JP3808663B2 - Computer network system and access control method thereof - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to a computer network system and an access control method therefor, and more particularly to a firewall construction technique for preventing unauthorized access from the Internet.
[0002]
[Prior art]
Conventionally, when using a local computer network in a company or research organization connected to the Internet, a firewall has been implemented to prevent unauthorized intrusion from the Internet.
[0003]
Typical firewalls include 1) a system in which a local computer network and the Internet are connected only by a router, and access is controlled by packet filtering of the router, and 2) the local computer network is made public and private. There are known methods that divide the network into internal subnets, connect the public subnet to the Internet via a router, and connect the public subnet and the private internal subnet by another router or gateway. .
[0004]
The latter 2) can create a double wall against intrusion from the outside, so the use of services provided on the Internet is limited to the minimum necessary, and all other access from outside is restricted. By refusing, the confidentiality of the private internal subnet can be maintained higher than the former 1). However, on the other hand, computers in the private internal subnet cannot freely use services provided on the Internet.
[0005]
[Problems to be solved by the invention]
In this way, with conventional firewalls, services that can be provided to users are limited if security is strengthened, and conversely, if Internet services are made relatively free to use, safety will be reduced accordingly. There was a problem.
[0006]
In addition, the conventional firewall has the following danger even when the double wall is formed against the intrusion from the outside as in the latter 2).
[0007]
1) If a computer in a private internal subnet accidentally downloads and executes a file containing a virus or Trojan horse via the Internet, the internal information is destroyed or the internal information is transferred to the outside. There was a risk of being.
[0008]
2) When a computer in the public subnet is illegally used, a large amount of packets are sent in accordance with the TCP / IP protocol, thereby increasing the load and making the computer in the private internal subnet unusable. A denial of service attack was possible.
[0009]
The present invention has been made in view of such circumstances, and allows the private internal subnet to be isolated from the external network without restricting the use of services provided by the external network such as the Internet, and is convenient. An object of the present invention is to provide a computer network system having high security and high confidentiality and an access control method thereof.
[0010]
[Means for Solving the Problems]
In order to solve the above-described problems, the present invention provides a read transaction in a computer network system that is divided into a public subnet connected to an external network and a private internal subnet that receives services of the external network via the public subnet. And a communication means in which a light transaction is defined, a connection means for connecting the public subnet and the private internal subnet, and a service in the external network can be used from a computer in the private internal subnet. Remote operation means for remotely operating a computer in the public subnet from a computer in the private internal subnet using frame buffer transfer for sharing screen information and input information. Means for transferring the frame buffer; The remote operation using, and executes the computer within said closed inner subnet by a read transaction and a write transaction to the computer in the public subnet.
[0011]
In this computer system, by operating a computer in a public subnet by remote operation based on frame buffer transfer, a computer in a private internal subnet can freely access an external network through a computer in the public subnet. In addition, since the public subnet and the private internal subnet are connected using a communication path in which a read transaction and a write transaction are defined, basically, a computer in the private subnet can be accessed from a computer in the public subnet. Data transfer to a computer is performed by a computer in a private internal subnet polling a computer in a public subnet by a read transaction at regular intervals, for example, and transferring data by a read transaction only when there is read data. Data transfer from a computer in a private internal subnet to a computer in a public subnet is performed by a write transaction. As described above, data transfer between the public subnet and the private internal subnet is always performed only by a transaction from a computer in the private internal subnet. By implementing the above-mentioned remote control through such asymmetric access, even if an intruder from outside illegally attempts to transfer illegal data to a private internal subnet using a computer in the public subnet, damage will occur. Can be minimized. Therefore, it is possible to isolate private internal subnets from external networks without restricting the use of services provided by external networks such as the Internet, and to construct a new firewall that is highly convenient and highly confidential. I can do things.
[0012]
In addition, when data sharing is performed between a computer in a public subnet and a computer in a private internal subnet, a block device is connected to the communication path on the public subnet side, and the private subnet is connected to the public subnet. For all the packets associated with the read transaction and the write transaction, and for packets from the public subnet to the private internal subnet, all packets from the block device and the read transaction It is preferable to perform packet filtering so as to allow only a read response packet to respond. In this case, if a computer in the public subnet is illegally used by an intruder from the outside, there is a risk that unauthorized data will be written to the block device, but the block device itself does not execute the program. You cannot access a private internal subnet through a block device. Therefore, it is possible to share data between the public subnet and the private internal subnet while ensuring confidentiality within the private internal subnet.
[0013]
The same configuration can be applied even when a block device is connected to a communication path on the private internal subnet side.
[0014]
Further, screen information updated when an external user terminal remotely operates a computer in the public subnet using the frame buffer transfer via an external network such as the Internet, and a computer in the private internal subnet. Authentication means for causing a computer in the private internal subnet to perform user authentication for checking the validity of the user terminal by comparing with pre-registered screen information; and the user terminal by the authentication means Is confirmed, the computer in the private internal subnet is logged out from the block device so that the user terminal can access the block device via the computer in the public subnet. Access to the block device from a computer in the public subnet By and means for permitting, it is possible to access and use the data of the computer in the private internal subnet from the outside.
[0015]
DETAILED DESCRIPTION OF THE INVENTION
Hereinafter, embodiments of the present invention will be described with reference to the drawings.
(First embodiment)
FIG. 1 shows the configuration of a computer network system according to the first embodiment of the present invention. This computer network system is a local computer network system used in a company or a research institution, and is divided into a public subnet 11 and a private internal subnet 12. The public subnet 11 is a public network that can freely access the Internet, and is connected to the Internet 17 via a router 16. Each computer 13 in the public subnet 11 is connected to a LAN such as Ethernet, and can be connected to the Internet 17 via the LAN and the router 16. Communication between the computers 13 in the public subnet 11 and between the computers 13 and other computers on the Internet 17 is performed based on the TCP / IP protocol. In this case, each computer 13 in the public subnet 11 can directly communicate with a computer on the Internet 17 at the IP address level.
[0016]
The private internal subnet 12 is an internal network isolated from the Internet 17, and provision of services by the Internet 17 is received via the public subnet 11. Each computer 14 in the private internal subnet 12 and each computer 13 in the public subnet 11 are connected not via Ethernet but via a communication path including an IEEE 1394 serial bus. That is, each computer 13 in the public subnet 11 has a communication interface for connecting to an IEEE 1394 serial bus in addition to a communication interface for connecting to the Ethernet.
[0017]
A router 15 is inserted in the IEEE 1394 serial bus so as to be located between the public subnet 11 and the private internal subnet 12. The router 15 is provided to prevent unauthorized entry into the private internal subnet 12 from the outside via the public subnet 11, and the router 14 in the private internal subnet 12 and the public subnet 11 Packets exchanged with the computer 13 are filtered. Since the communication interface provided in each of the computers 13 and 14 for connecting to the IEEE 1394 serial bus has a function of automatically generating a transmission source ID by hardware, the bucket filtering by the router 15 is basically a transmission. This is performed based on the original ID. The packet filtering function of the router 15 and the router 16 protects the private internal subnet 12 with a double wall.
[0018]
The IEEE 1394 serial bus is a communication path in which a write transaction and a read transaction are defined as communication protocols. In the present embodiment, data transfer between the computer 13 in the public subnet 11 and the computer 14 in the private internal subnet 12 is transferred from the computer 14 in the private internal subnet 12 to the computer 13 in the public subnet 11. By issuing a write transaction and a read transaction, it is always performed under the initiative of the computer 14 in the private internal subnet 12. That is,
a) In the data transfer from the computer 13 in the public subnet 11 to the computer 14 in the private internal subnet 12, the computer 14 in the private internal subnet 12 polls the computer 13 in the public subnet 11 by a read transaction at regular intervals. However, data transfer is performed by a read transaction only when there is read data.
[0019]
b) Data transfer from the computer 14 in the private internal subnet 12 to the computer 13 in the public subnet 11 is performed by a write transaction.
[0020]
In this way, due to the asymmetry of access that all data transfer is performed by read / write transactions from the computer 14 in the private internal subnet 12,
1) Even if an illegal large amount of data transfer from the computer 13 in the public subnet 11 occurs, the influence does not immediately occur in the computer 14 in the private internal subnet 12.
[0021]
2) An abnormal transfer can be detected by checking the data transfer amount at the time of polling from the computer 14 in the private internal subnet 12.
[0022]
Even if the computer 13 in the public subnet 11 is illegally used by an intruder from outside, the security in the private internal subnet 12 can be ensured.
[0023]
Further, in the present embodiment, in order to use the Internet service from the computer 14 in the private internal subnet 12, the computer 13 in the public subnet 11 is remotely operated from the computer 14 in the private internal subnet 12. A remote control function is provided. This remote control function is performed based on frame buffer transfer. In the remote operation based on this frame buffer transfer, the screen information and the input information are shared between the computer 13 in the public subnet 11 to be operated and the computer 14 in the private internal subnet 12 to be operated, and is not disclosed. This is performed by controlling the operation of the computer 13 in the public subnet 11 based on input information from the computer 14 in the internal subnet 12, and is realized by the following mechanism.
[0024]
(Sharing screen information)
Information on the frame buffer held by the graphic control unit of the remote computer to be operated (here, the computer 13 in the public subnet 11) is transferred via the network to the local computer on the operating side (here, the computer 14 in the private internal subnet 12). The screen information is shared by displaying the information of the frame buffer on the local computer on the monitor. In this case, on the local computer, the resources on the remote computer can be handled as if they existed on the local computer.
[0025]
(Sharing input devices)
Information input from an input device (keyboard, mouse) of a local computer on the operating side (here, the computer 14 in the private internal subnet 12) is a remote computer (here, the public subnet 11) to be operated via the network. The remote computer shares the input device by causing the remote computer to recognize the input information from the local computer as the input information from the input device connected to the remote computer.
[0026]
Remote operation by frame buffer transfer can be realized by an application program. In this case, normally, a remote operation application program executed on the remote computer to be operated is a server, and a remote operation application program executed on the local computer on the operation side is a client. Screen information sharing based on frame buffer information is less dependent on the operating system (OS) and window system running on the remote computer, and can be operated remotely even if the OS differs between the remote computer and the local computer. Yes, it has the feature that multi-platform can be easily realized. As an application program for remote operation based on such frame buffer transfer, buoy, nc (VNC) or the like is known.
[0027]
In this embodiment, the computer 13 in the public subnet 11 is remotely operated from the computer 14 in the private internal subnet 12 by frame buffer transfer. The communication protocol for this remote operation is a computer in the private internal subnet 12. 14 is implemented only by a read transaction and a write transaction. In other words, in this embodiment, the read transaction and the write transaction from the computer 14 in the private internal subnet 12 are used only for the execution environment of the application program for remote operation, and are restricted so that they cannot be used for other purposes. ing. Specifically, the following control is performed.
[0028]
(A) On the IEEE 1394 serial bus, which is a communication path connecting the public subnet 11 connected to the Internet and the private internal subnet 12, the computer 13 in the public subnet 11 is framed from the computer 14 in the private internal subnet 12. Only communication necessary for remote control by buffer transfer is performed by the above-described read transaction and write transaction, and other communication such as communication based on IP cannot be performed.
[0029]
(B) Normally, the computer 14 in the private internal subnet 12 is operated, and various services provided on the Internet are used by remotely operating the computer 13 in the public subnet 11 based on frame buffer transfer.
[0030]
Even if an intruder from the outside illegally uses the computer 13 in the public subnet 11 to transfer illegal data to the private internal subnet 12, it is affected by frame buffer transfer. It is only a remote control application based on it, and does not affect the information in the private internal subnet 12 at all. Therefore, it is possible to further ensure the security in the private internal subnet 12.
[0031]
In other words, the security can be improved only by performing communication between the public subnet 11 and the private internal subnet 12 by the read / write transaction from the private internal subnet 12, but the use of the read / write transaction can be improved by the frame buffer. By limiting only to remote operation by transfer, even if invalid data is sent to the computer 14 in the private internal subnet 12, the influence can be minimized.
[0032]
Next, the filtering function by the router 15 will be described with reference to FIG.
[0033]
The router 15 basically passes only packets necessary for remote operation based on frame buffer transfer, and blocks other packets. That is, for the packet from the computer 14 in the private internal subnet 12 to the computer 13 in the public subnet 11, the router 15 passes all packets associated with the read / write transaction, while the computer in the public subnet 11. For the packet from 13 to the computer 14 in the private internal subnet 12, only the read response packet for responding to the read transaction from the computer 14 in the private internal subnet 12 is allowed to pass, and all other packets are sent. It is set to block read / write request packets.
[0034]
FIG. 3 shows a read / write transaction executed on the IEEE 1394 bus.
[0035]
The read / write transaction used in this embodiment is based on the IEEE1394 asynchronous transfer protocol. As shown in FIG. 3A, in the read transaction, first, a read request packet is sent from the computer 14 in the private internal subnet 12 to the computer 13 in the public subnet 11. Acknowledgment (ACK) is returned from the internal computer 13. Thereafter, the computer 13 in the public subnet 11 transmits a read response packet to the computer 14 in the private internal subnet 12. The read response packet is a response packet to the read request packet, and data requested by the read request packet is transferred by the read response packet. Thereby, the computer 14 in the private internal subnet 12 can receive necessary data from the computer 13 in the public subnet 11.
[0036]
As shown in FIG. 3B, in the write transaction, a write request packet is sent from the computer 14 in the private internal subnet 12 to the computer 13 in the public subnet 11. This write request packet includes write data, and data can be sent to the computer 13 in the public subnet 11.
[0037]
In general, a communication protocol used in a computer network employs a so-called send method in which data transfer is always performed by a computer serving as a data transfer source. In this embodiment, as described above, the communication protocol is used as a communication protocol. By using the IEEE 1394 bus in which read transactions and write transactions are defined, asymmetric access control is realized in which communication with the computer 13 in the public subnet 11 is always led by the computer 14 in the private internal subnet 12. ing. Note that any communication path other than the IEEE 1394 bus can be used as long as the communication path defines a read transaction and a write transaction.
[0038]
FIG. 4 shows a comparison between the hierarchical structure of the communication protocol for realizing the access control of this embodiment and the hierarchical structure of the communication protocol used in a normal computer network.
[0039]
As shown in FIG. 4A, in the present embodiment, hardware such as an IEEE 1394 bus and a communication interface connected to the IEEE 1394 bus is located in the lowest layer, and a driver for hardware control is provided on the hardware. A transport protocol layer and an application layer for controlling write / read transactions are located. In the application layer, an application program for remote operation based on frame buffer transfer is executed, and communication for the remote operation is realized by only the write / read transaction on the IEEE1394 bus by the transport protocol layer.
[0040]
Further, communication other than communication between the computer 13 in the public subnet 11 and the computer 14 in the private internal subnet 12, for example, communication between the computers 13 in the public subnet 11 or communication between the computer 13 and the Internet 17. Etc. can be performed in a normal communication environment based on TCP / IP as shown in FIG.
[0041]
Next, a remote operation procedure based on frame buffer transfer will be described with reference to FIG. FIG. 5 (a) shows how input information is transferred, and FIG. 5 (b) shows how frame buffer information is transferred.
[0042]
As described above, an application (server) for remote operation is executed on the computer 13 in the public subnet 11, and an application (client) for remote operation is executed on the computer 14 in the private internal subnet 12. On the screen of the computer 14 in the private internal subnet 12, information on the desktop screen of the computer 13 in the public subnet 11 is displayed. In this state, the keyboard operation for operating the desktop screen of the computer 13 When the mouse operation is performed on the computer 14 in the private internal subnet 12, it is recognized as an input event for remote operation by the remote operation application (client). In this case, a write transaction for transmitting input information from the computer 14 in the private internal subnet 12 to the computer 13 in the public subnet 11 is executed by a request from the application (client) (FIG. 5A). . This light transaction is executed every time an input event occurs on the computer 14 side in the private internal subnet 12.
[0043]
In this way, information for remotely operating the computer 13 in the public subnet 11 is transferred from the computer 14 in the private internal subnet 12 to the computer 13 in the public subnet 11. The computer 13 in the public subnet 11 operates according to input information from the computer 14 under the control of a remote operation application (server), and can perform various communications via the Internet 17.
[0044]
The frame buffer information (screen information) of the computer 13 in the public internal subnet 11 is read only when the computer 14 in the private internal subnet 12 is polled by a read transaction at regular time intervals and the frame buffer information is updated. This is realized by transferring data of the updated frame buffer information by a transaction (FIG. 5B), so that the screen information of the computer 13 updated by remote operation is transferred to the computer 14 in the private internal subnet 12 as needed. Since it is sent, the result of the Internet service executed by the computer 13 by remote operation can be confirmed on the computer 14.
[0045]
(Second Embodiment)
FIG. 6 shows the configuration of a computer network system according to the second embodiment of the present invention. Since the system configuration of this computer network system and the access control method for remote operation are basically the same as those in the first embodiment, only different parts will be described below.
[0046]
That is, in FIG. 6, the block device 21 is provided on the public subnet 11 side for the purpose of data sharing between the computer 13 in the public subnet 11 and the computer 14 in the private internal subnet 12. The block device 21 is a data storage device that inputs and outputs data using a data block of a plurality of bytes as a unit. For example, a hard disk, a DVD-RAM drive, an MO, a magnetic tape, or the like is used. As shown in the figure, the block device 21 is connected to the IEEE 1394 bus of the router 15 on the public subnet 11 side, and can be freely accessed from the computer 13 in the public subnet 11.
[0047]
Further, the block device 21 is provided with a control mechanism that transfers data only when the transmission source ID that has requested access matches the ID of the data transfer source or data transfer destination.
[0048]
Next, the filtering function by the router 15 will be described with reference to FIG.
[0049]
In the second embodiment, the bucket passage restriction by the router 15 is not limited from the computer 13 in the public subnet 11 but also from the computer 14 in the private internal subnet 12 so that the bucket passage restriction by the router 15 is the first embodiment. Is more relaxed.
[0050]
That is, the router 15 passes all packets associated with the read / write transaction from the computer 14 to the computer 13 or the block device 21 for the packet from the private internal subnet 12 to the public subnet 11, while the public subnet 11 As for the packet from 11 to the private internal subnet 12, only the read response packet for responding to the read transaction from the computer 14 in the private internal subnet 12 and all the packets from the block device 21 are permitted to pass, The read / write request packet from the computer 13 is set to be blocked.
[0051]
FIG. 8 shows a procedure when the computer 14 in the private internal subnet 12 accesses the block device 21 on the public subnet 11 side. Here, a case where data written by the computer 13 in the public subnet 11 is read from the block device 21 will be described as an example. This access procedure is performed according to SBP_2 (SBP: Serial Bus Protocol).
[0052]
The block device 21 has an authentication (login) function, and access from other computers is not accepted while a certain computer is logged in to the block device 21. For this reason, when using the block device 21, the computer 14 in the private internal subnet 12 first performs access for logging in to the block device 21. For access for login, a login request is created in the main memory of the computer 14 in the form of an operation request block (ORB) in which a password or the like is written, and the address of this ORB is written to the MANAGEMENT_AGENT register of the block device 21 It is executed by performing a light transaction. The block device 21 reads the login request ORB by a read transaction, and when login is permitted due to the presence or absence of a password registered in the block device 21 in advance, a response to that effect is returned from the block device 21. . In this way, when the login is successful, the computer 14 in the private internal subnet 12 creates a request for the block device 21 in the ORB format on the main memory of the computer 14, and the address of this ORB is stored in the block device 21. Execute a write transaction for writing to the ORB_POINTER register. In response to this, the block device 21 executes a read transaction for reading the contents of the ORB from the access request source computer. If it is a data read request, the block device 21 executes a write transaction for writing the data designated by the ORB to the access request source computer. When the computer 14 in the private internal subnet 12 finishes reading all necessary data, it creates a logout request in the main memory of the computer 14 in the ORB format, and the address of this ORB is stored in the MANAGEMENT_AGENT register of the block device 21. Execute a write transaction for writing to the block device 21 and log out from the block device 21.
[0053]
As described above, in the second embodiment,
(A) Between the public subnet 11 and the private internal subnet 12, the IEEE 1394 serial bus, which is a communication path having a standard for which a transmission source ID is automatically generated by hardware, and a packet based on the transmission source ID Connect via the router 15 with the filtering function,
(B) A control mechanism that can be used by connecting to the public subnet 11 side of the network and that transfers data only when the source ID that requested access and the data transfer source / destination ID specified by the ORB are equal. Block device 21 having
(C) All packets from the private internal subnet 12 to the public subnet 11 are allowed to pass, and only all packets from the block device and the read / response packet from the computer 13 are allowed to pass from the public subnet 11 to the private internal subnet 12. Set the router 15 to
Thus, data sharing between the public subnet 11 and the private internal subnet 12 is realized via the block device 21.
[0054]
If a computer 13 in the public subnet 11 is illegally used by an intruder from outside, there is a risk that illegal data will be written to the block device 21, but the block device 21 does not have a program execution function like a computer. The block device 21 cannot control itself to access the private internal subnet 12. Even if an invalid request is written in the block device 21, it cannot be transferred to the computer 14 in the private internal subnet 12 by the function (b). Therefore, the data of the block device 21 can be shared between the public subnet 11 and the private internal subnet 12 while ensuring confidentiality in the private internal subnet 12.
[0055]
(Third embodiment)
FIG. 9 shows the configuration of a computer network system according to the third embodiment of the present invention. In this computer network system, the block device 21 for data sharing is connected to the IEEE 1394 serial bus of the router 15 on the private internal subnet 12 side. The block device 21 can be freely accessed from the computer 14 in the private internal subnet 12.
[0056]
FIG. 10 shows a filtering function by the router 15.
[0057]
That is, for the packet from the private internal subnet 12 to the public subnet 11, the router 15 performs all the packets accompanying the read / write transaction from the computer 14 to the computer 13 and all the packets from the block device 21 to the computer 13. On the other hand, for a packet from the public subnet 11 to the private internal subnet 12, a read response packet for responding to a read transaction from the computer 14 in the private internal subnet 12 and a packet in the public subnet 11 are passed. Only a packet with a specific address from the computer 13 to the block device 21 is allowed to pass, and other packets to the block device 21 and read / write request packets from the computer 13 to the computer 14 are blocked. It is.
[0058]
Here, the packet of the specific address from the computer 13 to the block device 21 in the public subnet 11 is a packet for the MANAGEMENT_AGENT register and the ORB_POINTER register of the block device 21. As a result, the risk of writing illegal data from the computer 13 in the public subnet 11 to the block device 21 can be reduced, and the data can be shared between the computer 13 and the computer 14.
[0059]
Further, the function of the router 15 is strengthened, and the login process from the computer 13 in the public subnet 11 to the block device 21 is monitored. Only when the login is successful, the packet for the ORB_POINTER register is passed and the login fails. In some cases, it is possible to further improve the safety by providing the router 15 with a function of notifying the administrator. The processing procedure of the router 15 in this case is shown in FIG.
[0060]
The router 15 always monitors the destination address of a packet transmitted from the computer 13 in the public subnet 11, and determines whether the packet is for the login address, that is, the packet for the MANAGEMENT_AGENT register of the block device 21. It discriminate | determines (step S11). If the packet received from the computer 13 in the public subnet 11 is a packet for the login address (YES in step S11), the router 15 passes the packet (step S12). Then, the router 15 determines whether or not the login is successful based on the presence / absence of a response packet indicating a successful login from the block device 21 (step S13). If the login fails, the router 15 notifies the administrator (step S14), and thereafter blocks packets addressed to the block device from the computer 13 in the public subnet 11. If the login is successful (YES in step S13), the router 15 proceeds to the processing in step S15 and subsequent steps, and the packet received from the computer 13 in the public subnet 11 is an address for a request from the computer that has successfully logged in. If it is a packet for logging out (write packet for ORB_POINTER register) or a logout packet (write packet for Management_AGENT) from a computer that has been successfully logged in, it is passed, and other packets are blocked Control is performed (steps S15 to S19).
[0061]
Thereby, unauthorized access from the public subnet 11 to the block device 21 can be reduced, and the security of the private internal subnet 12 can be further improved.
[0062]
Further, the block device 21 monitors the read transaction for reading the ORB created by the computer 13 in the public subnet 11, and the ID of the computer 13 in the public subnet 11 and the data transfer source / destination ID specified by the ORB are equal. By adding a function for transferring the read response packet to the private internal subnet 12 only in the case, it is possible to omit the transmission source ID and data transfer source / destination ID check mechanism in the block device 21. Become.
[0063]
(Application example to the second embodiment and the third embodiment)
Next, a process for improving safety using the exclusive control mechanism of the block device 21 will be described with reference to FIG. In this processing procedure, by using the exclusive control mechanism of the block device 21, the computer 14 in the private internal subnet 12 is preferentially logged in to the block device 21, and the public subnet 11 is used only when it is desired to share data. The exclusive control of permitting access from is performed.
[0064]
That is, during normal times, the computer 14 in the private internal subnet 12 logs in to the block device 21 (step S21). As a result, all logins from the public subnet 11 are rejected at normal times. For example, the computer 14 in the private internal subnet 12 is set so that the block device 21 can be automatically mounted as a remote drive, and the computer 13 in the public subnet 11 is set for the private internal subnet 12 for login. What is necessary is just to set so that the remote operation from the computer 14 in the inside may be required.
[0065]
When data is shared with the public subnet 11, that is, when data in the public subnet 11 is transferred to the private internal subnet 12 through the block device 21 or vice versa (YES in step S22), The computer 14 in the private internal subnet 12 that has logged in to the block device 21 temporarily logs out from the block device 21 (step S23). Thereafter, by remotely operating the computer 13 in the public subnet 11 from the computer 14 in the private internal subnet 12 using frame buffer transfer according to the above-described procedure, the computer 13 in the public subnet 11 is logged into the block device 21. (Step S24). Next, the computer 13 in the public subnet 11 is remotely operated from the computer 14 in the private internal subnet 12 to execute data transfer between the computer 13 in the public subnet 11 and the block device 21 (step S25). The remote operation is performed again to log out the computer 13 in the public subnet 11 from the block device 21 (step S26). Finally, the computer 14 in the private internal subnet 12 logs in to the block device 21 again (step S21). As a result, all logins from the public subnet 11 are rejected again.
[0066]
(Fourth embodiment)
FIG. 13 shows the configuration of a computer network system according to the fourth embodiment of the present invention. The system configuration of this computer network system, the access control method for remote operation, and the data sharing method are the same as those in the third embodiment, but in this fourth embodiment, the private internal subnet 12 from the external computer 100 through the Internet. It has a remote access function to make it possible to access the data inside. This remote access function is for making it possible to refer to the data of his / her own computer in the office, for example, from outside or at home. In the present embodiment, a remote operation application program for remotely operating the computer 13 in the public subnet 11 by frame buffer transfer is installed not only in the computer 14 in the private internal subnet 12 but also in the external computer 100, The remote access function is realized by authenticating the external computer 100 using the operation at the time of sharing.
[0067]
First, the basic operation when the remote computer is remotely operated by remote operation from a plurality of local computers will be described. In this embodiment, the remote computer to be operated is the computer 13 in the public subnet 11, and the local computer to be operated is the computer 14 and the external computer 100 in the private internal subnet 12.
[0068]
The frame buffer of the remote computer is transferred to a plurality of local computers, and the input information from the input devices of the plurality of local computers is transferred to the remote computer. The input information of each local computer is merged on the remote computer, and the operation of the remote computer is controlled based on the input information. With such a series of operations, it is possible to perform work by sharing the screen of the remote computer on a plurality of local computers. In this case, if the operation of the input device (keyboard, mouse) of a certain local computer updates the screen, the updated frame buffer information is transferred to all other local machines sharing the same screen. become.
[0069]
Therefore, in this embodiment, update frame buffer information (screen information) when predetermined input information is input from the external computer 100 is registered in advance in the computer 14 in the private internal subnet 12, and the registration information and The user authentication method of comparing the updated frame buffer information from the computer 13 in the public subnet 11 with the computer 14 in the private internal subnet 12 and permitting the external computer 100 to access the internal data when they match. Is used. Whether to access internal data is determined by using the exclusive control mechanism of the block device 21.
[0070]
In order to realize such a user authentication method, specifically, the following functions are added to the remote operation application program.
[0071]
(A: Recording and playback function of input information from input device (keyboard, mouse))
A function for storing information input to the input device in a file or the like and reproducing the input information based on the stored information is added to a remote operation application running on the local computer on the operation side. This is because the same input operation as the authentication input operation such as a mouse operation performed by the user of the local computer can be reproduced on the external computer 100 any number of times.
[0072]
(B: Update frame buffer information recording function)
A function for storing the updated frame buffer information in a file or the like is added to a remote operation application running on the local computer on the operation side. This is because the update frame buffer information for authentication is registered in the computer 14 in the private internal subnet 12.
[0073]
(C: Command execution function based on updated frame buffer information)
When the same update frame buffer information as preset update frame buffer information is transferred to a remote operation application running on the local computer on the operation side, a function for executing a certain command is added. This is because the external computer 100 is authenticated by comparing the updated frame buffer information. When the authentication is successful, the computer 14 in the private internal subnet 12 automatically logs out from the block device 21 and the external computer 100 This is to allow access to data.
[0074]
(D: Command execution function when communication connection is disconnected)
Execute a certain command when the communication connection with the remote operation application running on the remote computer to be operated is disconnected from the remote operation application running on the local computer on the operation side Add functionality. This is because when access to internal data by the external computer 100 is completed, the computer 14 in the private internal subnet 12 logs in to the block device 21 again and prohibits access from the public subnet 11 side. .
[0075]
(E: Communication connection disconnection function on a remote computer)
When the remote operation application running on the remote computer to be operated is disconnected from the remote operation application running on one local computer, all the screens that were shared Adds a function to disconnect the communication connection with the remote operation application running on the local computer. This is to notify the computer 14 in the private internal subnet 12 of the end of access to the internal data by the external computer 100.
[0076]
By using the above functions, it becomes possible to access data in the private internal subnet 12 via the Internet in the following procedure.
[0077]
First, the following process is performed as a preparation process.
(I) The computer 14 in the private internal subnet 12 stores data that the block device 21 wants to access via the Internet.
[0078]
(Ii) The computer 13 in the public subnet 11 is remotely operated from the computer 14 in the private internal subnet 12, and the following processing is performed.
[0079]
(Ii-1) Using the functions of (a) and (b), a value is randomly input to the input device, and input information from the input device at that time and sent from the computer 13 in the public subnet 11 Update frame buffer information is stored in a file or the like. The input information stored in the file is used later on the external computer 100.
[0080]
(Ii-2) When the same update frame buffer information as the update frame buffer information stored in (ii-1) is transferred by using the function (c), the block device 21 is not logged out. The computer 14 in the public internal subnet 12 is set. Further, the computer 14 in the private internal subnet 12 is used to log in to the block device 21 again when the communication connection with the computer 13 in the public subnet 11 is disconnected using the function (d). Set.
[0081]
Next, a procedure for accessing data in the private internal subnet 12 via the Internet will be specifically described with reference to FIG. 13 and FIG.
[0082]
(1): Reproduction of input information (step S101)
The input information stored in the file is reproduced on the external computer 100 while the remote operation application is being executed on each of the computers 13, 14, 100, and the authentication input information is transferred to the computers 13 in the public subnet 11. input.
[0083]
(2): Transfer of updated frame buffer information (step S102)
Since the computers 13, 14, and 100 share the screen, when the screen information of the computer 13 in the public subnet 11 is updated with the input information for authentication, the contents of the updated frame buffer information are changed to the private internal subnet 12. Is sent to the internal computer 14. The transmission of the updated frame buffer information is executed by a read transaction by the computer 14 in the private internal subnet 12.
[0084]
(3): Logout (step S103)
The computer 14 in the private internal subnet 12 performs user authentication of the external computer 100 by comparing the update frame buffer information with the update frame buffer information recorded in advance. When the update frame buffer information matches the pre-recorded update frame buffer information, the computer 14 in the private internal subnet 12 temporarily receives a block device 21 from the block device 21 in order to allow the external computer 100 to use the block device. Log out to.
[0085]
(4): Login, data transfer, logout (step S104)
The external computer 100 logs in to the block device 21 through the computer 13 in the public subnet 11 by remotely operating the computer 13 in the public subnet 11. Then, after necessary data is read from the block device 21 by remotely operating the computer 13 in the public subnet 11, the user logs out from the block device 21 through the computer 13 in the public subnet 11.
[0086]
(5): End of remote operation (step S105)
The external computer 100 terminates the remote operation of the computer 13 in the public subnet 11 and disconnects the communication connection with the computer 13 in the public subnet 11.
[0087]
(6): Disconnection of connection (step S106)
In response to the disconnection of the communication connection with the external computer 100, the computer 13 in the public subnet 11 disconnects the communication connection with the computer 14 in the private internal subnet 12.
[0088]
(7): Login again (step S107)
By this disconnection, the computer 14 in the private internal subnet 12 logs in to the block device 21 again and occupies the block device 21 exclusively.
[0089]
Through the above processing, data in the private internal subnet 12 can be used from the outside. Since data being transferred on the Internet has a risk of eavesdropping, it is preferable to encrypt the data in the private internal subnet 12 in advance.
[0090]
【The invention's effect】
As described above, according to the present invention, it becomes possible to isolate a private internal subnet from an external network without restricting the use of services provided by an external network such as the Internet, which is highly convenient and A highly confidential computer network system can be realized.
[Brief description of the drawings]
FIG. 1 is a block diagram showing a configuration of a computer network system according to a first embodiment of the present invention.
FIG. 2 is a diagram for explaining a packet filtering function of a router used in the first embodiment.
FIG. 3 is a view showing a state of a read / write transaction executed on a communication path connecting between a public subnet and a private internal subnet according to the first embodiment.
FIG. 4 is a diagram for explaining a hierarchical structure of communication protocols used in the first embodiment.
FIG. 5 is an exemplary view for explaining a remote operation procedure based on frame buffer transfer executed in the first embodiment;
FIG. 6 is a block diagram showing a configuration of a computer network system according to a second embodiment of the present invention.
FIG. 7 is a diagram for explaining a packet filtering function of a router used in the second embodiment;
FIG. 8 is a view showing an access procedure for a block device provided in the system of the second embodiment;
FIG. 9 is a block diagram showing a configuration of a computer network system according to a third embodiment of the present invention.
FIG. 10 is a diagram for explaining a packet filtering function of a router used in the third embodiment.
FIG. 11 is a flowchart showing a specific procedure of packet filtering processing executed by the router of the third embodiment.
FIG. 12 is a flowchart showing a procedure of exclusive control processing for the block devices of the second and third embodiments.
FIG. 13 is a block diagram showing a configuration of a computer network system according to a fourth embodiment of the present invention.
FIG. 14 is a flowchart showing a procedure of remote access processing in the fourth embodiment;
[Explanation of symbols]
11: Public subnet
12 ... Private subnet
13 ... Computer in public subnet
14 ... Computer in private subnet
15, 16 ... Router
21 ... Block device
100 ... External computer

Claims (13)

In a computer network system divided into a public subnet connected to an external network and a private internal subnet that receives services of the external network via this public subnet,
Connection means for connecting the public subnet and the private internal subnet using a communication path in which a read transaction and a write transaction are defined;
In order to be able to use the service of the external network from a computer in the private internal subnet, the computer in the private internal subnet uses the frame buffer transfer for sharing screen information and input information. Remote control means for remotely controlling a computer in the public subnet,
The remote operation means executes a remote operation using the frame buffer transfer by a read transaction and a write transaction from a computer in the private internal subnet to a computer in the public subnet. . A packet filtering unit that is inserted into the communication path so as to be positioned between the public subnet and the private internal subnet, and filters packets exchanged between the private internal subnet and the public subnet;
The packet filtering unit permits passage of all packets accompanying the read transaction and write transaction for packets from the private internal subnet to the public subnet, and packets from the public subnet to the private internal subnet 2. The computer network system according to claim 1, wherein only a read response packet for responding to the read transaction is permitted. In a computer network system divided into a public subnet connected to an external network and a private internal subnet that receives services of the external network via this public subnet,
Connection means for connecting the public subnet and the private internal subnet using a communication path in which a read transaction and a write transaction are defined;
In order to be able to use the service of the external network from a computer in the private internal subnet, the computer in the private internal subnet uses the frame buffer transfer for sharing screen information and input information. Remote operation means for remotely operating a computer in a public subnet, wherein remote control using the frame buffer transfer is performed by a read transaction and a write transaction from a computer in the private internal subnet to a computer in the public subnet Remote control means to perform;
A packet filtering unit that is inserted into the communication path so as to be positioned between the public subnet and the private internal subnet, and filters packets exchanged between the private internal subnet and the public subnet;
A block device connected to the communication path on the public subnet side and used for data sharing between a computer in the public subnet and a computer in the private internal subnet;
The packet filtering unit permits passage of all packets accompanying the read transaction and write transaction for packets from the private internal subnet to the public subnet, and packets from the public subnet to the private internal subnet For the computer network system, it is permitted to pass all packets from the block device and only a read response packet for responding to the read transaction. The block device is configured to prohibit access from other computers during a period until the computer logged in to the block device logs out,
Means for prohibiting access to the block device from a computer in the public subnet by preferentially logging into the block device a computer in the private internal subnet;
When sharing the data of the block device, the remote control means temporarily logs out the computer in the private internal subnet, and then remotely operates the computer in the public subnet to 4. The computer network system according to claim 3, wherein the block device is accessed from an internal computer. In a computer network system divided into a public subnet connected to an external network and a private internal subnet that receives services of the external network via this public subnet,
Connection means for connecting the public subnet and the private internal subnet using a communication path in which a read transaction and a write transaction are defined;
In order to be able to use the service of the external network from a computer in the private internal subnet, the computer in the private internal subnet uses the frame buffer transfer for sharing screen information and input information. Remote operation means for remotely operating a computer in a public subnet, wherein remote control using the frame buffer transfer is performed by a read transaction and a write transaction from a computer in the private internal subnet to a computer in the public subnet Remote control means to perform;
A packet filtering unit that is inserted into the communication path so as to be positioned between the public subnet and the private internal subnet, and filters packets exchanged between the private internal subnet and the public subnet;
A block device connected to a communication path on the private internal subnet side and used for data sharing between a computer in the public subnet and a computer in the private internal subnet;
The packet filtering unit permits passage of all packets accompanying the read transaction and write transaction for packets from the private internal subnet to the public subnet, and packets from the public subnet to the private internal subnet In the computer network system, only a read response packet for responding to the read transaction and a packet for accessing the block device from a computer in the public subnet are permitted to pass. The block device is configured to prohibit access from other computers during a period until the computer logged in to the block device logs out,
Means for prohibiting access to the block device from a computer in the public subnet by preferentially logging into the block device a computer in the private internal subnet;
When sharing the data of the block device, the remote control means temporarily logs out the computer in the private internal subnet, and then remotely operates the computer in the public subnet to 6. The computer network system according to claim 5, wherein the block device is accessed from an internal computer. In a computer network system divided into a public subnet connected to an external network and a private internal subnet that receives services of the external network via this public subnet,
Connection means for connecting the public subnet and the private internal subnet using a communication path in which a read transaction and a write transaction are defined;
In order to be able to use the service of the external network from a computer in the private internal subnet, the computer in the private internal subnet uses the frame buffer transfer for sharing screen information and input information. Remote operation means for remotely operating a computer in a public subnet, wherein remote control using the frame buffer transfer is performed by a read transaction and a write transaction from a computer in the private internal subnet to a computer in the public subnet Remote control means to perform;
Packet filtering means for filtering packets that are inserted into the communication path so as to be located between the public subnet and the private internal subnet, and that are exchanged between the private internal subnet and the public subnet, For packets from the private internal subnet to the public subnet, all packets associated with the read transaction and write transaction are allowed to pass, and for packets from the public subnet to the private internal subnet, the read transaction A read response packet for responding, and packet filtering means for permitting passage of only a packet for accessing the block device from a computer in the public subnet,
A block device connected to the communication path on the private internal subnet side and configured to prohibit access from the computers in the public subnet during a period until the computer in the private internal subnet logs out;
Screen information updated when an external user terminal remotely operates a computer in the public subnet using the frame buffer transfer via an external network; screen information registered in advance in a computer in the private internal subnet; Authentication means for causing a computer in the private internal subnet to execute user authentication for checking the validity of the user terminal by comparing
When the validity of the user terminal is confirmed by the authentication means, the computer in the private internal subnet is connected to the computer so that the user terminal can access the block device via the computer in the public subnet. A computer network system, comprising: means for logging out of a block device and permitting access to the block device from a computer in the public subnet. It is divided into a public subnet connected to an external network and a private internal subnet that is serviced by the external network via this public subnet, and a read transaction and a write transaction are defined between the public subnet and the private internal subnet. An access control method applied to a computer network system connected using a designated communication path,
In order to be able to use the service of the external network from a computer in the private internal subnet, the computer in the private internal subnet uses the frame buffer transfer for sharing screen information and input information. Remotely control computers in the public subnet,
An access control method characterized in that the remote operation by the frame buffer transfer is executed by a read transaction and a write transaction from a computer in the private internal subnet to a computer in the public subnet. It is divided into a public subnet connected to an external network and a private internal subnet that is serviced by the external network via this public subnet, and a read transaction and a write transaction are defined between the public subnet and the private internal subnet. A computer connected to the communication path on the public subnet side by a block device used for data sharing between the computer in the public subnet and the computer in the private internal subnet. An access control method applied to a network system,
In order to make it possible to use the services of the external network from a computer in the private internal subnet, a remote operation by frame buffer transfer for sharing screen information and input information is performed from the computer in the private internal subnet. Remotely controlling a computer in the public subnet from a computer in the private internal subnet by executing by a read transaction and a write transaction to the computer in the public subnet,
For packets from the private internal subnet to the public subnet, all packets are allowed to pass, and for packets from the public subnet to the private internal subnet, all packets from the block device and the non-public subnet Filtering packets sent and received between the private internal subnet and the public subnet so as to allow only a read response packet to respond to a read transaction from a computer in the public internal subnet Access control method. The block device is configured to prohibit access from other computers during a period until the computer logged in to the block device logs out,
By preferentially logging into the block device a computer in the private internal subnet, access to the block device from a computer in the public subnet is prohibited,
When sharing the data of the block device, after temporarily logging out the computer in the private internal subnet, by remotely operating the computer in the public subnet from the computer in the private internal subnet The access control method according to claim 9, wherein the block device is accessed from a computer in the public subnet. It is divided into a public subnet connected to an external network and a private internal subnet that is serviced by the external network via this public subnet, and a read transaction and a write transaction are defined between the public subnet and the private internal subnet. And a block device used for data sharing between the computer in the public subnet and the computer in the private internal subnet is connected to the communication path on the private internal subnet side. An access control method applied to the computer network system,
In order to make it possible to use the services of the external network from a computer in the private internal subnet, a remote operation by frame buffer transfer for sharing screen information and input information is performed from the computer in the private internal subnet. Remotely controlling a computer in the public subnet from a computer in the private internal subnet by executing by a read transaction and a write transaction to the computer in the public subnet,
For packets from the private internal subnet to the public subnet, all packets associated with the read transaction and write transaction are allowed to pass, and for packets from the public subnet to the private internal subnet, the read transaction The read response packet for responding to and the computer in the public subnet are exchanged between the private internal subnet and the public subnet so as to allow the passage of only the packet for accessing the block device. An access control method characterized by filtering packets. The block device is configured to prohibit access from other computers during a period until the computer logged in to the block device logs out,
By preferentially logging the computer in the private internal subnet into the block device, access to the block device from the computer in the private internal subnet is prohibited,
When sharing the data of the block device, after temporarily logging out the computer in the private internal subnet, by remotely operating the computer in the public subnet from the computer in the private internal subnet 12. The access control method according to claim 11, wherein the block device is accessed from a computer in the public subnet. It is divided into a public subnet connected to an external network and a private internal subnet that is serviced by the external network via this public subnet, and a read transaction and a write transaction are defined between the public subnet and the private internal subnet. The communication path on the side of the private internal subnet is prohibited from accessing from the computer in the public subnet during the period until the computer in the private internal subnet logs out. An access control method applied to a computer network system to which block devices configured as described above are connected,
In order to make it possible to use the services of the external network from a computer in the private internal subnet, a remote operation by frame buffer transfer for sharing screen information and input information is performed from the computer in the private internal subnet. Remotely controlling a computer in the public subnet from a computer in the private internal subnet by executing by a read transaction and a write transaction to the computer in the public subnet,
For packets from the private internal subnet to the public subnet, all packets associated with the read transaction and write transaction are allowed to pass, and for packets from the public subnet to the private internal subnet, the read transaction The read response packet for responding to and the computer in the public subnet are exchanged between the private internal subnet and the public subnet so as to allow the passage of only the packet for accessing the block device. Packets to be filtered by the router,
Screen information updated when an external user terminal remotely operates a computer in the public subnet using the frame buffer transfer via an external network; screen information registered in advance in a computer in the private internal subnet; By comparing the user terminal with a computer in the private internal subnet to perform user authentication for checking the validity of the user terminal,
When the validity of the user terminal is confirmed by the user authentication, the computer in the private internal subnet is connected to the computer so that the user terminal can access the block device via the computer in the public subnet. An access control method comprising: logging out from a block device and permitting access to the block device from a computer in the public subnet.

Images