JP5560011B2 - Remote access control method and remote access control system - Google Patents

Description

  The present invention relates to a remote access control method and a remote access control system used to access a specific client terminal installed in an office using an unspecified client terminal installed outside the office.

  In daily corporate activities, client terminals such as PC (Personal Computer) terminals installed in offices are assigned to each user, and business is often performed using such PC terminals.

  Furthermore, when an activity is performed outside a company office, a PC terminal may be carried. In some cases, a recording medium in which necessary information is recorded is taken out and information processing is performed using another client terminal. However, when taking a PC terminal or a recording medium out of the office, it is necessary to pay attention to ensuring security such as information leakage.

  Therefore, as a technique that can prevent information leakage even if the PC terminal is lost, a thin client system that has only a minimum necessary configuration in the client terminal has attracted attention. For example, in a thin client system, a diskless PC without a storage device is used as a client terminal. And using the client terminal which a user operates, the desktop on the server apparatus managed by the company etc. is operated remotely, and the various application programs and data mounted in the server apparatus are utilized.

  For this reason, the client device is equipped with a communication program for connecting the client device and the server device, a remote desktop program for causing the client device to function as an input / output device for the server device, and an operation system program for operating these programs. There is a need.

  Therefore, a technique relating to a remote access method for executing work that can be performed within the intranet outside the intranet without taking out the files within the intranet has been studied (for example, see Patent Document 1). The technique described in this document is configured by a plurality of PCs such as personal computers and servers in the Internet or an intranet, and a relay management server installed in the Internet. At least a part of the operation PC software is stored in an external storage medium such as a USB memory. The external storage medium has a unique ID and uses both this ID and authentication information such as a manually entered password. To log in to the relay management server.

  A technique for providing a remote access system for accessing data stored in a server connected via a network from a client terminal has also been studied (see, for example, Patent Document 2). In the technique described in this document, a device, a client terminal, and a server having a storage device that stores an OS program and an application program are used. The client terminal reads the OS program and the application program from the device, and stores the OS program and the application program in a memory provided in the client terminal. The OS is started by the OS program stored in the memory, and the application program stored in the memory is executed to generate a file. Then, the generated file is transmitted to the server, and the file is stored in a storage device included in the server.

JP 2007-110590 (first page, FIG. 2) JP 2007-310509 A (first page, FIG. 3)

  By the way, for example, when an influenza infected person occurs, there may be a situation where sudden work cannot be performed due to various circumstances. In such a case, not only an infected person but also a healthy person in the same office who may be infected may refrain from attending work and stay at home in order to prevent the spread of infection. In addition, even if an infected person recovers physically, he / she may refrain from going to the office for a certain period of time to control the infection.

  In such cases, it is important to ensure the continuity of business operations. In particular, today, personal PC terminals are often installed in employees' homes and the like, and a communication environment is often prepared, and there is a possibility that such an environment can be used.

  However, even when such a PC terminal is used, it is necessary to prepare an access environment for remote access to the PC terminal installed in the office. Further, when using a personal PC terminal, it is particularly necessary to consider security.

  Furthermore, it is difficult to specify a user who is waiting at home in advance in response to an unexpected situation. It is also possible to prepare a remote access environment for all users in advance, but in this case, the economic burden is large.

  The present invention has been made to solve the above-mentioned problems, and uses a non-specific client terminal installed outside the office to access a specific client terminal installed in the office. A control method and a remote access control system are provided.

In order to solve the above problems, the invention described in claim 1 is a first client terminal installed outside the office, and a first client terminal installed in the office connected to the first client terminal via a network. A method of controlling remote access using a two-client terminal and a remote access control device that holds personal authentication information and is attached to the first client terminal, and is attached to the first client terminal The remote access control device obtains user confirmation information, authenticates the user authentication information against the user confirmation information, and authenticates the user. Instructing the client terminal to shorten the screen saver activation time, and the first client terminal Wherein the thin client step of limiting the function, the first client terminal, the step of connecting to the second client terminal via a network, the second client terminal short for screen saver activation time, which was thin client The gist is to execute a step of permitting remote access in response to a connection from the first client terminal.

  According to a second aspect of the present invention, in the remote access control method according to the first aspect, the remote access control device holds an electronic certificate, and the first client terminal uses the electronic certificate. Is connected to the second client terminal.

According to a third aspect of the present invention, in the remote access control method according to the first or second aspect, the remote access control device holds biometric information as personal authentication information and reads biometric information reading means for reading user confirmation information And performing personal authentication using the biometric information read by the biometric information reading means as user confirmation information.

  According to a fourth aspect of the present invention, in the remote access control method according to any one of the first to third aspects, the remote access control device holds a preset password, and the first client The gist is to obtain a password input at the terminal and to perform identity authentication using the password.

  According to a fifth aspect of the present invention, in the remote access control method according to the fourth aspect, when the remote access control device performs personal authentication using a password, it performs personal authentication using biometric information. The gist is to strengthen the restrictions on the functions that can be used during remote access, rather than the case where

  According to a sixth aspect of the present invention, in the remote access control method according to any one of the first to fifth aspects, the remote access control device acquires a security status of the first client terminal, and the security status. The gist is to determine whether or not the user satisfies the use condition, and to authenticate the person when the use condition is satisfied.

According to a seventh aspect of the present invention, there is provided a first client terminal installed outside the office, a second client terminal connected to the first client terminal via a network and installed in the office, and personal authentication information. And a remote access control device mounted on the first client terminal, wherein the remote access control device mounted on the first client terminal is user-confirmed. Information is acquired, and means for authenticating the user by comparing the user authentication information with the user confirmation information; and if the user can be authenticated, a screen saver activation time is set for the second client terminal. with the an instruction to shorten, Shinkura to limit the functions of the first client terminal A Ant means, the first client terminal includes a means for connecting to said second client terminal via a network, the second client terminal short for screen saver activation time, thin client and said first The gist of the invention is that it has means for allowing remote access in response to a connection from a client terminal.

(Function)
According to the first or seventh aspect of the invention, the remote access control device attached to the first client terminal acquires the user confirmation information and compares the personal authentication information with the user confirmation information to authenticate the user. To do. If the user can be authenticated, the function of the first client terminal is restricted. Then, the first client terminal is connected to the second client terminal via the network. The second client terminal allows remote access according to the connection from the first client terminal. Thereby, by making the first client terminal “thin client”, it is possible to eliminate the risk of leakage of information relating to business due to theft of the first client terminal or the like. Further, by operating the second client terminal by remote control, the same work as in the office becomes possible. Then, by using a remote access control device such as a USB key device or an external storage, it is possible to construct a connection-only environment in the first client terminal and improve business convenience. As a result, work can be performed effectively and efficiently outside the office.

  According to the second aspect of the invention, the remote access control device holds the electronic certificate, and uses the electronic certificate to connect the first client terminal to the second client terminal. Thereby, connection authentication can be strengthened.

According to the third aspect of the present invention, the remote access control device includes biometric information reading means for holding biometric information as personal authentication information and reading user confirmation information. Then, the biometric information read by the biometric information reading means is used as user confirmation information to perform personal authentication. Thereby, accurate personal authentication can be performed using biometric information.

  According to the fourth aspect of the present invention, the remote access control device holds a preset password. And the password input in the 1st client terminal is acquired, and personal authentication is performed using a password. Accordingly, remote access can be realized even when biometric information is not registered or biometric information cannot be read.

  According to the fifth aspect of the present invention, the remote access control device has a function that can be used in remote access when performing personal authentication using a password than when performing personal authentication using biometric information. Increase restrictions. Thereby, security can be ensured according to the situation of personal authentication.

  According to the sixth aspect of the present invention, the remote access control device acquires the security status of the first client terminal and determines whether or not the security status satisfies the use condition. Then, when the usage conditions are satisfied, personal authentication is performed. Thereby, it is possible to realize remote access by confirming the environment of the first client terminal.

  According to the present invention, it is possible to provide a remote access control method and a remote access control system for accessing a specific client terminal installed in an office or the like using an unspecified client terminal installed in a home or the like. it can.

The system schematic of embodiment of this invention. Explanatory drawing of the functional block of the system of embodiment of this invention. Explanatory drawing of the process sequence of this embodiment. Explanatory drawing of the process sequence of other embodiment. Explanatory drawing of the process sequence of other embodiment. Explanatory drawing of the process sequence of other embodiment. Explanatory drawing of the process sequence of other embodiment.

  DESCRIPTION OF EMBODIMENTS Hereinafter, embodiments embodying the present invention will be described with reference to FIGS. In this embodiment, a remote access control method and a remote access control used when a user who is an employee of a company uses a client terminal installed at home or the like to connect to a client terminal installed at a company office or the like. As a system. Here, as shown in FIG. 1, an office PC terminal 30 (second client terminal) installed in the office F using a home PC terminal 10 (first client terminal) installed in each user's home H. Assume that remote access is performed. Here, the home PC terminal 10 is connected to the data center C via the Internet (network).

  In the data center C, a router 40, an encryption device 41, and a server group 42 are provided. These are existing facilities prepared for performing business using the office PC terminal 30. In this embodiment, the home PC terminal 10 is connected to the office PC terminal 30 via the router 40 and the encryption device 41 using such existing equipment.

When the router 40 acquires an access request via the Internet, the router 40 executes processing for transferring the access request to the encryption device 41.
The encryption device 41 executes a process for realizing a VPN (Virtual Private Network) for communication with the home PC terminal 10. In the present embodiment, a known SSL (Secure Sockets Layer) VPN is realized. In this case, the authenticity of the remote access control device 20 is confirmed by the electronic certificate stored in each remote access control device 20.

  The encryption device 41 is connected to a local area network (LAN) in which security is ensured, and is connected to the server group 42 and the office PC terminal 30 of the office F via this LAN.

When connecting the home PC terminal 10 to the office PC terminal 30, the remote access control device 20 is used.
The remote access control device 20 executes processing for realizing remote access in a state where security is ensured in the PC terminal. In the present embodiment, an auxiliary storage device (USB key device) that reads and writes data using Universal Serial Bus (USB) is used as the remote access control device 20. As shown in FIG. 2, the remote access control device 20 includes a connector unit 21, a data storage unit 22, a fingerprint sensor 23, and the like. The connector unit 21 is connected to an environment check unit 212, an installation unit 213, a personal authentication unit 214, and a thin client control unit 215.

The fingerprint sensor 23 functions as a biometric information reading unit, and executes a process of reading biometric information (here, fingerprint information) in order to authenticate the user.
The data storage unit 22 stores various data for realizing remote access with security. Specifically, the data storage unit 22 stores data relating to a VPN processing program, a remote control program, personal authentication information, an electronic certificate, connection destination information, allowable failure counts, and a usage allowable range table.

The VPN processing program is a program for building a VPN, and the remote control program is a program for realizing remote access.
The personal authentication information is personal authentication information for authenticating the user. In this embodiment, biometric information and a password of a user who is permitted remote access are stored as personal authentication information.

The electronic certificate is data for performing encryption in the VPN.
The connection destination information is information (address) for specifying the location of the office PC terminal 30 to which the home PC terminal 10 to which the remote access control device 20 is attached is connected.

The allowable number of failures is the number of times that authentication failure is permitted.
In the use allowable range table, identifier data for specifying applications and event processing that are allowed to be used during remote access is recorded in accordance with the security policy.

The connector unit 21 is configured by an interface (here, a USB connector) to be attached to the PC terminal.
The environment check unit 212 executes processing for confirming the state of the usage environment of the PC terminal to which the remote access control device 20 is attached. Then, it is determined whether or not the PC terminal has a function for performing remote access and a function for ensuring security. When it is determined that the PC terminal does not have a necessary function, the environment check unit 212 takes measures according to the state of the PC terminal.

The installation unit 213 executes a process for installing a program necessary for realizing VPN and a program necessary for remote access on the PC terminal of the installation destination. In the present embodiment, when the environment check unit 212 detects a function that is deficient in the home PC terminal 10, the installation unit 213 loads the VPN processing program stored in the data storage unit 22 or the remote control program at home. Provided to the PC terminal 10.

The personal authentication means 214 executes processing for authenticating a user who performs remote access. This personal authentication means 214 acquires the user's biometric information (here, fingerprint information) from the fingerprint sensor 23. Also, the personal authentication means 214 acquires a password input via the input unit of the home PC terminal 10. Then, the personal authentication unit 214 extracts the personal authentication information from the data storage unit 22 and compares it with the personal identification information (fingerprint information or password) input by the user.
Further, the personal authentication means 214 counts and temporarily stores the number of times of personal authentication failure. Then, when the personal authentication is completed, the temporarily stored number of failures is reset.

  The thin client control means 215 executes processing for restricting application and event processing of the PC terminal at the mounting destination. In the present embodiment, the thin client control unit 215 monitors an operation request generated in the PC terminal that is the attachment destination. When the target of the operation request is registered in the use allowable range table, execution of the application and event processing is permitted. On the other hand, when the target of the operation request is not registered in the use allowable range table, execution of the application and event processing are rejected. As a result, it is possible to limit event processing for downloading data on the PC terminal at the mounting destination, writing data to another storage medium, storing a hard copy of the screen image (print screen function), and the like.

  Home PC terminal 10 and office PC terminal 30 are computer terminals used by users. Home PC terminal 10 and office PC terminal 30 have a function of transmitting data via a network, a function of displaying received data, and the like. For this reason, the home PC terminal 10 and the office PC terminal 30 include a control unit (11, 31) including a CPU, a RAM, a ROM, an input unit such as a keyboard and a mouse, an output unit such as a display, and a communication unit (12, 32) and the like.

  The control unit 11 of the home PC terminal 10 is provided with control means (CPU, RAM, ROM, etc.), and will be described later (processing such as activation of each function of the remote access control device, VPN connection stage, remote access control stage, etc.) Etc.). By executing the remote access control program for that purpose, the control unit 11 functions as a boot unit 110, a remote control manager 111, and a VPN processing unit 112 as shown in FIG.

  The boot unit 110 executes processing for starting various units of the remote access control device 20. When the boot unit 110 detects that the remote access control device 20 is attached to the USB port of the home PC terminal 10, the boot unit 110 supplies power to the remote access control device 20. The boot unit 110 is realized by an OS stored in the home PC terminal 10 or a BIOS function mounted on the RAM.

  The remote control manager 111 executes remote access processing for the office PC terminal 30 via the Internet, the router 40, and the encryption device 41. Specifically, the screen image of the office PC terminal 30 (agent) that is the object of remote control is acquired and displayed on the output unit of the home PC terminal 10. Furthermore, the operation event input at the home PC terminal 10 is transmitted to the office PC terminal 30 to execute the operation process.

The VPN processing means 112 executes a process for constructing a VPN for communication with the office PC terminal 30. In this case, an encryption technique using an electronic certificate stored in the remote access control device 20 is used. The VPN processing unit 112 transmits a VPN connection request for starting communication using the VPN to the data center C via the communication unit 12. When response data that permits communication using VPN is received from the data center C, communication using VPN becomes possible.

The office PC terminal 30 includes a communication unit 32 and a control unit 31. The control unit 31 includes a remote control agent 312.
The remote control agent 312 executes processing for accepting remote access from the home PC terminal 10 via the Internet, the router 40, and the encryption device 41. The remote control agent 312 provides a screen image of the office PC terminal 30 itself to the home PC terminal 10 which is a controller, and executes an operation instructed from the home PC terminal 10 on the screen.

Next, remote access control in this embodiment will be described with reference to FIG.
In the present embodiment, the remote access control device 20 is provided in advance to a user who may work at home. The remote access control device 20 stores the user's biometric information and password in the data storage unit 22. Further, the data storage unit 22 stores the address of the office PC terminal 30 used by the user in the office F.

  When this user performs remote access, the user contacts the office F and activates the office PC terminal 30. Further, the home PC terminal 10 installed at home is activated, and the remote access control device 20 is attached to the USB port. In this case, power is supplied to the remote access control device via the connector unit 21.

  Then, the remote access control device 20 executes an environment check process (step S1-1). Specifically, when the connector unit 21 of the remote access control device 20 is attached to the PC terminal, the environment check unit 212 of the remote access control device 20 is activated in the control unit 11 of the home PC terminal 10. Then, the environment check unit 212 obtains an installation program list for programs stored in the home PC terminal 10.

  Next, the environment check unit 212 executes a determination process as to whether or not the VPN processing program is stored in the home PC terminal 10 (step S1-2). Specifically, the environment check unit 212 searches for a VPN processing program in the list of installed programs acquired from the home PC terminal 10.

  When the home PC terminal 10 cannot detect the VPN processing program (in the case of “NO” in step S1-2), the remote access control device 20 executes the installation process of the VPN processing program (step S1-3). . Specifically, the environment check unit 212 instructs activation of the installation unit 213 of the remote access control device 20 and installation of the VPN processing program. In this case, the installation unit 213 of the remote access control device 20 is activated in the control unit 11 of the home PC terminal 10. Then, the installation unit 213 installs the VPN processing program recorded in the data storage unit 22 in the home PC terminal 10 that is the attachment destination.

  Next, the environment check unit 212 executes a determination process as to whether or not the remote control program is stored in the home PC terminal 10 (step S1-4). Specifically, the environment check unit 212 searches for a remote control program in the list of installed programs acquired from the home PC terminal 10.

  When the home PC terminal 10 cannot detect the remote control program (in the case of “NO” in step S1-4), the remote access control device 20 executes the installation process of the remote control program (step S1-5). . Specifically, the environment check unit 212 instructs activation of the installation unit 213 of the remote access control device 20 and installation of a remote control program. In this case, the installation unit 213 activated in the control unit 11 of the home PC terminal 10 installs the remote control program recorded in the data storage unit 22 in the home PC terminal 10 as the mounting destination.

  Next, processing for acquiring user confirmation information for personal authentication is executed. In the present embodiment, either password authentication or fingerprint authentication can be selected. Specifically, the personal authentication means 214 of the remote access control device 20 is activated in the control unit 11 of the home PC terminal 10. Then, the personal authentication means 214 outputs an authentication screen on the display of the home PC terminal 10. This authentication screen has a password input field. On the authentication screen, a message for instructing an operation of either “reading a fingerprint with the fingerprint sensor of the remote access control device” or “inputting a password into the password input field” is displayed.

  Here, when the password input (user confirmation information) in the password input field is detected by the input unit of the home PC terminal 10, the personal authentication unit 214 executes password authentication processing (step S1-6). Specifically, the personal authentication unit 214 extracts the password stored in the data storage unit 22 and compares it with the password input in the password input field.

  On the other hand, when fingerprint information (user confirmation information) is acquired by the fingerprint sensor 23 of the remote access control device 20, the personal authentication means 214 executes fingerprint authentication processing (step S1-7). Specifically, the personal authentication unit 214 extracts the fingerprint information stored in the data storage unit 22 and compares it with the fingerprint information acquired from the fingerprint sensor 23.

  Next, the personal authentication unit 214 executes a determination process as to whether or not the acquired user confirmation information matches the personal authentication information recorded in the data storage unit 22 (step S1-8).

  If the user confirmation information does not match the user authentication information and it cannot be determined that the user is the user (in the case of “NO” in step S1-8), the user authentication unit 214 executes the process of adding the number of failures. (Step S1-9). Specifically, the personal authentication unit 214 adds “1” to the number of failed personal authentications.

  Then, the remote access control device 20 executes a determination process as to whether or not the number of failures exceeds the set number (step S1-10). Specifically, the personal authentication unit 214 compares the set number of times recorded in the data storage unit 22 with the temporarily stored number of failures.

  When the number of failures exceeds the set number (in the case of “YES” in step S1-10), the remote access control device 20 executes a lock process (step S1-11). Specifically, the personal authentication means 214 outputs a message “The user cannot be authenticated” to the display of the home PC terminal 10. Then, the personal authentication unit 214 stops the function of the remote access control device 20.

On the other hand, if the number of failures does not exceed the set number of times (in the case of “NO” in step S1-10), the personal authentication means 214 starts over from the authentication processing (steps S1-6, 7).
Further, when it is determined that the user confirmation information and the personal authentication information match each other (if “YES” in step S1-8), the remote access control device 20 executes the thin client process. (Step S1-12). Specifically, the personal authentication unit 214 instructs to start the thin client control unit 215 of the remote access control device 20. In this case, the thin client control means 215 of the remote access control device 20 is activated in the control unit 11 of the home PC terminal 10. Then, the thin client control unit 215 constructs a virtual desktop environment using the security kernel in the home PC terminal 10.

  Next, the remote access control device 20 executes a remote manager activation process (step S1-13). Specifically, the thin client control unit 215 activates the remote control manager 111 in the control unit 11 of the home PC terminal 10. By using this remote control manager 111, communication is performed with the remote control agent 312 of the office PC terminal 30. In this case, the control unit 11 of the home PC terminal 10 executes the VPN processing program and activates the VPN processing means 112. In this case, the VPN processing means 112 constructs a VPN with the encryption device 41 by using an electronic certificate stored in the data storage unit 22 of the remote access control device 20.

  Next, the control unit 11 of the home PC terminal 10 executes an operation process (step S1-14). Specifically, the remote control manager 111 of the home PC terminal 10 acquires the screen image of the office PC terminal 30 from the remote control agent 312 of the office PC terminal 30. Then, the remote control manager 111 transmits the operation contents at the home PC terminal 10 to the office PC terminal 30 via the data center C. The remote control agent 312 of the office PC terminal 30 implements remote access by executing processing according to the operation content. In this case, by using the home PC terminal 10, it is possible to access the server group 42 via the office PC terminal 30. In such an operation process, the thin client control unit 215 monitors an operation request input to the home PC terminal 10 and permits only execution of an application registered in the use allowable range table.

As described above, according to the present embodiment, the following effects can be obtained.
(1) In the above embodiment, a user who needs to operate a PC terminal in the office using a PC terminal outside the office uses the remote access control device 20. Since the remote access control device 20 is composed of an auxiliary storage device (USB key device) that reads and writes data, it can easily perform remote access.

  (2) In the above embodiment, the data storage unit 22 of the remote access control device 20 stores data relating to the personal authentication information. Then, the personal authentication unit 214 executes processing for authenticating a user who performs remote access using the personal authentication information. Thereby, unauthorized access due to impersonation can be suppressed.

  (3) In the above embodiment, the control unit 11 of the home PC terminal 10 executes the VPN processing program and activates the VPN processing means 112. In this case, the VPN processing means 112 constructs a VPN with the encryption device 41 by using an electronic certificate stored in the data storage unit 22 of the remote access control device 20. As a result, an environment with enhanced security can be realized using the electronic certificate stored in the remote access control device 20, and remote access can be performed in this environment.

(4) In the above-described embodiment, the thin client control unit 215 executes processing for restricting the application of the PC terminal as the mounting destination. This restricts operations such as downloading data from a normally used PC terminal, writing data to another storage medium, and storing a hard copy of a screen image in a PC terminal that is temporarily used. Can do. Therefore, even when the PC terminal outside the office is damaged such as theft, it is possible to reduce the risk of unauthorized access to data used in the office, copying or falsification of data.

  (5) In the above embodiment, the environment check unit of the remote access control device 20 executes the environment check process (step S1-1). When the home PC terminal 10 cannot detect a necessary program (in the case of “NO” in steps S1-2 and S1-4), the remote access control device 20 executes installation processing of various programs ( Steps S1-3, S1-5). Thereby, even in a situation where a PC terminal that is not supposed to be used must be used, remote access can be realized in a VPN environment with enhanced connection authentication. And, it is not limited to the whereabouts, and it is possible to carry out the business while realizing the construction of a dedicated connection environment and improving the convenience of the user.

In addition, you may change the said embodiment into the following aspects.
In the above embodiment, the USB key device is used as the remote access control device 20, but the present invention is not limited to this. It is also possible to use an information recording medium such as an optical disk.

  In the above embodiment, it is assumed that the PC terminal installed at home as the first client terminal and the PC terminal installed in the office as the second client terminal are used, but the present invention is not limited to these.

  In the above embodiment, the home PC terminal 10 is connected to the office PC terminal 30 via the data center C, but the network configuration is not limited to this. For example, the home PC terminal 10 may be directly connected to the office PC terminal 30 via a network. In this case, VPN processing means is provided in the office PC terminal 30.

  In the above embodiment, the personal authentication unit 214 acquires user confirmation information for personal authentication. Here, when the password input (user confirmation information) in the password input field is detected by the input unit of the home PC terminal 10, the personal authentication unit 214 executes password authentication processing (step S1-6). On the other hand, when fingerprint information (user confirmation information) is acquired from the fingerprint sensor 23 of the remote access control device 20, the personal authentication means 214 executes fingerprint authentication processing (step S1-7). Here, the authentication method may be limited based on the personal authentication information stored in the data storage unit 22. Specifically, as shown in FIG. 4, when performing the personal authentication process, the personal authentication unit 214 executes a determination process as to whether fingerprint information is registered in the remote access control device 20 (step S2-). 1). If no fingerprint information is registered in the data storage unit 22 and only a password is recorded (“NO” in step S2-1), password authentication processing is executed (step S1-6). ). On the other hand, when fingerprint information is registered (in the case of “YES” in step S2-1), the personal authentication means 214 executes fingerprint authentication processing (step S1-7). Thereby, when fingerprint information is registered, impersonation by a leaked password can be suppressed by allowing only biometric authentication.

In the above-described embodiment, when it is determined that the user confirmation information and the personal authentication information match each other (if “YES” in step S1-8), the remote access control device 20 becomes a thin client. Processing is executed (step S1-12). In addition to this, a process of shortening the screen saver activation time in the office PC terminal 30 may be executed. Specifically, as shown in FIG. 5, the thin client control unit 215 transmits an instruction to shorten the screen saver activation time to the office PC terminal 30 (step S3-1). In this case, the remote control agent 312 of the office PC terminal 30 shortens the screen saver activation time set in the office PC terminal 30. Thereby, even when browsing the screen on the home PC terminal 10 installed outside the office, it is possible to suppress snooping and the like.

  In the above-described embodiment, when it is determined that the user confirmation information and the personal authentication information match each other (if “YES” in step S1-8), the remote access control device 20 becomes a thin client. Processing is executed (step S1-12). Here, security may be strengthened by the authentication method of the person. Specifically, as shown in FIG. 6, the thin client control unit 215 executes an access restriction strengthening process according to the authentication method (step S4-1). In this case, in the allowable use range table, the types of applications and event processing that are allowed to be used during remote access are registered in correspondence with the authentication method. In other words, in the case of password authentication, since the password may be leaked, the types of applications that can be used and event processing are limited. On the other hand, in the case of authentication using biometric information, since high security can be expected, the types of applications that can be used and the range of event processing are made wider than in the case of password authentication. Thereby, the convenience of the user can be achieved while considering security.

  Further, depending on the number of failed personal authentications, the type of application permitted for use during remote access and the range of event processing may be changed. Specifically, in the usage allowable range table, the types of applications and event processing that are allowed to be used are registered in correspondence with the number of failures. In this case, when the number of failures is large, available applications and event processing are limited. Thereby, the allowable range of the operation request can be limited according to the authentication status.

  In the above embodiment, the remote access control device 20 is provided in advance to a user who may work at home. Alternatively, when the user needs to work at home, the remote access control device 20 may be provided to the user. In this case, biometric information, a password, and the address of the office PC terminal 30 are registered in advance in the user management database for each user. When the user is specified, the user's biometric information and password registered in the user management database and the address of the user's office PC terminal 30 are recorded in the data storage unit 22 of the remote access control device 20. Then, the remote access control device 20 is delivered to the user's whereabouts. As a result, a remote access environment can be realized while sharing a small number of remote access control devices.

  In the above-described embodiment, the remote access control device 20 that records biometric information and the address of the office PC terminal 30 is provided in advance to a user who may work at home. Instead, biometric information may be registered in the remote access control device 20 afterwards. In this case, the remote access control device 20 stores personal authentication information registration means for executing processing for acquiring various information necessary for remote access. Furthermore, a fingerprint management server accessible via the Internet is provided. In the fingerprint management server, biometric information (here, fingerprint information) and the address of the user's office PC terminal are registered in association with the user identifier of each user.

  The address of the fingerprint management server is stored in the data storage unit 22 of the remote access control device 20. Then, remote access pre-processing shown in FIG. 7 is executed.

First, when performing remote access, the remote access control device 20 is attached to the home PC terminal 10. In this case, the home PC terminal 10 to which the remote access control device 20 is attached executes password authentication processing (step S5-1). Specifically, when the connector unit 21 of the remote access control device 20 is attached to the PC terminal, the personal authentication information registration unit of the remote access control device 20 is activated in the control unit 11 of the home PC terminal 10. This personal authentication information registering means outputs a login screen provided with a user identifier and password input fields on the display of the home PC terminal 10. The user inputs his / her user identifier and a preset password on the login screen.

  When the password is input, the personal authentication information registration unit compares the password with the password recorded in the data storage unit 22. If the passwords do not match, use of the remote access control device 20 is rejected.

  On the other hand, if the passwords match, the personal authentication information registration means executes a biometric information acquisition process (step S5-2). Specifically, the personal authentication information registration unit outputs a message instructing reading of the fingerprint on the display of the home PC terminal 10. Then, the personal authentication information registration unit acquires fingerprint information from the fingerprint sensor 23 of the remote access control device 20.

  Next, the personal authentication information registration unit executes an access process to the fingerprint management server (step S5-3). Specifically, the personal authentication information registration unit accesses the fingerprint management server using the address recorded in the data storage unit 22. Then, the personal authentication information registration means transmits the user identifier input on the login screen and the fingerprint information read by the fingerprint sensor 23.

  Next, the fingerprint management server executes fingerprint collation processing (step S5-4). Specifically, the fingerprint management server uses the user identifier and fingerprint information acquired from the home PC terminal 10 to collate with registered fingerprint information.

  Next, the fingerprint management server executes a determination process as to whether or not the fingerprint information matches (step S5-5). If the fingerprint information acquired from the home PC terminal 10 matches the registered fingerprint information (in the case of “YES” in step S5-5), the fingerprint management server executes a fingerprint registration process (step S5-5). S5-6). Specifically, the fingerprint management server transmits a fingerprint registration instruction to the home PC terminal 10. The personal authentication information registration means that has received the fingerprint registration instruction records the fingerprint information read by the fingerprint sensor 23 in the data storage unit 22 of the remote access control device 20.

  On the other hand, when the fingerprint information acquired from the home PC terminal 10 does not match the registered fingerprint information (in the case of “NO” in step S5-5), the fingerprint management server executes a use refusal process. (Step S5-7). Specifically, the fingerprint management server transmits a use refusal notification to the home PC terminal 10. In this case, the personal authentication information registration unit ends the use processing of the remote access control device 20.

  Thereby, biometric information can be registered in the remote access control device 20 afterwards. Accordingly, even when fingerprint information is not registered in advance in the remote access control device 20, remote access can be efficiently performed using the fingerprint information registered afterwards.

In the above embodiment, authentication is performed using either biometric information or a password stored in the remote access control device 20. In addition to this, the remote access control device 2
It is also possible to store an authentication program for starting the personal authentication means 214 for executing processing for authenticating a user using a one-time password. In this case, the remote access control device 20 stores an identification code for identifying each device. The office administrator's PC terminal stores a one-time password program for generating a one-time password by introducing a challenge code and an identification code into a predetermined logic.

  Then, the user who wants to use the home PC terminal 10 notifies the office manager of the identification code stored in the remote access control device 20. In this case, the administrator inputs the identification code stored in the remote access control device 20 of the user who wishes to use and an arbitrary challenge code into the one-time password program, and acquires the one-time password. Then, the administrator tells the user who wants to use the one-time password and the challenge code.

  When the remote access control device 20 is attached to the home PC terminal 10, the authentication program is activated. In this case, the personal authentication unit 214 displays an authentication screen having an input field for a one-time password and a challenge code on the output unit of the home PC terminal 10. When the one-time password and the challenge code are input on this authentication screen, the personal authentication means 214 introduces the identification code stored in the remote access control device 20 and the input challenge code into a predetermined logic, and the one-time password Generate a password. Then, the personal authentication means 214 compares this one-time password with the one-time password input on the authentication screen, and if it matches, remote access is permitted. As a result, even in a situation where the password is forgotten and biometric authentication cannot be performed, remote access can be performed safely.

  DESCRIPTION OF SYMBOLS 10 ... Home PC terminal, 30 ... Office PC terminal, 11, 31 ... Control part, 12, 32 ... Communication part, 110 ... Boot means, 111 ... Remote control manager, 112 ... VPN processing means, 312 ... Remote control agent, 20 ... Remote access control device, 21 ... Connector part, 22 ... Data storage part, 23 ... Fingerprint sensor, 212 ... Environment check means, 213 ... Installation means, 214 ... Person authentication means, 215 ... Thin client control means, C ... Data center , 40 ... router, 41 ... encryption device, 42 ... server group

Claims (7)

A first client terminal installed outside the office;
A second client terminal connected to the first client terminal via a network and installed in an office;
A method of controlling remote access using a remote access control device that holds personal authentication information and is attached to the first client terminal,
The remote access control device mounted on the first client terminal obtains user confirmation information, and authenticates the user by comparing the user authentication information with the user authentication information;
If the user can be authenticated, an instruction to shorten the screen saver activation time is given to the second client terminal, and a thin client stage for limiting the function of the first client terminal;
Connecting the first client terminal to the second client terminal via a network;
The second client terminal having a shortened screen saver activation time executes a step of allowing remote access in accordance with a connection from the first client terminal made into a thin client . The remote access control device holds an electronic certificate;
The remote access control method according to claim 1, wherein the first client terminal is connected to the second client terminal using the electronic certificate. The remote access control device includes biometric information reading means for holding biometric information as personal authentication information and reading user confirmation information,
The remote access control method according to claim 1 or 2, wherein the personal authentication is performed using the biometric information read by the biometric information reading unit as user confirmation information. The remote access control device holds a preset password,
The remote access control method according to any one of claims 1 to 3, wherein a password input in the first client terminal is acquired, and personal authentication is performed using the password.   The remote access control device, when performing personal authentication using a password, reinforces restrictions on functions that can be used during remote access than when performing personal authentication using biometric information. Item 5. The remote access control method according to Item 4. The remote access control device acquires a security status of the first client terminal;
Determining whether the security status satisfies the use conditions;
6. The remote access control method according to claim 1, wherein personal authentication is performed when the use condition is satisfied. A first client terminal installed outside the office;
A second client terminal connected to the first client terminal via a network and installed in an office;
A system for holding remote authentication information and controlling remote access using a remote access control device attached to the first client terminal,
The remote access control device attached to the first client terminal obtains user confirmation information, and performs user authentication by comparing the user authentication information with the user authentication information;
When the user can be authenticated, the second client terminal is instructed to shorten the screen saver activation time, and a thin client means for limiting the function of the first client terminal is provided. ,
The first client terminal comprises means for connecting to the second client terminal via a network;
2. The remote access control system according to claim 1, wherein the second client terminal whose screen saver activation time is shortened includes means for allowing remote access in response to a connection from the first client terminal converted into a thin client .

Images