KR100851184B1 - System for providing virtual office service - Google Patents

Abstract

The present invention discloses a virtual office service providing system for providing a virtual office service to a number of corporate customers using a closed network.

The virtual office service providing system of the present invention manages information necessary for executing a specified application, and includes a plurality of application servers allowing users to access the application according to the application execution request; And a control server which integrates and manages authentication information of the users, information on network connection and application usage, authenticates the application usage of the users, and controls the application usage of each user by interworking with the application server. By separating the control / management information and general information needed for the application usage service, providing a user-centered service environment rather than an application-oriented service, the enterprise administrator can easily set up and execute IT policies for the users of the enterprise. Users can authenticate the network and all applications with a single ID.

Description

System for providing virtual office service

1 is a diagram illustrating an embodiment of a method in which a conventional ISP provider provides a virtual office service.

2 is a block diagram showing the configuration of a virtual office service providing system according to the present invention.

3 is a configuration diagram showing the configuration of the entire system to which the virtual office service providing system of FIG. 2 is applied.

4 is a configuration diagram showing in more detail the configuration of the control server 40 and its functions in FIGS.

5 is a view for briefly explaining a process of using a virtual office service according to the present invention of each user.

FIG. 6 is a flowchart illustrating a procedure of using the virtual office service of FIG. 5 in more detail.

The present invention relates to a system in which an ISP (Internet Service Provider) provider provides a virtual office service to various corporate customers who use a closed network. More specifically, the present invention relates to a control / control of an eWorker. The present invention relates to a virtual office service providing system that separates management information from general information required for an application using service and provides a user-centered service environment instead of an application-oriented one.

In virtual office services, all that is required is the use of the application over a network connection. In other words, virtual office services provide an environment in which an eWorker can use applications used in an office through a network connection regardless of when and where.

The virtual office services provided by ISP providers must ensure that authentication, authorization, accounting and auditing are done by the company and by the user, sharing a single physical element among multiple companies. . In order to provide such services, user convenience and security should be strengthened through the integration of network authentication and service authentication, and cost reduction and security should be guaranteed through sharing and security services for many companies. A multilevel structure of authentication, authority, and accounting (AAA) control and management procedures that lead to users is required.

However, existing methods in which ISP service providers provide virtual office services are shared by network and application as shown in FIG. In other words, the network was shared through a Virtual Privite Network (VPN) and each application was shared through an Application Service Provider (ASP).

In FIG. 1, since the user management function is maintained for each network and application, management information for each network and application is maintained as shown in the table. In this case, the network can control / manage each VPN, so even if users of different companies authenticate with the same ID, they can recognize that they are different people on the network. Can provide services. However, the application does not allow duplicate IDs because it only manages users without corporate concept.

Therefore, in some cases, a user must use a different ID for each application, and thus, the user has to remember which ID is used for which application. In the example of Figure 1, users authenticated with the VPN sujin ID for each company had to use a new ID in order not to be duplicated when using each application, A company users are forced to use a different ID for each application, The user must remember his ID for each application.

In this structure, since each application has control and management functions, more granular user management that integrates network and applications is not possible. In addition, users must register, modify, and delete their information with a different ID for each network and each application. Therefore, if a user moves to work, changes his address, or wants to change his / her ID, he / she must modify or delete information for each application. There was a hassle.

Accordingly, an object of the present invention for solving the above-described problems is to provide a user-centered virtual office service environment rather than an application-centered environment by separating management and application for an eWorker.

A virtual office service providing system of the present invention for achieving the above object is a plurality of application servers to manage the information necessary for the execution of the specified application, the user connected to use the application in response to the application execution request; And a control server which integrates and manages authentication information of the users, information on network connection, and application usage to authenticate the application usage of the users, and controls the application usage of each user in association with the application server.

Hereinafter, with reference to the accompanying drawings will be described in detail a preferred embodiment of the present invention.

2 is a block diagram showing the configuration of a virtual office service providing system according to the present invention.

The virtual office service providing system of the present invention includes an application server 10 to 30 and a control server 40.                     

Each application server 10 to 30 manages information necessary for executing a designated application (Internet use, e-mail, messenger, ERP, CRM, voice, video, etc.), and requests each user at the request of the control server 40. Provide different applications specified. That is, the application server 10 to 30 of the present invention processes the information necessary for the execution of the application in response to the request of the control server 40 to only allow the user to use the application, the personal information about the users Do not manage. These application servers 10 to 30 include all of the application server provided by each ISP (Internet Service Provider) and each company.

The control server 40 integrates and manages information on users who use the virtual office service according to the present invention, that is, information on all IT tasks from each user's network connection to application use, and the application servers 10 to 10. 30) to control and use the application of each user. That is, the control server 40 collectively manages virtual office service users for each company and each organization within each company, even though a plurality of different users use the same ID. If you are in, distinguish them from each other so that each user can use the application with their own ID. As such, the control server 40 enables more granular application usage control and user management, which enables differentiation of application usage rights according to network access methods and locations, or differentiation of IT usage rights by enterprise organizations.

This allows users in each enterprise to use the application in the same environment as in the office, regardless of the device they are using, their location, and how they access it, providing services regardless of the location of the application and the management of the application. I can receive it.

3 is a block diagram showing the configuration of the entire system to which the virtual office service providing system of FIG. 2 is applied.

On the ISP's VPN network 50, several companies make up the intranets A (HQ, BO) and B (HQ, BO) of the headquarters (HQ) and branch offices (BOs). 10) or the IT environment using the applications (20, 30) built by the company itself is built. These corporate customers are not only intranet users on the company's intranets A (HQ, BO) and B (HQ, BO), but also remote users A, B, who are in an environment where the intranet is unavailable for travel, travel, or telecommuting. You also need to provide the C with your company's IT environment. In order to provide such a virtual office service, first, the network side should be able to access the intranet over the Internet, and the control server 40 should allow the user to use the IT of all the applications 10 to 30. Thus, remote users A, B, and C allow access to the intranet through gateways 60 and 70 that connect the Internet and VPN network 50. That is, remote users A, B, and C on the Internet access the IPSec Internet gateway 60 using the IPSec VPN client software, or access the SSL VPN Internet gateway 70 using the SSL VPN through a web browser. By doing so, it is possible to access each company's site through the ISP's VPN network 50. Users who connect to the intranet use the IT of the applications 10 to 30 through the control server 40.

4 is a configuration diagram showing in detail the configuration of the control server 40 and its functions in FIGS. 2 and 3.

In FIG. 4, the control server 40 of the present invention includes a certificate server 42, a policy server 44, and an audit server 46.

The certificate server 42 is a server for reinforcing security for user authentication and performs certificate issuance and certificate authentication by the X.509 protocol. The certificate server 42 issues a certificate to the user and authenticates the user by receiving a certificate of the user connected through the user portal 82 of each corporate site 80 constructed in the intranet.

The policy server 44 manages per-company, per-organizational, per-user authentication and authorization information to selectively allow and prohibit the user's ID / PWD authentication and authorization to use the application. The policy server 44 receives ID / PWD of the users connected through the user portal 82 and authenticates the corresponding user, and transmits the result to the audit server 46 and the user portal. In addition, the policy server 44 grants authenticated users permission to use the application available to the user.

The audit server 46 manages audit data about the user's network access and application usage. The audit server 46 is a service manager (hereinafter referred to as a corporate administrator) of each company connected through the administrator portal 84 of each company site 80 built on the intranet, and any application of the user when the user connects to the network. Allows you to retrieve information such as whether or not you used.                     

The administrator portal 84 is a web portal that allows corporate administrators to set user policies and monitor access status and work behavior. The user portal 82 is a web portal where users access to receive the same IT environment as their offices. It should be able to accommodate various enterprise applications 30 based on client-server (C / S) as well as web-based applications 20. All users will use the application through the user portal 82.

When a user accesses the user portal 82 through a certificate or ID / PWD, the portal 82 checks whether the authentication server 42 or the policy server 44 is authenticated, and the policy server 44 checks the user. Informs the audit server 46 and the portal 82 that the portal 82 has succeeded / failed to the portal 82, and the portal 82 receives the IT permission information through the policy server 44 for the authorized user. The available applications 10 to 30 are connected. The corporate administrator accesses the administrator portal 84 through a certificate or ID / PWD in the same manner as in the user portal 82, and then stores the policies such as IT permissions of each user in the policy server 44, and the audit server. (46), the audit data for the users of the company can be queried to supervise the work behavior through information such as the network connection of each user and the use of the application. In this case, if the user is located at a remote location that cannot be accessed through the intranet, the user may be authenticated through the remote access gateways 60 and 70 and automatically connected to the user portal 82.

5 is a view for briefly explaining a process of using a virtual office service according to the present invention of each user.                     

Intranet users in the office can directly access the control server 40 on the same network (intranet) via the user portal 82 of the corporate site. On the other hand, remote users on the Internet for business trips, telecommuting, etc., can access the control server 40 by connecting to the SSL VPN 50 through the SSL Internet gateway 70 using a web browser, and also to the IPSec client. The software can be connected to the control server 40 by connecting to the IPSec VPN 50 through the IPSec Internet gateway 60.

The users connected to the control server 40 are authenticated and audited using the policy server 44 and the audit server 46, and the control server 40 is interlocked with the enterprise application servers 20 and 30. Control your application usage. The application servers 20 and 30 used by a company may be located in a data center of an ISP, or each company may be built in the corporate site 80. In addition, the application servers 20 and 30 may be web based applications or client-server based applications.

FIG. 6 is a flowchart illustrating a procedure of using the virtual office service of FIG. 5 in more detail.

In this embodiment, description of user authentication using a certificate is omitted.

If a company's manager wants a virtual office service, he / she notifies the ISP's service manager (1-①). The service manager initializes the enterprise DB of the audit server 46 (1-②), and then stores the certificate and policy information of the corresponding enterprise manager in the certificate server 42 and the policy server 44 (1-③). Do the work.                     

When the corporate manager requests the control server 40 to transmit the ID / PWD to the manager portal 84 (2-①), the manager portal 84 requests the authentication of the corresponding company manager to the policy server 44. (2-②). Then, the policy server 44 inquires the authentication information of the corresponding enterprise manager to perform authentication (2-③), and then requests the audit server 46 to store the information as audit data (2-④). . Upon receiving the request, the audit server 46 stores the corresponding information (2-⑤), and when the storage is completed, the audit server 46 responds to the policy server 44 that the audit data storage is completed (2-⑥). Next, if the policy server 44 permits the authentication of the corporate administrator to the administrator portal 84 (2-⑦), the administrator portal 84 grants the corporate administrator server access (2-⑧). When the authorized company administrator requests the administrator portal 84 to register the user's authentication / policy information (2-⑨), the administrator portal 84 requests the policy server 44 to store the authentication / policy information. (2-⑩). When the administrator portal 84 receives a response (2-j) from the policy server 44 that the storage is completed, the manager portal 84 informs the company manager of the fact (2-j).

A remote user who owns the IPSec client software (or hardware) executes the IPSec client software (3-①) and inputs a login ID and password (PWD) to request access to the IPsec gateway 60 (3-②). . When the IPSec gateway 60 requests a network connection for the user (3-③) to the policy server 44 of the control server 40, the policy server 44 inquires the authentication / policy information of the user (3- ④), request to the audit server 46 to store audit data on network connection, that is, information on which IP, where, when and when the network connection was successful or failed using the IPSec VPN 50. (3-⑤). Accordingly, the audit server 46 notifies the policy server 44 that the audit data has been stored (3-⑥) and then stored (3-⑦). The policy server 44 grants network access permission to the IPSec gateway 60 if the user has permission (3-⑧), and informs that the IPSec gateway 60 can access the IPSec client software (3-⑨). ). The user who has been granted access configures a connection environment for using the virtual office service (3-⑩), and accesses the user portal 82 through a web browser (3-⑪).

If the remote user wants to use the virtual office service through the SSL VPN, the user accesses the SSL gateway 70 through a web browser and inputs his login ID and PWD (4-①). Thereafter, the SSL gateway 70 permits the use of the virtual office service through the same process as that of the IPSec VPN. That is, if the user asks the policy server 44 whether the user can access the network (4-②), the policy server 44 inquires the authentication / policy information of the user (4-③), Request to store audit data for network connection in audit server 46 (4-④). Next, when audit server 46 stores the audit data (4-⑤) and sends a response signal (4-⑥), policy server 44 sends to SSL gateway 70 if the user has permission. Grant network access permission (4-⑦). Accordingly, the SSL gateway 70 automatically switches to the user portal (4-⑨) while automatically executing a mode capable of executing all applications (4-⑧).

Intranet users can access the user portal directly through the ISP's network without an IPSec VPN or SSL VPN.

When the state becomes accessible to the user portal by the above procedure, the user portal 82 requests the portal of the user to the policy server 44 (5-①). The policy server 440 inquires (5-②) which service authority the user has, and requests the audit server 46 to store audit data on portal use (5-③). The server 46 stores the audit data (5-④) and then informs the policy server 44 of the fact (5-⑤) Next, the policy server 44 sends the user's service authority and personalization information to the user. It is transmitted to the portal 82 (5-⑥) The portal 82 is interlocked with the applications 20.30 that the user can use according to the service authorization information of the user (5-⑦), and fits the user. The IT work environment is configured (5-⑧), and the user then performs all IT tasks through the portal 82. When the user uses the desired application (5-⑨), the portal 82 audits it. The data is transmitted to the server 46 (5-j) to store audit data on the user's use of the application (5-j).

If the corporate administrator wants to monitor the use of the virtual office services of these users, the service is requested after monitoring and accessing the administrator portal 84 (6-①). In this regard, the portal 84 requests and receives audit data for the users of the corresponding company stored in the audit server 46 (6-②, 6-③), and also logs data of each application server 20, 30. By showing (6-④), the company manager can monitor users' access and working behavior.

As described above, the virtual office service providing system of the present invention separates the control / management information for the user from the general information required for the application using service to provide a user-centered service environment rather than an application-oriented, so that the enterprise manager can It is easy to set up and enforce IT policies for users in the business, and users can authenticate the network and all applications with a single identity.

Claims (6)

Each user manages the information necessary for the execution of designated applications, and executes the requested application in response to an application execution request from a remote user connected through the network so that the user can use the application over the network. Application servers; And The virtual office services provided with a control server which integrates and manages the authentication information of the users, information on network access and application usage, authenticates the application usage of the users, and controls the application usage of each user by interworking with the application server. system. The method of claim 1, wherein the control server Virtual office service providing system, characterized in that for managing the application-specific permissions and the user-specific organizational permissions belong to each. The method of claim 1 or 2, wherein the control server A certificate server for issuing a certificate to the user and performing an authentication function for the user using the certificate; A policy server that selectively manages policy information on authentication and usage of the application and permits the users to use the application; And And an audit server for managing audit data on network access and application usage of the users. The method of claim 3, wherein the policy server Virtual office service providing system, characterized in that for authenticating the user using the user's ID and password. The method of claim 3, wherein the audit server A system for providing virtual office services, which enables a company administrator to query network access and application usage information for users of the enterprise. The method of claim 1, wherein the plurality of application servers Virtual office service providing system comprising an application server provided by the ISP and the application server provided by each company to which the user belongs.

Images