JP7172324B2 - Repeater, system and method - Google Patents

Description

The present invention relates to relay devices, systems, and methods.

Conventionally, cloud storage services can upload and manage files as long as there is an environment that connects to the Internet. For this reason, individual users are increasingly using cloud storage services.

There is a document disclosing a technique of encrypting a file on a terminal and obtaining a key to decrypt the file uploaded to a cloud storage service (see Patent Document 1).

However, if business files are managed using an external service such as a cloud storage service, if there is an environment where the terminal can be connected to the Internet, files can be transferred between the employee's own terminal and an external network such as outside the company. can be easily delivered. Since most of the business files are important files such as confidential files, it is a problem that there is no mechanism for managing the use of external services by employees in each business entity such as a company or facility.

SUMMARY OF THE INVENTION It is an object of the present invention to provide a relay device, system, and method capable of managing the use of external services in each business entity.

In order to solve the above-described problems, a relay device according to an embodiment of the invention includes a terminal authentication unit that authenticates a terminal, setting information that sets authentication information for an external service corresponding to the terminal, and the external service between the service authentication unit that authenticates with the external service based on the authentication information of and with the external service when the authentication with the external service is successful, uploading the file of the terminal that has been successfully authenticated with the external service Alternatively, a relay processing unit that downloads, a record holding unit that records and holds the relayed content of the file relayed between the relay processing unit and the external service, and an output unit that outputs the relayed content of the record holding unit; wherein the record holding unit also records and holds information that allows the content of the uploaded file to be browsed, and the output unit stores the content of the uploaded file in the record holding unit It is characterized by further outputting browsable information .

ADVANTAGE OF THE INVENTION According to this invention, there exists an effect that it becomes possible to manage use of an external service in each business entity.

FIG. 1 is a diagram showing an example of a configuration of an entire network including an in-house network according to an embodiment and an external network such as the Internet that provides cloud storage services. FIG. 2 is a diagram illustrating an example of a hardware configuration of a relay device; FIG. 3 is a diagram showing an example of the configuration of functional blocks of each device. FIG. 4 is a diagram showing an example of the data configuration of an authentication information table. FIG. 5 is a diagram showing an example of log information. FIG. 6 is a diagram showing an example of a sequence when an employee terminal uploads a file to cloud storage via a relay device. FIG. 7 is a diagram showing an example of a sequence when the administrator terminal browses the relay contents of the relay device. FIG. 8 is a diagram illustrating an example of a configuration of functional blocks according to Modification 2. As illustrated in FIG. FIG. 9 is a diagram showing an example of a configuration of an entire network including an in-house network according to Modification 3 and an external network such as the Internet that provides a cloud storage service. FIG. 10 is a diagram illustrating an example of a configuration of functional blocks according to Modification 3. As illustrated in FIG. FIG. 11 is a diagram showing another example of the configuration of functional blocks according to Modification 3. As shown in FIG.

BEST MODE FOR CARRYING OUT THE INVENTION Hereinafter, embodiments of relay devices, systems, and methods according to the present invention will be described in detail with reference to the accompanying drawings. As an example, we will show an example of application to an internal network of a "company", but it can also be applied to other institutions such as "public facilities", "educational facilities", "research facilities", "medical facilities", and networks of other business entities. Applicable. A cloud storage service is shown as an example of an external service, but any service that exchanges files can be applied.

(Embodiment)
In this embodiment, a relay device that uses a cloud storage service is provided in the company network. A terminal of an employee or the like is allowed to use the cloud storage service via the relay device, and relay contents of files uploaded or downloaded by the employee or the like between the terminal and the cloud storage are recorded by the relay device. Then, the relay device accepts access from an administrator (for example, a system administrator or a security officer who has administrator authority) so that the relay contents recorded in the relay device can be viewed on the administrator terminal. do. By doing so, the administrator can grasp the usage status of the cloud storage service by employees and the like from the relay contents of the relay device. Therefore, it becomes possible to manage the use of cloud storage services in business entities such as companies.

FIG. 1 is a diagram showing an example of a configuration of an entire network including an in-house network according to an embodiment and an external network such as the Internet that provides cloud storage services. The in-house network 1 shown in FIG. 1 includes a relay device 10, an employee terminal 20, an administrator terminal 30, and a firewall . The firewall 40 is a gateway, router, or the like that connects the internal network 1 and the external network 2 and has a firewall function. The relay device 10 is provided in the company network 1, and uploads and downloads files of each employee terminal 20 to and from the cloud storage services A1 and A2.

The employee terminal 20 and the manager terminal 30 are made connectable to the company network 1 . The employee terminal 20 is an employee's PC (Personal Computer) or smart device (smartphone, tablet type device, etc.), and the administrator terminal 30 is an administrator's PC or smart device. Both the employee terminal 20 and the manager terminal 30 have basic functions such as an OS (Operating System) and a web browser. In the following explanation, it is assumed that the employee terminal 20 and the administrator terminal 30 are PCs (desktop PCs, notebook PCs, etc.), but even in the case of smart devices, the wireless LAN interface equipped in the smart device can be used to It can be implemented in the same way by connecting to the company network 1 from the access point of the wireless LAN built in .

The employee terminal 20 accesses the relay device 10 of the company network 1 to upload and download files. Communication with the relay device 10 is performed by the basic function unit via protocols such as HTTP (Hypertext Transfer Protocol) and NFS (Network File System)/SMB (Server Message Block).

The administrator terminal 30 accesses the relay device 10 of the in-house network 1 and grasps the usage status of the cloud storage services A1 and A2 by each employee terminal 20 from the log information of the relay device 10 . Communication with the relay device 10 is performed by the basic function unit via protocols such as HTTP (Hypertext Transfer Protocol) and NFS (Network File System)/SMB (Server Message Block).

In the external network 2 shown in FIG. 1, X company's cloud storage service A1 and Y company's cloud storage service A2 are shown. As indicated by solid arrows in FIG. 1, each employee terminal 20 accesses the relay device 10 when using the cloud storage services A1 and A2. Connection to the servers that provide the respective cloud storage services A1 and A2 on the external network 2 and uploading and downloading of files to and from the respective cloud storage services A1 and A2 are performed by the relay device 1 for each of the cloud storage services A1 and A2. Use HTTPS or the like according to the specifications. That is, each employee terminal 20 uses the cloud storage services A1 and A2 of each company via the relay device 10 . Note that the two companies' cloud storage services A1 and A2 shown in FIG. 1 are examples, and the number of cloud storage services that can be used by the relay device 10 is not limited. The number of cloud storage services may be set as appropriate.

The administrator terminal 30 accesses the relay device 10 as indicated by the dashed arrow in FIG. The relay device 10 records the content relayed between each employee terminal 20 and the cloud storage. Therefore, the administrator terminal 30 can grasp the usage status of the cloud storage service by the employee by acquiring the relay contents of the relay device 10 . Here, "acquisition" is a concept including browsing.

(Hardware configuration)
FIG. 2 is a diagram showing an example of the hardware configuration of the relay device 10. As shown in FIG. The relay device 10 shown in FIG. 2 has a CPU (Central Processing Unit) 11, a ROM (Read Only Memory) 12, a RAM (Random Access Memory) 13, a HDD (Hard Disk Drive) 14, a network I/F 15, and the like. Other storage such as SSD (Solid State Drive) may be applied to the HDD 14 . Each part is electrically connected via a bus line 16 such as an address bus and a data bus. In addition, various interfaces such as an input device such as a keyboard for giving input instructions to the CPU 11, a display device such as an LCD (Liquid Crystal Display) for displaying display information output by the CPU 11, a media drive, and the like may be provided.

The CPU 11 is a central processing unit that executes programs stored in the ROM 12 and the HDD 14 and controls the relay device 10 as a whole. The ROM 12 is a non-volatile memory that stores fixed programs. A RAM 13 is a volatile memory used as a work area for the CPU 11 . The HDD 14 stores an OS that provides basic functions, various application programs such as a web server, and data (table information, etc.). The HDD 14 is also used to store files uploaded to and downloaded from each employee terminal 20 . The network I/F 15 is a communication interface such as Ethernet (registered trademark) that connects to the company network 1 .

Note that each employee terminal 20, administrator terminal 30, firewall 40, etc. can also be configured by the hardware of the computer configuration shown in FIG. As for the employee terminal 20 and the manager terminal 30, an OS, a web browser, etc., which are basic functions, are installed in the HDD. An input device such as a keyboard and a display device such as an LCD are also provided. Since the description of the hardware configuration of the relay device 10 is repeated, illustration and description of the hardware configuration of each device are omitted.

(Configuration of functional blocks)
FIG. 3 is a diagram showing an example of the configuration of functional blocks of each device. The relay device 10 realizes various functions by executing the programs of the ROM 12 and the HDD 14 by the CPU 11 . The relay device 10 in FIG. 3 has a local authentication unit 101, an HTTP server 102, a cloud authentication unit 103, a relay unit 104, and a log operation unit 105 as main functions. The employee terminal 20 and the administrator terminal 30 have basic function units 201 and 301, respectively. FIG. 3 also shows cloud storage services A1 and A2 with which the relay device 10 communicates.

Each functional unit may be configured as a module, but it is sufficient if each functional unit is implemented as a whole including an OS. Here, the local authentication unit 101 corresponds to a "terminal authentication unit". The cloud authentication unit 103 corresponds to a "service authentication unit". The relay unit 104 and the HTTP server 102 (or an OS file sharing system may be used) correspond to the "relay processing unit". The HTTP server 102 (or an OS file sharing system) or the like corresponds to the “output unit”. The log operation unit 105 and log information (for example, a log file) correspond to the "record holding unit". The authentication information table T1 (see FIG. 4) corresponds to setting information.

The local authentication unit 101 has a function of authenticating a terminal (employee terminal 20 or administrator terminal 30) accessed within the company network 1. FIG. The local authentication unit 101 authenticates the terminal using the authentication information set in the authentication information table T1 (see FIG. 4).

The HTTP server 102 performs HTTP communication with a communication destination. When a terminal uses a web browser to make a request to the relay device 10, the HTTP server 102 accepts the request and performs processing according to the request. For example, use screens of the cloud storage services A1 and A2 are output to the employee terminal 20, and an upload or the like is accepted. Also, when there is an access from the administrator terminal 30, a log screen (browsing screen) is generated and output. The relay device 10 has set a shared folder on the company network 1 by a file sharing system. When a terminal uses a shared folder, the relay unit 104 accepts a request from the employee terminal 20 or the like using a protocol such as NFS/SMB without going through the HTTP server 102 . The administrator terminal 30 acquires and displays the log file output to the shared folder that can be accessed with administrator authority.

The cloud authentication unit 103 has a function of performing authentication with the cloud storage services A1 and A2. Based on the settings in the authentication information table T1 (see FIG. 4), the relay device 10 accesses the servers of the cloud storage services A1 and A2, and the cloud authentication unit 103 transmits authentication information to the cloud storage services A1 and A2 for authentication. .

The relay unit 104 has a function of relaying file upload and download between the cloud storage services A1 and A2. For example, it is assumed that files are transferred to and from the employee terminal 20 via a shared folder. In the case of uploading, after the employee terminal 20 is authenticated, the relay unit 104 stores the file to be uploaded to the cloud storage in the shared folder (the employee's shared folder), and then the cloud authentication unit 103 is notified of the cloud storage services A1 and A2. Instruct authentication. Then, when cloud authentication unit 103 succeeds in authentication, relay unit 104 transmits the files in the shared folder to cloud storage services A1 and A2. In the case of downloading, for example, when the employee terminal 20 accesses the shared folder of the relay device 10 (the employee's shared folder) and the authentication of the employee terminal 20 succeeds, the cloud authentication unit 103 performs cloud storage services A1 and A2. and authenticate. When the cloud authentication unit 103 succeeds in authentication, the relay unit 104 downloads the files of the employee terminal 20 from the cloud storage services A1 and A2, and places them in the shared folder (the employee's shared folder).

Uploaded files and downloaded files in the shared folder are held in the HDD 14 until delivery to the employee terminal 20 or cloud storage is completed. For example, the uploaded file is deleted from the HDD 14 when it is uploaded to the cloud storage. Further, the downloaded file is deleted from the HDD 14 when moved to the employee terminal 20. - 特許庁

Also, when the employee terminal 20 performs HTTP communication, the HTTP server 102 generates and displays a usage screen for the cloud storage services A1 and A2 on the employee terminal 20, and based on the request received on the usage screen, the employee Send and receive files to and from the terminal 20 . When receiving a file to be uploaded, the relay unit 104 performs authentication with the cloud storage services A1 and A2 and uploads the file to the cloud storage services A1 and A2. When the employee terminal 20 is authenticated successfully, the cloud authentication unit 103 performs authentication with the cloud storage services A1 and A2, downloads the file of the employee terminal 20 from the cloud storage services A1 and A2, and downloads the file from the employee terminal 20. Arrange it in the shared folder of the terminal 20 .

The log operation unit 105 has a function of recording information indicating relay contents of file upload or download between the employee terminal 20 and the cloud storage services A1 and A2. The log operation unit 105 records information indicating relay contents in a log file held by the HDD 14 (such as a log file placed in a shared folder that can be accessed with administrator authority).

(Structure of information table)
Various information tables are stored in the HDD 14 . Here, mainly, the authentication information table T1 in which the local authentication information and the cloud authentication information are associated with each other will be described. In addition, for example, a table for storing relay contents may be provided. In this embodiment, FIG. 5 shows an example in which relay contents are written and recorded in a log file. The content of the relay will be described later with reference to FIG.

FIG. 4 is a diagram showing an example of the data configuration of the authentication information table T1. The authentication information table T1 shown in FIG. 4 shows the data configuration of a table including local authentication information T10 and cloud authentication information T11. In the example shown in FIG. 4, the corresponding information of the local authentication information T10 and the cloud authentication information T11 are shown in the same row. The local authentication information T10 and the cloud authentication information T11 can be associated by user names. The local authentication information T10 and the cloud authentication information T11 may be associated with user names and provided in different tables. Although the user name is associated here, any identification information that uniquely identifies the user of the terminal may be used.

Authentication information for authenticating the user of the employee terminal 20 and authentication information for authenticating the administrator of the administrator terminal 30 are set in each item of the local authentication information T10. In FIG. 4, the authentication information is "user name" and "password". "Authority" is set with information indicating whether the user is a user or an administrator.

Each item of the cloud authentication information T11 includes information indicating access destinations of the cloud storage services A1 and A2 available to the user and authentication information used for authentication by the cloud storage services A1 and A2. In FIG. 4, the information indicating the access destination is set to "use service". The information indicating the access destination is associated with URLs (Uniform Resource Locators) and IP addresses of the servers of the cloud storage services A1 and A2.

(log)
FIG. 5 is a diagram showing an example of log information. The log information D1 shown in FIG. 5 has items of "time" d1, "user name" d2, "used service" d3, "file name" d4, and "operation details" d5 as items indicating relay contents. Every time the relay unit 104 relays a file, the log operation unit 105 acquires information corresponding to each item and adds one line of information to the log information D1.

(sequence of the whole system)
FIG. 6 is a diagram showing an example of a sequence when the employee terminal 20 uploads a file to the cloud storage via the relay device 10. As shown in FIG. As an example, a case where the employee terminal 20 communicates with the relay device 10 using the NFS/SMB protocol will be described.

First, the employee terminal 20 accesses the relay device 10 and logs in to the relay device 10 (step S1). For example, on the employee terminal 20 , the employee designates a shared folder in the relay device 10 from the folder tree of the company network displayed by Explorer, and displays the login screen of the relay device 10 on the employee terminal 20 . The employee inputs the login information (local user name and password) on the login screen on the employee terminal and transmits it to the relay device 10 . The login process in the employee terminal 20 may be automated by storing the login information in the employee terminal 20 in advance.

In the relay device 10, when the login information is transmitted from the employee terminal 20, the local authentication unit 101 authenticates the local authentication information T10 set in the authentication information table T1 based on the login information. When the user name and password match the settings of the local authentication information T10, the local authentication unit 101 determines that the authentication is successful (OK), and permits the employee terminal 20 to access the shared folder.

Subsequently, the employee terminal 20 uploads the file to the relay device 10 (step S2). For example, the user creates his/her own folder (it may be created in advance) in the shared folder displayed on the display screen of the employee terminal 20, and stores the file to be uploaded there. By this operation, the file is uploaded from the employee terminal 20 to the own folder of the relay device 10 .

In the relay device 10, when a file is uploaded to the shared folder, the relay unit 104 instructs the cloud authentication unit 103 to authenticate with the cloud storage services A1 and A2 (step S3), and the cloud authentication unit 103 authenticates the cloud storage service A1. , A2 is authenticated (step S4). At this time, the cloud authentication unit 103 acquires the setting of the cloud authentication information T11 of the authentication information table T1 from the user name authenticated by the local authentication unit 101, and includes the cloud storage service that the user can use, which is included in the setting. Access A1, A2.

In the setting example of the authentication information table T1 shown in FIG. 4, the number of cloud storage services A1 and A2 that can be used by each user is one, but there may be more than one. When the cloud storage services A1 and A2 request authentication information, the cloud authentication unit 103 transmits the authentication information included in the setting of the cloud authentication information T11 acquired from the authentication information table T1 to the cloud storage services A1 and A2. , to complete the authentication.

When the cloud storage services A1 and A2 notify the user that the authentication is OK, the relay unit 104 uploads the file of the user uploaded to the shared folder to the cloud storage services A1 and A2 (step S5).

When the upload is completed, the relay unit 104 instructs the log operation unit 105 to write out the relay contents (step S6), and notifies the employee terminal 20 of the completion of file upload (step S7). Based on the instruction from the relay unit 104, the log operation unit 105 reads the time and the like, and records the information indicating the relay contents of the relay unit 104 in the log information. Log information is placed in a shared folder that can be accessed with administrator privileges.

In addition, when the employee terminal 20 uses a Web browser, it is as follows. The employee inputs the URL or IP address of the relay device 10 into the address bar of the Web browser displayed on the employee terminal 20. - 特許庁The employee terminal 20 accesses the relay device 10 based on the information input to the address bar and displays the login screen transmitted from the relay device 10 . After that, the usage screen is displayed, and the operation is performed through the usage screen. On the relay device 10 side, the HTTP server 102 receives the request from the usage screen. As for the sequence of authentication and uploading on the side of the relay device 10, files are stored in a predetermined folder of the relay device 10 without using a shared folder. Other than this, it is substantially the same as that described above.

FIG. 7 is a diagram showing an example of a sequence when the administrator terminal 30 browses relay contents of the relay device 10. As shown in FIG. First, the administrator terminal 30 accesses the relay device 10 and logs in to the relay device 10 (step S11). For example, on the administrator terminal 30, the administrator designates a folder that can be accessed with administrator authority in the relay device 10 of the company network displayed by Explorer or the like, and logs in to the relay device 10 from the administrator terminal 30. display the screen. The administrator enters the login information (user name and password) on the login screen on the administrator terminal 30 and transmits it to the relay device 10 .

In the relay device 10, when the login information is transmitted from the administrator terminal 30, the local authentication unit 101 authenticates the local authentication information T10 set in the authentication information table T1 based on the login information. If the user name and password match the settings of the local authentication information T10, and if the administrator authority is associated with the local authentication information T10, the local authentication unit 101 determines that the authentication is successful (OK), and the administrator terminal 30 to access folders, such as viewing files.

Subsequently, when the administrator terminal 30 performs an operation to open the log file (step S12), the designated log information is acquired and the contents are displayed (step S13).

In addition, when the administrator terminal 30 uses a Web browser, it is as follows. The administrator enters the URL or IP address of the relay device 10 into the address bar of the web browser displayed on the administrator terminal 30 . The administrator terminal 30 accesses the relay device 10 based on the information input to the address bar and displays the login screen transmitted from the relay device 10 . After that, the usage screen is displayed, and the operation is performed through the usage screen. On the relay device 10 side, the HTTP server 102 receives the request from the usage screen. For example, when viewing log information is requested from the usage screen, the HTTP server 102 generates a log display screen (viewing screen) and outputs it to the administrator terminal 30 to display the log information.

The sequences of uploading files to the cloud storage services A1 and A2 and downloading files to the cloud storage services A1 and A2 by the relay device 10 shown in the present embodiment are examples. The timing of uploading and downloading by the relay device 10 may be set as appropriate. For example, the relay device 10 may periodically download files uploaded to the cloud storage services A1 and A2, or upload downloaded files. Also, an example in which the authentication is successful has been shown, but when the authentication fails, the relay device 10 may notify an authenticated terminal of an error indicating authentication failure. Further, if the relay device 10 fails authentication with the cloud storage service after uploading a file from the employee terminal 20 to the relay device 10, the file may be deleted from the HDD of the relay device 10 as appropriate.

In this embodiment, an example in which the employee terminal 20, the administrator terminal 30, etc. communicate with the relay device 10 via a protocol such as HTTP or NFS/SMB has been described, but the present invention is not limited to these. Only one of these may be applied, or other available means may be applied.

As described above, in the present embodiment, a relay device that uses a cloud storage service is provided in an in-house network, and a terminal of an employee or the like is made to use the cloud storage service via the relay device. Therefore, it is possible to manage the content of relayed files that are uploaded or downloaded between the terminal and the cloud storage by an employee or the like by viewing them from the relay device on the administrator terminal. Therefore, it is possible to manage the use of the cloud storage service in each entity such as a company.

In addition, it is possible to achieve both the convenience of being able to work efficiently using cloud storage services and the safety of being able to reduce security risks by allowing administrators to understand the use of cloud storage services by employees.

Conventionally, there was also the problem that IT administrators could not grasp the usage status of employees' cloud storage services due to reasons such as the inability to introduce high-performance web filtering equipment and insufficient IT literacy education for employees. In addition, the cost was high because software for "encrypting and uploading" and "downloading and decrypting" was required for all employee terminals. However, with the configuration shown as an example in this embodiment, it is possible to use any terminal equipped with a web browser and basic functions for handling shared folders, and special software must be installed on the terminal. you don't have to Therefore, even small and medium-sized businesses can introduce a system for managing the use of cloud storage services at a low cost.

(Modification 1)
In the embodiment, the relay device 10 holds the relay content written by the log operation unit 105 as the log information D<b>1 , and enables the administrator terminal 30 to view the relay content. However, the present invention is not limited to this, and the files themselves uploaded to the cloud storage services A1 and A2, or the files saved in a different format may be held by the relay device 10 and viewed from the administrator terminal 30. good. At least the content of the file to be browsed is allowed to be browsed. For example, it may be saved after being converted into an image file such as PDF. The file is stored in the same folder together with the log information D1, or is extracted from the database using the file name as a key and displayed. In addition to this, as long as browsing from the administrator terminal 30 is possible, it may be modified as appropriate.

For example, if the configuration is to extract from a database, the relay device 10 is provided with a file database. In the file database, files uploaded to the cloud storage services A1 and A2 or files whose contents are saved in a different format are stored in association with file names. Then, a file search screen is displayed on the administrator terminal 30, and the file name of the file that the administrator wants to display is input from the relay contents included in the log information D1 (see FIG. 5). The relay device 10 searches the file database using the file name accepted on the file search screen, and outputs the extracted file to the administrator terminal 30 .

As described above, in Modification 1, even information on the content of the file uploaded by the relay device 10 is retained. Uploading files from within the company is an operation with a particularly high risk of information leakage. If the content of the uploaded file is also retained, the administrator can view the uploaded file itself, which enables more robust management.

(Modification 2)
Also, in order to allow the relay device 10 to limit the file uploaded by the employee terminal 20, the relay device 10 may be modified so that the limitation information of the file whose upload is to be limited can be set. The restriction information is, for example, prohibited words.

(Structure of functional blocks of modification 2)
FIG. 8 is a diagram illustrating an example of a configuration of functional blocks according to Modification 2. As illustrated in FIG. The relay device 10 according to Modification 2 further includes a prohibited word registration unit 106 in addition to the relay device 10 according to the embodiment (see FIG. 3). The relay apparatus 10 in FIG. 8 shows functional units mainly related to the prohibited word registration unit 106, and other functions are omitted. The prohibited word registration unit 106 has a function of accepting registration of prohibited words from the administrator terminal 30 and registering them in a prohibited word table and a prohibited word file. For example, a prohibited word file in which prohibited words are set is received from the administrator terminal 30 and registered. Forbidden words are, for example, "XX trading company".

When there is a file to be uploaded, the relay unit 104 acquires the prohibited word from the prohibited word registration unit 106 and compares the file name of the file to be uploaded with the prohibited word. When the relay unit 104 obtains the result that the prohibited words are not included by the collation, the relay unit 104 relays the file upload between the cloud storage services A1 and A2 in the same procedure as the function shown in the embodiment. process.

On the other hand, if the result of the collation shows that prohibited words are included, the relay unit 104 sends the file to the employee terminal 20 without starting the file upload relay process between the cloud storage services A1 and A2. (an example of information indicating that uploading is restricted) is notified to the user. For example, if the file name of the file to be uploaded is "Quotation for ○○ trading company", it cannot be uploaded because it contains the prohibited word "○○ trading company".

Note that the relay unit 104 may collate not only the file name of the file to be uploaded, but also the text in the content of the file with the prohibited words.

As described above, in Modification 2, it is possible to check against the prohibited words registered by the administrator terminal 30 before uploading files to the cloud storage services A1 and A2. Uploading files from inside the company to the outside poses a particularly high security risk, and the risk of leakage of confidential information and personal information is particularly high. By registering prohibited words for such files, it is possible to prevent them from being uploaded.

(Modification 3)
As a modification 3, a modification of the configuration of the in-house network 1 shown in the embodiment is shown. The configuration according to Modification 3 is applicable to a network in which the employee terminal 20 can use the cloud storage services A1 and A2 without using the relay device 10 .

FIG. 9 is a diagram showing an example of a configuration of an entire network including an in-house network according to Modification 3 and an external network such as the Internet that provides cloud storage services A1 and A2. The in-house network 3 shown in FIG. 9 indicates a route through which the cloud storage services A1 and A2 can be used without going through the relay device 10, and the communication packet collection device 50 is provided on this route. Note that in FIG. 9, illustration of a network in which the employee terminal 20 uses the cloud storage services A1 and A2 via the relay device 10 is omitted.

When the employee terminal 20a uses the cloud storage services A1 and A2 from within the company, the employee terminal 20a designates the URL of the cloud storage services A1 and A2 instead of the relay device 10 using its own Web browser to perform HTTP communication with the cloud storage services A1 and A2. conduct. Then, when the employee terminal 20a is successfully authenticated with the cloud storage services A1 and A2, the employee terminal 20a uploads and downloads files with the cloud storage services A1 and A2 without going through the relay device 10.例文帳に追加

The communication packet collection device 50 is provided in the communication path of the company network 3 where the cloud storage services A1 and A2 can be directly used from inside the company like the employee terminal 20a, collects the communication packets of the employee terminal 20a, and copies them. is transferred to the relay device 10 .

(Structure 1 of functional blocks of modification 3)
FIG. 10 is a diagram illustrating an example of a configuration of functional blocks according to Modification 3. As illustrated in FIG. The relay device 10 shown in FIG. 10 further includes a transfer information receiving unit 107 in addition to the configuration of the relay device shown in the embodiment, modified example 1, and modified example 2. FIG. The relay device 10 in FIG. 10 shows main functions related to transfer information, and other detailed functions are omitted from the illustration.

The transfer information receiving unit 107 receives transfer information transferred by the transfer unit 501 of the communication packet collection device 50 . In the configuration shown in FIG. 10, a copy of the communication packet transferred from the transfer unit 501 is received as transfer information. The communication packet transferred to the transfer information receiving unit 107 is analyzed by the analysis unit 108 to see if it is a communication packet between the employee terminal 20a and the cloud storage services A1 and A2. Then, the log operation unit 105 writes the usage log of communication packets between the employee terminal 20a and the cloud storage services A1 and A2, which is found by the analysis by the analysis unit 108, into the log information.

Whether or not the communication packet uses the cloud storage services A1 and A2 from the employee terminal 20a can be detected as follows. For example, it can be detected from a DNS (Domain Name System) query of the host names owned by the cloud storage services A1 and A2. When service usage is detected, the time, service used, and source IP address are recorded as a usage log. It should be noted that although it is ideal to associate the user name managed by the authentication function, most information such as the user name is often encrypted in communication with the cloud storage services A1 and A2. For this reason, the source IP address, which is highly unlikely to be encrypted, is recorded. The employee terminal 20a may be narrowed down from the source IP address by collating with logs of other network management devices such as DHCP servers and routers.

The administrator terminal 30 acquires browsing information from the relay device 10 in the same manner as in the embodiment. That is, the administrator terminal 30 accesses the relay device 10, authenticates that it is an administrator, and acquires and displays a usage log when the authentication succeeds. As the usage log, a usage log recording the contents of relaying by the relay device 10 and a usage log obtained by analysis by the analysis unit 108 can be acquired.

(Configuration 2 of functional blocks of modification 3)
FIG. 11 is a diagram showing another example of the configuration of functional blocks according to Modification 3. As shown in FIG. FIG. 11 shows a configuration in which an analysis unit is provided on the communication packet collection device 50 side. It should be noted that FIG. 11 shows mainly related portions of the configuration shown in FIG. 10, and other portions are omitted from the drawing.

As shown in FIG. 11, the communication packet collection device 50 has an analysis section 502 . The analysis unit 502, like the analysis unit 108 (see FIG. 10) provided in the relay device 10, determines from the collected communication packets whether the packets are communication packets between the employee terminal 20a and the cloud storage services A1 and A2. To analyze. In the configuration shown in FIG. 11, since analysis is performed by the communication packet collection device 50, the usage log of the communication packets between the employee terminal 20a and the cloud storage services A1 and A2 among the collected communication packets is sent from the transfer unit 501. The information shown will be transferred.

In the relay device 10 , the transfer information receiving unit 107 receives the information indicating the usage log transferred as the transfer information from the transfer unit 501 . Then, the log operation unit 105 writes the usage log into the log information. Others are substantially the same as those described in the configuration of FIG. 10, and therefore descriptions thereof are omitted here.

The configuration shown in Modification 3 may be appropriately modified as follows. If all packets are acquired on the route to the Internet, the load will increase, so it may be modified so that packets are randomly extracted at a constant rate. Collected packets may also be filtered based on conditions such as protocol and IP address.

As described above, in the configuration of Modification 3, even if the employee terminal uses the cloud storage service without going through the relay device 10, the communication packets can be collected and analyzed. The communication is recorded as a usage log and can be checked by the administrator.

Note that if a function for analyzing communication packets is provided on the side of a network device such as the communication packet collection device 50, only the information indicating the usage log needs to be transferred to the relay device 10 side. It is possible to reduce the amount of communication between

10 relay device 20 employee terminal 30 administrator terminal 101 local authentication unit 102 HTTP server 103 cloud authentication unit 104 relay unit 105 log operation unit 201, 301 basic function unit A1, A2 cloud storage service

JP 2016-72769 A

Claims (9)

a terminal authentication unit that authenticates a terminal;
setting information in which authentication information for an external service corresponding to the terminal is set;
a service authentication unit that authenticates with the external service based on the authentication information of the external service;
a relay processing unit that uploads or downloads a file of a terminal that has been successfully authenticated with the external service with the external service when the authentication with the external service is successful;
a record holding unit that records and holds relay contents of the file relayed between the relay processing unit and the external service;
an output unit that outputs relay contents of the record holding unit;
has
The record holding unit also records and holds information on which the content of the uploaded file can be browsed,
The output unit further outputs information of the record holding unit that allows the content of the uploaded file to be browsed;
A relay device characterized by: the external service is a cloud storage service;
Having a storage that holds a file uploaded or downloaded by the terminal that has been successfully authenticated by the terminal authentication unit;
2. The relay device according to claim 1, wherein: The output unit outputs the relay content to a terminal authenticated as an administrator's terminal by the terminal authentication unit.
3. The relay device according to claim 1 or 2, characterized in that: The authentication information used by the terminal authentication unit to authenticate the terminal and the authentication information used by the service authentication unit to authenticate with the external service are associated with each other by identification information that uniquely identifies the user of the terminal. there is
4. The relay device according to any one of claims 1 to 3, characterized in that: having a registration unit for registering file restriction information that restricts uploading to an external service;
When uploading a file in the terminal to the external service, the relay processing unit does not upload if there is a file corresponding to the restriction information registered in the registration unit, and notifies that the upload is restricted. notifying said terminal;
5. The relay device according to any one of claims 1 to 4 , characterized in that: further comprising an analysis unit for analyzing communication performed by the terminal with an external service without going through the relay processing unit based on communication packets on a network;
The record holding unit also records and holds information about communication packets between the terminal and the external service obtained by the analysis by the analysis unit.
6. The relay device according to any one of claims 1 to 5 , characterized in that: A system that allows a terminal to use an external service on an external network via a relay device,
The terminal is
Having a basic function unit that accesses the relay device,
The relay device
a terminal authentication unit that authenticates the terminal;
setting information in which authentication information for the external service corresponding to the terminal is set;
a service authentication unit that authenticates with the external service based on the authentication information of the external service;
a relay processing unit that uploads or downloads a file of a terminal that has been successfully authenticated with the external service with the external service when the authentication with the external service is successful;
a record holding unit that records and holds relay contents of the file relayed between the relay processing unit and the external service;
an output unit that outputs relay contents of the record holding unit;
has
The record holding unit records and holds information in which the content of the uploaded file can be browsed,
The output unit further outputs information of the record holding unit that allows the content of the uploaded file to be browsed;
A system characterized by: having a collection device that collects communication packets in the network;
The collection device comprises:
an analysis unit that analyzes communication performed by the terminal with an external service without going through the relay processing unit based on the collected communication packets;
a transfer unit configured to transfer information about a communication packet between the terminal and the external service to the relay device based on the analysis performed by the analysis unit;
has
The record holding unit of the relay device also records and holds the information transferred from the collection device.
8. The system of claim 7 , wherein: A method for managing uploads or downloads performed by a terminal with an external service via a relay device,
The relay device
authenticating the terminal;
authenticating with the external service using authentication information of the external service;
a step of uploading or downloading a file of the terminal successfully authenticated with the external service to or from the external service when the authentication with the external service is successful;
a step of recording and holding relayed content of the file relayed between the external service and information that enables viewing of the content of the uploaded file ;
a step of outputting the relay content;
a step of further outputting information in which the content of the uploaded file can be browsed;
method including.

Images