JP4632062B2 - Access restriction information generation apparatus, access restriction information generation method, and program - Google Patents

Description

  The present invention relates to a technique for preventing unauthorized access to an access restriction target network in a thin client system, and in particular, access restriction information capable of restricting access to an access restriction target network according to the characteristics of the thin client system. The present invention relates to a technology for generating access restriction information.

  In recent years, information leakage problems have frequently occurred, and there is an increasing need to introduce a thin client system that uses a thin client terminal device that cannot store data for the purpose of restricting the taking of information. However, there are many cases in which the wrong recognition that the countermeasures against information leakage are completely implemented just by introducing a thin client system, and the risk when a terminal device (normal terminal device) other than the thin client terminal device is connected. Is often not considered. In addition, when a thin client system is introduced, there are few cases where all terminal devices are changed to a thin client terminal device at once, and there are many cases where a thin client terminal device and a normal terminal device are used together. There are very many cases in which countermeasures against unauthorized access during this introduction transition period are not taken into consideration.

  Even if a thin client system is introduced, unless a countermeasure against unauthorized access is taken, a normal terminal device can access a network subject to access restriction, and there is a risk that information may be leaked from here. For this reason, it is necessary to take measures against unauthorized access even in a thin client system, and prevent unauthorized access to network components (network switches, routers, etc.) installed between the terminal device and the access-restricted network (intranet, etc.). It is necessary to set access restriction information for this purpose.

  By the way, in the thin client system, there are various mounting methods such as a network boot type, a screen transfer type, and a virtual PC type, and the protocol to be used differs depending on the mounting method. In addition, there is a thin client system that permits connection of a normal terminal device other than the thin client terminal device, and there is a thin client system that does not permit it. Therefore, when setting access restriction information for network configuration devices, it is possible to set access restriction information that matches the characteristics of the thin client system in consideration of the thin client system implementation method and whether or not a normal terminal can be connected. I need it. As described above, when setting the access restriction information, it is necessary to consider the difference in protocol depending on the mounting method and whether or not a normal terminal device can be connected. Therefore, much knowledge and experience are required.

  On the other hand, the following techniques are conventionally known as techniques related to setting of network components such as routers and switches (see, for example, Patent Documents 1 and 2).

  The technique described in Patent Document 1 is a technique for generating router setting information capable of controlling whether or not communication between network segments is possible. The network segment pair is displayed on the display device and the user is displayed. Based on the communication availability information input to each pair, setting information (information indicating whether communication between network segments is permitted) to be set in the router is generated.

  The technique described in Patent Document 2 is a technique for setting filtering conditions for a switch newly introduced in a network, and by transferring the filtering conditions set for an existing switch to the newly established switch, Filtering conditions are set for the new switch.

JP 2005-311704 A JP 2006-340161 A

  According to the technique described in Patent Document 1 described above, it is possible to easily generate setting information to be set in a router that controls whether or not communication between network segments is possible. Further, according to the conventional technique described in Patent Document 2, it is possible to easily set the filtering condition for the newly installed switch. However, since Patent Documents 1 and 2 do not relate to the thin client system, it is not possible to generate access restriction information to be set in the network configuration device of the thin client system. That is, it is not possible to generate access restriction information that matches the characteristics of the thin client system in consideration of the mounting method and whether or not a normal terminal device can be connected.

(Object of invention)
Therefore, an object of the present invention is to provide access restriction information for restricting access by an access restriction method suitable for the characteristics of the thin client system, simply by inputting the thin client system mounting method and whether or not the normal terminal device can be connected. It is to be able to generate.

The first access restriction information generating apparatus according to the present invention is:
Thin client feature input means for receiving feature information indicating whether or not a thin client system is mounted and a normal terminal device is input from the input device;
The thin client system mounting method and the normal thin client system mounting method indicated by the feature information received by the thin client feature input means from among the access restriction methods set in advance depending on whether or not the terminal device can be connected. An access restriction method selection means for selecting an access restriction method suitable for connection of the terminal device;
Access restriction information generating means for generating access restriction information for carrying out access restriction for the access restriction target network according to the access restriction method selected by the access restriction method selection means.

A first access restriction information generation method according to the present invention includes:
A thin client feature input step for receiving feature information indicating whether a computer is input from an input device and a thin client system mounting method and whether or not a normal terminal device can be connected;
Of the thin client system indicated by the feature information received in the thin client feature input step, among the access restriction methods set in advance by the computer according to the thin client system mounting method and whether or not a normal terminal device can be connected An access restriction method selection step for selecting an access restriction method suitable for the mounting method and whether or not a normal terminal device can be connected;
The computer includes an access restriction information generation step of generating access restriction information for performing access restriction on the access restriction target network according to the access restriction method selected in the access restriction method selection step.

The first program according to the present invention is:
Computer
Thin client feature input means for receiving feature information indicating whether a thin client system is mounted and a normal terminal device can be connected, which is input from an input device;
The thin client system mounting method and the normal thin client system mounting method indicated by the feature information received by the thin client feature input means from among the access restriction methods set in advance depending on whether or not the terminal device can be connected. Access restriction method selection means for selecting an access restriction method suitable for the connection of the terminal device;
According to the access restriction method selected by the access restriction method selection means, it functions as an access restriction information generating means for generating access restriction information for restricting access to the access restriction target network.

  According to the present invention, it is possible to generate access restriction information for restricting access by an access restriction method suitable for the characteristics of the thin client system, simply by inputting the thin client system mounting method and whether or not a normal terminal device can be connected. The effect that it becomes possible can be acquired.

  Next, the best mode for carrying out the present invention will be described in detail with reference to the drawings.

[First embodiment of the present invention]
FIG. 1 is a block diagram showing a configuration example of a first embodiment of an access restriction information generating apparatus according to the present invention. The access restriction information generation apparatus 100 according to the present embodiment causes network configuration devices to perform access restriction that matches the characteristics of the thin client system based on the feature information indicating the characteristics of the thin client system, which is input by the administrator. Access restriction information, and includes thin client feature input means 101, access restriction method selection means 102, and access restriction information generation means 103.

  The thin client feature input unit 101 receives feature information input by an administrator. Here, the feature information input by the administrator includes mounting method information indicating the mounting method of the thin client system and connection permission / inhibition information indicating whether or not the connection of the normal terminal device is permitted.

  The access restriction method selection means 102 is an access restriction that indicates in what manner the access restriction for the access restriction target network, which is set in advance according to the thin client system mounting method and whether or not a normal terminal device can be connected, is executed. The thin client feature input unit 101 has a function of selecting a thin client system mounting method recognized by the feature information received by the thin client feature input unit 101 and an access restriction method suitable for connection of a normal terminal device.

  The access restriction information generation unit 103 has a function of generating access restriction information for performing access restriction on the access restriction target network according to the access restriction method selected by the access restriction method selection unit 102.

  The access restriction information generating apparatus 100 having such a function can be realized by a computer, and when realized by a computer, for example, as follows. A disk, a semiconductor memory, and other recording media on which a program for causing a computer to function as the access restriction information generating apparatus 100 is recorded are prepared, and the computer reads the program. The computer controls its own operation according to the read program, thereby realizing thin client feature input means 101, access restriction method selection means 102, and access restriction information generation means 103 on its own computer.

[Description of Operation of First Embodiment]
Next, the operation of this embodiment will be described in detail.

  When the administrator generates access restriction information to be set in the network configuration device of the thin client system, the administrator inputs characteristic information indicating the characteristics of the thin client system. In other words, the feature includes the mounting method information indicating the mounting method (for example, screen transfer type, virtual PC type, network boot type, etc.) of the thin client system and the connectability information indicating whether or not the connection of the normal terminal device is permitted. Enter information.

  The thin client feature input unit 101 receives feature information input by an administrator.

  The access restriction method selection means 102 is based on the characteristics of the thin client system indicated by the feature information received by the thin client feature input means 101, and is selected from the access restriction methods predetermined according to the characteristics of the thin client system. Then, an access restriction method suitable for the characteristics of the thin client is selected, and the selected access restriction method is passed to the access restriction information generation unit 103. That is, select an access restriction method suitable for the characteristics of the thin client system to be restricted from access restriction methods set in advance according to the implementation method of the thin client system and whether or not a normal terminal device can be connected. To do.

  The access restriction information generation unit 103 generates access restriction information for performing access restriction on the access restriction target network according to the access restriction method passed from the access restriction method selection unit 102. The generated access restriction information is set in a network component device such as a router.

[Effect of the first embodiment]
According to this embodiment, it is possible to obtain access restriction information for restricting access by an access restriction method suitable for the characteristics of the thin client system, simply by inputting the implementation method of the thin client system and whether or not the normal terminal device can be connected. The effect that it becomes possible to produce | generate can be acquired.

  The reason is that an access restriction method indicating how to perform access restriction on the access restriction target network is set in advance according to the thin client system implementation method and whether or not a normal terminal device can be connected. The access restriction information suitable for the access restriction target network is generated according to the selected access restriction method according to the thin client system implementation method entered by the user and the access restriction method suitable for whether or not a normal terminal device can be connected. Because.

[Second embodiment of the present invention]
Next, a second embodiment of the present invention will be described in detail. Referring to FIG. 2, the present embodiment includes an access restriction information generation device 1, a thin client management server 2, a network configuration device 3, a thin client terminal device 4, and a user terminal device 5 that is a normal terminal device. It is configured. The access restriction information generation device 1, the thin client management server 2, and the network component device 3 are connected to each other via a network 7 such as an intranet, and the thin client terminal device 4 and the user terminal device 5 are connected to the network component device 3. The network 7 is accessed via Note that there is a possibility that the unauthorized connection terminal device 6 is connected to the network component device 3.

  The thin client terminal device 4 is a terminal device having a minimum function such as a function of connecting to the network 7 and a function of performing input / output. Resources such as application programs and files managed by the thin client management server 2 are used. By using this function, the same function as the user terminal device 5 is provided to the user.

  The user terminal 5 is an information processing apparatus such as a personal computer and has a function of accessing the network 7 via the network constituent device 3.

  The network component 3 is realized by a network switch or a router, and has a function of restricting access from the terminal devices 4 to 6 to the network 7 in accordance with access restriction information sent from the access restriction information generating device 1. Have

  The thin client management server 2 has a function of managing resources such as application programs and files used by the thin client terminal device 4.

  The access restriction information generation device 1 generates access restriction information based on feature information indicating characteristics of the thin client system input by the administrator and an access restriction method corresponding to the characteristics of the thin client system set in advance. It has a function of generating and transmitting the generated access restriction information to the network component device 3.

  The access restriction information generation apparatus 1 having such a function includes a thin client feature input unit 11, an access restriction method selection unit 12, an access restriction information generation unit 13, and a transmission unit 14. The access restriction information generating apparatus 1 is connected to an input device 15 such as a keyboard, a display device 16 such as an LCD, and a storage device 17 such as a disk device.

  The storage device 17 is provided with an access restriction method storage unit 171 and an access restriction information storage unit 172. In the access restriction method storage unit 171, an access restriction method suitable for a thin client system having the characteristics is registered in association with the characteristics of the thin client system. In addition, the access restriction information generated by the access restriction information generating unit 13 is registered in the access restriction information storage unit 172.

  FIG. 3 is a diagram showing an example of the contents of the access restriction method storage unit 171. The first entry in the example in the figure is an access restriction method suitable for a thin client system having a feature that the mounting method is a virtual PC type, and uses a filter that allows only packets according to the DHCP protocol and the RDP protocol to pass. It is shown that. Also, the third entry in the example of the figure is an access restriction method suitable for a thin client system having a feature that a mounting method is a virtual PC type or a screen transfer type and a connection of a normal terminal device is not permitted. This shows that the connection destination of the interface on the network 7 side of the network component device 3 is limited to the thin client management server 2 only.

  The thin client feature input unit 11 has a function of receiving feature information representing features of a thin client system that performs access restriction, which is input by an administrator using the input device 15.

  The access restriction method selection means 12 is an access restriction method that matches the features of the thin client system indicated by the feature information received by the thin client feature input means 11 from the access restriction methods registered in the access restriction method storage unit 171. It has a function to select.

  The access restriction information generation unit 13 generates access restriction information for performing access restriction according to the access restriction method selected by the access restriction method selection unit 12 and registers the generated access restriction information in the access restriction information storage unit 172. It has a function.

  The transmission unit 14 has a function of transmitting the access restriction information registered in the access restriction information storage unit 172 to the network constituent device 3 via the network 7.

  The access restriction information generating apparatus 1 having such a function can be realized by a computer, and when realized by a computer, for example, as follows. A disk, a semiconductor memory, and other recording media on which a program for causing a computer to function as the access restriction information generation device 1 is recorded are prepared, and the computer reads the program. The computer realizes the thin client feature input means 11, the access restriction method selection means 12, the access restriction information generation means 13 and the transmission means 14 on its own computer by controlling its own operation according to the read program.

[Description of Operation of Second Embodiment]
Next, the operation of this embodiment will be described in detail.

  First, as shown in the flowchart of FIG. 4, the administrator inputs feature information indicating the features of the thin client system that performs access restriction from the input device 15 to the access restriction information generation device 1 (step A1). This feature information is received by the thin client feature input means 11.

  Here, the feature information input in step A1 will be described. Thin client systems have various mounting methods such as a network boot type, a screen transfer type, and a virtual PC type. Further, there are some that allow connection of only the thin client terminal device 4, and some that allow connection of the user terminal device 5 that is a normal terminal device. Furthermore, there are those that perform individual authentication of terminal devices, and others that do not. In addition, some perform network authentication and others do not.

  Therefore, in this embodiment, feature information including the following information is input in step A1.

Mounting method information: Information indicating whether the mounting method is a network boot type, a screen transfer type, or a virtual PC type.
Implementation restriction information: Information indicating whether or not to implement access restriction according to the implementation method.
Connection enable / disable information: Information indicating whether or not to permit connection of a user terminal device (normal terminal device).
Individual authentication presence / absence information: information indicating whether or not to perform individual authentication of the terminal device.
Network authentication presence / absence information: Information indicating whether or not to perform network authentication.

  Various methods can be used as the feature information input method. For example, a method of inputting in an interactive format or a method of inputting in a selected format can be employed.

  Thereafter, based on the feature information input in step A1, the access restriction method selection means 12 and the access restriction information generation means 13 perform the following processing.

  First, the access restriction method selection unit 12 performs individual authentication by the thin client system subject to access restriction based on the features of the thin client system recognized from the feature information received by the thin client feature input unit 11. (Step A2).

  If it is determined that individual authentication is to be performed (step A2 is Yes), the following processing is performed.

  First, the access restriction method selection unit 12 displays a message on the display device 16 to request the administrator for a list of device specific information of the terminal device that permits connection (access) to the network 7. In this embodiment, the MAC address is used as the device specific information, but the present invention is not limited to this, and an IP address or the like can also be used. After that, the access restriction method selection unit 12 extracts the access restriction method “generate MAC address filter” registered in association with the feature “perform individual authentication” from the access restriction method storage unit 171. Thereafter, when a list of MAC addresses of terminal devices that are permitted to connect to the network 7 is input by the administrator, the list and the access restriction method are transferred to the access restriction information generating unit 13. In the access restriction information generating unit 13, according to the list and the access restriction method passed from the access restriction method selecting unit 12, as the access restriction information, the MAC address that passes only the packet having the MAC address included in the list as the transmission source is passed. A filter is generated, and the generated MAC address filter is registered in the access restriction information storage unit 172 (step A3).

  Thereafter, based on the feature information received by the thin client feature input unit 11, the access restriction method selection unit 12 determines whether or not the thin client system to be subject to access restriction performs access restriction according to the mounting method. Is determined (step A4).

  If the access restriction according to the mounting method is not performed (No in step A4), the transmission unit 14 is instructed to transmit access restriction information. In accordance with this instruction, the transmission means 14 transmits the access restriction information registered in the access restriction information storage unit 172 to the network component device 3 (step A15 in FIG. 5).

  On the other hand, when the access restriction according to the mounting method is to be performed (Yes in Step A4), the thin client that is the target of the access restriction based on the feature information received by the thin client feature input unit 11 is used. The mounting method of the client system is determined (step A5).

  When the mounting method is the virtual PC type, the access restriction method “DHCP protocol and RDP protocol only packets registered by the access restriction method storage unit 171 in association with the feature“ implementation method is virtual PC type ”is stored. “Generate filter allowing passage” is taken out, and the taken out access restriction method is passed to the access restriction information generation means 13. As a result, the access restriction information generating unit 13 generates a filter that passes only packets according to the DHCP protocol and the RDP protocol as the access restriction information, and registers the generated filter in the access restriction information storage unit 172 (step A6). In other words, in the thin client system of which the mounting method is a virtual PC type, information exchange between the thin client terminal device 4 and the thin client management server 2 is performed using the RDP protocol. Since the IP address necessary for accessing the network 7 is often obtained using the DHCP protocol, a filter that passes only packets using the DHCP protocol and the RDP protocol is generated.

  Further, when the mounting method is the screen transfer type, the access restriction method “DHCP protocol and ICA protocol only packets that are registered in association with the feature“ implementation method is screen transfer type ”from the access restriction method storage unit 171. “Generate filter allowing passage” is taken out and passed to the access restriction information generating means 13. As a result, the access restriction information generating unit 13 generates a filter that passes only packets according to the DHCP protocol and the ICA protocol as access restriction information, and registers the generated filter in the access restriction information storage unit 172 (step A7). That is, in a thin client system with a screen transfer type implementation method, information exchange between the thin client terminal device 4 and the thin client management server 2 is performed using the ICA protocol, and the thin client terminal device 4 Since the IP address necessary for accessing the network 7 is often obtained using the DHCP protocol, a filter that passes only packets using the DHCP protocol and the ICA protocol is generated.

  When the mounting method is a virtual PC type or a screen transfer type, after steps A6 and A7 are completed, the access restriction method selection unit 12 performs access based on the feature information received by the thin client feature input unit 11. The thin client system to be restricted determines whether or not the connection of the user terminal device is permitted (step A8 in FIG. 5).

  If the connection of the user terminal device (normal terminal device) is not permitted (No in Step A8), the feature “implementation method is virtual PC type or screen transfer type and normal terminal is selected from the access restriction method storage unit 171. An access restriction method “Generate a filter that restricts the connection destination of the interface on the network 7 side of the network component device 3 to the thin client management server 2” registered in association with “device cannot be connected” is retrieved, It passes to the generation means 13. The access restriction information generation unit 13 generates and generates a filter that restricts the connection destination of the interface on the network 7 side of the network device 3 to the thin client management server 2 as the access restriction information in accordance with the passed access restriction method. The filter is registered in the access restriction information storage unit 172 (step A12). When access restriction is performed using the access restriction information generated in step A12, terminal devices (user terminal device 5 and unauthorized connection terminal device 6) other than the thin client terminal device 4 are also connected to the thin client management server 2. However, in the thin client authentication process performed in the thin client management server 2, since the correct thin client authentication information cannot be transmitted except for the thin client terminal device 4, the connection is rejected.

  On the other hand, when the connection of the user terminal device is permitted (Yes in Step A8), the thin client system to be subject to access restriction is based on the feature information received by the thin client feature input unit 11, It is determined whether network authentication is performed not only for the user terminal device but also for the thin client terminal device (step A9). If it is determined that network authentication is to be performed for the thin client terminal device and the user terminal device (Yes in step A9), the feature “implementation method is virtual PC type or screen transfer from the access restriction method storage unit 171. Access restriction method “Network authentication port to terminal connection port of network component 3” registered in association with “Perform network authentication for thin client terminal device and normal terminal device” "Access denied when authentication fails (Reject)" is taken out and passed to the access restriction information generating means 13. The access restriction information generation means 13 sets a network authentication port as the terminal connection port of the network component device 3 according to the passed access restriction method, and generates and generates access restriction information for denying access when authentication fails. The access restriction information is registered in the access restriction information storage unit 172 (step A10).

  In step A9, when it is determined that the thin client system subject to access restriction does not perform network authentication for the thin client terminal device 4 (when the determination result is No), access restriction is performed. An access restriction method “network that is registered in association with the feature“ implementation method is virtual PC type or screen transfer type, allows connection of normal terminal device, and performs network authentication for normal terminal device ”from the method storage unit 171 A network authentication port is set as the terminal connection port of the component device 3. When network authentication fails, “Connect to Default VLAN” is extracted and passed to the access restriction information generation means 13. The access restriction information generating means 13 sets a network authentication port in the terminal connection port of the network component device 3 according to the passed access restriction method, and when the network authentication fails, access restriction information for connecting the terminal device to the Default VLAN is provided. The generated access restriction information is stored in the access restriction information storage unit 172 (step A11).

  The Default VLAN is a VLAN prepared for permitting network access (access to the thin client management server 2) beyond the network configuration device 3 even to a terminal device that has failed network authentication, and the accessible range is limited. VLAN. The terminal device that has failed network authentication is connected to the Default VLAN for the following reason. If the network authentication port is set to the terminal connection port of the network component device 3 in accordance with the access restriction information generated in step A11, the thin client terminal device 4 does not perform network authentication (thin client terminal device 4). In a thin client system that does not have a configuration for performing network authentication, not only the unauthorized connection terminal device 6 but also the thin client terminal device 4 fails in network authentication. Therefore, if access is denied when network authentication fails, the thin client terminal device 4 cannot access the thin client management server 2. Therefore, in order to enable the thin client terminal device 4 to access the thin client management server 2, it is connected to the Default VLAN. The unauthorized connection terminal device 6 can also access the thin client management server 2 by being connected to the Default VLAN, but the connection is rejected by the thin client authentication process performed by the thin client management server 2. .

  Next, an operation when it is determined in step A5 in FIG. 4 that the implementation method of the thin client system to be subject to access restriction is the network boot type will be described. In this case, the access restriction method selection means 12 determines whether or not the thin client system subject to access restriction performs network authentication based on the feature information received by the thin client feature input means 11. (Step A13 in FIG. 5).

  And when it determines with not performing network authentication (step A13 is No), a transmission instruction | indication is output with respect to the transmission means 14. FIG. Thereby, the transmission means 14 transmits the access restriction information registered in the access restriction information storage unit 172 to the network constituent device 3 (step A15).

  On the other hand, if it is determined that network authentication is to be performed (step A13 is Yes), the access restriction method storage unit 171 registers the information in association with the feature “implementation method is network boot type and performs network authentication”. The access restriction method is taken out, “Set the network authentication port to the terminal connection port of the network component 3. Connect to the Default VLAN when the network authentication fails. Open the port for network boot in the Default VLAN.” It passes to the generation means 13. According to the above access restriction method, the access restriction information generation means 13 sets a network authentication port as the terminal connection port of the network component device 3 and connects to the Default VLAN when access authentication fails. Necessary for network boot in the Default VLAN. The access restriction information for opening a new port (DHCP, PXE, etc.) "is generated and registered in the access restriction information storage unit 172 (step A14). Then, when the process of step A14 is completed, the access restriction information generation unit 13 outputs a transmission instruction to the transmission unit 14. Thereby, the transmission means 14 transmits the access restriction information registered in the access restriction information storage unit 172 to the network constituent device 3 (step A15). Even when Steps A10 to A12 are completed, the access restriction information generation unit 13 outputs a transmission instruction to the transmission unit 14, and the access restriction information registered in the access restriction information storage unit 172 is transmitted to the network configuration device. 3 to send.

  The network component device 3 reflects the access restriction information sent from the access restriction information generation device 1 in the setting of the own device 3, and constructs an unauthorized access prevention environment suitable for the characteristics of the thin client system (step A16).

  Next, with reference to FIG. 6, the operation when the network device 3 performs access restriction using the MAC address filter generated in step A3 of FIG. 4 will be described.

  When the user operates the thin client terminal device 4 and tries to connect to the thin client management server 2, a communication packet is transmitted from the thin client terminal device 4 (step B1).

  When a communication packet is sent from the thin client terminal device 4, the network component device 3 extracts information (in this embodiment, the source MAC address) necessary for performing individual authentication from the communication packet. Thereafter, based on the extracted MAC address and the MAC address filter generated in step A3, it is determined whether or not to permit connection of the thin client terminal device 4 (step B2). When it is determined that the thin client terminal device 4 is a connectable terminal device (step B2 is Yes), the network configuration device 3 transmits a connection request to the thin client management server 2 (step B3), thereby The thin client management server 2 is connected to the thin client terminal device 4 (step B4). As a result, the thin client terminal device 4 can access the network 7 through the network component device 3.

  Next, a case where an unauthorized connection terminal device 6 that is not permitted to connect is connected to the network component device 3 will be described.

  When the user operates the unauthorized connection terminal device 6 and tries to access the network 7, a communication packet is transmitted from the unauthorized connection terminal device 6 (step B5).

  The network component device 3 extracts information (MAC address) necessary for performing individual authentication from the communication packet sent from the unauthorized connection terminal device 6, and based on the MAC address and the MAC address filter, It is determined whether or not the unauthorized connection terminal device 6 is a terminal device that permits connection (step B6). If it is determined that the unauthorized connection terminal device 6 is a terminal device that does not permit connection (No in Step B6), the connection of the unauthorized connection terminal device 6 is rejected (Step B7). Through the above operation, the thin client terminal device 4 is permitted to access the network 7, and the unauthorized connection terminal device 6 is denied access to the network 7.

  Next, with reference to FIG. 7 and FIG. 8, the operation in the case where the network component device 3 performs access restriction according to the access restriction information generated in Step A10 of FIG. 5 will be described.

  When the user connects the thin client terminal device 4 to the network component device 3 (step C1), the network component device 3 requests the thin client terminal device 4 for information necessary for network authentication (step C2). ).

  Thereby, the thin client terminal device 4 transmits information (authentication information) necessary for network authentication to the network constituent device 3 (step C3). This authentication information is sent to a network authentication server (not shown) via the network constituent device 3, and network authentication is performed.

  When network authentication by the network authentication server is successful (step C4 is Yes), the network component device 3 opens a communication port to which the thin client terminal device 4 is connected (step C5). As a result, the thin client terminal device 4 can communicate beyond the network component device 3 (step C6).

  Next, an operation when the user terminal device 5 that is permitted to connect is connected to the network component device 3 will be described.

  When the user connects the user terminal device 5 to the network component device 3 (step C7), the network component device 3 requests authentication information from the user terminal device 5 (step C8). As a result, the user terminal device 5 transmits the authentication information to the network constituent device 3 (step 9). This authentication information is sent to the network authentication server via the network constituent device 3, and network authentication processing is performed.

  When the network component 3 is successfully authenticated by the network authentication server (Yes in Step C10), the network component device 3 opens the communication port connected to the user terminal device 5 (Step C11). As a result, the user terminal device 5 can communicate over the network 7.

  Next, an operation when an unauthorized connection terminal device 6 that is not permitted to connect is connected to the network component device 3 will be described.

  When the user connects the unauthorized connection terminal device 6 to the network component device 3 (step C12 in FIG. 8), the network component device 3 requests authentication information from the unauthorized connection terminal device 6 (step C13). However, the unauthorized connection terminal device 6 cannot transmit authentication information (step C14). Therefore, the network component device 3 determines that network authentication has failed (step C15). When network authentication fails, the communication port to which the unauthorized connection terminal device 6 is connected is blocked (step C16). As a result, the unauthorized connection terminal device 6 cannot communicate beyond the network component device 3.

  Through the above operation, the thin client terminal device 4 and the user terminal device 5 are permitted to access the network 7, and the unauthorized connection terminal device 6 is denied access to the network 7.

[Effect of the second embodiment]
According to the present embodiment, in addition to the effect obtained in the first embodiment, it is possible to obtain an effect that the access restriction information can be easily set in the network component device 3. The reason is that it includes a transmission unit 14 that transmits the access restriction information generated by the access restriction information generation unit 13 to the network constituent device 3.

[Third embodiment of the present invention]
Next, a third embodiment of the present invention will be described in detail. In this embodiment, the network configuration device is not used by the administrator to input device specific information (MAC address, etc.) of the terminal device that permits connection, which is necessary when performing access restriction by individual authentication. All the device-specific information of the terminal device connected to the network 7 is collected, and the device-specific information of the terminal device that permits the connection is selected from among the device-specific information.

  FIG. 9 is a block diagram showing a configuration example of the third embodiment of the present invention. The difference from the second embodiment shown in FIG. 2 is that the access restriction information generating device 1 and the network component device 3 are replaced. Is provided with an access restriction information generating device 1a and a network constituent device 3a.

  The access restriction information generating device 1a is provided with a collection request transmission means 18, added an access restriction method selection means 12a instead of the access restriction method selection means 12, and transmitted / received means 14a instead of the transmission means 14. Is different from the access restriction information generating apparatus 1.

  The collection request transmitting unit 18 has a function of transmitting a device specific information collection request to the network configuration device 3a in accordance with an administrator instruction input from the input device 15.

  The transmission / reception unit 14a is different from the transmission unit 14 in that the transmission / reception unit 14a has a function of passing the device-specific information transmitted from the network configuration device 3a to the access restriction method selection unit 12a.

  The access restriction method selection unit 12a has a function of transmitting a device specific information acquisition request to the network configuration device 3a, a function of displaying the device specific information passed from the transmission / reception unit 14a on the display device 16, and the displayed device specific It differs from the access restriction method selection means 12 in that it has a function of passing a list of device specific information selected by the administrator to the access restriction information generation means 13.

  The network constituent device 3 a is different from the network constituent device 3 in that the device constituent information collecting means 31 is provided.

  The device unique information collecting unit 31 starts the device unique information collection process when a device unique information collection request is sent from the access restriction information generating device 1a, and the device unique information of the terminal device connected to the network 7 is started. (For example, a MAC address) is collected. Further, the device unique information collecting means 31 terminates the device unique information collection process when the device restriction information acquisition request is sent from the access restriction information generating device 1a, and accesses the collected device unique information. It has a function of transmitting to the restriction information generating apparatus 1a.

  The access restriction information generating device 1a can also be realized by a computer in the same manner as the access restriction information generating device 1.

[Description of Operation of Third Embodiment]
Next, the operation of this embodiment will be described.

  First, the device specific information collection process will be described.

  When starting the collection process of the device specific information, the administrator inputs a collection request transmission instruction from the input device 15. As a result, as shown in the flowchart of FIG. 10, the collection request transmission means 18 transmits a collection request for device specific information to the network constituent device 3a (step D1).

  When a device specific information collection request is sent, the device specific information collecting means 31 in the network constituent device 3a starts the device specific information collection process, and every time a terminal device accessing the network 7 appears (step D2, D4, D6), device specific information (for example, MAC address) of the terminal device is collected, and the collected device specific information is registered in a storage device (not shown) in the network constituent device 3a (steps D3, D5). , D7). At this time, it is checked whether or not the collected device specific information has already been registered, and if it has been registered, the registration process may not be performed.

  Next, the operation when generating access restriction information will be described. This embodiment is different from the second embodiment described above only in the processing performed in step A3 in FIG. 4, and only this point will be described.

  In this embodiment, the process shown in the flowchart of FIG. 11 is performed instead of step A3. If the access restriction method selection unit 12a determines that the thin client system subject to access restriction performs the individual authentication based on the feature information received by the thin client feature input unit 11, FIG. As shown in FIG. 4, a device specific information acquisition request is transmitted to the network constituent device 3a (step E1).

  Upon receiving the device specific information acquisition request, the device specific information collecting means 31 in the network configuration device 3a transmits the device specific information stored in the storage device to the access restriction information generating device 1a (step E2).

  When the device-specific information is sent from the network configuration device 3a, the transmission / reception means 14a in the access restriction information generating device 1a passes it to the access restriction method selection means 12a, and the access restriction method selection means 12a receives the transmission / reception means 14a. All the device-specific information passed from is displayed on the display device 16 (step E3). At this time, the device-specific information may be sorted and displayed.

  When the device specific information is displayed on the display device 16, the administrator selects the device specific information of the terminal device that is permitted to access the network 7.

  When the device-specific information of the terminal device that permits connection to the network 7 is selected by the administrator, the access restriction method selection unit 12a sets the feature “perform individual authentication” from the access restriction method storage unit 171 shown in FIG. The access restriction method “generate MAC address filter” registered in association with the acquired access restriction method and the list of device-specific information (MAC address) selected by the administrator are obtained as access restriction information generation means 13. To pass. The access restriction information generation means 13 passes only packets whose source is the MAC address listed in the list as access restriction information according to the access restriction method and the list of MAC addresses passed from the access restriction method selection means 12a. The filter to be generated is generated, and the generated filter is stored in the access restriction information storage unit 172 (step E4). The above is the processing performed in this embodiment instead of step A3.

[Effect of the third embodiment]
According to this embodiment, in addition to the effects obtained in the first and second embodiments, it is possible to obtain an effect that it is possible to easily generate access restriction information for a thin client system that performs individual authentication. . The reason is that the network-constituting device 3 includes device-specific information collecting means 31 for collecting device-specific information of terminal devices connected to the network 7, and the network 7 is selected from the device-specific information collected by the device-specific information collecting means 31. This is because the device-specific information of the terminal device that permits access to is selected.

[Fourth embodiment of the present invention]
Next, a fourth embodiment of the present invention will be described. The feature of this embodiment is that it is possible to present to the administrator the precautions for using the thin client system and the feasible access restriction method only by inputting the characteristics of the thin client system. And

  FIG. 12 is a block diagram of the fourth embodiment of the present invention. The difference from the second embodiment shown in FIG. 2 is that an access restriction information generating device 1b is provided instead of the access restriction information generating device 1. It is a point.

  The access restriction information generating device 1b is different from the second embodiment shown in FIG. 2 in that it includes an advice unit 19 and an advice information storage unit 173 is provided in the storage device 17. .

  The advice information storage unit 173 stores advice information to be displayed in association with the characteristics of the thin client system. The advice unit 19 has a function of displaying, on the display device 16, points to note according to the characteristics of the thin client system input by the administrator, an executable access restriction method, and the like.

  Note that the access restriction information generating device 1b can be realized by a computer in the same manner as the access restriction information generating device 1.

[Description of Operation of Fourth Embodiment]
Next, the operation of this embodiment will be described in detail.

  When the administrator wants to know the precautions regarding the thin client that has already been introduced or the thin client that is scheduled to be introduced, the operation mode of the access restriction information generating device 1b is set to the advice mode, and the feature that represents the characteristics of the thin client system that is to receive the advice Information is input from the input device 15 (step F1 in FIG. 13). The thin client feature input unit 11 passes the feature information input from the input device 15 to the advice unit 19 when the operation mode is the advice mode. The specific contents of the feature information input in step F1 are the same as in the second embodiment.

  When the feature information of the thin client system that gives advice is input from the thin client feature input unit 11, the advice unit 19 determines the implementation method of the thin client system to be advised based on the feature information (step F2).

  When it is determined that the mounting method is the screen transfer type, the advice information “only packets based on the DHCP protocol and the ICA protocol” registered from the advice information storage unit 173 in association with the feature “the mounting method is the screen transfer type”. The access can be restricted by a filter that passes through “is taken out and displayed on the display device 16 (step F3).

  If it is determined that the mounting method is the virtual PC type, the advice information “only packets based on the DHCP protocol and the RDP protocol are registered from the advice information storage unit 173 in association with the feature“ the mounting method is a virtual PC type ”. The access can be restricted by a filter that passes through "is taken out and displayed on the display device 16 (step F4).

  If it is determined that the mounting method is the network boot type, the advice information stored in association with the feature “the mounting method is the network boot type” from the advice information storage unit 173 “access restrictions by the protocol are almost performed. "Cannot be performed" is taken out and displayed on the display device 16 (step F5). That is, the network boot type thin client terminal device performs the same operation as the user terminal device after the network boot, and performs the above-described display because it is difficult to restrict access by the protocol.

  If the implementation method of the thin client system is a screen transfer type or a virtual PC type, after performing the processing of steps F3 and F4, based on the feature information passed from the thin client feature input means 11, the user terminal It is determined whether or not the connection of the device 5 is permitted (step F6).

  Then, when the connection of the user terminal device 5 is not permitted (No in Step F6), it is registered in association with the feature “connection of the user terminal device 5 is not permitted” from the advice information storage unit 173. The advice information “The connection destination of the interface on the network 7 side of the network component device 3 can be limited only to the thin client management server 2” is extracted and displayed on the display device 16 (step F7).

  On the other hand, when the connection of the user terminal device 5 is permitted (Yes in Step F6), the thin client that is the object of advice is based on the feature passed from the thin client feature input unit 11, and the user It is determined whether not only the terminal device 5 but also the thin client terminal device 4 performs network authentication (step F8).

  When it is determined that the thin client terminal device 4 also performs network authentication (Yes in Step F8), the feature “implementation method is a screen transfer type or a virtual PC type from the advice information storage unit 173, and The advice information registered in association with “Perform network authentication for thin client terminal devices” is also set so that the connection port of the network component 3 is set as the network authentication port and the terminal access is denied when the network authentication fails. By doing so, the access can be restricted. "Is taken out and displayed on the display device 16 (step F9).

  On the other hand, when it is determined that the network authentication is not performed for the thin client terminal device 4 (No in Step F8), the feature “mounting method is a screen transfer type or a virtual PC type” from the advice information storage unit 173. In addition, the advice information “the connection port of the network device 3 is set as the network authentication port in association with“ do not perform network authentication for the thin client terminal device ”and the connection terminal device is set when the network authentication fails. The access can be restricted by setting to connect to the Default VLAN ”and is displayed on the display device 16 (step F10).

  If the implementation method of the thin client system to be advised is a network boot type, after performing the process of step F5, the advice is made based on the feature passed from the thin client feature input means 11. It is determined whether or not the thin client system that performs the network authentication (step F11).

  If it is determined that the network authentication is to be performed (Yes in Step F11), it is registered in association with the feature “the mounting method is network boot type and performs network authentication” from the advice information storage unit 173. Advice information “Set the connection port of the network component 3 to the network authentication port and connect to the default VLAN when the network authentication fails. In the default VLAN, the ports required for network boot (DHCP, PXE, etc.) It is only necessary to make a setting for opening. "Is taken out and displayed on the display device 16 (step F12).

  On the other hand, when it is determined that the network authentication is not performed (No in Step F11), the advice information storage unit 173 changes the feature “the mounting method is the network boot type and the network authentication is not performed”. The advice information registered in association with it is extracted and displayed on the display device 16 (if the network authentication is not performed, this environment has a high risk of unauthorized connection) (step F13).

  Finally, device specific information such as a MAC address is collected, and device specific information of a terminal that is permitted to be connected is registered to display on the display device 16 that access can be restricted (step F14).

[Effect of the fourth embodiment]
According to the present embodiment, in addition to the effects obtained in the first and second embodiments, there are points to note when operating a thin client system that has been installed by a user or a thin client system that is planned to be installed. Thus, it is possible to obtain an effect that it is possible to easily know an access restriction method that can be implemented. The reason is that the thin client feature input means 11 recognizes from the advice information including the precautions set in advance according to the client system mounting method and whether or not the terminal device can be connected and the possible access restriction method. This is because there is provided advice means 19 for selecting advice information according to the implementation method of the thin client system and whether or not the normal terminal device can be connected, and displaying the selected advice information on the display device.

  The present invention can be applied to prevent unauthorized access of a thin client system.

It is a block diagram which shows the structural example of the 1st Example of this invention. It is a block diagram which shows the structural example of the 2nd Example of this invention. 6 is a diagram illustrating an example of contents of an access restriction method storage unit 171. FIG. 4 is a flowchart illustrating a part of a processing example of the access restriction information generation device 1. 4 is a flowchart showing the remaining part of the processing example of the access restriction information generating apparatus 1. It is a figure which shows the operation | movement at the time of implementing the access restriction by individual authentication. It is a figure explaining operation | movement (at the time of network authentication success) at the time of implementing the access restriction by network authentication. It is a figure for demonstrating operation | movement of the operation | movement (at the time of network authentication failure) at the time of restricting access by network authentication. It is a block diagram which shows the structural example of the 3rd Example of this invention. It is a figure which shows the operation | movement at the time of apparatus specific information collection. It is a figure which shows the operation | movement at the time of producing | generating the access restriction information using apparatus specific information (MAC address). It is a block diagram which shows the structural example of the 4th Example of this invention. It is a flowchart which shows the process example of the access restriction information generation apparatus 1b.

Explanation of symbols

1, 1a, 1b, 100 ... access restriction information generation device 11, 101 ... thin client feature input means 12, 12a, 102 ... access restriction method selection means 13, 103 ... access restriction information generation means 14 ... transmission means 14a ... transmission / reception means DESCRIPTION OF SYMBOLS 15 ... Input device 16 ... Display device 17 ... Storage device 171 ... Access restriction method storage part 172 ... Access restriction information storage part 173 ... Advice information storage part 18 ... Collection request transmission means 19 ... Advice means 2 ... Thin client management server 3, 3a ... Network component device 31 ... Device specific information collecting means 4 ... Thin client terminal device 5 ... User terminal device 6 ... Unauthorized connection terminal device

Claims (18)

Thin client feature input means for receiving feature information including mounting method information indicating a mounting method of a thin client system input from an input device;
In association with the implementation method of the thin client system, as an access restriction method, an access restriction method storage unit in which the type of protocol used in the implementation method is recorded,
An access restriction method selection means for retrieving the type of protocol recorded in association with the mounting method indicated by the feature information received by the thin client feature input means, from the access restriction method storage unit;
Access restriction information generating means for generating a filter that passes only packets of the protocol type retrieved by the access restriction method selection means as restriction information for restricting access to the access restriction target network. An access restriction information generating device as a feature. The access restriction information generating apparatus according to claim 1,
In the access restriction method storage unit, information indicating DHCP and RDP is recorded in association with the virtual PC type that is the implementation method of the thin client system, and DHCP and ICA are associated with the screen transfer type that is the implementation method of the thin client system. An access restriction information generating device characterized in that information indicating the above is recorded. In the access restriction information generating apparatus according to claim 1 or 2,
The feature information further includes connectability information indicating whether or not a normal terminal device is connectable,
The access restriction method storage unit further records an access restriction method according to the combination of the thin client system mounting method and the connection of the normal terminal device in association with the combination.
The access restriction method selection means includes an access restriction method recorded in association with a combination of a thin client system mounting method indicated by the feature information received by the thin client feature input means and whether or not a normal terminal device can be connected. Search from the restriction method storage,
The access restriction information generation means is an access restriction method retrieved from the access restriction method storage unit by the access restriction method selection means, and includes a thin client mounting method indicated by the feature information and whether or not a normal terminal device can be connected. An access restriction information generating apparatus that generates access restriction information according to an access restriction method associated with a combination of the above. The access restriction information generating device according to claim 3,
In the access restriction method storage unit, the connection of the interface on the network subject to the access restriction of the network component device is associated with the combination of the virtual PC type or screen transfer type, which is the implementation method of the thin client system, and the connection failure of the normal terminal device. An access restriction information generating apparatus, wherein an access restriction method for instructing generation of a filter for restricting a destination to a thin client management server is recorded. In the access restriction information generating device according to claim 3 or 4,
In the case where the feature information indicates that the normal terminal device is permitted to be connected, the feature information further indicates whether the terminal device subject to network authentication is only the normal terminal device, the normal terminal device, the thin client terminal device, Including network authentication presence / absence information indicating both
The access restriction method storage unit associates with a combination of a thin client system mounting method, a normal terminal device connection permission, and a type of terminal device to be subjected to network authentication, and an access restriction method according to the combination. Is recorded,
The access restriction information generation means is an access restriction method retrieved from the access restriction method storage unit by the access restriction method selection means, and includes a thin client system mounting method indicated by the feature information and a connection of a normal terminal device. An access restriction information generating device, characterized in that the access restriction information is generated according to an access restriction method related to a combination of permission / inhibition and a type of terminal device to be subjected to network authentication. The access restriction information generating apparatus according to claim 5,
The access restriction method storage unit includes a virtual PC type or a screen transfer type that is a thin client system mounting method, a connection permission for a normal terminal device, and a terminal device targeted for network authentication as a normal terminal device and a thin client terminal. A thin client is recorded with an access restriction method in which a network authentication port is set as a terminal connection port of a network component device in association with a combination with information indicating that both of the devices are instructed and access is denied when authentication fails. The network is associated with a combination of a possible PC type or screen transfer type which is a system implementation method, connection permission for a normal terminal device, and information indicating that the terminal device to be subjected to network authentication is only a normal terminal device. Set the network authentication port to the terminal connection port of the component device. Authentication failure access restriction information generating apparatus characterized by access restriction method for instructing to connect the terminal device has failed to authenticate the Default VLAN is recorded at the time. The access restriction information generating device according to any one of claims 1 to 6,
The feature information includes network authentication presence / absence information indicating whether to perform network authentication when the mounting method information indicating that the mounting method of the thin client system is a network boot type,
In the access restriction method storage unit, an access restriction method according to the combination is recorded in association with a combination of information indicating whether to implement the thin client system and network authentication,
The access restriction method selection means includes an access restriction method that is recorded in association with a combination of a thin client system implementation method and network authentication availability indicated by the feature information received by the thin client feature input means. Search from the method storage,
The access restriction information generation means is an access restriction method searched by the access restriction method selection means, and is an access restriction method related to a combination of a thin client system mounting method and whether network authentication is indicated by the feature information. An access restriction information generating device that generates access restriction information according to the above. The access restriction information generation device according to any one of claims 1 to 7,
Device-specific information collecting means for collecting device-specific information of a terminal device connected to the access restriction target network; and
The access restriction method selection means selects, from among the device specific information collected by the device specific information collection means, device specific information of a terminal device that permits connection to the access restriction target network according to an operation of an administrator,
The access restriction information generating device, wherein the access restriction information generating means generates access restriction information according to the device specific information selected by the access restriction method selecting means and the access restriction method. The access restriction information generation device according to any one of claims 1 to 7,
An access restriction information generating apparatus comprising: an input device that inputs device specific information of a terminal device that permits connection to the access restriction target network according to an operation performed by an administrator. The access restriction information generation device according to any one of claims 1 to 7,
A display device;
Depending on the feature information received by the thin client feature input means from the advice information including the precautions set according to the implementation method of the thin client system and whether or not the normal terminal device can be connected and the possible access restriction method Access restriction information generation comprising: an advice means for selecting advice information according to the thin client system implementation method shown and whether or not a normal terminal device can be connected, and displaying the selected advice information on the display device apparatus. In association with the implementation method of the thin client system, as an access restriction method, an access restriction method storage unit in which the type of protocol used in the implementation method is recorded, a thin client feature input means, an access restriction method selection means, an access An access restriction information generation method executed by a computer comprising restriction information generation means,
The client feature input means accepts feature information including mounting method information indicating a mounting method of a thin client system input from an input device;
The access restriction method selection unit searches the access restriction method storage unit for the protocol type recorded in association with the mounting method indicated by the feature information received by the thin client feature input unit,
The access restriction information generating means generates a filter that passes only packets of the protocol type searched by the access restriction method selecting means as restriction information for restricting access to an access restriction target network. A method for generating access restriction information. The access restriction information generation method according to claim 11,
In the access restriction method storage unit, information indicating DHCP and RDP is recorded in association with the virtual PC type that is the implementation method of the thin client system, and DHCP and ICA are associated with the screen transfer type that is the implementation method of the thin client system. An access restriction information generation method characterized by recording information indicating The access restriction information generation method according to claim 11 or 12,
The feature information further includes connectability information indicating whether or not a normal terminal device is connectable,
The access restriction method storage unit further records an access restriction method according to the combination of the thin client system mounting method and the connection of the normal terminal device in association with the combination.
The access restriction method selection means includes an access restriction method recorded in association with a combination of a thin client system mounting method indicated by the feature information received by the thin client feature input means and whether or not a normal terminal device can be connected. Search from the restriction method storage,
The access restriction information generation means is an access restriction method retrieved from the access restriction method storage unit by the access restriction method selection means, and includes a thin client mounting method indicated by the feature information and whether or not a normal terminal device can be connected. An access restriction information generating method, wherein access restriction information is generated according to an access restriction method associated with a combination of the above. The access restriction information generating apparatus according to claim 13,
In the access restriction method storage unit, the connection of the interface on the network subject to the access restriction of the network component device is associated with the combination of the virtual PC type or screen transfer type, which is the implementation method of the thin client system, and the connection failure of the normal terminal device. An access restriction information generation method, wherein an access restriction method for instructing generation of a filter for restricting a destination to a thin client management server is recorded. In association with the implementation method of the thin client system, as an access restriction method, a computer having an access restriction method storage unit in which the type of protocol used in the implementation method is recorded.
Thin client feature input means for receiving feature information including mounting method information indicating the mounting method of the thin client system input from the input device;
Access restriction method selection means for retrieving from the access restriction method storage unit the type of protocol recorded in association with the mounting method indicated by the feature information received by the thin client feature input means;
Program for functioning as access restriction information generating means for generating a filter that passes only packets of the protocol type searched by the access restriction method selecting means as restriction information for restricting access to an access restriction target network . The program according to claim 15, wherein
In the access restriction method storage unit, information indicating DHCP and RDP is recorded in association with the virtual PC type that is the implementation method of the thin client system, and DHCP and ICA are associated with the screen transfer type that is the implementation method of the thin client system. A program characterized in that information indicating the above is recorded. The program according to claim 15 or 16,
The feature information further includes connectability information indicating whether or not a normal terminal device is connectable,
The access restriction method storage unit further records an access restriction method according to the combination of the thin client system mounting method and the connection of the normal terminal device in association with the combination.
The access restriction method selection means includes an access restriction method recorded in association with a combination of a thin client system mounting method indicated by the feature information received by the thin client feature input means and whether or not a normal terminal device can be connected. Search from the restriction method storage,
The access restriction information generation means is an access restriction method retrieved from the access restriction method storage unit by the access restriction method selection means, and includes a thin client mounting method indicated by the feature information and whether or not a normal terminal device can be connected. A program for generating access restriction information according to an access restriction method associated with a combination of the above. The program according to claim 17,
In the access restriction method storage unit, the connection of the interface on the network subject to the access restriction of the network component device is associated with the combination of the virtual PC type or screen transfer type, which is the implementation method of the thin client system, and the connection failure of the normal terminal device. An access restriction method for instructing generation of a filter for restricting a destination to a thin client management server is recorded.

Images