JP4785952B2 - ACCESS CONTROL SYSTEM, ACCESS CONTROL METHOD, ACCESS CONTROL PROGRAM, AND ACCESS CONTROL PROGRAM RECORDING MEDIUM - Google Patents

Description

  The present invention relates to a technology for accessing a home device connected to a home network from an end user terminal arranged in an external network.

  At present, the necessity and importance of home gateways (hereinafter referred to as HGWs) are increasing with the spread of the Internet and the progress of home networks in which home devices in end-user homes are connected by a network. HGW cross-connects home devices to each other by performing address conversion and data transfer across various standards such as PC devices, AV devices, telephone devices, white goods devices, etc. In addition to communication between each home device in the home network, it also has a function of bridging communication between them and the Internet.

  Such an HGW is arranged in the end user's home, and a firewall function (hereinafter referred to as FW) that restricts access from the Internet side to the end user's home (including access in the reverse direction) or a private address is converted into a global address ( It also has a NAPT (Network Address Port Translation) function that performs conversion in the reverse direction.

  The NAPT / FW setting depends on the user's home network environment, depending on the port number of the application running on the home device connected to the home network, the connection position of the end user terminal that accesses the home device, and the like. Generally, the FW is set to deny access from the external network side to the home gateway side, and vice versa, and UPnP (Universal Plug and Play) NAT traversal (non- NAPT / FW is set using the patent document 3).

  However, in DNS server operation, each server holds a cache for a certain period in order to minimize inquiries to the server holding the original address information, and immediately after the server address is rewritten by dynamic DNS, There is a problem in that it cannot be accessed from an end user terminal connected to an external network because inconsistency occurs with the cache of each DNS server.

  In addition, the NAPT / FW setting using UPnP has a problem that home devices to be accessed are limited because home devices connected to the home network need to support UPnP. Furthermore, since the NAPT / FW setting using UPnP does not authenticate access from an external network, there is a problem that it can be an attack target such as a malicious script.

  Further, in Patent Document 1, a target device to be accessed registers a URL for accessing itself in an external server device, and accesses the external server device from a Web browser device on the same home network. Thus, a technique for searching for a URL using the identity of a source address as a key and accessing a target device is disclosed.

  However, since the target device needs to have the registration function in order to register with the external server device, there is still a problem that home devices to be accessed are limited. Further, since the Web browser apparatus is connected to the same home network, there is a problem that even if the disclosed configuration and method are used, access from an external network cannot be handled.

Japanese Patent No. 4110145

“Dynamic Updates in the Domain Name System (DNS UPDATE)”, [online], RFC2136, The Internet Engineering Task Force, [Search June 2, 2009], Internet <http://www.ietf.org/rfc /rfc2136.txt> “DOMAIN NAMES-IMPLEMENTATION AND SPECIFICATION”, [online], RFC1035, The Internet Engineering Task Force, [Search June 2, 2009], Internet <http://www.ietf.org/rfc/rfc1035.txt> “Internet Gateway Device”, [online], UPnP FORUM, [Search June 2, 2009], Internet <http://www.upnp.org/standardizeddcps/igd.asp>

  The present invention has been made in view of the above problems, and it is an object of the present invention to reliably and safely access a home device connected to a home network from an external network.

  The present invention according to claim 1 is an access control system for accessing a home device connected to a home network from a user terminal located in the external network. The home device associates the port number with which the home device waits for an access request and stores it in the storage means, displays a management page for selecting the stored home device on the user terminal, and corresponds to the selected target home device A port number to be searched from the storage means, and NAPT and an access request that reaches an address on the external network side in a home gateway arranged at a boundary between the external network and the home network are transferred to the target home device. Setting request to set FW table information Whether or not the reception server that transmitted the setting request can access the target home device based on the reception server to be transmitted and an access control list that defines access restrictions from the reception server / home device to the home device / reception server When the access is possible, the home gateway connected to the same home network as the target home device is searched based on the home gateway identifier list from which the home gateway can be searched from the home device identifier. An operation server that relays the setting request to the address of the home gateway obtained from the inquiry result to the address management server that is arranged, an identifier of the home gateway connected to the dedicated network, and the dedicated network side of the home gateway Address and An address management server that transmits a home gateway address in response to an inquiry from the operation server, an operation server communication unit that receives the setting request relayed via the dedicated network, An information acquisition unit that acquires an address on the external network side set to itself after receiving the setting request, and a broadcast to the home network using the identifier of the target home device after receiving the setting request After determining the home device communication unit for resolving the device address, and the port number to wait on the external network side, using the address and port number on the external network side and the address and port number of the target home device, And a setting unit that performs setting according to the setting request. The reception server generates a URI or RDP file using an address and port number on the external network side of the home gateway, generates a link to the URI or RDP file, and The access request from the terminal is transitioned from the management page to the target home device.

  According to a second aspect of the present invention, the operation server communication unit, the information acquisition unit, the home device communication unit, and the setting unit are configured by a bundle using an OSGi framework. Features.

  According to a third aspect of the present invention, there is provided an access control method for accessing a home device connected to a home network from a user terminal arranged in an external network, by a reception server arranged in the external network. The identifier of the device and the port number on which the home device waits for an access request is stored in the storage means, the management page for selecting the stored home device is displayed on the user terminal, and the selected target The port number corresponding to the home device is searched from the storage means, and the access request that has reached the address on the external network side in the home gateway located at the boundary between the external network and the home network is transferred to the target home device Set NAPT and FW table information to And a receiving server that has transmitted the setting request based on an access control list that defines an access restriction from the receiving server / home device to the home device / receiving server by the operation server. A home gateway connected to the same home network as the target home device based on a home gateway identifier list that determines whether or not the device can be accessed and, when accessible, can search for the home gateway from the home device identifier Inquiring about an address on the dedicated network side of the home network from an address management server arranged in the dedicated network, an identifier of the home gateway connected to the dedicated network by the address management server, and the home gateway A dedicated network address in B is managed in association with each other, and a home gateway address corresponding to the inquiry from the operation server is transmitted, and the home gateway obtained from the inquiry result by the operation server Relaying the setting request to the address of the home gateway, receiving the setting request relayed via the dedicated network by the operation server communication unit of the home gateway, and information setting unit of the home gateway The step of acquiring the address on the external network side set in itself after receiving the request, and the home device communication unit of the home gateway, after receiving the setting request, using the identifier of the target home device to the home network Broadcast And resolving the address of the target home device, and after determining the port number to be waited on the external network side by the setting unit of the home gateway, the address and port number on the external network side and the target home device Using the address and port number to perform setting according to the setting request; and generating a URI or RDP file using the address and port number on the external network side in the home gateway by the receiving server; Generating a link to a URI or RDP file, and transitioning an access request from the user terminal from a management page to the target home device.

  According to a fourth aspect of the present invention, the operation server communication unit, the information acquisition unit, the home device communication unit, and the setting unit are configured by a bundle using an OSGi framework. Features.

  The present invention described in claim 5 is characterized by causing a computer to execute each process of the reception server, operation server, address management server, and home gateway described in claim 1 or 2.

  The present invention described in claim 6 is characterized in that the access control program described in claim 5 is recorded.

  According to the present invention, it is possible to reliably and safely access a home device connected to a home network from an external network.

It is a figure which shows the whole structure of an access control system. It is a figure which shows the functional block structure of HGW. It is a figure which shows the processing flow of an access control system. It is a figure which shows an example of a screen transition. It is a figure which shows another example of a screen transition. It is a figure which shows another example of a screen transition.

  Hereinafter, an embodiment will be described with reference to the drawings.

  FIG. 1 is a diagram showing an overall configuration of an access control system according to the present embodiment. The access control system 1 is an access control system for accessing the home device 14 connected to the home networks 32 of the end user homes A and B from the third end user terminal 15c via the external network 30. , HSP server 10 (first HSP server 10a, second HSP server 10b), HNW operation server 11, HGW address management server 12, HGW 13 (first HGW 13a, second HGW 13b), and dedicated network 31.

  In addition, each server and HGW which comprise such an access control system 1 can be comprised by computers provided with arithmetic processing units, such as CPU, and memory | storage devices, such as memory, and each function process is carried out by a program. Executed. Such a program is stored in a storage device, and can be recorded on a recording medium or provided through a network. Hereinafter, the functions and processing flow of the access control system 1 will be described individually and specifically, and the operations and effects of the present embodiment will be described.

  A home network service provider (HSP) server 10 is connected to an external network 30 that is a widely used wide area network such as the Internet, and is connected to a home network 32 of end user homes A and B. And the port number that waits for an access request in the home device are associated with each other and stored in the storage unit. In addition, when there is an access request from the third end user terminal 15c, the identifier of the home device (or the name of the home device) stored in the storage unit, the access method to the home device (specifically, It has a function of displaying on the third end user terminal 15c a home device centralized management page capable of selecting remote access or remote desktop connection). The home device centralized management page is a page that collectively manages devices of various different vendors connected to the home networks 32 of a plurality of end user homes A and B, and is displayed on the screen. . The end user terminals (first end user terminal 15a to third end user terminal 15c) are terminals used by end users for access control. For example, a PC, a mobile phone, a TV, etc. The first home device 14a to the third home device 14c) are target devices whose access is controlled by the end user.

  Further, the HSP server 10 searches the storage unit for a port number corresponding to a home device (hereinafter referred to as a target home device) selected by the end user operating the third end user terminal 15c, and It has a function of transmitting a NAPT / FW setting request for setting NAPT and FW table information of the HGW 13 so as to transfer the access request that has reached the address on the external network side to the target home device. When the NAPT and FW table information of the HGW 13 is set (changed or added) based on the NAPT / FW setting request, a URI or RDP file is created using the address and port number on the external network side of the HGW 13. Generate a link to the generated URI or RDP file and redirect if possible, and transition the access request from the third end user terminal 15c from the home device unified management page to the target home device. It has a function. The HSP server 10 can also perform login authentication using end user information and a password registered in advance when accessed from the third end user terminal 15c.

  The HNW operation server 11 is a server that manages communication between the HSP server 10 and the home network 32, and communication (action relay) from the HSP server 10 to the home device 14 and communication from the home device 14 to the HSP server 10. An access control list (hereinafter referred to as ACL) in which permission / non-permission with (notify relay) is set, and an HGW identifier list (hereinafter referred to as HIL) in which the identifier of the home device 14 and the identifier of HGW 13 are described in association with each other. Is stored. Further, based on the ACL, it is determined whether or not the HSP server 10 that has transmitted the NAPT / FW setting request can access the target home device. If the target home device can be accessed, the same home as the target home device is determined based on the HIL. The HGW 13 of the network is searched, the address of the HGW 13 is inquired to the HGW address management server 12 arranged in the closed and secure dedicated network 31 such as an NGN (Next Generation Network) network, and the address of the HGW 13 obtained from the inquiry result Has a function of relaying a NAPT / FW setting request.

  The HGW address management server 12 allocates an address to the HGW 13 connected to the dedicated network 31 and manages the allocated network address of the HGW 13 in association with the identifier of the HGW 13. It has a function of transmitting the address of the HGW 13 in response to the inquiry.

  The HGW 13 is connected to the external network 30, the dedicated network 31, and the home network 32, and has a router function, a NAPT function, and an FW function. Further, as shown in FIG. 2, the HNW operation server communication unit 131 that receives the NAPT / FW setting request relayed via the dedicated network 31, and the external set in itself after receiving the NAPT / FW setting request An HGW information acquisition unit 132 that acquires an address on the network side, and home device communication that resolves the address of the target home device by broadcasting to the home network 32 using the identifier of the target home device after receiving the NAPT / FW setting request After determining the port number that the unit 133 and the external network side wait on, the setting according to the NAPT / FW setting request is performed using the address and port number on the external network side and the address and port number of the target home device. The NAPT / FW setting unit 134 is configured. The HNW operation server communication unit 131, the HGW information acquisition unit 132, the home device communication unit 133, and the NAPT / FW setting unit 134 constituting the HGW 13 are bundles using an OSGi (Open Services Gateway initiative) framework. Implemented in. By mounting in bundles in this way, each bundle can be easily distributed and updated using the OSGi framework, so that various home devices can be supported.

  In the present embodiment, the HSP server 10 and the HNW operation server 11 are described as independent devices. However, depending on the operation mode, the functions of both servers can be integrated into one device.

  Next, a processing flow of the access control system 1 will be described. FIG. 3 is a diagram showing a processing flow of the access control system.

  First, in step S1, if there is an access request (web connection with a web browser) to the home device at the end user's home from the third end user terminal 15c to the first HSP server 10a, login authentication is performed. The first HSP server 10a outputs a home device centralized management page for selecting home devices arranged in the end user's home on the screen of the third end user terminal 15c. Thereby, the end user operating the third end user terminal 15c can select a desired home device in the end user's home.

  In step S2, after a predetermined home device 14 is selected by the end user (hereinafter, the first home device 14a is selected), the first HSP server 10a can be used by the selected first home device 14a. A screen for selecting an appropriate access method, specifically, a display for selecting “remote access” or “remote desktop connection” is output to the home device centralized management page.

  In step S3, the first HSP server 10a retrieves from the storage unit the port number on which the selected first home device 14a is waiting for an access request, stores the identifier of the NAPT / FW setting request, and the first HSP that is the transmission source. The identifier of the server 10a, the identifier of the first home device 14a that is the transmission destination, the standby port number of the first home device 14a, and the source address of the third end user terminal 15c are designated, and if necessary, the HGW 13 Is sent to the HNW operation server 11 so as to relay the NAPT / FW setting request packet in which the designation information is described.

  In step S4, the HNW operation server 11 that has received the NAPT / FW setting request packet uses the identifier of the first HSP server 10a and the identifier of the first home device 14a described in the packet to set the ACL setting contents. Based on the HIL, the identifier of the HGW 13 associated with the identifier of the first home device 14a is resolved from the HIL (here, the identifier of the first HGW 13a). Is resolved). Thereafter, the identifier of the first HGW 13a is transmitted to the HGW address management server 12 via the dedicated network 31, and the address on the dedicated network side in the first HGW 13a is resolved. Then, the received NAPT / FW setting request packet is relayed to the first HGW 13a of the resolved address.

  In step S5, after receiving the NAPT / FW setting request packet relayed by the HNW operation server 11 via the dedicated network 31 by the HNW operation server communication unit 131 of the first HGW 13a, the HGW information acquisition unit 132 performs its own external network. Get the address set on the side. The home device communication unit 133 then broadcasts to the home network 32 using the identifier of the first home device 14a described in the NAPT / FW setting request packet, and resolves the address of the first home device 14a. After that, the NAPT / FW setting unit 134 indicates the port number when the standby port number of the HGW 13 is specified in the NAPT / FW setting request packet, and the specification when it is not specified or is specified in advance. Using either the port number according to the above or a randomly determined port number as the standby port number of the first HGW 13a, the external network side address acquired by the HGW information acquisition unit 132 and reached the determined standby port number The NAPT and the address of the first home device 14a resolved by the home device communication unit 133, so that the packet can be transferred to the standby port number of the first home device 14a described in the NAPT / FW setting request. FW table information is set (changed or added). If the setting of the table information is successful, the external network side address and standby port number of the first HGW 13a or the URI generated from these two pieces of information is returned to the first HSP server 10a via the dedicated network 31.

  In step S6, the first HSP server 10a uses the returned URI as it is, or generates a URI or RDP file from the address of the external network side of the returned first HGW 13a and a standby port number, and stores it in the URI or RDP file. If redirection is possible after generating the link, the redirection is performed, and the access request from the third end user terminal 15c is changed from the home device integrated management page to the first home device 14a.

  In step S <b> 7, the end user can access and control the first home device 14 a via the external network 30 by waiting as it is or by clicking a link displayed on the screen.

  Finally, in step S8, after the access to the first home device 14a is completed, the setting information set in step S5 is applied to the NAPT / FW based on the timeout process or the user's explicit instruction from the home device centralized management page. Delete from the table information.

  By using the access control system described above, for example, 1) remote access to a home device using a web browser using http / https 2) remote control to a home device using a web browser and a remote desktop connection Desktop connection 3) It is possible to provide services such as DLNA (Digital Living Network Alliance) content viewing using a Web browser and software capable of reproducing moving image files.

  First, the screen transition in the case of 1) is shown in FIG. In this remote access, after selecting a home device, the NAPT / FW setting unit 134 performs NAPT / FW setting via the HNW operation server communication unit 131 of the HGW 13 and redirects after the setting is completed to directly access the home device. It is an access method to do.

  First, a home device centralized management page for selecting a home device is displayed on the screen of the third end user terminal 15c (transition Sa1), followed by an access method that can be used by the selected home device. (Transition Sa2). By selecting remote access, a home device management screen or a screen for selecting file browsing is displayed (transition Sa3), and by selecting to start file browsing, the NAPT / FW of the HGW 13 via the HNW operation server 11 is displayed. Settings are made. Here, a new window is displayed, indicating that the setting is being performed during the NAPT / FW setting (transition Sa4), and that setting is displayed (transition Sa5). After that, by redirecting or clicking a designated location on the screen and following the link, the home device page is displayed, and the home device file can be browsed (transition Sa6). When the browsing of the file ends, the page is closed (transition Sa7), and the screen returns to the transition Sa3 screen (transition Sa8). Thereafter, by selecting the end of file browsing, all processing ends (transitions Sa9 and Sa10).

  Next, the screen transition in the case of 2) is shown in FIG. In this remote desktop connection, after selecting a home device, NAPT / FW setting is performed by the NAPT / FW setting unit 134 via the HNW operation server communication unit 131 of the HGW 13, and the accessed home device is accessed after the setting is completed. Create an RDP file that describes the standby port number of the HGW 13 and the address on the external network side so that it can be created, create a page that describes the URL to the RDP file, and access the home device directly on the remote desktop Is the method.

  First, a home device centralized management page for selecting a home device is displayed on the screen of the third end user terminal 15c (transition Sb1), and subsequently an access method and the like that can be used with the selected home device are displayed. (Transition Sb2). By selecting the RDP connection, a screen for selecting the start / end of the RDP connection is displayed (transition Sb3). By selecting the start of the RDP connection, the NAPT / FW setting of the HGW 13 is set via the HNW operation server 11. And an RDP file is generated. Here, a new window is displayed, and it is displayed during the NAPT / FW setting (transition Sb4). After the setting and the RDP file are generated, a page describing a link to the RDP file is displayed. Is displayed (transition Sb5). After that, by clicking on the designated location displayed, the external program is started, and it becomes possible to access the home device via a remote desktop connection (transition Sb6). When the connection to the home device is terminated, the page is closed (transition Sb7), and the screen returns to the transition Sb3 screen (transition Sb8). Thereafter, by selecting the end of the RDP connection, all the processes are completed (transitions Sb9 and Sb10).

  Finally, the screen transition in the case of 3) is shown in FIG. In this content viewing, after selecting a home device, the user can follow the hierarchy up to the content of the home device via the HNW operation server communication unit 131 and the home device communication unit 133 of the HGW 13 and obtain a content list that can be provided. Later, NAPT / FW setting is performed by the NAPT / FW setting unit 134 via the HNW operation server communication unit 131, and the standby port number of the HGW 13 and the external are set so that the content of the home device to be accessed can be accessed after the setting is completed. In this access method, a link describing the address on the network side is generated and redirected to directly access the content of the home device.

  First, a home device centralized management page for selecting a home device is displayed on the screen of the third end user terminal 15c (transition Sc1), and subsequently an access method and the like that can be used with the selected home device are displayed. (Transition Sc2). Here, by selecting content viewing, the HNW operation server communication unit 131 and the home device communication unit 133 retrieve and display content that can be viewed by the selected home device from the home device (transition Sc3). . When a video is selected and all videos are further selected (transition Sc4), a screen for selecting start / end of video 1 to video 3 that can be provided by the home device is displayed (transition Sc5). When the start of 1 is selected, the NAPT / FW setting of the HGW 13 is performed via the HNW operation server 11. Here, a new window is displayed, and it is displayed that NAPT / FW is being set (transition Sc6). After a link to the HGW 13 is generated, a page describing the link is displayed ( Transition Sc7). Thereafter, the external program is activated by performing redirection or clicking the designated location displayed, and content viewing is enabled (transition Sc8). When the content viewing ends, the page is closed (transition Sc9), and the screen returns to the transition Sc5 (transition Sc10). Thereafter, by selecting the end of the video 1, all the processes are completed (transitions Sc11 and Sc12).

  According to the present embodiment, the HGW information acquisition unit 132 acquires the address on the external network side connected to the external network 30 after the access request is transmitted from the third end user terminal 15c. Even when the address on the external network side of the HGW 13 is changed, the access from the third end user terminal 15c is surely transited to the HGW 13, and the user can access the home device 14 more reliably. can do.

  According to the present embodiment, the home device communication unit 133 broadcasts to the home network using the identifier of the home device to be accessed to resolve the address of the home device, in other words, communication with the home device. Therefore, it is not necessary for the home device to support UPnP, and a device that is widely spread can be used as a target for access control.

  According to the present embodiment, authentication is performed at the time of login to the HSP server 10, and NAPT / FW setting of the HGW 13 is performed via the closed and secure dedicated network 31, thereby reducing the risk of impersonation and wiretapping. be able to.

  According to the present embodiment, the HNW operation server communication unit 131, the HGW information acquisition unit 132, the home device communication unit 133, and the NAPT / FW setting unit 134 are implemented in a bundle using the OSGi framework. Therefore, it is possible to easily cope with the expansion of home devices and functions in the future.

A, B ... End user home 1 ... Access control system 10 ... HSP server (reception server)
11 ... HNW operation server (operation server)
12 ... HGW address management server (address management server)
13 ... HGW (Home Gateway)
131 ... HNW operation server communication unit (operation server communication unit)
132 ... HGW information acquisition unit (information acquisition unit)
133 ... Home device communication unit 134 ... NAPT / FW setting unit (setting unit)
DESCRIPTION OF SYMBOLS 14 ... Home equipment 15 ... End user terminal 30 ... External network 31 ... Dedicated network 32 ... Home network S1-S8 ... Step Sa1-Sa10, Sb1-Sb10, Sc1-Sc12 ... Transition

Claims (6)

In an access control system for accessing a home device connected to a home network from a user terminal arranged in an external network,
A management page which is arranged in the external network and associates an identifier of the home device with a port number on which the home device waits for an access request is stored in a storage means, and a management page capable of selecting the stored home device is stored in the user terminal The port number corresponding to the selected target home device is retrieved from the storage means, and the access that has reached the address on the external network side in the home gateway located at the boundary between the external network and the home network A reception server that transmits a setting request for setting NAPT and FW table information so as to transfer the request to the target home device;
Based on an access control list that defines access restrictions from the reception server / home device to the home device / reception server, it is determined whether or not the reception server that transmitted the setting request can access the target home device. In this case, the home gateway connected to the same home network as the target home device is searched based on the home gateway identifier list that can search the home gateway from the home device identifier, and the address management server arranged in the dedicated network. An operation server that relays the setting request to the address of the home gateway obtained from the inquiry result to
An address management server that manages the identifier of the home gateway connected to the dedicated network in association with the address on the dedicated network side of the home gateway, and transmits the address of the home gateway according to the inquiry from the operation server; ,
An operation server communication unit that receives the setting request relayed through the dedicated network, an information acquisition unit that acquires an address on the external network side set in itself after receiving the setting request, and the setting request After receiving the home device communication unit that broadcasts to the home network using the identifier of the target home device and resolves the address of the target home device, and determining the port number that the external network side waits for, the external network A home gateway having a setting unit configured to perform a setting according to the setting request, using the address and port number of the side and the address and port number of the target home device,
The reception server generates a URI or RDP file using an address and port number on the external network side in the home gateway, generates a link to the URI or RDP file, and manages an access request from the user terminal An access control system, wherein a transition is made from a page to the target home device.   The access according to claim 1, wherein the operation server communication unit, the information acquisition unit, the home device communication unit, and the setting unit are configured by a bundle using an OSGi framework. Control system. In an access control method for accessing a home device connected to a home network from a user terminal arranged in an external network,
A management page in which an identifier of a home device and a port number waiting for an access request in the home device are associated with each other and stored in a storage unit by a reception server arranged in the external network, and the stored home device can be selected. Is displayed on the user terminal, the port number corresponding to the selected target home device is retrieved from the storage means, and the address on the external network side in the home gateway placed at the boundary between the external network and the home network Transmitting a setting request for setting NAPT and FW table information so as to transfer the access request that has reached the target home device;
The operation server determines whether or not the receiving server that sent the setting request can access the target home device based on an access control list that defines access restrictions from the receiving server / home device to the home device / receiving server. If it is accessible, the home gateway connected to the same home network as the target home device is searched based on the home gateway identifier list from which the home gateway can be searched from the home device identifier, and the home gateway is located in the dedicated network. Querying the address management server for the address on the dedicated network side in the home network;
The address management server associates and manages the identifier of the home gateway connected to the dedicated network and the address on the dedicated network side of the home gateway, and transmits the address of the home gateway according to the inquiry from the operation server And steps to
Relaying the setting request to the home gateway address obtained from the inquiry result by the operation server;
Receiving the setting request relayed via the dedicated network by the operation server communication unit of the home gateway;
Acquiring an address on the external network side set in the home gateway after receiving the setting request by the information acquisition unit of the home gateway;
Resolving the address of the target home device by broadcasting to the home network using the identifier of the target home device after receiving the setting request by the home device communication unit of the home gateway;
After determining the port number to be waited on the external network side by the setting unit of the home gateway, using the address and port number on the external network side and the address and port number of the target home device in response to the setting request The steps to set
The reception server generates a URI or RDP file using the address and port number on the external network side of the home gateway, generates a link to the URI or RDP file, and manages access requests from the user terminal Transitioning from the page to the target home device;
An access control method comprising:   The access according to claim 3, wherein the operation server communication unit, the information acquisition unit, the home device communication unit, and the setting unit are configured by a bundle using an OSGi framework. Control method.   An access control program for causing a computer to execute each process of the reception server, operation server, address management server, and home gateway according to claim 1 or 2.   6. An access control program recording medium, wherein the access control program according to claim 5 is recorded.

Images