JP4878043B2 - Access control system, connection control device, and connection control method - Google Patents

Description

  The present invention relates to an access control system comprising: a file server that holds resources accessed by a user terminal; and a connection control device that connects the user terminal and a network to which the file server belongs via a virtual communication path. The present invention relates to a connection control device and a connection control method.

  Conventionally, various types of networks such as the Internet, LAN (Local Area Network), and WAN (Wide Area Network), and laptop computers that are easy to carry, have become popular. There is a need for a file sharing environment that can do this.

  Recently, WebDAV (Web-based Distributed Authoring and Versioning), which is an extension of HTTP (Hypertext Transfer Protocol), has begun to be used as a method for realizing such a file sharing environment.

  This WebDAV is a protocol defined in RFC4918 that realizes a distributed file system for the purpose of file management on a Web server (file server), and without using a file transfer protocol such as FTP (File Transfer Protocol). Update, deletion, acquisition, etc. of files and contents can be performed on the Web server.

  As described above, when an environment in which a file server in a LAN can be easily accessed via the Internet becomes widespread, there is a problem that files or confidential information leaked due to unauthorized access by a malicious third party. appear.

  Therefore, recently, a method for realizing a high-security file sharing environment that denies access by a malicious third party by combining the above-described WebDAV and SSL-VPN (Secure Socket Layer-Virtual Private Network) has been disclosed. (For example, refer nonpatent literature 1).

“Feature: Ultimate File Server with Samba and WebDAV”, Nikkei Linux, 2004.8, p45-p53

  However, the above-described conventional technology requires user authentication to input a “user ID” and a “password” when accessing a file server resource using WebDAV after performing a VPN connection. Since the access to the file server resource can be accessed only after executing the authentication for performing the VPN connection and the authentication for accessing the file server, the security of the user is improved. There was a problem that convenience was bad.

  Therefore, the present invention has been made to solve the above-described problems of the prior art, and an access control system, a connection control device, and a connection that can improve user convenience while improving security. An object is to provide a control method.

  In order to solve the above-described problems and achieve the object, the present invention provides a virtual communication between a file server holding resources accessed by a user terminal and a network to which the user terminal and the file server belong. An access control system having a connection control device connected by a route, wherein the user is based on identification information for identifying a user of the user terminal obtained when the virtual communication route is connected Corresponding to the user of the user terminal based on the access control information creating means for creating access control information indicating information for controlling the access of the terminal and identification information for identifying the user of the user terminal The resource generation means for generating resources on the file server and the access control information created by the access control information creation means And access control means for controlling access to resources that are generated by over scan generation means, characterized by comprising a.

  According to the present invention, it is possible to improve user convenience while improving security.

  Exemplary embodiments of an access control system, a connection control device, and a connection control method according to the present invention will be explained below in detail with reference to the accompanying drawings. In the following, the outline of the access control system according to the present embodiment, the configuration of the access control system, and the flow of processing will be described in order, and finally various modifications to the present embodiment will be described.

[Outline of access control system]
First, the outline of the access control system according to the first embodiment will be described with reference to FIG. FIG. 1 is a system configuration diagram illustrating the overall configuration of the access control system according to the first embodiment.

  As shown in FIG. 1, the access control system according to the first embodiment is a VPN that connects a file server holding resources accessed by an employee home terminal and the employee home terminal via a virtual communication path (VPN). It is possible to improve user convenience while improving security.

  Specifically, in this access control system, “suzuki” and “tanaka” who are employees of the company are at home and always use the Internet connection service. A VPN apparatus connected to the Internet and the intranet, and a file server in the intranet. Note that, here, an example in which the VPN device and the file server are realized in different housings is shown, but they may be realized in the same housing.

  Each employee's house and the company LAN are different networks and are connected via the Internet via a router. However, each employee house shown here is merely an example, and the present invention is not limited to this, and other employees are also connected in the same manner. Note that, in the VPN connection, generally, as in the VPN connection, an authentication process for authenticating whether the user is a registered user (whether the user can permit the VPN connection) or not is executed. OSS (Open Source Software) middleware (for example, OpenVPN) is used. The file server executes server software that can use WebDAV, and an employee's home terminal that exists outside the intranet accesses the file server using WebDAV.

  The access control system having such a configuration is an access control indicating information for controlling access to the employee home terminal based on identification information for identifying the user of the employee home terminal obtained when connecting the VPN. Information is created, and a resource corresponding to the user of the employee home terminal is generated on the file server based on the identification information. Thereafter, the access control system performs access control to the resources generated on the file server according to the created access control information.

  Specifically, as shown in (1) of FIG. 1, the VPN device of the access control system uses each of “Suzuki” and “Tanaka” to connect the VPN tunnels. The identification information “user ID” and “IP address” are acquired from the employee. Then, as shown in (2) of FIG. 1, the VPN device permits only the creation of the obtained “user ID” folder and the access from the terminal having the “IP address” corresponding to the “user ID”. Create access control information.

  Subsequently, as shown in (3) of FIG. 1, the VPN device creates a folder corresponding to the “user ID” for identifying the user of the employee home terminal in the file server, and copies the access control information to the file server. To do. Thereafter, the file server permits access control according to the copied access control information, that is, access from “suzuki” to “folder (suzuki)”, and access from “suzuki” to “folder (tanaka)”. Similarly, access from “tanaka” to “folder (tanaka)” is permitted, and access control is performed to deny access from “tanaka” to “folder (suzuki)”.

  As described above, since the access control system according to the first embodiment can perform access control using the identification information used at the time of VPN connection, it is not necessary to perform user authentication when accessing the file server after the VPN connection. That is, since it is not necessary to perform user authentication twice for VPN connection and file server access, it is possible to improve user convenience while improving security.

[Configuration of access control system]
Next, the configuration of the access control system shown in FIG. 1 will be described with reference to FIG. FIG. 2 is a block diagram illustrating the configuration of the access control system according to the first embodiment. Here, a VPN device and a file server in the access control system will be described.

(Configuration of VPN device)
As illustrated in FIG. 2, the VPN apparatus 10 includes a LAN adapter A <b> 11, a LAN adapter B <b> 12, a storage unit 20, and a control unit 30.

  The LAN adapter A11 is a NIC (Network Interface Card) that controls various communications transmitted and received via the Internet. Specifically, the LAN adapter A11 receives a VPN connection request, a VPN disconnection request, an access request to the file server 50, and the like from an employee home terminal on the Internet, and outputs them to the control unit 30 described later. Further, the LAN adapter A11 outputs the response to the access request and data output from the file server 50 and received by the LAN adapter B12 to the employee's home terminal on the Internet.

  The LAN adapter B12 is a NIC that controls various communications transmitted and received within an intranet (in-house LAN). Specifically, the LAN adapter B12 outputs an access request to the file server 50 received by the LAN adapter A11 to the file server 50, or receives an access request response or data output from the file server 50. Then, the data is output to the LAN adapter A11, or various control processes executed by the control unit 30 to the file server 50 are output to the file server 50.

  The storage unit 20 stores data and programs necessary for various processes by the control unit 30, routing information for executing network communication, and an authentication log acquired at the time of VPN connection, and is particularly closely related to the present invention. Are provided with an address information DB 21, an authentication information DB 22, and a server information DB 23.

  The authentication log stored in the storage unit 20 is a communication log acquired when a VPN connection is established by the VPN connection unit 31 described later. This authentication log includes, for example, the “time” when the VPN is established, the “router-side IP address (global IP address)” of the employee's home terminal where the VPN is established, and the employee's home terminal where the VPN is established on the internal LAN. “Intranet side IP address (private IP address)”, “User ID” and “Password” which are authentication information at the time of VPN connection.

  The address information DB 21 is a table on a database management system (DBMS) that stores the global address used on the Internet by the employee home terminal, which is a user terminal, and the private address used by the employee home terminal in the VPN. . Specifically, as shown in FIG. 3, the address information DB 21 includes “global address (router side IP address) used on the Internet” and “private address (intranet side IP address) used by the employee's home terminal on the VPN. ) ”” Is stored as “129.xxx.yyy.zzz, 172.168.0.Y”, “150.aaa.bbb.ccc, 172.168.0.Z”, and the like. FIG. 3 is a diagram illustrating an example of information stored in the address information DB.

  The authentication information DB 22 is a table on the database management system that stores information for authenticating the employee's home terminal connected to the VPN. Specifically, as shown in FIG. 4, the authentication information DB 22 includes “129.xxx.yyy.zzz, 172.168.0.Y Suzuki,” “router side IP address, intranet side IP address, user ID, password”. “ikuzusu” and so on.

  The “router-side IP address” stored here is an IP address assigned to a router in a VPN-connected employee's home LAN, that is, an IP address used on the Internet by a VPN-connected employee's home terminal. The “intranet-side IP address” is an IP address used by the employee's home terminal connected via VPN in the in-house LAN (intranet). The “user ID” and “password” are user authentication information for the employee home terminal to make a VPN connection. In other words, when the VPN device 10 receives the “user ID” and “password” from the employee home terminal during VPN connection and performs an authentication process to determine whether or not the stored information matches, Only establish a VPN session. FIG. 4 is a diagram illustrating an example of information stored in the authentication information DB.

  The server information DB 23 is a table on the database management system that stores administrator information of the file server 50 for executing various processes with administrator authority on the file server 50. Specifically, as shown in FIG. 5, the server information DB 23 stores “192.168.1.11, yamazaki, 11231123, / var / www / html” or the like as “IP address, administrator ID, password, HomeDir”. .

  The “IP address” stored here is the IP address of the file server 50 on the in-house LAN, and the “manager ID” is used to identify a user having administrator authority of the file server 50. It is an identifier, “password” is information for identifying an administrator corresponding to the administrator ID, and “HomeDir” is a home directory that can be freely used by the administrator on the file server 50. FIG. 5 is a diagram illustrating an example of information stored in the server information DB.

  The control unit 30 is a processing unit that has an internal memory for storing a control program such as an OS (Operating System), a program that defines various processing procedures, and necessary data, and performs various processes using these. Particularly, those closely related to the present invention include a VPN connection unit 31, an authentication log extraction unit 32, an access control information creation unit 33, and a resource generation unit 34.

  The VPN connection unit 31 establishes a VPN session with the employee's home terminal that has transmitted the VPN connection request, and stores an authentication log when the VPN connection is made in the storage unit 20. Specifically, when the VPN connection unit 31 receives a VPN connection request from the employee home terminal via the Internet, the VPN connection unit 31 requests and accepts a “user ID” and a “password” from the employee home terminal. It is authenticated whether or not “user ID” and “password” are stored in the authentication information DB 22. Then, when the received “user ID” and “password” are stored in the authentication information DB 22, the VPN connection unit 31 determines that authentication is permitted and establishes a VPN with the employee home terminal.

  Then, the VPN connection unit 31 acquires the “router side IP address” and the “intranet side IP address” used by the employee home terminal that has established the VPN connection from the VPN session, and acquires the acquired “router side IP address, intranet side” The “IP address” and “user ID, password” are stored in the storage unit 20 in association with each other. On the other hand, when the received “user ID” and “password” are not stored in the authentication information DB 22, the VPN connection unit 31 determines that authentication is rejected and rejects the connection.

  For example, when the VPN connection unit 31 receives a VPN connection request from the terminal used by the employee “suzuki” via the Internet, the VPN connection unit 31 requests a “user ID” and a “password” for the “suzuki”. And “authenticating” whether or not “user ID = suzuki” and “password = ikuzusu” are stored in the authentication information DB 22. In this case, since the received “user ID = suzuki” and “password = ikuzusu” are stored in the authentication information DB 22, the VPN connection unit 31 determines that the authentication is permitted, and between the “suzuki” terminal. Establish a VPN. Then, the VPN connection unit 31 obtains “router side IP address = 129.xxx.yyy.zzz, intranet side IP address = 172.168.0.Y” used by the “suzuki” terminal that has established the VPN connection from the VPN session. The acquired “router side IP address, intranet side IP address” and “user ID, password” are stored in the storage unit 20 in association with each other.

  As an assignment method of the “intranet-side IP address”, it is possible to assign from the address information DB 21 or automatically assign a free address. That is, the VPN connection unit 31 may acquire the “router-side IP address” from the VPN session, and acquire the “intranet-side IP address” corresponding to the acquired “router-side IP address” from the address information DB 21. . When the “intranet side IP address” corresponding to the “router side IP address” is not in the address information DB 21, the VPN connection unit 31 may automatically assign a vacant “intranet side IP address”. .

  The authentication log extraction unit 32 periodically monitors the authentication log stored in the storage unit 20 to acquire identification information for identifying the user of the employee home terminal, and generates an access control information creation unit 33 and a resource generation described later. To the unit 34. Specifically, the authentication log extraction unit 32 includes “of time, router side IP address, intranet side IP address, user ID, password” acquired by the VPN connection unit 31 and stored in the storage unit 20. "Intranet IP address and user ID" are extracted. Then, the authentication log extraction unit 32 outputs the extracted “intranet IP address” together with the access control information generation request to the access control information generation unit 33, and outputs the extracted “user ID” to the resource generation unit 34.

  The access control information creation unit 33 creates access control information indicating information for controlling access to the user terminal based on identification information for identifying the user of the employee home terminal obtained when connecting the VPN. To do. Specifically, the access control information creation unit 33 can be applied only to the file server 50 that executes WebDAV using Apache + mod_dav using the “intranet-side IP address and user ID” acquired from the authentication log extraction unit 32. Then, the access control information (access setting information) shown in FIG. 6 is created.

  As shown in FIG. 6, the access control information created here permits access from the intra-side IP address “172.168.0.Y” used by the employee's home terminal “Suzuki” and denies access from others. Create information to be used. Although an example in which an IP address is set as the access control information has been described here, a network address may be set. Further, since the VPN apparatus 10 exists in the same network as the file server 50, the IP address of the file server 50 can be recognized. FIG. 6 is a diagram illustrating an example of access control information.

  The resource generation unit 34 generates, on the file server 50, a resource corresponding to the user of the employee home terminal connected by VPN based on the identification information for identifying the user of the employee home terminal. Specifically, when the resource generation unit 34 acquires the “user ID” of the employee home terminal connected by VPN from the authentication log extraction unit 32 and the “access control information” generated by the access control information generation unit 33, The administrator information “IP address, user ID, password, HomeDir” of the file server 50 is acquired from the server information DB 23. Subsequently, the resource generation unit 34 accesses the file server 50 with administrator authority using the acquired administrator information.

  Then, the resource generation unit 34 remotely operates the file server 50 using “remote shell” or “secure shell”, and creates a folder having the name of “user ID” acquired from the authentication log extraction unit 32 in HomeDir. To do. Then, the resource generation unit 34 copies (stores) the access control information generated by the access control information generation unit 33 in the created “user ID” folder.

  For example, when the resource generation unit 34 obtains “user ID = suzuki” of the VPN-connected employee home terminal and the access control information generated by the access control information creation unit 33 from the authentication log extraction unit 32, the server information DB 23 To obtain the administrator information “IP address = 192.168.0.20, user ID = yamazaki, password = 11231123, HomeDir = / var / www / html” of the file server 50. Subsequently, the resource generation unit 34 accesses the file server 50 with the administrator authority using the acquired administrator information, and sets “/ var / www” as a folder having the name “suzuki” acquired from the authentication log extraction unit 32. / html / suzuki ". Then, the resource generation unit 34 copies (stores) the access control information generated by the access control information generation unit 33 to the folder “/ var / www / html / suzuki”.

(File server configuration)
Next, the configuration of the file server in the access control system according to the first embodiment will be described. The file server 50 includes a LAN adapter 51, a resource 52, and a control unit 60.

  The LAN adapter 51 controls communication related to various types of information exchanged via an in-house LAN (intranet). Specifically, the LAN adapter 51 receives a resource creation request, access control information, etc. from the VPN device 10, receives an access request from the employee home terminal via the VPN device 10, Send an access response.

  The resource 52 is a directory, folder, file, etc. created on the file server 50. The resource 52 is created by the VPN device 10 and corresponds to a folder having the name of “user ID” of the employee's home terminal. Each resource 52 stores access control information (see FIG. 6) set for itself.

  The control unit 60 includes a control program such as an OS (Operating System), a program that defines various processing procedures, and an internal memory for storing necessary data, and an access control unit 61, and various types of these are included. Execute the process.

  The access control unit 61 executes access control according to the access control information stored in each resource. Specifically, the access control information shown in FIG. 6 is stored in the resource “/ var / www / html / suzuki”, and the employee home terminals “user ID = suzuki” and “user ID = tanaka” connected by VPN are connected. It is assumed that an access request is received from each. In this case, the access control unit 61 acquires the “intranet-side IP address” from the VPN session and performs access control.

  That is, in the case of the employee home terminal “user ID = suzuki”, the access control unit 61 acquires “intranet-side IP address = 172.168.0.Y”, and this address indicates “permitted” in the access control information of FIG. Since it is set, access to the resource “/ var / www / html / suzuki” is permitted from the employee home terminal “user ID = suzuki”. On the other hand, in the case of the employee home terminal “user ID = takana”, the access control unit 61 acquires “intranet-side IP address = 172.168.0.Z”, and this address is set to “permitted” in the access control information. Therefore, access to the resource “/ var / www / html / suzuki” is denied from the employee's home terminal.

[Processing by access control system]
Next, processing by the access control system will be described with reference to FIGS. FIG. 7 is a flowchart illustrating the flow of folder creation and folder access processing in the access control system according to the first embodiment. FIG. 8 illustrates the flow of folder and access setting deletion processing in the access control system according to the first embodiment. It is a flowchart.

(Flow of folder creation and folder access processing)
As shown in FIG. 7, when the terminal at the employee's home executes VPN software and transmits a connection request (user ID, password) to the corporate LAN to the router at the employee's home LAN (step S101), the router Relays this connection request and transmits a VPN connection login processing request (user ID, password) to the VPN apparatus 10 (step S102).

  The VPN connection unit 31 of the VPN apparatus 10 that has received this login processing request determines whether or not the received “user ID, password” is stored in the authentication information DB 22 (steps S103 and S104).

  The received “user ID, password” is stored in the authentication information DB 22, and the VPN connection unit 31 of the VPN device 10 that has determined that the authentication of the employee's home terminal that has transmitted the connection request is permitted to authenticate. The session information that is the VPN session information is transmitted to the employee home terminal via the router, and the VPN is established with the employee home terminal (steps S105 to S107). In addition, the VPN connection part 31 will extract the authentication log which authenticated the employee home terminal, if VPN is established.

  Subsequently, the authentication log extraction unit 32 of the VPN apparatus 10 periodically monitors the authentication log acquired at the time of VPN connection by the VPN connection unit 31 and extracts the “intranet-side IP address and user ID” from the authentication log, An access control information creation request is output to the access control information creation unit 33 (steps S108 to S111).

  Then, the access control information creation unit 33 of the VPN apparatus 10 controls access to the employee home terminal outside the in-house LAN based on the “intranet IP address and user ID” extracted by the authentication log extraction unit 32. The access control information indicating the information for this is created (step S112). Subsequently, the access control information creation unit 33 notifies the extracted “user ID” to the resource generation unit 34, and transmits an access setting request (step S113).

  The resource generation unit 34 that has received the access setting request acquires the administrator information of the file server 50 stored in the server information DB 23 (steps S114 and S115). Subsequently, the resource generation unit 34 accesses the file server 50 with the administrator authority using the acquired administrator information, creates a folder having the notified “user ID” name in HomeDir, and accesses control information. The access control information received from the creation unit 33 is copied (stored) in the created “user ID” folder (steps S116 and S117). Note that when the VPN device 10 and the file server 50 are realized in the same housing, it is not necessary to perform Step S114 and Step S115.

  Thereafter, the employee home terminal with the established VPN connection transmits an access request to the file server 50 (step S118), and the VPN apparatus 10 that has received the request transfers the request to the file server 50 (step S119).

  Then, the file server 50 identifies the “intranet-side IP address and user ID” of the employee's home terminal that transmitted the connection request or the request from the VPN session, and stores the access control stored in the resource corresponding to the identified “user ID”. Based on the information, it is determined whether or not to permit access to a terminal having the specified “intranet-side IP address” (step S120).

  Then, the file server 50 transmits an access response indicating permission or denial of the access to the employee home terminal of the access request transmission source via the VPN device 10 and the router (steps S121 to S123).

(Flow of folder and access setting deletion process)
As shown in FIG. 8, when the terminal at the employee's home transmits a connection disconnection request for disconnecting the connection with the corporate LAN to the router at the employee's home LAN (step S201), the router relays the connection disconnection request. To the VPN device 10 (step S202).

  The VPN connection unit 31 of the VPN apparatus 10 that has received the connection disconnection request transmits a response permitting connection disconnection to the employee's home terminal via the router (step S203 and step S204). At this time, the VPN connection unit 31 acquires “intranet-side IP address”, “user ID”, and the like from the VPN session as an authentication log.

  Subsequently, the authentication log extraction unit 32 of the VPN apparatus 10 periodically monitors the authentication log acquired when the VPN is disconnected by the VPN connection unit 31, and extracts the “intranet-side IP address and user ID” from the authentication log. An access control information deletion request is output to the resource generation unit 34 together with the extracted “intranet-side IP address and user ID” (steps S205 to S208).

  The resource generation unit 34 that has received the access control information deletion request acquires the administrator information of the file server 50 stored in the server information DB 23 (steps S209 and S210). Subsequently, the resource generation unit 34 accesses the file server 50 with the administrator authority using the acquired administrator information, and issues a deletion request for the folder having the name “user ID” and the access control information notified to the file server. 50 (step S211), and the file server 50 executes a deletion process of deleting the folder having the notified "user ID" name and access control information (step S212). Note that when the VPN apparatus 10 and the file server 50 are realized in the same housing, it is not necessary to perform Step S209 and Step S210.

[Effects of Example 1]
As described above, according to the first embodiment, the VPN device 10 controls the access of the employee home terminal based on the identification information for identifying the user of the employee home terminal obtained when connecting the VPN. Access control information indicating information is created, and a resource corresponding to the user of the employee home terminal is generated on the file server 50 based on the identification information for identifying the employee home terminal. Then, the file server 50 performs access control to the resource generated by the VPN device 10 in accordance with the access control information created by the VPN device 10. In this way, since access control can be performed using the identification information used at the time of VPN connection, there is no need to perform user authentication when accessing the file server after VPN connection, that is, at the time of VPN connection and file Since it is not necessary to perform user authentication twice at the time of server access, it is possible to improve user convenience while improving security.

  Further, according to the first embodiment, the VPN apparatus 10 can also use the identification information for the name of the resource. In this way, since the user can easily recognize his / her folder, the convenience of the user is further improved, and the company side makes a VPN connection to the user who accesses the corporate LAN. Since it can be easily identified, an unauthorized third party can be easily found and security can be further improved.

  In addition, according to the first embodiment, the VPN apparatus 10 can permit access to resources to terminals that exist in the same network as the file server 50. By doing so, an administrator such as an in-house LAN can monitor each resource created by VPN connection, and can further improve security.

  In the first embodiment, an example has been described in which “router side IP address and user ID”, which is identification information, is extracted from an authentication log (communication log) at the time of VPN connection, and folder creation and access control information generation are performed. The present invention is not limited to this, and identification information can also be acquired from a VPN session.

  Therefore, in the second embodiment, an example in which identification information is acquired from a VPN session and folder creation and access control information generation are performed will be described with reference to FIGS. 9 and 10.

  First, the flow of folder creation and folder access processing will be described with reference to FIG. FIG. 9 is a flowchart illustrating the flow of folder creation and folder access processing in the access control system according to the second embodiment. As shown in FIG. 9, the employee's home terminal executes VPN software and transmits a connection request (user ID, password) to the in-house LAN to the router of the employee's home LAN (step S301). Relays this connection request and transmits a VPN connection login processing request (user ID, password) to the VPN apparatus 10 (step S302).

  Upon receiving this login processing request, the VPN connection unit 31 of the VPN apparatus 10 determines whether or not the received “user ID, password” is stored in the authentication information DB 22 (steps S303 and S304).

  The received “user ID, password” is stored in the authentication information DB 22, and the VPN connection unit 31 of the VPN device 10 that has determined that the authentication of the employee's home terminal that has transmitted the connection request is permitted to authenticate. The session information that is the VPN session information is transmitted to the employee home terminal via the router, and the VPN is established with the employee home terminal (steps S305 to S307).

  Subsequently, the VPN connection unit 31 extracts the “intranet IP address and user ID” from the received connection request and the established VPN session, and outputs them to the access control information creation unit 33 (step S308).

  Then, as in the first embodiment, the access control information creation unit 33 creates access control information based on the received “intranet-side IP address and user ID” and transmits an access setting request (step S309).

  Thereafter, the resource generation unit 34 acquires administrator information of the file server 50 stored in the server information DB 23 (steps S310 and S311). Subsequently, the resource generation unit 34 accesses the file server 50 with the administrator authority using the acquired administrator information, creates a folder having the notified “user ID” name in HomeDir, and accesses control information. The access control information received from the creation unit 33 is copied (stored) in the created “user ID” folder (steps S312 and S313).

  Since the subsequent processing is the same as steps S118 to S123 of the first embodiment, detailed description thereof is omitted here.

  Next, the flow of folder and access setting deletion processing will be described with reference to FIG. FIG. 10 is a flowchart illustrating a flow of folder and access setting deletion processing in the access control system according to the second embodiment.

  As shown in FIG. 10, when the terminal at the employee's home transmits a connection disconnection request for disconnecting the connection with the corporate LAN to the router of the employee's home LAN (step S401), the router relays the connection disconnection request. To the VPN device 10 (step S402).

  The VPN connection unit 31 of the VPN apparatus 10 that has received this connection disconnection request transmits a response permitting connection disconnection to the employee's home terminal via the router (steps S403 and S404).

  Subsequently, the VPN connection unit 31 acquires the “intranet-side IP address and user ID” from the VPN session when the VPN is disconnected, and sends an access control information deletion request together with the acquired “intranet-side IP address and user ID” to the resource generation unit 34. (Step S405).

  Thereafter, the resource generation unit 34 acquires administrator information of the file server 50 stored in the server information DB 23 (Steps S406 and S407). Subsequently, the resource generation unit 34 accesses the file server 50 with the administrator authority using the acquired administrator information, and issues a deletion request for the folder having the name “user ID” and the access control information notified to the file server. 50 (step S408), and the file server 50 executes a deletion process for deleting the folder having the notified “user ID” name and access control information (step S409).

  By doing so, the area for securing the authentication log can be deleted, and resources can be used effectively. Further, since it is not necessary to monitor the authentication log regularly, the load on the CPU can be reduced, and furthermore, the processing extracted from the authentication log can be omitted, so that the processing speed can be increased.

  Although the embodiments of the present invention have been described so far, the present invention may be implemented in various different forms other than the embodiments described above. Therefore, as shown below, (1) address correspondence table, (2) SIP (Session Initiation Protocol), (3) system configuration, etc., (4) different embodiments will be described by being divided into programs.

(1) Address correspondence table For example, in the first embodiment, when establishing an VPN connection, the access control system automatically assigns the IP address on the intranet side for the employee home terminal that performs the VPN connection, and then assigns the access control information. Although the example to produce was demonstrated, this invention is not limited to this.

  The access control system disclosed in the present application stores a global address (router-side IP address) used by the employee's home terminal on the Internet and a private address (intranet-side IP address) used by the employee's home terminal in the VPN. The access control information may be created only when a private address corresponding to the global address of the employee's home terminal connected by VPN is stored.

(2) SIP
In the first and second embodiments, the case where authentication is performed by VPN using the Internet has been described. However, the present invention is not limited to this, and the access control system disclosed in the present application is a dial-up VPN using SIP. Connection technology (Reference 1: VPN connection method for connecting broadband and secure home LANs, 2007, BS-5-6, IEICE BS-5-6, Reference 2: Home LAN connection system with telephone interface In 2007, the Institute of Electronics, Information and Communication Engineers B-6-31) can be applied.

  In this case, by creating access control information using a “telephone number” or “SIP-URI (Session Initiation Protocol-Uniform Resource Identifier)” instead of the “intranet-side IP address” described in the first and second embodiments. The same processing as in the first and second embodiments can be executed. By doing so, the present invention can be applied to data communication such as voice, and a wide range of services can be provided in accordance with user needs.

(3) System configuration etc. In addition, among the processes described in the present embodiment, all or a part of the processes (for example, the authentication log extraction process) described as being automatically performed may be manually performed. Alternatively, all or part of the processing described as being manually performed (for example, user ID and password input processing at the time of VPN connection) can be automatically performed by a known method. In addition, the processing procedures, control procedures, specific names, and information including various data and parameters (for example, FIG. 3 to FIG. 6) shown in the above documents and drawings are optional unless otherwise specified. Can be changed.

  Further, each component of each illustrated apparatus is functionally conceptual, and does not necessarily need to be physically configured as illustrated. In other words, the specific form of distribution / integration of each device is not limited to that shown in the figure, and all or a part thereof may be functionally or physically distributed or arbitrarily distributed in arbitrary units according to various loads or usage conditions. It can be configured by integrating (for example, integrating the access control information creating unit and the resource generating unit). Further, all or any part of each processing function performed in each device may be realized by a CPU and a program analyzed and executed by the CPU, or may be realized as hardware by wired logic.

(4) Program The connection control method described in the present embodiment can be realized by executing a program prepared in advance on a computer such as a personal computer or a workstation. This program can be distributed via a network such as the Internet. The program can also be executed by being recorded on a computer-readable recording medium such as a hard disk, a flexible disk (FD), a CD-ROM, an MO, and a DVD and being read from the recording medium by the computer.

  As described above, the access control system, the connection control device, and the connection control method according to the present invention provide a connection between a file server that holds resources accessed by a user terminal and a network to which the user terminal belongs. This is useful for an access control system having a connection control device connected via a virtual communication path, and is particularly suitable for improving user convenience while improving security.

1 is a system configuration diagram illustrating an overall configuration of an access control system according to a first embodiment. 1 is a block diagram illustrating a configuration of an access control system according to a first embodiment. It is a figure which shows the example of the information memorize | stored in address information DB. It is a figure which shows the example of the information memorize | stored in authentication information DB. It is a figure which shows the example of the information memorize | stored in server information DB. It is a figure which shows the example of access control information. 7 is a flowchart illustrating a flow of folder creation and folder access processing in the access control system according to the first embodiment. 7 is a flowchart illustrating a flow of folder and access setting deletion processing in the access control system according to the first embodiment. 12 is a flowchart illustrating a flow of folder creation and folder access processing in the access control system according to the second embodiment. 12 is a flowchart illustrating a flow of a folder and access setting deletion process in the access control system according to the second embodiment.

Explanation of symbols

10 VPN device 11 LAN adapter A
12 LAN adapter B
20 storage unit 21 address information DB
22 Authentication information DB
23 Server information DB
DESCRIPTION OF SYMBOLS 30 Control part 31 VPN connection part 32 Authentication log extraction part 33 Access control information creation part 34 Resource generation part 50 File server 51 LAN adapter 52 Resource 60 Control part 61 Access control part

Claims (8)

An access control system comprising: a file server that holds resources accessed by a user terminal; and a connection control device that connects the user terminal and a network to which the file server belongs via a virtual communication path,
Create access control information indicating information for controlling access of the user terminal based on identification information for identifying the user of the user terminal obtained when connecting the virtual communication path Access control information creation means;
Based on identification information for identifying the user of the user terminal, resource generation means for generating a resource corresponding to the user of the user terminal on the file server;
Access control means for controlling access to the resource generated by the resource generating means according to the access control information created by the access control information creating means;
An access control system comprising: An address information storage means for storing a global address used by the user terminal on the Internet and a private address used by the user terminal on the virtual communication path in association with each other;
The access control information creation means creates the access control information when a private address corresponding to a global address of a user terminal connected through the virtual communication path is stored in the address information storage means. The access control system according to claim 1.   The access control system according to claim 1, wherein the resource generation unit uses the identification information as a name of the resource.   4. The access control information creating unit creates access control information for permitting access to the resource for a terminal existing in the same network as the file server. The access control system according to one. The virtual communication path is connected using SIP,
The access control information creating means creates the access control information based on a calling telephone number of the user terminal obtained when connecting the virtual communication path. The described access control system. An access control system comprising: a file server that holds resources accessed by a user terminal; and a connection control device that connects the user terminal and a network to which the file server belongs via a virtual communication path,
The connection control device includes:
Based on identification information for identifying the user of the user terminal obtained when connecting the virtual communication path, access control information indicating information for controlling access of the user terminal is created. Access control information creating means for storing in the file server;
Resource generating means for generating, on the file server, a resource corresponding to the user of the user terminal, based on identification information for identifying the user of the user terminal;
The file server is
Access control means for controlling access to the resource generated by the resource generating means in accordance with the access control information created by the access control information creating means;
An access control system comprising: The connection in an access control system comprising: a file server that holds resources accessed by a user terminal; and a connection control device that connects the user terminal and a network to which the file server belongs via a virtual communication path. A control device,
Based on identification information for identifying the user of the user terminal obtained when connecting the virtual communication path, access control information indicating information for controlling access of the user terminal is created. Access control information creating means for storing in the file server;
Based on identification information for identifying the user of the user terminal, resource generation means for generating a resource corresponding to the user of the user terminal on the file server;
A connection control device comprising: The connection control in an access control system comprising: a file server that holds resources accessed by a user terminal; and a connection control device that connects the user terminal and a network to which the file server belongs via a virtual communication path. A connection control method suitable for a device,
Based on identification information for identifying the user of the user terminal obtained when connecting the virtual communication path, access control information indicating information for controlling access of the user terminal is created. An access control information creation step to be stored in the file server;
Based on identification information for identifying a user of the user terminal, a resource generation step of generating a resource corresponding to the user of the user terminal on the file server;
The connection control method characterized by including.

Images