JP5554946B2 - Thin client system, session management method, and program - Google Patents

Description

  The present invention relates to a thin client system, and more particularly to a thin client system that performs session management.

  In a thin client system, an OS (Operating System) and data used by a user are present on the thin client server side. Therefore, in a normal client / server system, a conventional client server system has multiple PCs or multiple jobs. When a business mode concurrently serving at a place is converted into a thin client, the user needs to be aware of the connection destination server from a thin client terminal (hereinafter referred to as TC). Further, when a failure occurs in the OS and the OS is restarted, it is necessary to request the system administrator. Thus, the operability for the user is lower in the thin client system than in the conventional client / server system.

  For example, in a client / server configuration using a client terminal having a disk, a plurality of PCs are owned by one person due to the low price of PCs and complicated operations. There are many cases. The thin client system has been introduced for the purpose of reducing terminal management costs and measures against information leakage in recent years. It is a thin client terminal that is diskless or forbidden to write to a disk, and a thin client that has an operating system, business applications, and data. Consists of servers. The TC and the server are connected by RemoteDesktopProtocol or network boot. When migrating from a client / server form to a thin client system, the user needs to be aware of the connection destination thin client server, or the administrator needs to restart the OS, which makes the terminal user's operability easy. There was a problem of being lowered.

As a related technique, Japanese Laid-Open Patent Publication No. 2000-181821 (Patent Document 1) discloses a network computer system.
This prior art relates to a network computer system comprising a first computer and a second computer that operates by acquiring an operating system and application programs from the first computer via a network. The second computer includes identification data reading means for reading the identification data from a storage medium for personal authentication storing identification data for identifying an individual, and identification data read by the identification data reading means. Identification data transmitting means for transmitting to the computer, wherein the first computer receives identification data transmitted from the second computer, and the identification data received by the identification data receiving means. Transmission program determining means for determining an application program to be automatically transmitted from the data to the second computer.

Japanese Laid-Open Patent Publication No. 2002-117713 (Patent Document 2) discloses a network system.
The network system includes a name server, a plurality of servers whose names are resolved by the name server, and a client that requests the name server for name resolution of a desired server. The name server responds with an IP address by searching the database in response to the name resolution request from the client, a database for managing the name, IP address, and operation status of each server to be resolved. The server has a function of checking the operating status of the server whose name has been resolved, and transmitting a start request packet to the server whose name has been resolved if it has been stopped. It has a function of performing activation processing in response to the activation request packet.

JP-A-2005-339133 (Patent Document 3) discloses a shared personal computer system.
This shared-use personal computer system includes a diskless user terminal for shared use, a PC initial environment management server for storing and managing an initial environment construction file for operating the user terminal in a predetermined initial environment, and the user terminal And a personal data backup server that backs up different environments for each user. The user terminal constructs an initial environment by downloading the initial environment construction file from the PC initial environment management server to the memory and executing it, and downloads the user's own environment settings from the personal data backup server to the memory. It is characterized by setting.

Japanese Patent Laid-Open No. 8-263283 (Patent Document 4) discloses a software management system.
This prior art relates to a software management system in which a server and a plurality of terminal devices are connected by communication means, and a program is shared by each terminal device. The software management system includes a management information storage unit that stores management information such as an identification name of the program, an identification name of a terminal device that can use the program, an identification name of the user, and a password of the user in the server, Means for judging the validity of the use of the program in the terminal device based on the management information stored in the means and the security check information received from the terminal device; Means for transmitting to the terminal device that has transmitted the information. A means for transmitting the security check information such as the identification name of the program, the identification name of the terminal device, the identification name of the user, and the password of the user to the server every time the terminal device is requested to execute the program; And a means for granting an execution right to the program based on the determination result received from the server.

JP 2000-181821 A JP 2002-111713 A JP 2005-339133 A JP-A-8-263283

An object of the present invention is to provide a thin client system that manages a session between a thin client terminal and a thin client server using a user and a terminal as keys.
Another object of the present invention is to automatically connect to a thin client server according to the purpose (business) without recognizing the user, to resume business by reconnecting a session, and to start up and shut down the OS on the thin client server side. It is to provide a thin client system that enables a user to perform the above.
Still another object of the present invention is to provide a thin client system that enables an operation equivalent to that of a conventional client / server system.

  A thin client system of the present invention includes a thin client server including a plurality of execution units to which tasks are given, a thin client terminal, and a session management server for assigning a thin client terminal to a predetermined execution unit among the plurality of execution units. Including. The session management server stores execution unit information indicating a predetermined execution unit in association with user information indicating a user of the thin client terminal and terminal information indicating the thin client terminal, and a connection destination setting table. Receiving user information and terminal information from the thin client terminal, detecting execution unit information indicating a predetermined execution unit from the connection destination setting table based on the user information and terminal information, and detecting the detected execution unit information Session management means for notifying the thin client terminal.

  The session management method of the present invention is a session management method in a thin client system, and uses a session management server to connect a thin client terminal to a predetermined execution unit among a plurality of execution units to which tasks are assigned on the thin client server. And on the session management server, the execution unit information indicating the predetermined execution unit is stored in association with the user information indicating the user of the thin client terminal and the terminal information indicating the thin client terminal. A connection destination setting table, receiving user information and terminal information from the thin client terminal on the session management server, and executing unit from the connection destination setting table based on the user information and terminal information. Detecting information and the detected execution unit information to the thin client terminal And a be known.

  The program of the present invention uses execution unit information indicating a predetermined execution unit among a plurality of execution units to which a task is given on the thin client server, and indicates a user of a thin client terminal assigned to the predetermined execution unit A connection destination setting table stored in association with user information and terminal information indicating a thin client terminal, and detecting execution unit information from the connection destination setting table based on user information and terminal information And a step of executing reconnection between the thin client terminal and the thin client server when the connection state between the thin client terminal and the thin client server indicates that the connection is disconnected while being used. Is a program for causing a computer to execute.

The first effect is that a job corresponding to the user and the place of use (terminal) can be performed only by inputting a logon ID and a password. Similar to the client / server system, the user does not need to be aware of the thin client server of the connection destination. The reason is that the session management server automatically determines the thin client server to be connected according to the user and the terminal.
The second effect is that the OS can be restarted at the user's discretion. It is possible to quickly recover without requiring the system administrator to recover when a failure occurs in the OS. The reason is that the session management server automatically restarts the OS from the connection state and the OS state.
The third effect is that it cannot be used from an unauthorized terminal. Further, by using encryption together, security can be further improved. The reason is to determine the connection source TC from the connection destination setting table.

It is a block diagram which shows the structure of this invention. It is a figure which shows the content of a connection destination setting table. It is a figure which shows the content of a connection state management table. It is a flowchart which shows operation | movement of this invention. It is a figure shown about allocation of a some execution part. It is a figure shown about terminal authentication.

Hereinafter, a first embodiment of the present invention will be described with reference to the accompanying drawings.
Referring to FIG. 1, the thin client system according to the present invention includes a thin client server 10, a session management server 20, and a TC (thin client terminal) 30.

  The thin client server 10 (10-i, i = 1 to n: n is the number of servers) is at least one server. The thin client server 10 includes an execution unit (execution image) 11 and a client state acquisition unit 12.

  The execution unit 11 includes a client OS 111, a business application (business AP) 112, and data 113. The client status acquisition unit 12 acquires the status of the client OS 111. The client OS 111, the business application 112, and the data 113 are allocated for each connection from the TC 30. Accordingly, when the number of connections from the TC 30 is m, there are m execution units 11, client status acquisition units 12, client OSs 111, business applications 112, and data 113, for each thin client server 10. In FIG. 1, the execution unit 11 (11-ki, k = 1 to m, i = 1 to n) and the client state acquisition unit 12 (12-ki, k = 1 to m, i = 1), respectively. N), client OS 111 (111-ki, k = 1 to m, i = 1 to n), business application 112 (112-ki, k = 1 to m, i = 1 to n), data 113 (113-ki, k = 1 to m, i = 1 to n).

  The session management server 20 is a server for performing session management. The session management server 20 includes a session management unit 21, a connection destination setting table 22, and a connection state management table 23.

  The session management unit 21 refers to the connection destination setting table 22 and determines a connection destination in response to a request from the TC 30. The connection destination setting table 22 stores data defining which execution unit 11 is to be connected with the terminal and the user as keys. The connection state management table 23 stores data for maintaining the connection state with the execution unit 11.

  The TC 30 is a terminal for communicating with the thin client server 10 via the session management server 20. The TC 30 includes a protocol management unit 31 and a connection destination control unit 32.

  The protocol management unit 31 connects to the thin client server 10 as, for example, a Remote Desktop Protocol (hereinafter referred to as RDP) client. The connection destination control unit 32 specifies a connection destination with respect to the protocol management unit 31. Also, the session management unit 21 is requested to determine the connection destination.

FIG. 2 shows details of the connection destination setting table 22.
Referring to FIG. 2, the connection destination setting table 22 includes definition information as to which execution unit 11 is connected by a combination of a user (account) and a TC. For example, referring to FIG. 2, when the user A is a user terminal and the user terminal is TC-A, the connection destination is the IP address A.

FIG. 3 shows details of the connection state management table 23.
Referring to FIG. 3, the connection state management table 23 includes a state information list indicating which user (account) is connected to which execution unit 11 from which TC. For example, referring to FIG. 3, the user A is connected to the IP address A from the terminal TC-A.

  The operation of this embodiment will be described in detail with reference to FIG.

(1) Step S101
The session management server 20 creates the connection destination setting table 22 before system operation.

(2) Step S102
Next, at the start of use of the TC 30, the connection destination control unit 32 acquires user (user account) information and information for identifying the TC 30 (such as a MAC address) by displaying a login screen, and the session management unit 21. Make a connection request to.

(3) Step S103
The session management unit 21 searches the connection destination setting table 22 (FIG. 2) using the user and terminal information transmitted from the connection destination control unit 32 as keys, determines a connection destination IP address, and connects to the connection destination control unit 32. And the result is recorded in the connection state management table 23.

(4) Step S104
The connection destination control unit 32 connects to the execution unit 11 having the instructed IP address by notifying the protocol management unit 31 of the connection destination IP address.

(5) Step S105
Further, when the user executes the connection destination control unit 32 after the session is disconnected by the user or the session is disconnected, the user (user account) information and information for identifying the TC 30 (such as a MAC address) ) Is transmitted to the session management unit 21.

(6) Step S106
The session management unit 21 searches the connection state management table 23 (FIG. 3). If the session management unit 21 is currently in use, the session management unit 21 returns the IP address being used to the connection destination control unit 32, thereby executing the execution unit 11 being used. Reconnect to

(7) Step S107
If a failure occurs in the OS (client OS 111, etc.) of the execution unit 11 being connected, the user executes the connection destination control unit 32, and similarly identifies the user (user account) information and the TC 30. Information (such as a MAC address) is transmitted to the session management unit 21.

(8) Step S108
The session management unit 21 searches the connection state management table (FIG. 3), and inquires the client state acquisition unit 12 about the state of the OS if it is currently in use. In the case of an abnormal response or no response, it is determined that the OS has failed, and the executing unit 11 being used is restarted.

  Note that a program for causing various computers to execute the operation of the above-described embodiment may be used. In the program, a statement and definition necessary for the computer to execute the operation of this embodiment are described.

The second embodiment of the present invention will be described below.
The second embodiment of the present invention relates to allocation of a plurality of execution units.
The allocation of a plurality of execution units will be described in detail with reference to FIG.

  In FIG. 5, for example, a user A: 40A concurrently serves as a business a and a business b. The business a is performed at the head office A from TC-A: 30A, and the business b is performed at the sales office B at TC-B: Since the data and application used for business are different from 30B, a connection destination setting table is defined as shown in FIG.

  When user A: 40A conducts a business from TC-A: 30A, a business image (IP address) holding an application or data for business a according to the connection destination setting table (FIG. 2) of the session management server 20 A): Connect to 11A-1. Similarly, when user A conducts business from TC-B: 30B, connection is made to business image for business b (IP address B): 11B-1. The business image corresponds to the execution unit (execution image) 11.

  Even when business is performed from TC-A: 30A, when user B: 40B logs on, connection is made to IP address C from the setting on the third line of the connection destination setting table (FIG. 2).

The third embodiment of the present invention will be described below.
The third embodiment of the present invention relates to terminal authentication.
The terminal authentication will be described in detail with reference to FIGS.

  In FIG. 5, when a user A: 40A tries to perform a business from TC-C: 30C, it is not registered in the connection destination setting table (FIG. 2) of the session management server 20, so that the user A: 40A But you can't do business.

  Further, in FIG. 6, the session management unit in which the secret key 33 unique to the TC 30 is distributed on the TC 30 or previously written in the ROM on the TC 30, and the secret key 33 or the public key corresponding to the secret key 33 is distributed from the TC 30. The public key corresponding to the secret key 33 is registered as TC information in the connection destination setting table 22. As a result, when an operation is attempted from TC-C: 30C in FIG. 5, it is possible to prevent unauthorized connection due to the spoofing of the IP address or MAC address of TC-C: 30C.

  Note that the present invention can be applied to a system that inherits the operability of the user and requires high security when shifting from the client / server system to the thin client system.

  As described above, the thin client system of the present invention includes the session management server 20 that manages the session between the thin client server 10 and the TC 30, and the connection destination control unit 32 that notifies the protocol management unit 31 of the connection destination IP address. ing.

  The connection destination control unit 32 transmits user information and terminal information to the session management unit 21, and the session management unit 21 refers to the connection destination setting table 22 and the connection state management table 23, so that the user and terminal ( Connection to the execution unit 11 in which the business application and data corresponding to the usage location are installed.

  When the TC 30 user re-executes the connection destination control unit 32 when the session is disconnected, user information and terminal information are transmitted to the session management unit 21, and the session management unit 21 refers to the connection state management table 23. Thus, the execution unit 11 currently in use is specified. The state of the corresponding execution unit 11 is acquired from the client state acquisition unit (N-2-M). When the OS is normal, reconnection is performed, and when the OS is abnormal, the OS is restarted.

  The first feature of the present invention is that the connection destination can be determined dynamically from the user and the use TC without being conscious of the user by setting the connection destination in advance.

  The second feature of the present invention is that use from an unauthorized terminal can be prevented by setting a connection destination in advance.

  The third feature of the present invention is that reconnection after session disconnection is possible by maintaining the connection state.

  A fourth feature of the present invention is that the OS can be automatically restarted by a user reconnection request when an OS failure occurs by maintaining the connection state and acquiring the OS state. .

  As described above, according to the present invention, in a thin client system, a session between a thin client terminal and a thin client server is managed using the user and the terminal as a key, so that the user can respond to the purpose (business) without being aware of it. It enables the user to restart work by automatically connecting to a thin client server or reconnecting a session, and start and shut down the OS on the thin client server side. The same operation is possible.

10 ... Thin client server 11 ... Execution unit (execution image)
111 ... Client OS
112 ... Business application (business AP)
DESCRIPTION OF SYMBOLS 113 ... Data 12 ... Client state acquisition part 20 ... Session management server 21 ... Session management part 22 ... Connection destination setting table 23 ... Connection state management table 30 ... TC (thin client terminal)
31 ... Protocol management unit 32 ... Destination control unit

Claims (13)

A thin client server including a plurality of execution units each assigned a task;
A thin client terminal,
A session management server that allocates the thin client terminal to a predetermined execution unit to be connected among the plurality of execution units,
The session management server
An execution unit information indicating the predetermined execution unit, a connection destination setting table stored in advance in association with user information indicating a user of the thin client terminal and terminal information indicating the thin client terminal,
A connection state management table for storing the user information, the terminal information, and the execution unit information in association with each other;
The user information and the terminal information are received simultaneously with the connection request from the thin client terminal, and the execution unit information is detected from the connection destination setting table based on a combination of the user information and the terminal information. When the predetermined execution unit to be connected is specified based on the execution unit information, the connection state management table is referred to and the connection state between the thin client terminal and the predetermined execution unit is being used. If registered, it is determined that accidental disconnection occurs, look contains a session management means to said thin client terminal reconnects with the predetermined execution unit,
Each of the plurality of execution units is
OS (Operating System),
A business application corresponding to the given task;
Data used by the business application and
Including
The thin client server
Client status acquisition means provided to each execution unit for acquiring and holding the state of each of the plurality of execution units
Further including
When the connection state between the thin client terminal and the predetermined execution unit is registered as in use, the session management unit performs the predetermined execution according to the execution unit information with respect to the client state acquisition unit. A thin client system that inquires about the status of the OS of each unit and, if there is an abnormal response from the client status acquisition means, determines that there is an OS failure and restarts the predetermined execution unit . The thin client system according to claim 1 ,
The session management unit registers an encryption key unique to the thin client terminal as one of the terminal information in the connection destination setting table, and the other terminal when a connection request is made from another terminal. A thin client system that prevents unauthorized connections by spoofing address information. The thin client system according to claim 1 or 2 ,
The session management unit dynamically determines a connection destination based on a combination of the user information and the terminal information without making the user aware of the connection destination by setting the connection destination in the connection destination setting table in advance. By preventing connection from unauthorized terminals and maintaining the connection status in the connection status management table, reconnection to the connection destination after session disconnection is realized, and the OS status is acquired from the connection destination. A thin client system that automatically restarts the OS when an OS failure occurs. A thin client system according to any one of claims 1 to 3 ,
The thin client terminal
A connection destination control means for transmitting the user information and the terminal information to the session management server at the start of use by the user or at the time of session disconnection, and acquiring the execution unit information as a response;
A thin client system, comprising: protocol management means for obtaining the execution unit information from the connection destination control unit and communicating with the predetermined execution unit using the session management server based on the execution unit information. The session management server used with the thin client system as described in any one of Claims 1 thru | or 4 . The thin client server used with the thin client system as described in any one of Claims 1 thru | or 4 . The thin client terminal used with the thin client system as described in any one of Claims 1 thru | or 4 . In a thin client system, a session management method implemented by a session management server that manages a connection state between a thin client terminal and a thin client server,
Simultaneously with the connection request from the thin client terminal, receiving user information indicating a user of the thin client terminal, and terminal information indicating the thin client terminal;
A connection destination that stores in advance execution unit information indicating a predetermined execution unit to be connected among a plurality of execution units to which tasks are assigned on the thin client server in association with the user information and the terminal information. Referring to a setting table and detecting the execution unit information from the connection destination setting table based on the received combination of the user information and the terminal information;
Storing the user information, the terminal information, and the execution unit information in a connection state management table in association with each other;
When the predetermined execution unit to be connected is specified based on the execution unit information, the connection state management table is referred to, and the connection state between the thin client terminal and the predetermined execution unit is registered as being used. If it is determined that an unexpected disconnection has occurred, reconnecting the thin client terminal to the predetermined execution unit ;
When the connection state between the thin client terminal and the predetermined execution unit is registered as in use, an inquiry about the state of the OS of the predetermined execution unit according to the execution unit information is made to the thin client server And doing
If there is an abnormal response from the thin client server, it is determined that an OS failure has occurred, and the predetermined execution unit is restarted . The session management method according to claim 8 , comprising:
In the connection destination setting table, an encryption key unique to the thin client terminal is registered as one of the terminal information, and fraud due to impersonation of the address information of the other terminal when a connection request is made from another terminal A session management method further comprising preventing connection. The session management method according to claim 8 or 9 , wherein
By setting the connection destination in the connection destination setting table in advance, the connection destination is dynamically determined based on the combination of the user information and the terminal information without making the user aware of it. Preventing the use of
By realizing the connection state in the connection state management table, realizing reconnection to the connection destination after session disconnection;
A session management method further comprising: automatically restarting the OS when an OS failure occurs by acquiring the state of the OS from the connection destination. Simultaneously with the request for connection from the thin client terminal, receiving user information indicating a user of the thin client terminal, and terminal information indicating the thin client terminal;
A connection destination setting in which execution unit information indicating a predetermined execution unit to be connected is stored in advance in association with the user information and the terminal information among a plurality of execution units to which tasks are assigned on the thin client server. Referring to a table and detecting the execution unit information from the connection destination setting table based on the received combination of the user information and the terminal information;
Storing the user information, the terminal information, and the execution unit information in association with each other in a connection state management table;
When the predetermined execution unit to be connected is specified based on the execution unit information, the connection state management table is referred to, and the connection state between the thin client terminal and the predetermined execution unit is registered as being used. Determining that an unexpected disconnection has occurred, reconnecting the thin client terminal to the predetermined execution unit ;
When the connection state between the thin client terminal and the predetermined execution unit is registered as in use, an inquiry about the state of the OS of the predetermined execution unit according to the execution unit information is made to the thin client server The steps of
If there is an abnormal response from the thin client server, it is determined that the OS has failed, and a program for causing the computer to execute a step of restarting the predetermined execution unit . The program according to claim 11 ,
In the connection destination setting table, an encryption key unique to the thin client terminal is registered as one of the terminal information, and fraud due to impersonation of the address information of the other terminal when a connection request is made from another terminal A program for causing a computer to further execute a step for preventing connection. The program according to claim 11 or 12 ,
By setting the connection destination in the connection destination setting table in advance, the connection destination is dynamically determined based on the combination of the user information and the terminal information without any steps that the user is conscious of, and from the unauthorized terminal Steps to prevent the use of
Realizing reconnection to the connection destination after session disconnection by holding a connection state in the connection state management table;
A program for causing a computer to further execute a step of automatically restarting an OS when an OS failure occurs by acquiring the state of the OS from the connection destination.

Images