JP3511623B2 - Remote VPN authentication / management system and remote VPN authentication / management system construction method - Google Patents

Description

Detailed Description of the Invention

[0001]

TECHNICAL FIELD OF THE INVENTION

[0002]

2. Description of the Related Art Japanese Unexamined Patent Publication No. 2000-341327 discloses a plurality of Internet providers (ISPs) regarding a VPN configuration system, an interwork router device, a packet communication system, a data communication device and a packet relay device.
As a method of providing a virtual private line (VPN) that spans multiple ISPs, by deploying a VPN conversion system at the entrance and exit of the ISP, a VPN that spans multiple ISPs
An example of realizing a service is shown.

Japanese Patent Laid-Open No. 2000-244547 discloses that
As a mobile terminal authentication method and a VPN communication method, a VPN communication method that spans different networks by accessing a server that manages the VPN with secret key information given when accessing a portal site is described. There is.

In Japanese Patent Laid-Open No. 2000-59357, V
As a method of constructing a PN service, register the ID number and password of the client using the network in the management server, distribute the IC card storing the authentication / encryption software to each client, and authenticate with the management server when accessing. And a method of providing a VPN service by assigning clients to usable VPNs.

[0005]

However, the conventional method has the following problems.

In the VPN configuration system, the interwork router device, the packet communication system, the data communication device, and the packet relay device disclosed in Japanese Patent Laid-Open No. 2000-341327, the VPN is set by link-by-link and managed and operated. The first problem is that the integrated VPN service is not managed and operated.

Further, in the mobile terminal authentication method and the VPN communication method disclosed in Japanese Patent Laid-Open No. 2000-244547, an IC card is distributed to a client, and the client terminal requires equipment such as an IC card reader. And in the communication across multiple ISPs,
There was a second problem that the operation and management of the tunnel server was not centrally performed.

The present invention has been made in view of these problems, and a first object thereof is to provide an operation management system and system for providing an integrated VPN service.

A second object is to provide a service for centrally managing and operating a VPN conversion device that provides a VPN service.

[0010]

According to a first aspect of the present invention, a client group and an ISP (internet service pro) are provided.
(vider) group, which is a server that remotely provides authentication / management services to a VPN conversion device group that provides end-to-end VPN (virtual private network) service, and provides service from the client group. Means for notifying the client group of the examination result after receiving and examining the application information for joining the client, and the application information from the client group determined to be able to provide a service in the examination result in the first storage unit. Means for registering for each client, and the V used by the client group determined to be able to provide a service based on the examination result
Means for registering information of the PN conversion device group in the first storage unit for each client, and means for registering a history of communication contents with the registered client group in the second storage unit for each client A means for registering a history of communication contents with the registered VPN conversion device in the third storage unit for each VPN conversion device, and a case where a certificate issuance request is issued from the registered VPN conversion device group When the client applies for communication destination information at the time of application for joining, means for registering the communication destination information in the fourth storage unit for each client, and means for issuing a certificate to the VPN conversion device group. When there is an inquiry from the VPN conversion device group to which the certificate has been issued as to whether communication to the communication destination is possible, the communication destination information registered in the fourth storage unit is detected at the communication destination. Means for, the search results the V
A means for notifying the PN conversion device group and a probe of a predetermined cycle is sent to the VPN conversion device group to which the certificate is issued.
Means for collecting status information from the VPN conversion device group and the VPN conversion device group to which the certificate is issued.
Analyzing the status information collected from the
Means for performing and VPN conversion device group to which the certificate is issued
By sending a probe of a predetermined period, statistics on traffic that is logging the VPN converter group
Means for collecting a predetermined cycle, V the authentication certificate is issued
Remote VPN authentication characterized by comprising: means for analyzing statistical information about traffic collected from the PN conversion device group; and means for reporting the analysis result to each of the client groups to which the certificate is issued.
A management server is provided.

According to a second aspect of the present invention, a client group equipped with a WWW browser and an ISP (internet ser
end-to-end
In a system for remotely providing an authentication / management service to a VPN conversion device group that provides an end VPN (virtual private network) service, after receiving and examining the subscription request information for the service provision from the client group, the examination result is displayed. Means for notifying the client group, means for registering the subscription application information from the client group determined to be serviceable by the examination result in the first storage unit for each client, and service possible by the examination result Means for registering the information of the VPN conversion device group used by the client group determined to be in the first storage unit for each client, and a history of communication contents with the registered client group in the second storage unit. Means for registering each client in the storage unit, and the registered VPN
A history of communication contents with the converter is stored in the third storage unit as the VP.
Means for registering each N conversion device, means for registering the communication destination information in the fourth storage unit for each client when the client applies for communication destination information when applying for subscription, and the registered VPN. When a certificate issuance request is issued from the conversion device group, the client group and the VPN
When there is an inquiry about means of issuing a certificate to the conversion device group and whether or not the VPN conversion device group to which the certificate is issued can communicate with the communication destination, the fourth storage unit is used at the communication destination. Means for retrieving the communication destination information registered in, and the retrieval result is the VPN in which the certificate is issued.
A means for notifying the conversion device group and a probe of a predetermined period are transmitted to the VPN conversion device group to which the certificate is issued ,
Means for collecting status information from the VPN converter group, collected from VPN converter group the authentication certificate is issued
To analyze the status information that has been collected and monitor and control the failure.
And the VPN conversion device group to which the certificate is issued.
And periodically transmit the probe, the predetermined peripheral statistics on traffic that is logging VPN converter group
And means for collecting the period, and means for analyzing the statistical traffic information collected from the VPN converter group the authentication certificate is issued, the analysis result in a predetermined cycle to said each client group the authentication certificate is issued to Means for editing the reporting information, means for hyperlinking the document information edited in the predetermined cycle to an email, and means for adding the email address of the client group in the first storage to the email. A means for transmitting the e-mail at a predetermined cycle; a means for displaying the reporting content on a WWW browser when a client group receiving the e-mail at the predetermined cycle opens the text information;
A remote VPN authentication / management server is provided.

The remote VPN authentication / management server is
Depending on the geographical conditions and the number of managing VPN conversion device groups to which the certificate is issued, the master server and slave
Means for forming a distributed system configuration by load balancing with a server group, and means for registering a history of communication between the master server and slave servers in a fifth storage unit for each slave server in the master server , The master
In the master server, if the server receives an acknowledgment from the slave server, the slave
In response to the confirmation response from the server group, a means for authenticating with a one-time password and a status information inquiry from the master server to the slave server group are performed at a predetermined cycle, and the confirmation response from the slave server group If there is a means for authenticating with the one-time password at the master server and the slave server to which status information of no response or failure is attached as a result of the response, the master server is best substituted. Slave server selecting means and the first storage relating to the selected alternative slave server relating to the VPN conversion device to which the certificate to be managed by the slave server has been issued from the master server. Section, the second storage section, the third storage section, and the fourth storage section, and sends confirmation information. And a replication for centrally managing the contents of the first storage unit, the second storage unit, the third storage unit and the fourth storage unit in the master server in the slave server group. Means may further be provided.

According to a third aspect of the present invention, in a remote VPN authentication / management system comprising the server, the VPN conversion device group, and the client terminal group, which are mutually connected by a network, The VPN conversion device transmits means for issuing a certificate issuance request to the server, means for storing the certificate returned from the server, and communication with the server when there is an access request from the client. Means for inquiring about availability, as a result of the inquiry, when a reply that restricts communication is received, means for rejecting a communication request from the client, and as a result of the inquiry, when a reply indicating that communication is possible is received, V to which the certificate of the communication partner has been issued
A function for performing negotiation such as an encryption method with a PN conversion device, means for providing the VPN service to the client, means for returning status information in response to a status inquiry from the server, and Or a means for registering the communication history from the storage unit in the storage unit, and a unit for returning the communication history information regarding the client in the storage unit when receiving the request for the communication history information from the server, , A VPN communication means, and a negotiation means such as an encryption method for VPN communication between the client terminal and the destination VPN conversion device, the remote VPN authentication / management system. Will be provided.

[0014]

BEST MODE FOR CARRYING OUT THE INVENTION A first embodiment will be described with reference to FIGS.

FIG. 1 shows the system configuration of the present invention. The terminal-X 101, the intranet-A 102, the intranet-B 103, the terminal-A in the intranet,
Intranet terminal-B105, VPN conversion device-A
106, VPN conversion device-B 107, remote VPN authentication / management server (master) 108, remote VPN authentication / management server (slave) 109, switching network 110, ISP-A1
11, ISP-X 112, and World Wide Internet 113.

FIG. 2 shows a functional configuration of the remote VPN authentication / management server, which is the subscriber information storage unit 20.
1. VPN conversion device information storage unit 202, X.509 directory storage unit 203, subscriber communication history storage unit 204, VPN communication history storage unit 205, slave communication history storage unit (master server) 206, VPN conversion device authentication function 211,
CA issue / registration function 212, X.509 directory storage search function 213, communication restriction control function 214, VPN converter diagnosis / analysis function 220, log information collection function 221, slave DB replication function 222, subscriber notification function 223 Log information analysis function 224, analysis result editing function 2
25, edited document transmission function 226, system reconfiguration function 230, slave diagnosis function (master server) 240, slave diagnosis analysis function 241, optimum alternative slave selection function (master server) 242, optimum slave relocation function ( Master server)
243, Slave information search / edit function (master /
Server 245 and external transmission / reception function 250.

The subscriber information storage unit 201 is a VP installed by the client when the client applies for a subscription.
Examining whether the N conversion device has the specifications for service provision, and if service provision is possible, authorize subscription,
The client's email address, the IP address of the VPN converter installed by the client, the service fee settlement method, the organization number, ID number, and signature number of the client issued by the server at the time of registration are stored. To do.

The VPN conversion device information storage unit 202 stores, for each client, information about the VPN conversion device that issued the CA.

The X.509 directory storage unit 203 manages the communication destination information that can be accessed for each client.
Stores directory information conforming to 509.

The subscriber communication history storage unit 204 stores, for each client, history information of communication with the client group that issued the CA.

The VPN communication history storage unit 205 stores communication history information with the VPN conversion device that issued the CA for each VPN conversion device.

The slave communication history storage unit (master server) 206 stores the history of communication with the slave server group in the master server.

The VPN conversion device authentication function 211 performs authentication when an access is made from a VPN conversion device that is authorized to join.

The CA issuance / registration function 212 is authorized to join.
Issues a certificate in response to a CA (certificate) request from the VPN conversion device.

X.509 directory storage search function 213
Responds to the inquiry from the VPN conversion device as to whether communication to the communication destination is possible, the communication destination is searched for communication destination information for each client in the X.509 directory storage unit 203.

The communication restriction control function 214 returns the communication availability to the VPN conversion device as a result of the X.509 directory storage section search.

The VPN converter diagnosis / analysis function 220 includes
The probe is sent to the VPN conversion device group that issued the CA at a predetermined cycle, and status information is collected from the VPN conversion device.

The log information collecting function 221 collects logging information such as traffic-related information in the VPN converter from the VPN converter at regular intervals.

Slave DB replication function 222
Is a master server, and activates a replication function of each storage unit in a slave server in order to centrally manage each storage unit in the master server.

The subscriber notification function 223 notifies the client to that effect when the result of the diagnosis / analysis of the VPN conversion device is judged to be abnormal.

The log information analysis function 224 analyzes the collected logging information.

The analysis result editing function 225 edits the result of analyzing the logging information in each VPN converter for each client.

The edited document sending function 226 hyperlinks the reporting information edited for each client and adds the mail address of each client and sends it.

System reconfiguration function 2
The 30 automatically reconfigures the system configuration when a failure occurs in the server system.

Slave diagnostic function (master server) 2
40 collects the status information of the slave server in the master server in a predetermined cycle.

The slave diagnostic analysis function 241 analyzes the status information from the slave server.

The optimum alternative slave selection function (master server) 242 selects the optimum alternative slave server in the master server when the slave server needs to be replaced.

The optimum slave relocation function (master server) 243 relocates necessary information to the slave server when the alternative slave server is selected.

Slave information search / edit function 245
When an alternative slave server is selected by the master server, retrieves, collects, and edits necessary information for the slave server from the associated storage unit.

The external transmission / reception function 250 transmits / receives communication to / from a client, a VPN converter, a master server, and a slave server group.

Next, the operation of the first embodiment will be described with reference to FIGS. 3 and 4.

In FIG. 3, when there is a service subscription application from the client (S301), whether or not the service can be provided is examined from the subscription application information, and when it is not possible, the examination result is notified by electronic mail (S303). When the service can be provided, the organization number, ID number, and signature number (password) are issued to each client and sent (S302), and registered in the service subscriber information storage unit 201 stored for each client.

Further, the communication destination information is registered in the X.509 directory storage unit which registers and manages for each client.

As a result of the examination, when it is determined that the service can be provided, and the VPN conversion device of the client to which the organization number, the ID number, and the signature number (password) are issued, issues a certificate (CA) (S31).
0), the organization number, the ID number, and the signature number (password) are used for authentication, and in the case of NG, a reply to that effect is sent (S312), and in the case of OK, the certificate is returned to the VPN conversion device (S311).

Next, a series of operations will be described with reference to FIG.

When an inquiry about whether or not communication with the communication destination is possible based on the access request (S410) from the client is received from the VPN conversion device which has issued the CA (S42).
0), authentication with the organization number, ID number, signature number (password), if it is NG, it is returned (S421), and if authentication is OK, the X.509 directory storage unit that manages registration on a client-by-client basis. Is searched for in the communication destination, it is determined whether the destination is registered in the communication destination information, and the determination result is returned to the VPN conversion device (S42).
2), limit and control communication.

Next, the remote VPN conversion device authentication / management server transmits a probe for collecting status information to the VPN conversion device group to which CA has been issued in a predetermined cycle (S430), and V
When a reply with status information from the PN converter is received (S431), the received result is analyzed, and if an abnormality is found in the VPN converter, the client is notified of that (S432), and the VPN device fails. Etc. are monitored.

Next, the remote VPN converter authentication / management server sends a probe for collecting traffic related information logged by the VPN converter to the VPN converter issued with a CA at a predetermined cycle (S440). ), Receives a reply from the VPN conversion device group with attached traffic related information logged by the VPN conversion device group (S441), collects the traffic related information of the VPN device group, and analyzes the collected traffic related statistical information. To do.

Next, the analyzed traffic related information is edited into a document, and a mail hyperlinking the edited sentence information to each client is transmitted (S442), and each client receiving the mail receives the edited sentence information. When is opened, the WWW browser is automatically started, the edited text information is accessed (S443), and the edited text is displayed on the screen of the WWW browser (S444).

The second embodiment will be described with reference to FIG.

As shown in FIG. 5, in the distributed system configuration,
A probe for inquiring the status status is transmitted from the master server 108 to the remote VPN authentication / management slave server group 501 at a predetermined cycle (S51).
0), the reply including the status information from the slave server group 501 is received (S511).

Next, when the master server 108 detects overload information, failure information or no response in the reply information from the slave server group 501, the master server 108 selects an optimum alternative slave server and Slave
By transmitting the alternative slave instruction to the server (S521), taking a confirmation response (S522), transmitting the substitution related information to the slave server (S523), and receiving the confirmation response (S524) from the slave server, Providing seamless consistency services to the provided services.

Next, in order to perform unified management by the master server 108, a transmission request (S530) of a difference from the previous transmission of each storage unit of the slave server is transmitted to the replication function of the slave server group 501 at a predetermined cycle, By performing the operation of receiving the difference of each storage unit (S531) to all the slave servers and updating / registering each storage unit of the master server 108, all the VPN servers are centralized.
It manages the conversion device and service providing client information.

FIG. 4 and FIG. 6 for the third embodiment.
Will be explained.

In the operation explanatory view of the present invention shown in FIG.
VPN conversion device group 402, remote VPN authentication management server 30
The operation for No. 3 is as shown in FIG.

Here, the terminal-A 104, the VPN conversion device-A 106 and the VPN conversion device-in the intranet in FIG.
The operation between the terminal and B105 in the intranet via B107 will be described with reference to FIG.

In FIG. 6, an access request (S61) is sent from the terminal-A104 in the intranet to the VPN converter.
0), the remote authentication management server is inquired as to whether or not the access is possible as shown in FIG. 4, and if the access is possible, the VPN converter-A 106 accesses the VPN converter-B 107 of the terminal-B 105 in the destination intranet. (S611), and negotiation (S612) such as an encryption method based on IPsec is performed between the VPN conversion devices (10).
6, 107) (S612), and after the VPN session is established, VPN communication is performed between the terminal-A 104 and the terminal-B 105 (S6).
13) is performed.

Next, the operation when the terminal is equipped with the VPN communication function will be described with reference to FIG.

In FIG. 7, terminal-X101 to ISP-
Connect to X112 by dial-up line connection (S710), connect to the connection port of ISP-X112 that you subscribed in advance, and send ID and password (S711) to ISP-X1
Received authentication from 12 and returned IP address (S712)
To be done.

Connection Destination Terminal-VPN Converter for A104-
A communication request is sent to the A106 (S713), and the negotiation of the encryption method based on the IPsec (S714) is performed by V.
After establishing a VPN session with the PN converter-A 106, VPN communication is performed between the terminal-X 101 and the terminal-A 104 by VPN communication (S715).

[0061]

The first effect of the present invention is end-to-end
It is to provide a simple and maintenance-free VPN converter authentication / management service at the end.

The second effect of the present invention is to provide a VPN service which is conventionally closed by one ISP and an integrated service for authentication / management thereof.

The third effect of the present invention is that a VPN service which has been conventionally closed by one ISP and a unified management service for authentication / management thereof are provided.

The fourth effect of the present invention is to provide a highly reliable service by adopting a distributed system configuration.

The fifth effect of the present invention is that the distributed system can reduce the traffic to and from the VPN converter.

The sixth effect of the present invention is that the initial investment of the slave server can be reduced by adopting the distributed system configuration.

[Brief description of drawings]

FIG. 1 is a system configuration outline diagram showing a system configuration outline of the present invention.

FIG. 2 is a system functional configuration diagram showing the functional configuration of the server of the present invention and the relationship between the functions.

FIG. 3 is a sequence diagram showing an operation between a client, a VPN conversion device, and a remote authentication management server from when a subscription application is received from the client of the present invention to when a CA is issued.

[Fig. 4] Client, VPN issued by CA in the present invention
It is a sequence diagram which shows operation | movement between a conversion apparatus and a remote authentication management server.

FIG. 5 is a sequence diagram showing operations of a master server and a slave server group when the system configuration of the present invention is a distributed system configuration.

FIG. 6 is a sequence diagram showing a system configuration and an operation of each system in communication between a terminal equipped with a VPN conversion function of the present invention and a terminal in an intranet via the VPN conversion device.

FIG. 7 is a sequence diagram showing a system configuration and operation in each system when VPN communication is performed between terminals in the intranet of the present invention.

[Explanation of symbols]

101 Terminal-X 102 Intranet-A 103 Intranet-B 104 Terminal in intranet-A 105 Terminal in intranet-B 106 VPN conversion device-A 107 VPN conversion device-B 108 Remote authentication management server (master server) 109 Remote Authentication management server (slave server) 110 Switching network 111 ISP-A 112 ISP-X 113 World Wide Internet 201 Subscriber information storage unit 202 VPN conversion device information storage unit 203 X.509 directory storage unit 204 Subscriber communication history storage unit 205 VPN communication history storage unit 206 Slave communication history storage unit (master server) 211 VPN conversion device authentication function 212 CA issuing / registration function 213 X.509 directory storage unit search function 214 Communication restriction control function 220 VPN conversion device diagnosis / analysis Function 221 Log information collection function 222 Slave DB replication function 223 Subscriber notification function 224 Log information analysis function 225 Analysis result editing function 226 Edit document transmission function 230 System reconfiguration function 240 Slave diagnosis function (master server) 241 Slave diagnosis Analysis function 242 Optimal alternative slave selection function (master server) 243 Optimal slave relocation function (master server) 245 Slave information search / edit function (master
Server) 250 External transmission / reception function 301 Client 302 VPN conversion device 303 Remote authentication management server 401 Client group 402 VPN conversion device group 501 Slave server group

Claims (11)

(57) [Claims] 1. A client group and an ISP (internet ser)
end-to-end
A server for remotely providing an authentication / management service for a VPN conversion device group that provides an end VPN (virtual private network) service receives and examines subscription application information for service provision from the client group, and then displays the examination result. Means for notifying the client group, means for registering the application information from the client group determined to be able to provide a service based on the examination result in the first storage unit for each client, and providing the service based on the examination result A means for registering information of the VPN conversion device group used by the client group determined to be possible in the first storage unit for each client, and a history of communication contents with the registered client group, a second Means for registering each client in the storage unit of the server, and communication contents of the registered VPN conversion device. Means for registering a history in the third storage unit for each of the VPN conversion devices; and when the registered client applies for information on a communication destination when applying for a subscription, the communication destination information is stored in the fourth storage unit. Means for registering for each client; means for issuing a certificate to the VPN conversion apparatus group when the registered VPN conversion apparatus group issues a certificate; and VPN conversion for which the certificate has been issued. When there is an inquiry from the device group about whether communication is possible to the communication destination, a unit for searching the communication destination information registered for each client in the fourth storage unit at the communication destination; A means for notifying the VPN conversion device group, and a means for notifying the VPN conversion device group that has issued the certificate of a predetermined period.
A means for transmitting a probe to collect status information from the VPN conversion device group, and a means for collecting the status information from the VPN conversion device group to which the certificate is issued.
Means to analyze status information and monitor and control failures
The VPN conversion device group to which the certificate has been issued
By sending a probe, and means for yield <br/> current at a predetermined period statistics on traffic that is logging the VPN converter group, for traffic collected from VPN converter group the authentication certificate is issued A remote VPN authentication / management server comprising: means for analyzing statistical information; and means for reporting the analysis result to each client group to which the certificate has been issued. 2. An end-to-end VPN (virtual pr) installed between a client group equipped with a WWW browser and an ISP (internet service provider) group.
In a system for remotely providing an authentication / management service for a VPN conversion device group that provides a private network) service, after accepting and examining a service application subscription request from the client group, the examination result is notified to the client group. Means, means for registering the subscription application information from the client group determined to be serviceable in the examination result in the first storage unit for each client, and the client determined to be serviceable in the examination result Means for registering information of the VPN conversion device group used by each group in the first storage unit for each client, and a history of communication contents with the registered client group in the second storage unit for each client And a history of contents of communication with the registered VPN conversion device group in the third storage unit. A unit for registering each N conversion device, a unit for registering each client in the fourth storage unit that stores the communication access destination information applied by the client group at the time of application for subscription, and from the registered VPN conversion device group When there is a request to issue a certificate, a means for issuing a certificate to the VPN conversion device group and an inquiry about whether or not communication from the VPN conversion device group to which the certificate is issued to a communication destination are inquired A means for retrieving the communication destination information registered for each client in the fourth storage unit at the communication destination; a means for notifying the retrieval result to a VPN conversion device group that issued the certificate. the predetermined cycle VPN converter group the authentication certificate is issued
A means for transmitting a probe to collect status information from the VPN conversion device group, and a means for collecting the status information from the VPN conversion device group to which the certificate is issued.
Means to analyze status information and monitor and control failures
The VPN conversion device group to which the certificate has been issued
By sending a probe, and means for yield <br/> current at a predetermined period statistics on traffic that is logging the VPN converter group, for traffic collected from VPN converter group the authentication certificate is issued Means for analyzing statistical information; means for editing the analysis result at a predetermined cycle for each client group to which the certificate has been issued; and means for hyperlinking the document information edited at the predetermined cycle to an electronic mail. Means, means for adding the email address of the client group in the first storage unit to the electronic mail, means for transmitting the electronic mail at a predetermined cycle, and client group for receiving the electronic mail at a predetermined cycle Means for displaying the reporting content on a WWW browser when the document information is opened by the user. Remote VPN authentication and management server that butterflies. 3. The remote VPN authentication according to claim 2.
In the management server, depending on geographical conditions and the number of managing VPN conversion device groups to which the certificate is issued, the master server and slave
A means for forming a distributed system configuration by load balancing with a server group, and a history of communication between the master server and the slave server group in the master server is registered in a fifth storage unit for each slave server. At the master server if the master server receives an acknowledgment from the slave server,
In response to the confirmation response from the slave server group,
A means for authenticating with a time password, and an inquiry about status information from the master server to the slave server group at a predetermined cycle.
In response to the confirmation response from the server group, if there is a means for authenticating with the one-time password in the master server, and the slave server with the status information of no response or failure attached as a result of the response, Optimum alternative slave server selecting means in the master server, and VPN conversion in which the master server issues the certificate to the selected alternative slave server, the master server managing the slave server. Means for transmitting related information of the first storage unit, the second storage unit, the third storage unit and the fourth storage unit regarding the device and taking a confirmation response; and the slave server group including the first storage unit. Storage of the second
A remote VPN authentication / management server comprising: a replication unit for centrally managing the contents of the storage unit, the third storage unit, and the fourth storage unit by a master server. 4. A client group and an ISP (internet ser)
end-to-end
A method for remotely providing an authentication / management service to a VPN conversion device group that provides an end VPN (virtual private network) service, comprising: receiving and examining a subscription request for service provision from the client group; Notifying the group of clients, registering the application information from the group of clients determined to be able to provide a service based on the examination result in the first storage unit for each client, and providing the service based on the examination result A step of registering information of the VPN conversion device group used by the client group determined to be possible in the first storage unit for each client, and a history of communication contents with the registered client group, Registering each of the clients in the storage unit of the server, and the registered VPN conversion device group Registering a history of the communication contents of each of the VPN conversion devices in the third storage unit, and when the client applies for the communication destination information when applying for the subscription, the communication destination information is stored in the fourth storage unit. A step of registering for each client; a step of issuing a certificate to the VPN conversion apparatus group when there is a certificate issuance request from the registered VPN conversion apparatus group; and a VPN in which the certificate is issued. A step of searching the communication destination information registered for each of the clients in the fourth storage unit at the communication destination when an inquiry is made from the conversion device group to the communication destination, the search result Is sent to the VPN conversion device group , and the VPN conversion device group to which the certificate is issued has a predetermined period.
A step of transmitting a probe to collect status information from the VPN converter group, and collecting the status information from the VPN converter group to which the certificate is issued.
A step that analyzes status information and monitors and controls failures.
And the VPN conversion device group to which the certificate has been issued
By sending a probe, a step of yield <br/> current at a predetermined period statistics on traffic that is logging the VPN converter group, for traffic collected from VPN converter group the authentication certificate is issued A method for providing a remote VPN authentication / management service, comprising: a step of analyzing statistical information; and a step of reporting the analysis result to each of the client groups to which the certificate is issued. 5. An end-to-end VPN (virtual pr) installed between a client group equipped with a WWW browser and an ISP (internet service provider) group.
A method for remotely providing an authentication / management service to a VPN conversion device group that provides a private network) service, which receives and examines a subscription request for service provision from the client group, and then notifies the client group of the examination result. Registering the subscription application information from the client group determined to be serviceable in the examination result for each client in the first storage unit; the client determined to be serviceable in the examination result Registering information of the VPN conversion device group used by each group in the first storage unit for each client, and a history of communication contents with the registered client group in the second storage unit for each client. And a history of communication contents with the registered VPN conversion device in the third storage. In each of the VPN converters, when the client applies for a communication destination when applying for a subscription, the communication destination information is registered in the fourth storage unit for each client, and the registered When a certificate issuance request is issued from the VPN converter group, a step of issuing the certificate to the client group and the VPN converter group; and a step from the VPN converter group having issued the certificate to a communication destination. When there is an inquiry as to whether or not communication is possible, a step of searching the communication destination information for the communication destination information registered for each client in the fourth storage unit at the communication destination, and the certificate of the search result is issued. A step of notifying the VPN conversion device group , and
A step of transmitting a probe to collect status information from the VPN converter group, and collecting the status information from the VPN converter group to which the certificate is issued.
A step that analyzes status information and monitors and controls failures.
And the VPN conversion device group to which the certificate has been issued
By sending a probe, a step of yield <br/> current at a predetermined period statistics on traffic that is logging the VPN converter group, for traffic collected from VPN converter group the authentication certificate is issued Analyzing statistical information; editing the analysis result at a predetermined cycle for each client group to which the certificate is issued; and hyperlinking the document information edited at the predetermined cycle to an electronic mail. A step of adding a mail address of the client group in the first storage unit to the electronic mail; a step of transmitting the electronic mail at a predetermined cycle; a client group receiving the electronic mail at a predetermined cycle When you open the text information, the WWW browser displays the reporting content. Steps and the remote VPN authentication and management service providing method, characterized in that it comprises a. 6. The remote VPN authentication according to claim 5.
In the management service providing method, depending on geographical conditions and the number of managing the VPN conversion device group to which the certificate is issued, the master server and the slave server
A step of forming a distributed server configuration by load balancing with a server group, and a step of registering a history of communication between the master server and the slave server in the fifth storage unit for each slave server in the master server And in the master server if the master server receives an acknowledgment from the slave server,
In response to the confirmation response from the slave server group,
The step of authenticating with the time password and the slave server group inquiring of the status information from the master server at a predetermined cycle are performed.
In response to the confirmation response from the server group, the step of authenticating with the one-time password at the master server; and, as a result of the response, if there is the slave server with no response or failure status information attached, In the master server, a step of selecting an optimum alternative slave server, and a VPN issued to the selected alternative slave server from the master server by the master server to issue the certificate to be managed by the slave server. Transmitting related information of the first storage unit, the second storage unit, the third storage unit, and the fourth storage unit regarding the conversion device to obtain a confirmation response, and the slave server group includes the first storage unit 1 storage unit, 2nd
And a replication step for centrally managing the contents of the storage unit, the third storage unit, and the fourth storage unit in the master server, and a remote VPN authentication / management service providing method. 7. A client group and an ISP (internet ser)
end-to-end
A program for causing a computer to execute a method of remotely providing an authentication / management service to a VPN conversion device group that provides an end VPN (virtual private network) service, the method comprising: A step of notifying the client group of the examination result after receiving and examining the subscription application information; and a step of notifying the application information from the client group determined to be able to provide a service in the first storage unit to the client in the first storage unit. Registering for each client, registering information of the VPN conversion device group used by the client group determined to be able to provide a service in the examination result in the first storage unit for each client, The history of the communication contents with the client that has been set is stored in the second storage unit as the client. Registering for each VPN conversion device, a history of communication contents with the registered VPN conversion device in the third storage unit for each VPN conversion device, and when the client applies for subscription, communication destination information is registered. When applying, a step of registering the communication destination information in the fourth storage unit for each client, and when there is a certificate issuance request from the registered VPN conversion device group, the client group and the VPN conversion are performed. A step of issuing a certificate to the device group; and, if there is an inquiry from the VPN conversion device group to which the certificate is issued to the communication destination whether or not communication is possible, the communication destination stores in the first storage unit. A step of searching the registered communication destination information; a step of notifying the VPN conversion device group of the search result; a VPN conversion device to which the certificate has been issued. The predetermined cycle group
A step of transmitting a probe to collect status information from the VPN converter group, and collecting the status information from the VPN converter group to which the certificate is issued.
A step that analyzes status information and monitors and controls failures.
And the VPN conversion device group to which the certificate has been issued
By sending a probe, a step of yield <br/> current at a predetermined period statistics on traffic that is logging the VPN converter group, for traffic collected from VPN converter group the authentication certificate is issued A program comprising: analyzing statistical information; and reporting the analysis result to each client group to which the certificate is issued. 8. An end-to-end VPN (virtual pr) installed between a client group having a WWW browser and an ISP (internet service provider) group.
In a program for causing a computer to execute a method for remotely providing an authentication / management service to a VPN conversion device group that provides a private network) service, the method receives and examines a service application subscription application from the client group. After that, a step of notifying the client group of the examination result, a step of registering the subscription application information from the client group determined to be serviceable in the examination result in the first storage unit for each client, Registering information of the VPN conversion device group used by the client group determined to be serviceable based on the examination result in the first storage unit for each client, and contents of communication with the registered client group Registering a history of the above in the second storage unit for each client, A step of registering the recorded history of communication contents with the VPN conversion device in the third storage unit for each of the VPN conversion devices; and when the client applies for the communication destination information at the time of application for joining, the communication destination information is stored. Registering in the fourth storage unit for each client; and, if there is a request to issue a certificate from the registered VPN converter group, the certificate is issued to the client group and the VPN converter group. And a step of searching the communication destination information registered in the first storage unit with the communication destination, when the VPN conversion device group to which the certificate is issued makes an inquiry as to whether communication to the communication destination is possible. And a step of notifying the VPN conversion device group to which the certificate has been issued with the search result, and a predetermined period to the VPN conversion device group to which the certificate has been issued .
A step of transmitting a probe to collect status information from the VPN converter group, and collecting the status information from the VPN converter group to which the certificate is issued.
A step that analyzes status information and monitors and controls failures.
And the VPN conversion device group to which the certificate has been issued
By sending a probe, a step of yield <br/> current at a predetermined period statistics on traffic that is logging the VPN converter group, for traffic collected from VPN converter group the authentication certificate is issued Analyzing statistical information; editing the analysis result at a predetermined cycle for each client group to which the certificate is issued; and hyperlinking the document information edited at the predetermined cycle to an electronic mail. A step of adding a mail address of the client group in the first storage unit to the electronic mail; a step of transmitting the electronic mail at a predetermined cycle; a client group receiving the electronic mail at a predetermined cycle When you open the text information, the WWW browser displays the reporting content. A program characterized by comprising the steps, a. 9. The remote VPN authentication according to claim 8.
In a program for causing a computer to execute the management service providing method, the method uses a master server and a slave server depending on geographical conditions and the number of managing VPN conversion device groups to which the certificate is issued.
A step of forming a distributed server configuration by load balancing with a server group; a step of registering a history of communication between the master server and a slave server in the fifth server in the master server for each of the slave servers. , In the master server if the master server receives an acknowledgment from the slave server,
In response to the confirmation response from the slave server group,
The step of authenticating with the time password and the slave server group inquiring of the status information from the master server at a predetermined cycle are performed.
In response to the confirmation response from the server group, the master server authenticates with the one-time password, and as a result of the response, if there is the slave server to which no response or failure status information is attached, In the master server, a step of selecting an optimum alternative slave server, and a VPN issued to the selected alternative slave server from the master server by the master server to issue the certificate to be managed by the slave server. Transmitting related information of the first storage unit, the second storage unit, the third storage unit, and the fourth storage unit regarding the conversion device to obtain a confirmation response, and the slave server group includes the first storage unit 1 storage unit, 2nd
And a replication step for centrally managing the contents of the storage unit, the third storage unit, and the fourth storage unit in the master server. 10. A remote VPN authentication / management system comprising: the server according to claim 1 or 2, interconnected by a network, the VPN conversion device group, and the client terminal group, The VPN conversion device transmits means for issuing a certificate issuance request to the server, means for storing the certificate returned from the server, and communication with the server when there is an access request from the client. A means for inquiring about availability, as a result of the inquiry, when a reply that restricts communication is received, a means for rejecting a communication request from the client, and a result of the inquiry, when a reply indicating that communication is possible is received, Means for providing the VPN service to the client, and a status inquiry from the server Means for returning status information, means for registering communication history from or to the client in the storage unit, and when receiving a request for communication log information from the server, the communication log information regarding the client in the storage unit is displayed. And a means for returning the information, wherein the client terminal comprises: the VPN communication means; 11. The remote VPN authentication / management system according to claim 10, wherein when the VPN conversion device receives a reply that communication is possible as a result of the inquiry, the authentication certificate of the communication partner is Issued VPN
And a function of performing a negotiation such as an encryption method with a conversion device, wherein the client terminal is an encryption method for VPN communication with the VPN conversion device of a destination with which the client terminal communicates. A remote VPN authentication / management system further comprising a negotiation means such as.