JP4340848B2 - Remote access system and remote access method - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to a system and method for accessing an internal network such as a LAN (Local Area Network) from the outside.
[0002]
[Prior art]
  As a system for accessing the internal network from the outside, for example, there is a system described in Patent Document 1. This system is behind a firewallDepartment andEach server is provided outside. The internal server is connected to a network (for example, LAN) inside the firewall, and the external server is connected to a network (for example, the Internet) outside the firewall. In this system, the connection from the internal server to the external server is secured in advance, and when the external server has an access request to the internal network, after confirming the validity of the access destination, Access to the internal network is performed via the internal server using the secured connection.
[0003]
In addition to the above, there is an intranet access system as described in Patent Document 2. In this intranet access system, a VPN gateway connected to an external client via a dedicated line is connected to an intranet that is an internal network via the Internet and a router unit in order. By using a VPN tunnel set up between the VPN gateway and the router unit and connecting to a device connected to the intranet, an external client accesses the internal network.
[0004]
There is also a system using a product called a reverse proxy. In this system, a server installed with a reverse proxy connected to an external network or DMZ (reverse proxy server) accesses a Web server connected to the internal network via a firewall in response to a request from an external client. As a result, access from the external client to the internal network is performed.
[0005]
  Furthermore, there is a system as described in Patent Document 3. In this system, when a network connection device that relays between an external network and an internal network performs an authentication process using a user ID and a password for an external client that requests access to the internal network, and the authentication is successful. Presents a list of accessible service information to an external client. Then, when the external client selects a service from the presented list of service information, the network-connected device has an address necessary for access to the selected service (URL) To external clients. As a result, an external client can access the internal network. Note that the network connection device also performs address conversion for the service selected by the external client.
[0006]
In Patent Document 4, the convenience of the firewall is remarkably improved by changing the filtering method, and further, security is performed by separately performing user authentication check and access control to internal resources (internal network). Is a doubled version.
[0007]
In addition, there is a DMZ (DeMilitarized Zone) which is a segment protected by a firewall, and a public server is connected thereto. Patent Document 5 describes a technique for easily constructing a DMZ.
[0008]
[Patent Document 1]
Special table 2000-505270
[Patent Document 2]
JP2002-232460
[Patent Document 3]
JP2002-141953
[Patent Document 4]
JP-A-11-338799
[Patent Document 5]
JP 2002-344530
[0009]
[Problems to be solved by the invention]
However, there are the following problems in the above-described conventional one.
[0010]
In the thing of patent document 1, when user authentication is not performed in the server connected to the internal network, the access to the internal network by an outsider who knows the access destination cannot be prevented. . In addition, if the server connected to the internal network uses unencrypted HTTP, unencrypted data flows through the external network, so there is a risk of data being intercepted by outsiders. . Thus, there is a problem that security cannot be ensured.
[0011]
In addition, it is necessary to ensure a connection from the internal server to the external server regardless of whether there is an external access, and thus a load is constantly generated on the network and the firewall. Thus, there is a problem that the network load becomes high.
[0012]
Furthermore, when the connection is disconnected, there is a problem that the internal network cannot be accessed from the outside until it is detected and reconnected on the internal server side.
[0013]
In the device described in Patent Document 2, since a VPN tunnel is used for connection via the Internet, a VPN gateway and a dedicated line for connection to an external client are required. For this reason, there is a problem that a special mechanism is required on the user side.
[0014]
In the conventional method using a reverse proxy, when there is a change in an internal Web server that is desired to be accessed from an external client, in order to be able to access the internal Web server from the reverse proxy server, not only the reverse proxy server, You need to change the firewall settings. As described above, there is a problem that the firewall setting becomes complicated.
[0015]
Further, the connection from the reverse proxy server to the internal Web server needs to be maintained until the internal Web server returns a response, and a load is generated on the network and the firewall. Thus, there is also a problem that the network load becomes high.
[0016]
In the device described in Patent Document 3, unauthorized access to an internal network by an outsider cannot be reliably prevented only by performing authentication processing using a user ID or password.
[0017]
In the thing of patent document 4, since it is necessary to maintain an internal and external network, network load becomes high like the conventional technique using the thing of the above-mentioned patent document 1, and the reverse proxy. There is also a problem. In addition, since a special application for managing authentication is required on the client side, there is a problem that the burden on the client side becomes large.
[0018]
In the device described in Patent Document 5, although DMZ can be easily constructed, access to the internal network by outsiders cannot be reliably prevented.
[0019]
Each of the conventional methods described above has a different method, and it is very difficult to adopt only these features in combination.
[0020]
An object of the present invention is to provide a remote access system and a remote access method that can surely prevent an outsider from accessing an internal network, and can reduce the burden on the client side and the network load. There is.
[0021]
[Means for Solving the Problems]
  In order to achieve the above object, a remote access system of the present invention is a remote access system that controls access from an external client connected to an external network to at least one internal Web server connected to the internal network,
  DMZ isolated from the external network and internal network by a firewall;
  A DMZ relay server connected to the DMZ;
  And at least one internal relay server connected to the internal network,
  The DMZ relay server has a first access control information storage means in which information on an internal Web server that can be accessed by a user of the external client and an internal relay server that relays the connection is associated and stored in advance. When the access request to the internal Web server is received from the external client, the legitimacy of the user of the external client is confirmed, and the stored information in the first access control information storage unit is referred to Determining whether or not access by a user of the external client is permitted, and when determining that the access is permitted, transmitting an access request from the external client to the corresponding internal relay server,
  The internal relay server includes an internal Web server that can be accessed by a user of the external client and a second access control information storage unit that stores connection information associated with the internal Web server, and the external client terminal When the access request from the DMZ relay server is received, it is determined whether access by the user is permitted by referring to the stored information in the second access control information storage means. If it is determined, the access request from the external client terminal is transmitted to the corresponding internal Web server.And
  Further, when the internal relay server receives a response from the internal Web server that has transmitted the access request from the external client terminal, the internal relay server performs a predetermined conversion process on the received response, and the conversion process result is transmitted to the DMZ relay. To the server,
  The DMZ relay server transmits the conversion processing result from the internal relay server to the external client,
  Communication between the external client and the DMZ relay server is performed by HTTPS.It is characterized by that.
[0022]
  The remote access method of the present invention comprises a DMZ isolated from an external network and an internal network by a firewall, a DMZ relay server connected to the DMZ, and at least one internal relay server connected to the internal network. A remote access method performed in a system for controlling access from an external client connected to the external network to at least one internal Web server connected to the internal network,
  When the DMZ relay server receives an access request to the internal Web server from the external client, the first step of confirming the validity of the user of the external client;
  When it is determined in the first step that the user of the external client is valid, the DMZ relay server relays an internal Web server that can be accessed by the user of the external client and its connection. A second step of determining whether or not access by a user of the external client is permitted with reference to first access control information storage means stored in advance associated with information with the relay server;
  When it is determined in the second step that access by a user of the external client is permitted, the DMZ relay server transmits an access request from the external client to the corresponding internal relay server. And the steps
  When the internal relay server receives an access request from the external client terminal from the DMZ relay server, an internal Web server that can be accessed by a user of the external client and its connection information are stored in association with each other. A fourth step of referring to the access control information storage means 2 to determine whether access by the user is permitted;
  When it is determined in the fourth step that access by a user of the external client is permitted, the internal relay server transmits an access request from the external client terminal to the corresponding internal Web server. 5 steps and,
  When the internal relay server receives a response from the internal Web server that has transmitted the access request from the external client terminal, the internal relay server performs a predetermined conversion process on the received response and sends the conversion process result to the DMZ relay server. A sixth step of transmitting;
  The DMZ relay server includes a seventh step of transmitting the conversion processing result from the internal relay server to the external client;
  Communication between the external client and the DMZ relay server is performed by HTTPS.It is characterized by that.
[0023]
According to the present invention as described above, the firewall prevents direct access from the external network to the internal network, and when the external client accesses the internal Web server, user authentication is performed by the DMZ relay server. In addition, it is confirmed whether access is permitted in both the DMZ relay server and the internal relay server. For this reason, it is extremely difficult for a third party to illegally access the internal Web server from the outside. For example, even if the firewall is broken by an attack by a third party and the stored information in the first access control information storage means in the DMZ relay server is altered, unauthorized access is eliminated by access control by the internal relay server.
[0024]
Further, since it is not necessary to provide a special mechanism for the external client, the burden on the user is small.
[0025]
Furthermore, if a connection between the DMZ relay server and the internal relay server can be secured, it is possible to send and receive access requests and responses. In this case, loads on the internal firewall, DMZ, and internal network are reduced.
[0026]
In addition, a dedicated line such as a VPN tunnel is not necessary, which is advantageous in terms of cost.
[0027]
Furthermore, if a firewall is set so that communication between the DMZ relay server and the internal relay server is possible, the DMZ relay server and the internal relay server can be set even when an internal Web server is added, deleted, or changed. This can be done by changing the settings, and there is no need to change the internal firewall settings.
[0028]
Further, by encrypting the communication between the external client and the DMZ, the content of the communication is not intercepted by a third party. Thereby, higher security is ensured.
[0029]
By using, for example, SSL for encrypted communication between the external client and the DMZ, an existing terminal can be used as the external client, and the burden on the user is further reduced.
[0030]
DETAILED DESCRIPTION OF THE INVENTION
Next, embodiments of the present invention will be described with reference to the drawings.
[0031]
FIG. 1 shows a schematic configuration of a remote access system according to an embodiment of the present invention. This remote access system includes an external client 1, an external network 2, an external firewall 3, a DMZ 4, a DMZ relay server 5, an internal firewall 6, an internal network 7, an internal relay server 8, and an internal Web server 9.
[0032]
The external network 2 is the Internet and a public network for connecting to it by dial-up. The internal network 7 is a network constructed in a company, and is, for example, a LAN or a WAN (Wide Area Network). The external network 2 is connected to the DMZ 4 via the external firewall 3, and the internal network 7 is connected to the DMZ 4 via the internal firewall 6.
[0033]
The external firewall 3 controls communication between the external network 2 and the DMZ 4, and the internal firewall 6 controls communication between the internal network 7 and the DMZ 4. Communication between the external network 2 and the internal network 7 is performed via the DMZ 4.
[0034]
The DMZ 4 is a network segment that relays between the external network 2 and the internal network 7 and is isolated from the external network 3 and the internal network 6 by a firewall. The DMZ 4 is generally widely used for the purpose of suppressing unauthorized access to the internal network from the external network.
[0035]
A DMZ relay server 5 is connected to the DMZ 4, and an internal relay server 8 and an internal Web server 9 are connected to the internal network 7. The external client 1 is a user terminal (including a mobile phone or a portable information terminal) equipped with a Web browser compatible with HTTPS (HTTP (HyperText Transfer Protocol) protected by Secure Sockets Layer (SSL)). For example, an employee or the like can use the device while away from home or at home. The external client 1 can be connected to the external network 2.
[0036]
The internal Web server 9 is a business system that performs internal business operations such as ordering and inventory management from a user terminal (not shown) (hereinafter referred to as an internal client) equipped with a Web browser connected to the internal network 7. Provide access to the function. Specifically, the internal Web server 9 causes the business system to execute necessary processing based on an HTTP or HTTPS request from the internal client, and returns the result to the internal client.
[0037]
When the DMZ relay server 5 receives an HTTPS access request from the external client 1 to the internal Web server 9, the DMZ relay server 5 determines the legitimacy of the user who made the access request, and then the internal Web that is the destination of the received request. The server determines whether or not access by the user is permitted, and transmits an access request from the external client 1 to the corresponding internal relay server only when the server is permitted. Also, the DMZ relay server 5 receives a processing result from the internal relay server in response to the transmitted access request, and makes a response to the external client 1.
[0038]
When the internal relay server 8 receives an access request from the external client 1 from the DMZ relay server 5, whether the internal Web server that is the destination of the received request is permitted to be accessed by the user who made the request. The access request from the external client 1 is transmitted to the corresponding internal Web server only when it is permitted. The internal relay server 8 performs necessary conversion processing on the response from the internal Web server to the transmitted access request, and transmits the result to the DMZ relay server 5.
[0039]
In the remote access system of this embodiment described above, when accessing the internal Web server 9, the external client 1 first issues a request to the DMZ relay server 5 using HTTPS. When the DMZ relay server 5 receives a request from the external client 1, it is determined whether the access is from an authenticated user or permitted access. In the case of access from an authenticated user and permitted access, the DMZ relay server 5 transmits a request from the external client 1 to the internal relay server 8.
[0040]
  The internal relay server 8 determines again whether the access is permitted. If the access is permitted, the internal relay server 8 transmits a request from the external client 1 to the internal Web server 9 by HTTP or HTTPS. Then, necessary conversion processing is performed on the response from the internal Web server 9 and the result is transmitted to the DMZ relay server 5. The DMZ relay server 5 sends a response from the converted internal Web server 9TheSend to external client 1.
[0041]
With the series of processes described above, access from the outside to the internal Web server 9 connected to the internal network 7 is realized while ensuring security.
[0042]
Next, specific configurations of the DMZ relay server 5 and the internal relay server 8 will be described.
[0043]
(1) Configuration of DMZ relay server 5:
FIG. 2 shows a schematic configuration of the DMZ relay server 5. Referring to FIG. 2, the DMZ relay server 5 includes a data processing device 51 and a storage device 52. The data processing device 51 includes a request processing unit 511, a communication unit 512, a session management unit 513, an authentication unit 514, and an access control unit 515. The storage device 52 includes an access control information storage unit 521.
[0044]
The request processing unit 511 receives an access request from the external client 1 via the external network 2, the external firewall 3, and the DMZ 4, and passes the received request to the session management unit 513. The session management unit 513 acquires valid session information based on the cookie included in the request received from the request processing unit 511, and returns the content of the acquired session information to the request processing unit 511. If valid session information is not included in the request from the external client 1, the session management unit 513 newly generates a session.
[0045]
When valid session information is received from the session management unit 513, the request processing unit 511 passes the session information to the authentication unit 514. When the session management unit 513 generates a new session, the request processing unit 511 responds to the external client 1 to make a transition to the authentication screen.
[0046]
The authentication unit 514 determines whether the request is from an authenticated user based on the session information received from the request processing unit 511, and returns the result to the request processing unit 511. If the request is from an authenticated user, the request processing unit 511 passes the access request from the external client 1 to the access control unit 515. If it is not a request from an authenticated user, the authentication unit 514 performs user authentication again. As the user authentication method, for example, a fixed password method or a one-time password method can be used. If it is determined that the user authentication is not valid, the request processing unit 511 responds to the external client 1 to make a transition to the authentication screen.
[0047]
When the access control unit 515 receives an access request from the external client 1 from the request processing unit 511, the access control unit 515 refers to information stored in the access control information storage unit 521 in advance, and the internal Web server that is the destination of the received request is Then, it is determined whether or not access by a user who is determined to be valid by the authentication unit 514 is permitted.
[0048]
FIG. 3 shows an example of information stored in the access control information storage unit 521. The access control information storage unit 521 includes a user ID number, a number (or name) that identifies an internal Web server that is permitted to be accessed by the user, and an internal relay server that relays the connection to the internal Web server. A number (or name) to be identified is stored in advance in association with each other. In the example illustrated in FIG. 3, a user having a user ID “000001” can access internal Web servers “A1”, “A2”, and “B”, and “A1”, “A2”. When accessing the internal web server, the internal relay server “a” is used, and when accessing the internal web server “B”, the internal relay server “b” is used. By referring to the information in the access control information storage unit 521, whether or not the internal Web server that is the destination of the accepted request is permitted to be accessed by an authenticated user. Judgment can be made.
[0049]
If the destination internal Web server is permitted to be accessed by an authenticated user, the access control unit 515 obtains the corresponding internal relay server information from the access control information storage unit 521 and requests it. The data is passed to the processing unit 511. For example, when the internal Web server of the destination is “A1” and the user ID is “00001”, the access control unit 515 acquires the information of the internal relay server “a” as the corresponding internal relay server information, It is passed to the request processing unit 511. If the destination internal Web server is not permitted to be accessed by the authenticated user, the access control unit 515 passes that fact to the request processing unit 511.
[0050]
When receiving the internal relay server information from the access control unit 515, the request processing unit 511 sends the external client 1 to the corresponding internal relay server 8 from the communication unit 512 via the DMZ 4, the internal firewall 6, and the internal network 7 in order. The access request from is sent together with user information.
[0051]
A processing result from the internal relay server 8 in response to the transmitted access request is supplied to the request processing unit 511 via the internal network 7, the internal firewall 6, the DMZ 4, and the communication unit 512 in order. The request processing unit 511 performs response processing to the external client 1 according to the received processing result.
[0052]
(2) Configuration of the internal relay server 8:
FIG. 4 shows a schematic configuration of the internal relay server 8. Referring to FIG. 4, the internal relay server 8 includes a data processing device 81 and a storage device 82. The data processing device 81 includes a communication unit 811, a request processing unit 812, an access control unit 813, and a URL conversion unit 814. The storage device 82 includes an access control information storage unit 821 and a URL conversion information storage unit 822.
[0053]
The communication unit 811 is configured to be capable of mutual communication with the communication unit 512 of the DMZ relay server 5 described above via the DMZ 4, the internal firewall 6, and the internal network 7.
[0054]
Upon receiving a request from the DMZ relay server 5 via the communication unit 811, the request processing unit 812 passes the request to the access control unit 813. The access control unit 813 refers to the information in the access control information storage unit 821, and the internal Web server that is the destination of the received request is permitted to be accessed by a user who is determined to be valid by the authentication unit 514. It is judged again whether it is a thing.
[0055]
FIG. 5 shows an example of information stored in the access control information storage unit 821. The access control information storage unit 821 includes a user ID number, a number (or name) that identifies an internal Web server that is permitted to be accessed by the user, and connection information for connecting to the internal Web server. Associated and stored in advance. In the example of FIG. 5, a user having a user ID “000001” is assigned to an internal Web server “A1” and “A2”, and a user having a user ID “000003” is assigned to “A1”, “A2”. It is possible to access the internal Web servers A2 and C, and when accessing “A1”, “http: // A /”, when accessing “A2”, “https: // A In order to access “/” and “C”, the setting is to use “http: // C: 8080 /”. By referring to such information in the access control information storage unit 821, whether or not the internal Web server that is the destination of the received request is permitted to be accessed by an authenticated user. It is possible to determine the connection information and obtain the connection information to the permitted internal Web server.
[0056]
If the destination internal Web server is permitted to be accessed by an authenticated user, the access control unit 813 obtains connection information about the destination internal Web server from the access control information storage unit 821 and uses it. To the request processing unit 812. For example, when the destination internal Web server is “A1” and the user ID is “00001”, the access control unit 813 obtains “http: // A /” as connection information regarding the destination internal Web server. Then, it is passed to the request processing unit 812. If the destination internal Web server is not permitted to be accessed by the authenticated user, the access control unit 813 passes the fact to the request processing unit 812.
[0057]
When connection information to the internal Web server is received from the access control unit 813, the request processing unit 812 checks whether there is a problem (for example, format abnormality) in the request from the external client 1 received from the DZM relay server 5. . If there is no problem with the request, the request processing unit 812 sends the request from the external client 1 together with the user information based on the connection information to the internal Web server received from the access control unit 813 using the HTTP or HTTPS. To the corresponding internal Web server, and waits for a response.
[0058]
When there is a response from the internal Web server, the request processing unit 812 passes the response content to the URL conversion unit 814. The URL conversion unit 814 refers to the information stored in advance in the URL conversion information storage unit 822 and performs conversion processing on the response content from the internal Web server. The converted content is transferred to the request processing unit 812.
[0059]
FIG. 6 shows an example of information stored in the URL conversion information storage unit 822. Referring to FIG. 6, the conversion information storage unit 822 such as URL holds conversion information for a response for each internal Web server. In this example, for example, if the response from the internal Web server “A1” includes the character string “<A HREF =“ / ”, the character string“ <A HREF = “/ access / A1 /” is added. It is set to convert. By referring to the information in the conversion information storage unit 822 such as the URL, the conversion process can be performed on the response content from the internal Web server.
[0060]
The request processing unit 812 transmits the response converted by the URL conversion unit 814 from the communication unit 811 to the DMZ relay server 5 via the internal network 7, the internal firewall 6, and the DMZ 4 in order.
[0061]
In the case where access by the user is not permitted, there is a problem in the request, or there is no response from the internal Web server, the request processing unit 812 sends the request from the communication unit 811 to the internal network 7, Information indicating that an error has occurred is sequentially transmitted to the DMZ relay server 5 through the internal firewall 6 and the DZM 4.
[0062]
Next, a series of remote access operations performed in the remote access system of this embodiment will be described in detail.
[0063]
FIG. 7 is a flowchart showing the operation of the DMZ relay server 5. Hereinafter, the operation in the DMZ relay server 5 will be described with reference to FIGS. 2 and 7.
[0064]
When the DMZ relay server 5 is activated, the request processing unit 511 waits for an access request by HTTPS from the external client 1 (step S101). When the request processing unit 511 receives an access request from the external client 1, the session management unit 513 determines whether valid session information is included in the access request (step S102). When this determination is “No”, the session management unit 513 newly generates a session (step S108), and in response to this, the request processing unit 511 transitions to the authentication screen for the external client 1. (Step S114). After the instruction, the process returns to step S101.
[0065]
  If “Yes” is determined in step S102, the authentication unit 514 determines whether the access request from the external client 1 is a request from the authenticated user by the session management unit 513.GetJudgment is made from the valid session information that has been made (step S103). If the determination is “No”, the request processing unit 511 determines whether the access request from the external client 1 is an access request to the authentication screen (step S109). If the determination is “Yes”, the request processing unit 511 transmits an authentication screen to the external client 1 (step S110). After transmitting the authentication screen, the process returns to step S101.
[0066]
If “No” is determined in step S109, the request processing unit 511 determines whether the access request from the external client 1 is an input request for authentication information (step S111). If the determination is “Yes”, the authentication unit 514 determines whether the input authentication information is valid (step S112). If the authentication determination is “Yes”, the request processing unit 511 instructs the external client 1 to transition to the request screen (step S110). After the instruction, the process returns to step S101.
[0067]
If “No” is determined in any of the determinations in steps S111 and S112, the process proceeds to step S114.
[0068]
If the determination in step S103 results in “Yes”, the access control unit 515 uses the access request from the external client 1 and the user information included therein to retrieve the information in the access control information storage unit 521. Referring to this, it is determined whether or not the internal Web server that is the destination of the request is permitted to be accessed by the authenticated user (step S104). If the determination is “No”, the request processing unit 511 transmits information indicating that an error has occurred to the external client 1 (step S115). After sending the error, the process returns to step S101.
[0069]
If the determination in step S104 is “Yes”, the access control unit 515 acquires the corresponding internal relay server information from the access control information storage unit 521, and the request processing unit 511 acquires the acquired internal relay server information. Based on the above, the access request from the external client 1 is transmitted to the corresponding internal relay server together with the user information (step S105). After transmitting the access request, the DMZ relay server 5 waits for a response from the internal relay server, and the request processing unit 511 determines whether there is a normal response from the internal relay server (step S106). When the determination is “No”, the process proceeds to step S115. When the determination is “Yes”, the request processing unit 511 transmits a response from the internal relay server to the external client 1 (step S107). ). After the response is transmitted, the process returns to step S101.
[0070]
FIG. 8 is a flowchart showing the operation of the internal relay server 8. Hereinafter, the operation of the internal relay server 8 will be described with reference to FIGS. 4 and 8.
[0071]
When the internal relay server 8 is activated, the request processing unit 812 waits for an access request (access request from the external client 1) from the DMZ relay server 5 (step S201). When the request processing unit 812 receives an access request from the DMZ relay server 5, the access control unit 813 refers to the information in the access control information storage unit 821, and the internal Web server that is the destination of the received request It is determined again whether access by the authenticated user is permitted (step S202). If the determination is “No”, the request processing unit 812 transmits information indicating that an error has occurred to the DMZ relay server 5 (step S208). After sending the error, the process returns to step S201.
[0072]
If “Yes” is determined in step S202, the request processing unit 812 checks whether there is a problem in the content of the access request received from the DMZ relay server 5 (step S203). If there is a problem, the process proceeds to step S108. If there is no problem, the access control unit 813 acquires connection information to the corresponding internal Web server from the access control information storage unit 821, and the request processing unit 812 corresponds to the corresponding internal Web based on the acquired connection information. The access request received from the DMZ relay server 5 is transmitted to the server (step S204).
[0073]
After the access request is transmitted, the internal relay server 8 waits for a response from the internal Web server, and the request processing unit 812 checks whether there is a response from the internal Web server (step S205). If this confirmation is “No”, the process proceeds to step S208. In the case of “Yes”, the URL conversion unit 814 refers to the information stored in the URL conversion information storage unit 822 and performs conversion processing on the response from the internal Web server (step S206). The request processing unit 812 transmits the conversion processing result to the DMZ relay server 5 (step S207). After the conversion process result is transmitted, the process returns to step S201.
[0074]
Next, the above-described access control operation will be described in more detail with a specific example.
[0075]
FIG. 9 is a sequence diagram showing an example of a specific operation of the remote access system of this embodiment. Hereinafter, the operation will be described with reference to FIGS. 2, 4, 7, 8 and 9.
[0076]
Here, the DMZ relay server 5 and the internal relay server 8 are in a request waiting state (corresponding to steps S101 and S201), and the user transmits a screen request to the DMZ relay server 5 for the first time using the external client 1. The operation in the case of having been performed will be described.
[0077]
In the DMZ relay server 5, the session management unit 513 tries to acquire the session information of the request from the external client 1, but since the received request is the first request, there is no session information. Therefore, the session management unit 513 newly generates a session (corresponding to step S108), and the request processing unit 511 instructs the external client 1 to transition to the authentication screen (corresponding to step S114). After the instruction, the DMZ relay server 5 returns to the request waiting state (corresponding to step S101).
[0078]
In the external client 1 instructed to transition to the authentication screen, a message or screen requesting input for transition to the authentication screen is displayed. In response to this display, the user performs a predetermined input operation on the external client 1, whereby an authentication screen request is transmitted from the external client 1 to the DMZ relay server 5.
[0079]
In the DMZ relay server 5 that has received the authentication screen request, the session management unit 513 acquires session information from the received authentication screen request, and the authentication unit 514 accesses from an authenticated user based on the acquired session information. Is determined (corresponding to step S103). Since it is not an access from an authenticated user, the authentication unit 514 subsequently determines whether the request is for an authentication screen (corresponding to step S109). Since it is an authentication screen request, subsequently, the request processing unit 511 returns an authentication screen to the external client 1 (corresponding to step S110).
[0080]
In the external client 1 that has received the authentication screen, the received authentication screen is displayed, and the user inputs authentication information in response to the display, whereby an authentication request including authentication information is sent from the external client 1 to the DMZ relay server 5. Is sent.
[0081]
In the DMZ relay server 5 that has received the authentication request, the session management unit 513 acquires session information from the received authentication request, and the authentication unit 514 is an access from an authenticated user based on the acquired session information. (Corresponding to step S103). Since it has not been authenticated, the request processing unit 511 subsequently determines whether the request is for an authentication screen (corresponding to step S109). Since it is not a request for an authentication screen, the request processing unit 511 subsequently determines whether or not the authentication information is input (corresponding to step S111). Since the authentication information is input, the authentication unit 514 confirms the validity of the input authentication information (corresponding to step S112), and the request processing unit 511 displays the request screen for the external client 1. A transition is instructed (corresponding to step S113).
[0082]
In the external client 1 instructed to transition to the request screen, a message or screen requesting input for transition to the request screen is displayed. In response to this display, the user performs a predetermined input operation on the external client 1, whereby a screen request is transmitted from the external client 1 to the DMZ relay server 5.
[0083]
In the DMZ relay server 5 that has received the screen request, the session management unit 513 acquires session information from the received screen request, and the authentication unit 514 can access the authenticated user based on the acquired session information. It is determined whether or not there is (corresponding to step S103). Since the authentication has been completed, the access control unit 515 confirms whether or not the authenticated user has access permission (corresponding to step S104). Here, it is assumed that access by an authenticated user is permitted. Since the access is permitted, the access control unit 515 subsequently acquires the corresponding internal relay server information, and the request processing unit 511 receives the corresponding internal relay from the communication unit 512 according to the acquired internal relay server information. The received screen request is transmitted to the server 8 together with user information (corresponding to step S105).
[0084]
In the internal relay server 8 that has received the screen request, the access control unit 813 confirms whether or not the user authenticated by the authentication unit 514 has access permission (corresponding to step S104). Here, it is assumed that access by an authenticated user is permitted. Since access is permitted, the request processing unit 812 then checks whether there is a problem with the contents of the screen request received from the DMZ relay server 5 (corresponding to step S203). Here, it is assumed that there is no problem in the contents of the screen request. Since there is no problem, the access control unit 813 subsequently acquires connection information to the corresponding internal Web server, and the request processing unit 812 sends DMZ to the corresponding internal Web server 9 according to the acquired connection information. The screen request received from the relay server 5 is transmitted (step S204).
[0085]
The internal Web server 9 that has received the screen request executes necessary processing for the received screen request, and returns a URL of a predetermined screen to the internal relay server 8 as a response. Here, the necessary processing is, for example, user authentication. If this user authentication fails, error information indicating that is returned as a response. Here, it is assumed that the URL of a predetermined screen is returned.
[0086]
In the internal relay server 8 that has transmitted the screen request, the request processing unit 812 checks whether there is a response from the internal Web server 9 (corresponding to step S205). Since the response is received from the internal Web server 9, the URL conversion unit 814 subsequently converts the response (URL) from the internal Web server 9 (corresponding to step S 206), and the request processing unit 812. However, the conversion processing result (converted URL) is returned to the DMZ relay server 5 (corresponding to step S207). Thereafter, the internal relay server 8 returns to the request waiting state (corresponding to step S201).
[0087]
In the DMZ relay server 5 that has transmitted the screen request, the request processing unit 511 checks whether there is a response from the internal relay server 8 (corresponding to step S106). Since the response (converted URL) has been received from the internal relay server 8, the request processing unit 511 then returns the received response (converted URL) to the external client 1 (corresponding to step S107). . Thereafter, the DMZ relay server 5 returns to the request waiting state (corresponding to step S101).
[0088]
With the above operation, a predetermined screen presented from the internal Web server 9 is displayed on the external client 1. When the user makes some input on the display screen, the external client 1 transmits a new screen request to the DMZ relay server 5 accordingly. The above-described operation is executed for the screen request transmitted in this way, and as a result, a new request screen is displayed on the external client 1.
[0089]
According to the remote access system of the present embodiment described above, it is impossible to directly access the internal network 7 from the external network 2 by the firewall, and the DMZ for the access from the external client 1 to the internal Web server 9 is prevented. User authentication is performed at the relay server 5 and access control is performed at two locations, the DMZ relay server 5 and the internal relay server 8. For this reason, for example, even if the external firewall 5 is broken by an attack by a third party and the stored information in the access control information storage unit 521 in the DMZ relay server 5 is falsified, unauthorized access is prevented by access control by the internal relay server 8. Eliminated. Thus, it is extremely difficult for a third party to illegally access the internal Web server 9 from the outside.
[0090]
In addition, since the communication between the external client 1 and the DMZ relay server 5 is encrypted by SSL, the communication content is not intercepted by a third party. Thereby, security is ensured.
[0091]
In the remote access system of the present embodiment, the external client 1 may use any terminal as long as it can use a web browser compatible with HTTPS, for example, an existing personal computer (PC) or the like. Can be used. Thus, since a special mechanism is unnecessary, the burden on the user is small.
[0092]
Further, since URL conversion is performed by the internal relay server 8, the response (URL) from the internal Web server 9 to the external client may be the same as the response (URL) for the internal client that is originally performed. There is no need to modify the content of the internal Web server itself for an external client in order to convert it into a response for the client. Therefore, the setting change of the internal Web server can be minimized.
[0093]
Furthermore, the connection of the DMZ relay server 5 and the internal relay server 8 should be ensured when actually transmitting and receiving request and response data, so the load on the internal firewall 6, DMZ 4 and internal network 7 is reduced. In this way, the network load can be reduced.
[0094]
Further, if the internal firewall 6 is set so that communication between the DMZ relay server 5 and the internal relay server 8 is possible, even when the internal Web server 9 is added, deleted, or changed, the DMZ relay server 5 and This can be dealt with by changing the settings of the internal relay server 8, and there is no need to change the settings of the internal firewall. In this way, the firewall setting is also easy.
[0095]
Further, the external firewall 3 and the internal firewall 6 can be the same device.
[0096]
(Other embodiments)
In the system of the above-described embodiment, when the connection from the external client 1 to the internal Web server 9 is performed, the user authentication is performed in the connection destination Web server 9. This authentication operation is performed for each Web server 9 and normally requires manual input by the user. Here, a system that collectively performs user authentication performed for each of these Web servers will be described.
[0097]
The basic configuration of the remote access system of this other embodiment is the same as the system configuration shown in FIG. 1, but the internal relay server access control information storage unit 821 uses authentication information for each internal Web server. Each user is stored, and when the internal relay server 8 accesses the internal Web server 9, user authentication is performed using the authentication information. Here, the authentication information for the internal Web server includes an authentication method (basic authentication (RFC2617) or screen form input method) performed by each internal Web server and user authentication information (user name and password). Including. In the case of the screen form input method, information on the URL for authentication processing and form fields (fields corresponding to the user name and password) are included.
[0098]
User authentication by the internal relay server 8 is executed between steps S203 and S204 of the procedure shown in FIG. In this case, if the user authenticates the DMZ relay server 5 once, the user can access each internal Web server 9 without performing user authentication. improves.
[0099]
The configuration of the remote access system of each embodiment described above is not limited to the illustrated configuration, and can be appropriately changed without departing from the spirit of the invention. For example, the external firewall 3 and the internal firewall 6 may be the same device.
[0100]
In addition, although one external client is connected to the external network 2, a plurality of external clients may be connected to access the internal Web server from each external client.
[0101]
Furthermore, although one internal relay server 8 is connected to the internal network 7, a plurality of internal relay servers may be connected. Thereby, since load distribution can be performed, it becomes possible to further reduce the network load.
[0102]
Furthermore, although one internal Web server is connected to the internal network 7, a plurality of internal Web servers may be connected.
[0103]
Furthermore, the encryption of communication between the external client 1 and the DMZ relay server 5 is not limited to SSL, and other existing encryption methods can be used.
[0104]
【The invention's effect】
As described above, according to the present invention, in order to access the internal Web server, it is necessary to perform user authentication at the DMZ relay server and access control at two locations of the DMZ relay server and the internal relay server. In addition, since direct access from the external network to the internal network is disabled by the firewall, there is an effect that it is possible to more reliably prevent outsiders from accessing the internal Web server.
[0105]
Further, since communication from the external client to the DMZ relay server is encrypted by, for example, SSL, there is an effect that wiretapping by outsiders can be suppressed.
[0106]
Furthermore, since it is only necessary to secure a connection for actually transmitting and receiving request and response data between the DMZ relay server and the internal relay server, the load on the internal firewall, DMZ, and internal network is reduced, and the network is increased accordingly. There is an effect that the load can be reduced.
[0107]
Furthermore, by using a plurality of internal relay servers, the load can be distributed, and the network load can be further reduced.
[0108]
In addition, if an internal firewall is set so that communication between the DMZ relay server and the internal relay server is possible, the DMZ relay server and the internal relay can be used even when an internal Web server is added, deleted, or changed. This can be dealt with by changing the server settings, and there is no need to change the internal firewall settings. As described above, there is an effect that the setting of the firewall is easy.
[0109]
Furthermore, since the external client only needs to be able to use a Web browser that supports HTTPS, a commonly used PC (personal computer) or the like can be used as the external client. Thus, a special mechanism is unnecessary on the user side, and there is an effect that there is no burden on the user.
[0110]
In addition, since the response for the internal client of the internal Web server is converted to the response for the external client by converting the URL etc. in the internal relay server, it is necessary to modify the content of the internal Web server for the external client. There is no. For this reason, there is an effect that the setting change of the internal Web server can be minimized.
[Brief description of the drawings]
FIG. 1 is a block diagram showing a schematic configuration of a remote access system according to an embodiment of the present invention.
FIG. 2 is a block diagram showing a schematic configuration of a DMZ relay server shown in FIG. 1;
FIG. 3 is a diagram showing an example of information stored in an access control information storage unit shown in FIG.
4 is a block diagram showing a schematic configuration of an internal relay server shown in FIG. 1. FIG.
FIG. 5 is a diagram illustrating an example of information stored in an access control information storage unit illustrated in FIG. 4;
6 is a diagram showing an example of information stored in a conversion information storage unit such as URL shown in FIG. 4. FIG.
7 is a flowchart showing the operation of the DMZ relay server shown in FIG.
FIG. 8 is a flowchart showing an operation of the internal relay server shown in FIG. 4;
FIG. 9 is a sequence diagram for explaining the operation of the remote access system shown in FIG. 1;
[Explanation of symbols]
1 External client
2 External network
3 External firewall
4 DMZ
5 DMZ relay server
6 Internal firewall
7 Internal network
8 Internal relay server
9 Internal Web server
51, 81 Data processing device
52, 82 Storage device
511, 812 Request processing part
512, 811 Communication Department
513 Session Management Department
514 Authentication Department
515, 813 Access control unit
521, 821 Access control information storage unit
814 URL conversion unit
822 URL conversion information storage unit

Claims (4)

A remote access system for controlling access from an external client connected to an external network to at least one internal Web server connected to the internal network,
A DMZ isolated from the external and internal networks by a firewall;
A DMZ relay server connected to the DMZ;
And at least one internal relay server connected to the internal network,
The DMZ relay server has a first access control information storage means in which information on an internal Web server that can be accessed by a user of the external client and an internal relay server that relays the connection is associated and stored in advance. When the access request to the internal Web server is received from the external client, the legitimacy of the user of the external client is confirmed, and the stored information in the first access control information storage unit is referred to Determining whether or not access by a user of the external client is permitted, and when determining that the access is permitted, transmitting an access request from the external client to the corresponding internal relay server,
The internal relay server includes an internal Web server that can be accessed by a user of the external client and a second access control information storage unit that stores connection information associated with the internal Web server, and the external client terminal When the access request from the DMZ relay server is received, it is determined whether access by the user is permitted by referring to the stored information in the second access control information storage means. If determined, the access request from the external client terminal is transmitted to the corresponding internal Web server ,
Further, when the internal relay server receives a response from the internal Web server that has transmitted the access request from the external client terminal, the internal relay server performs a predetermined conversion process on the received response, and the conversion process result is transmitted to the DMZ relay. To the server,
The DMZ relay server transmits the conversion processing result from the internal relay server to the external client,
A remote access system , wherein communication between the external client and the DMZ relay server is performed by HTTPS . A plurality of internal web servers,
The second access control information storage means stores in advance authentication information of the user of the external client necessary for user authentication performed in each of the plurality of internal Web servers,
2. The internal relay server confirms the validity of the user of the external client with reference to the authentication information when it is determined that access by the user is permitted. The described remote access system. A DMZ isolated from an external network and an internal network by a firewall, a DMZ relay server connected to the DMZ, and at least one internal relay server connected to the internal network, and connected to the external network A remote access method performed in a system for controlling access from an external client to at least one internal Web server connected to the internal network,
When the DMZ relay server receives an access request to the internal Web server from the external client, the first step of confirming the validity of the user of the external client;
When it is determined in the first step that the user of the external client is valid, the DMZ relay server relays an internal Web server that can be accessed by the user of the external client and its connection. A second step of determining whether or not access by a user of the external client is permitted with reference to first access control information storage means stored in advance associated with information with the relay server;
When it is determined in the second step that access by a user of the external client is permitted, the DMZ relay server transmits an access request from the external client to the corresponding internal relay server. And the steps
When the internal relay server receives an access request from the external client terminal from the DMZ relay server, an internal Web server that can be accessed by a user of the external client and its connection information are stored in association with each other. A fourth step of determining whether or not access by the user is permitted with reference to the access control information storage means of 2;
When it is determined in the fourth step that access by a user of the external client is permitted, the internal relay server transmits an access request from the external client terminal to the corresponding internal Web server. 5 steps ,
When the internal relay server receives a response from the internal Web server that has transmitted the access request from the external client terminal, the internal relay server performs a predetermined conversion process on the received response and sends the conversion process result to the DMZ relay server. A sixth step of transmitting;
The DMZ relay server includes a seventh step of transmitting the conversion processing result from the internal relay server to the external client;
A remote access method , wherein communication between the external client and the DMZ relay server is performed by HTTPS . The system has a plurality of the internal web servers,
The second access control information storage means stores in advance authentication information of the user of the external client necessary for user authentication performed in each of the plurality of internal Web servers,
When the internal relay server determines that access by the user is permitted, the internal relay server further includes a step of confirming the validity of the user of the external client with reference to the authentication information. The remote access method according to claim 3 .

Images