . FIG. 3B is an example in which “control type = notification of failure log” is described in the data section, and it is indicated that the requested remote control (type) is to notify (retrieve) the failure log. Represents. Other types of remote control include station data notification, traffic log notification, and online data change operation.

  When the PBX 2 receives the periodic monitoring + control request signal S3, the PBX 2 transmits information notification signals S4a and S4b to the NMS device 7 (step 105). Strictly speaking, the information notification signal S4a from the PBX 2 to the firewall device 5 and the information notification signal S4b from the firewall device 5 to the NMS device 7 are slightly different in configuration. The information notification signal S4a from the PBX 2 to the firewall device 5 is the IP address and port number of the PBX 2 as the transmission source information, but the information notification signal S4b from the firewall device 5 to the NMS device 7 is the NAT function of the firewall device 5. Thus, the transmission source information is the IP address and port number of the firewall device 5. FIG. 3C shows the configuration of the information notification signal S4b from the firewall device 5 to the NMS device 7. This information notification signal S4b is described as “connection information notification” in the request type header of the common part, and in the data part, main device connection information such as the IP address and port number of the PBX 2 and connection account such as ID and password. Contains information. The above-described IP address and port number of the firewall device 5 are included in the IP header and TCP header of the information notification signal S4b.

  When the NMS device 7 receives the information notification signal S4b, the NMS device 7 extracts the transmission source information (the IP address and port number of the PBX 2 and the firewall device 5) set therein and transmits the information notification signal to the remote control device 3 S4c is generated and transmitted (step 106). In the information notification signal S4c, the IP address and port number of the PBX 2 and the firewall device 5 are set in the data portion, for example. The transmission source information in the information notification signal S4c is the transmission source information (the IP address or port number of the firewall device 5) of the information notification signal S4b.

  Whether or not the transmission source information of the information notification signal S4c is changed depends on the function of the firewall device 6 provided in relation to the remote control device 3, and may be any in this embodiment. .

When the remote control device 3 receives the information notification signal S4c, the remote control device 3 extracts the IP address and port number of the PBX 2 and the firewall device 5 included therein and stores them in the remote control target device information memory 15 (step 107). Then, based on the information, the remote control device 3 forms and transmits a control request signal S5 for the PBX 2 and connects to the PBX 2 (step 108), and receives the control response signal S6 from the PBX 2 (step 109). . Transmission / reception of signals relating to remote control, such as transmission / reception of the control request signal S5 and control response signal S6, is executed automatically or in response to the operation of the system administrator, for example, as many times as necessary for remote control. The exchange of the control request signal S5 and the control response signal S6 is executed without going through the NMS device 7.

  FIG. 3D shows the configuration of the control request signal S5, and FIG. 3E shows the configuration of the control response signal S6. In the example of the control request signal S5 shown in FIG. 3D, “control request” is described in the request type header of the common part, and the requested control type is a fault log notification and requested in the data part. The detailed information is that there is a line failure. The example of the control response signal S6 shown in FIG. 3 (E) corresponds to the example of the control request signal S5 shown in FIG. 3 (D), and is described as “control response” in the request type header of the common part. The data section includes log information (log notification) of line faults belonging to the requested fault log notification.

  For example, the FW software 13 of the firewall device 5 has a correspondence between the configuration of the common unit in the information notification signal S4b from the LAN side to the WAN side and the configuration of the common unit in the control request signal S5 from the WAN side to the LAN side. The stateful inspection function is enabled, and the control request signal S5 going to the LAN side, in other words, going to the PBX 2 is permitted.

(A-3) Effect of Embodiment According to the above-described embodiment, when the remote control device registers in the NMS device that there is a request for remote control and the PBX periodically inquires the NMS device, the NMS If the device is registered, it responds that there is a control request registration. At this time, the PBX notifies the remote control device via the NMS device of information that can be accessed by itself, and the remote control device receives the notification. Since the remote control is performed without going through the NMS device, the communication port when connecting from the Internet of the firewall device provided in connection with the PBX can be made variable by selecting the accessible information described above. Remote control can be executed when necessary while preventing security threats from an unspecified number of users on the Internet.

  Here, even if the system administrator instructing remote control uses a remote PC as a remote control device, the firewall device opens the port according to the above procedure and Since the signal of the IP address passes through the firewall device, it can be remotely controlled using a personal computer or the like on the go while ensuring security.

(B) Other Embodiments Although not specified in the description of the above embodiment, the remote control device 3 turns off the control request flag F in response to the operation of the system administrator or after a predetermined time has elapsed. The signal to be transmitted is transmitted to the NMS device 7.

  In the above embodiment, the NMS device 7 (the NMS software 14) receives the control request signal S1 from the remote control device 3, and sets the control request flag F to ON to register the data related to the request contents. In addition to this, or alternatively, the NMS device 7 (the NMS software 14) may turn on the control request flag F at a preset time period. Even when it is turned on in such a time period, the remote control device 3 that automatically performs remote control at that time is determined in advance, and the NMS device 7 sets the information notification signal S4c to the predetermined remote control device 3. Forward. As described above, in the case of automatically turning on, when the automatic remote control is finished, the remote control device 3 transmits a signal for turning off the control request flag F to the NMS device 7 to control the control request flag. It is sufficient to turn off F.

  In the above embodiment, the PBX 2 transmits a periodic monitoring signal at a constant period. However, the period may be changed by a response to the previous periodic monitoring signal. For example, when a control request is notified in response to the previous periodic monitoring signal, the cycle may be switched long.

  In the above embodiment, the remote control support device that holds the control request from the remote control device 3 and notifies that there is a control request in response to the periodic monitoring inquiry from the PBX 2 is the NMS device 7. However, the remote control support device is not limited to the NMS device. For example, a SIP (Session Initiation Protocol) server may be applied, or an EMS (Element Management System) element may be applied. Here, it is preferable that the PBX 2 is a device in which the firewall device 5 is opened for frequent access in the processing.

  In the above embodiment, the portion related to the present invention in the PBX 2, the firewall device 5, and the NMS device 7 is configured with software as a center. However, a part or all of the portion configured with software is hardware. You may make it comprise a wear (for example, exclusive LSI chip).

  In the above embodiment, the remote control target device is the PBX 2, but the remote control target device is not limited to the PBX 2.

  DESCRIPTION OF SYMBOLS 1 ... Remote control system, 2 ... PBX, 3 ... Remote control apparatus, 4 ... Internet, 5, 6 ... Firewall apparatus, 7 ... NMS apparatus.

Claims (5)

In a remote control system in which a remote control target device having a firewall device is remotely controlled via a network by a remote control device,
A remote control support device connectable to the remote control target device and the remote control device via the network;
The remote control support device is
A request presence / absence storage means for storing a request for remote control;
In response to an inquiry from the remote control target device, when a request for remote control is stored, inquiry response means for returning the presence of the request;
Transfer means for transferring an information notification signal from the remote control target device to the remote control device, which contains information that allows the remote control device to connect to the remote control target device;
The remote control target device is:
Inquiry means for inquiring the remote control support device whether there is a request for remote control,
An information notification transmission means for forming and transmitting the information notification signal when the presence of a remote control request is returned from the remote control support device;
The remote control device is
Based on the information included in the received information notification signal, a control request signal for requesting remote control is formed and transmitted to the remote control device.
The firewall device
A remote control system comprising: a control request permission unit that switches to an internal state that allows the control request signal to pass when the information notification signal is passed. In a remote control method for remotely controlling a remote control target device having a firewall device via a network,
The request presence / absence storage means of the remote control support device stores the presence / absence of a request for remote control,
The inquiry means of the remote control target device inquires of the remote control support device whether there is a request for remote control,
In response to the inquiry, the response means of the remote control support device returns the presence of the request when the remote control request is stored,
An information notification signal including information that allows the remote control device to connect to the remote control target device when the information notification transmission means of the remote control target device returns a request for remote control. Form and send,
When the control request permission means of the firewall device passes the information notification signal, it switches to an internal state that allows the control request signal to pass.
The transfer means of the remote control support device transfers the information notification signal from the remote control target device to the remote control device,
The control request transmission means of the remote control device forms the control request signal for requesting remote control based on the information included in the received information notification signal, and transmits the control request signal to the remote control device. A remote control method characterized. A remote control system provided in a remote control system in which a remote control device remotely controls a remote control target device having a firewall device via a network, and is connectable to the remote control device and the remote control device via the network. A support device,
A request presence / absence storage means for storing a request for remote control;
In response to an inquiry from the remote control target device, when a request for remote control is stored, inquiry response means for returning the presence of the request;
Transfer means for transferring an information notification signal from the remote control target device to the remote control device, which contains information that allows the remote control device to connect to the remote control target device. Remote control support device. In a remote control target device in a remote control system in which a remote control device having a firewall device remotely controls the remote control device via a network,
Inquiry means for inquiring the remote control support device connectable to the remote control target device and the remote control device via the network, whether there is a request for remote control
An information notification transmitting means for forming and transmitting the information notification signal when the presence of a request for remote control is returned from the remote control support device. In a remote control device in a remote control system in which a remote control device remotely controls a remote control target device having a firewall device via a network,
Based on the information included in the information notification signal received from the remote control target device and the remote control support device connectable to the remote control device via the network, a control request signal for requesting remote control is formed. A remote control device comprising control request transmission means for transmitting to the remote control device.

Images