KR102617954B1 - Control method to improve security of remote control service and computer program for performing the method - Google Patents

Abstract

A control method for improving the security of a remote control service according to an aspect according to the technical idea of the present disclosure includes a security policy server connected to a client terminal and a remote terminal, respectively, receiving a remote control service provision request from the client terminal. receiving identifying information; identifying the remote terminal matching the client terminal based on received identification information, wherein the remote terminal has a remote control service disabled; generating port information for connecting the client terminal to the identified remote terminal; transmitting the generated port information and remote control service activation command to the identified remote terminal; transmitting remote terminal access information including the port information to the client terminal; and providing a remote control service based on the connection between the client terminal and the remote terminal.

Description

Control method for improving security of remote control service and computer program for performing the same {CONTROL METHOD TO IMPROVE SECURITY OF REMOTE CONTROL SERVICE AND COMPUTER PROGRAM FOR PERFORMING THE METHOD}

The technical idea of the present disclosure relates to a control method for improving the security of a remote control service and a computer program for performing the same.

With the development of communication technologies such as 5G and cloud computing technologies, restrictions on work locations are disappearing. In particular, due to recent changes in the environment such as the untact society caused by COVID-19, the rate of remote work (remote work), which is a form of work that is not limited to the company but is performed in various locations, is rapidly increasing.

Users (workers) can perform remote work by using a terminal such as a PC, laptop, or smartphone located in a remote location (home, etc.) to connect to another terminal located at the workplace, etc. This type of service is provided as a remote control service. It can be defined as: Defined differently, a remote control service may mean a service that allows a terminal to connect to another terminal and perform remote work through a remote control protocol provided upon execution of a remote control application. These remote control services can be provided by various service providers. For example, Microsoft provides remote control services through Remote Desktop Protocol (RDP) and remote desktop applications.

The remote control protocol is a protocol that provides an interface so that a user can have control over another terminal connected to a network. As the remote control application is executed on the terminal, the user can connect to another terminal at the workplace (company network, etc.) through the remote control protocol, check the graphic data displayed on the screen of the other terminal on the terminal, and connect the terminal to the terminal. You can perform user input operations on a remote computer.

However, these remote control applications may have security vulnerabilities, and there is a risk that cyber attacks may be attempted against internal networks through programs with security vulnerabilities.

In fact, various vulnerabilities (CVE-2019-0708, etc.) have been discovered in remote control applications, and due to these vulnerabilities, security guidelines presented by the Financial Security Institute recommend not using remote control applications with weak security. (“Financial Company Telework Security Guide” published by the Financial Security Institute in 2022).

Therefore, there may be a need for a method that enables effective remote work through a remote control service and at the same time prevents security threats caused by remote control applications with weak security.

The technical problem to be solved by the present invention is to provide a method to strengthen the security of remote control services with weak security.

In order to achieve the above object, a control method for improving the security of a remote control service according to an aspect according to the technical idea of the present disclosure includes a security policy server connected to a client terminal and a remote terminal, respectively, Receiving identification information from the client terminal on which a remote control service provision request has been received; identifying the remote terminal matching the client terminal based on received identification information, wherein the remote terminal has a remote control service disabled; generating port information for connecting the client terminal to the identified remote terminal; transmitting the generated port information and remote control service activation command to the identified remote terminal; transmitting remote terminal access information including the port information to the client terminal; and providing a remote control service based on the connection between the client terminal and the remote terminal.

According to one embodiment, the identification information may include at least one unique information related to the client terminal or the user.

According to one embodiment, the step of identifying a remote terminal matching the client terminal may include selecting information that matches or matches unique information in the identification information received from the client terminal among the service authentication information stored for each of the plurality of remote terminals. It may include identifying a remote terminal having a as a remote terminal matching the client terminal.

According to one embodiment, generating the port information includes randomly selecting one of port numbers that are not being used in the remote terminal; and generating the port number including one randomly selected port number.

According to one embodiment, the method further includes activating a remote control service of the remote terminal in response to the port information and a remote control service activation command, wherein the activating step includes: the remote terminal, the port Modifying registry information or port setting information to enable connection of the client terminal through a port number corresponding to the information; and setting a policy of a firewall to allow communication related to a remote control service to the port number.

According to one embodiment, the method further includes the step of the client terminal connecting to the remote terminal based on the remote terminal connection information, wherein the connecting step includes the client terminal connecting to the remote terminal connection information. It may include running an installed remote control application based on the included port information.

According to one embodiment, the step of transmitting the generated port information and remote control service activation command to the identified remote terminal includes sending the port information, remote control service activation command, and IP address information of the client terminal to the remote terminal. A step of transmitting to the client terminal, wherein the step of connecting the client terminal to the remote terminal confirms that the IP address of the client terminal matches the received IP address information by a remote control application of the remote terminal. In this case, it may include the step of the client terminal connecting to the remote terminal.

According to one embodiment, the method includes detecting termination of the remote control service; and transmitting connection termination information based on the detection result to a security policy server, wherein detecting termination of the remote control service includes: detecting termination of a remote control application associated with the remote control service; Alternatively, it may include detecting termination of communication of the port corresponding to the port information.

According to one embodiment, the method includes: transmitting, by the security policy server, a remote control service deactivation command to the remote terminal in response to received connection termination information; and deactivating, by the remote terminal, the remote control service in response to a received remote control service deactivation command.

According to one embodiment, the step of deactivating the remote control service includes: modifying registry information or port setting information to disable communication of a port corresponding to the port information; deleting a policy of a firewall configured to allow communication related to a remote control service to the port number; and blocking execution of an application process related to the remote control service.

According to an aspect according to the technical idea of the present disclosure, a device is combined with a computer, which is hardware, and stored in a computer-readable recording medium to perform a control method for improving the security of a remote control service according to embodiments of the present disclosure. A computer program is provided.

According to the technical idea of the present disclosure, the remote terminal basically disables the remote control service and disables the basic port used in the remote control protocol to prevent security threats through unauthorized access by other terminals and security vulnerabilities in the remote control application. It can be effectively blocked, and the remote control service can be activated only when an authorized user's client terminal (the terminal on which a remote control application execution request has been received) attempts to connect. And the remote terminal can use the remote control application smoothly by restricting the network communication used in the remote control application to only the information (IP, port) confirmed on the authorized user's client terminal. Accordingly, unauthorized users or terminals are effectively blocked from accessing the remote terminal through the remote control application, thereby providing a remote control service with improved security.

The effects that can be obtained by the control method for improving the security of a remote control service according to the technical idea of the present disclosure are not limited to the effects mentioned above, and other effects not mentioned can be understood from the description below. It will be clearly understandable to those with ordinary knowledge in the technical field.

In order to more fully understand the drawings cited in this disclosure, a brief description of each drawing is provided.
1 is a diagram schematically showing a remote control service providing system with improved security according to an embodiment of the present disclosure.
FIG. 2 is a block diagram showing the control configuration of a device included in the system shown in FIG. 1.
3 and 4 are ladder diagrams for explaining a control method for improving security of a remote control service according to an exemplary embodiment of the present disclosure.
Figure 5 is a diagram showing a remote work system using a virtual private network as an example of a system in which a control method for improving security of a remote control service according to an embodiment of the present disclosure is implemented.

Illustrative embodiments according to the technical idea of the present disclosure are provided to more completely explain the technical idea of the present disclosure to those skilled in the art, and the examples below can be modified into various other forms. may be, and the scope of the technical idea of the present disclosure is not limited to the examples below. Rather, these embodiments are provided to make the present disclosure more faithful and complete and to completely convey the technical idea of the present invention to those skilled in the art.

Although the terms first, second, etc. are used in this disclosure to describe various members, regions, layers, portions, and/or components, these members, parts, regions, layers, portions, and/or components are referred to by these terms. It is obvious that it should not be limited by . These terms do not imply any particular order, superiority, inferiority, or superiority or inferiority, and are used only to distinguish one member, region, region, or component from another member, region, region, or component. Accordingly, the first member, region, portion, or component to be described in detail below may refer to the second member, region, portion, or component without departing from the teachings of the technical idea of the present disclosure. For example, a first component may be referred to as a second component without departing from the scope of the present disclosure, and similarly, the second component may also be referred to as a first component.

Unless otherwise defined, all terms used herein, including technical terms and scientific terms, have the same meaning as commonly understood by those skilled in the art in the technical field to which the concept of the present disclosure pertains. Additionally, commonly used terms, as defined in dictionaries, should be interpreted to have meanings consistent with what they mean in the context of the relevant technology, and should not be used in an overly formal sense unless explicitly defined herein. It should not be interpreted.

In cases where an embodiment can be implemented differently, a specific process sequence or process sequence may be performed differently from the described sequence. For example, two processes or processes described in succession may be performed substantially simultaneously, or may be performed in an order opposite to the order in which they are described.

In addition, terms such as “unit”, “unit”, “unit”, and “module” used in this specification refer to a unit that processes at least one function or operation, which refers to a processor, micro Processor (Micro Processer), Micro Controller, CPU (Central Processing Unit), GPU (Graphics Processing Unit), APU (Accelerate Processor Unit), DSP (Drive Signal Processor), ASIC (Application Specific Integrated Circuit), FPGA It may be implemented as hardware or software, such as a Field Programmable Gate Array, or a combination of hardware and software, and may also be implemented in a form combined with a memory that stores data necessary for processing at least one function or operation. .

Additionally, we would like to clarify that the division of components in this specification is merely a division according to the main function each component is responsible for. That is, two or more components, which will be described below, may be combined into one component, or one component may be divided into two or more components for more detailed functions. In addition to the main functions it is responsible for, each of the components described below may additionally perform some or all of the functions handled by other components, and some of the main functions handled by each component may be performed by other components. Of course, it can also be carried out exclusively by .

As used herein, the term 'and/or' includes each and every combination of one or more of the mentioned elements.

Hereinafter, embodiments based on the technical idea of the present disclosure will be described in detail with reference to the attached drawings.

1 is a diagram schematically showing a remote control service providing system with improved security according to an embodiment of the present disclosure.

In this specification, the remote control service refers to a service that allows a terminal to control the operation of another terminal located at a distance through a remote control protocol provided upon execution of a remote control application program. These remote control services may be provided by various operators (service providers), and representative examples include MS's remote desktop application and Remote Desktop Protocol (RDP), but the embodiment of the present disclosure is MS's service. It is not limited to application only.

Referring to FIG. 1, a remote control service providing system according to an embodiment of the present disclosure may include a first terminal 10, a second terminal 20, and a security policy server 30. Although FIG. 1 shows one first terminal 10, a second terminal 20, and a security policy server 30, there may be a plurality of the configurations.

The first terminal 10 is a client terminal that requests a connection for remote control of the second terminal 20, and remotely controls the operation of the second terminal 20 through a remote control service, and the second terminal 20 ) may correspond to a device that receives and outputs the screen or sound output. In addition, the second terminal 20 may correspond to a remote terminal that provides remote control rights to the first terminal 10 through a remote control service and provides an output screen or sound to the first terminal 10. Each of the first terminal 10 and the second terminal 20 may include various fixed/mobile terminals such as a PC, laptop, smartphone, tablet PC, and workstation.

The security policy server 30 may correspond to a server that performs a series of operations to improve the security of the remote control service provided between the first terminal 10 and the second terminal 20.

FIG. 2 is a block diagram showing the control configuration of a device included in the system shown in FIG. 1.

The device 200 shown in FIG. 2 may correspond to the first terminal 10, the second terminal 20, or the security policy server 30 of FIG. 1. 2 shows a communication unit 210, an input unit 220, an output unit 230, a control unit 240, and a memory 250 as an example of the control configuration of the device 200, but the first terminal 10 ), the second terminal 20, or the security policy server 30 may each include more or less configurations than those shown in FIG. 2.

The communication unit 210 may include one or more communication modules that enable communication with other devices, terminals, servers, etc. by connecting the device 200 to a network. For example, the communication module may include a module that supports various known types of wired/wireless communication, such as a mobile communication module, a wired or wireless Internet module, and a short-range wireless communication module.

The input unit 220 is for inputting information, image information, audio information, data, etc. input from the user, and may include various input means such as various mechanical/electronic input means, cameras, microphones, etc. The output unit 230 is used to provide information to users by generating output related to vision, hearing, or tactile senses, and may include a display, speaker, haptic module, etc.

The control unit 240 may control the overall operation of the device 200. The control unit 240 may process signals, data, information, etc. input or output through the above-described components, or provide certain information or functions by running various applications stored in the memory 250.

For example, the control unit 240 may provide a remote connection between the first terminal 10 and the second terminal 20 through the remote control application 254. In particular, the control unit 240 can provide a remote control service with improved security through the security control application 252 when connecting to a remote desktop. Operations for improving the security of a remote control service according to an embodiment of the present disclosure will be described in detail later with reference to FIGS. 3 and 4.

The control unit 240 may include at least one processor, which may include a CPU, an application processor (AP), an integrated circuit, a microcomputer, an application specific integrated circuit (ASIC), a field programmable gate array (FPGA), and /Or it may be implemented with hardware such as a neural processing unit (NPU).

The memory 250 can store programs and data necessary for the operation of the device 200. Additionally, the memory 250 may store data generated or acquired through the control unit 240. For example, the memory 250 may store various applications and data, such as a security control application 252 and a remote control application 254.

The memory 250 may be composed of a storage medium such as ROM, RAM, flash memory, SSD, or HDD, or a combination of storage media.

3 and 4 are ladder diagrams for explaining a control method for improving security of a remote control service according to an exemplary embodiment of the present disclosure.

The security control application 252 according to an embodiment of the present disclosure is an application that is loaded and executed by the control unit 240 of the device 200 to perform a predetermined operation. In other words, the security control application 252 is combined with a computer (terminal or server) as hardware, and operates as the first terminal 10, the second terminal 20, or the security policy server 30 according to embodiments of the present disclosure. Control operations can be performed to improve the security of remote control services. And, in each of the devices 10, 20, and 30, the specific operation of the security control application 252 may be different. In the following specification, the subject of control operations for improving the security of the remote control service according to the embodiment of the present disclosure is described as the first terminal 10, the second terminal 20, or the security policy server 30. These control operations can be performed by each device executing the security control application 252.

Based on this, referring to FIGS. 3 and 4, the second terminal 20 deactivates the remote control service (S300), and the user activates the remote control service of the second terminal 20 through another terminal. Authentication information may be transmitted to the security policy server 300 (S305).

The remote control application 254 is a service in which the second terminal 20 provides control rights of the second terminal 20 to another terminal and provides the screen or sound output from the second terminal 20 to the other terminal. In fact, ensuring security can be very important. However, if a security vulnerability exists in the remote control application 254 that provides the remote control protocol, the security of the remote control protocol may deteriorate and problems such as leakage of important information stored in the second terminal 20 may occur. there is.

Accordingly, the second terminal 20 can basically disable the remote control service to block unauthorized users from accessing the second terminal 20 through the remote control service. For example, the second terminal 20 may stop a service for running a remote control protocol or set a firewall policy to block a communication port for the remote control protocol. Alternatively, the second terminal 20 may block execution of the remote control application 254 process (eg, mstsc.exe, etc.).

However, the user of the second terminal 20 may wish to use the remote control service with the second terminal 20 through another terminal of the user or another authorized user. Accordingly, the second terminal 20 may transmit service authentication information that allows an authorized user to activate a deactivated remote control service to the security policy server 30. In Figure 1, step S305 is shown as being performed after step S300, but step S305 may be performed when the security control application 252 is first run, or may be performed at various times or situations, such as in response to a user's setting operation, etc. It can be done.

The service authentication information is unique information for user and/or terminal identification, and may include the user's ID, employee number, and/or name, or the ID of the second terminal 20. The security policy server 30 may store the service authentication information transmitted from the second terminal 20 in the storage unit 250 or a DB.

Meanwhile, the first terminal 10 may receive a remote control service provision request (S310) and transmit identification information for using the remote control service to the security policy server 30 (S315).

The user of the first terminal 10 may run the remote control application 254 and perform a user input operation for remote access to the second terminal 20. The first terminal 10 may receive a remote control service provision request according to the series of user input operations and transmit identification information for use of the remote control service to the security policy server 30. For example, the identification information may include the user's unique information (ID, employee number, name, etc.) and the IP address and ID of the first terminal 10.

The security policy server 30 may identify the second terminal 20 matching the first terminal 10 based on the received identification information (S320).

Based on the received identification information, the security policy server 30 may identify the matched second terminal 20 so that the first terminal 10 can remotely access it. Specifically, the security policy server 30 matches the identification information received from the first terminal 10 among the service authentication information for each remote terminal (received and stored in step S315) stored in the memory 250 or the DB. A remote terminal (second terminal 20) with matching information can be identified as the matching terminal. For example, the security policy server 30 may select a second user ID that matches the user ID included in the identification information received from the first terminal 10 among the user IDs for each remote terminal stored in the memory 250 or the DB. The terminal 20 may be identified as the matching terminal.

Meanwhile, if the matched terminal is not identified, the security policy server 30 may request retransmission of identification information to the first terminal 10 or may not permit use of the remote control service.

The security policy server 30 generates port information to enable the first terminal 10 to access the identified second terminal 20 (S325), and sends the generated port information and remote control service activation command to the second terminal 20. It can be transmitted to the terminal 20 (S330).

In TCP/UDP communication, the port number can be used to identify which program in the terminal data will be delivered to. Some of the port numbers of the second terminal 20 may be used by other programs, while others may be unused.

The security policy server 30 may generate port information corresponding to one of the port numbers that are not being used in the second terminal 20. To this end, the second terminal 20 may provide information about port numbers that are not currently in use to the security policy server 30. For example, any one of the port numbers may be selected at random, but the port number is not limited to this and may be selected according to various methods. The security policy server 30 may transmit the generated port information and remote control service activation command to the second terminal 20.

Depending on the embodiment, the security policy server 30 may further transmit IP address information of the first terminal 10 to the second terminal 20 in addition to the port information and remote control service activation command. This is to allow the second terminal 20 to connect only the first terminal 10 to the port number corresponding to the port information.

The second terminal 20 may activate the deactivated remote control service based on the received port information and the remote control service activation command (S335).

For example, the second terminal 20 may modify registry information or port setting information so that a remote control protocol connection is established using a port number corresponding to the received port information. Additionally, the second terminal 20 may set a remote control service-related policy of the firewall to allow communication related to the remote control service to the IP address and port number of the first terminal 10. Afterwards, the remote control service (remote desktop service, etc.) of the second terminal 20 is executed, so that the remote control service of the second terminal 20 may be activated.

Meanwhile, the security policy server 30 may transmit the second terminal connection information including the generated port information to the first terminal 10 (S340).

The first terminal 10 connects to the second terminal 20 based on the received second terminal connection information (S345), and when the connection is successful, a remote control service is provided between the first terminal 10 and the second terminal 20. may be provided (S350).

For example, the second terminal connection information may include the created port information and IP address information of the second terminal 20.

The first terminal 10 may transmit a connection request to the port number corresponding to the port information to the second terminal 20 based on the received second terminal connection information. The second terminal 20 may permit a connection when a connection request from the first terminal 10 is received through the port number. Depending on the embodiment, when the connection request is received, the second terminal 20 may allow the connection after checking the IP address of the first terminal 10.

As the first terminal 10 connects to the second terminal 20, a remote control service is provided, and the first terminal 10 displays a screen and/or output through the output unit 230 of the second terminal 20. Alternatively, data corresponding to sound may be received and output, and user input received through the input unit 220 of the first terminal 10 may be transmitted to the second terminal 20.

Meanwhile, referring to FIG. 4, the first terminal 10 may receive a remote control service termination request (S400) and terminate the connection to the second terminal 20 in response to the received request (S410).

After completing use of the remote control service, the user of the first terminal 10 may input a request to terminate execution of the remote control application 254 or a request to terminate connection with the second terminal 20 through the input unit 220. You can. That is, the first terminal 10 may receive a remote control service termination request corresponding to the execution termination request or connection termination request through the input unit 220, etc.

The first terminal 10 may terminate the connection to the second terminal 20 in response to the received remote control service termination request. For example, the security control application 252 of the first terminal 10 detects termination of the remote control application 254 or detects termination of communication by monitoring communication of the port used while providing the remote control service, thereby The termination of the control service can be detected. As the first terminal 10 detects termination of the remote control service, it may transmit connection termination information to the security policy server 30. The connection termination information may include information about the second terminal 20, which is a remote terminal.

Depending on the embodiment, the remote control service termination request may be received by the second terminal 20, and the second terminal 20 secures the connection termination information, similar to the operation of the first terminal 10 described above. It can be transmitted to the policy server 30.

When the connection is terminated according to the remote control service termination request, the first terminal 10 (or the second terminal 20) may transmit information notifying the termination of the connection (connection termination information) to the security policy server 30. (S420). The security policy server 30 transmits a remote control service deactivation command to the second terminal 20 in response to the received connection termination information (S430), and the second terminal 20 activates the remote control service in response to the received command. can be disabled (S440).

In response to the received command, the second terminal 20 modifies the registry information or port setting information to disable communication permission for the port used when providing the remote control service in the embodiment of FIG. 3, and configures the remote control protocol. Services to run can be stopped. Alternatively, the second terminal 20 may delete the firewall policy that was set to allow communication related to the remote control service. Alternatively, the second terminal 20 may again block execution of the remote control application process (eg, mstsc.exe, etc.). Through at least one of the above-described operations, the second terminal 20 may deactivate the remote control service.

According to the embodiment shown in FIGS. 3 and 4, the second terminal 20 (remote terminal) can effectively block access to other terminals by basically disabling the remote control service, and the first terminal ( 10) When (client terminal) wants to connect, a smooth remote control service can be provided by activating the remote control service. Accordingly, unauthorized users or terminals are effectively blocked from accessing the remote terminal through the remote control application and remote control protocol, and a remote control service with improved security can be provided.

Figure 5 is a diagram illustrating a remote work system using a virtual private network as an example of a system in which a method for improving security of a remote control service according to an embodiment of the present disclosure is implemented.

Due to recent developments in communication and cloud computing technology and the social environment such as untact due to COVID-19, the workplace is not limited to the company and is a form of work performed in various locations, that is, the proportion of remote work (remote work) has increased. It is increasing. In this remote work system, it is impossible to use the terminal 630 existing in the company network 600 when workers, etc. are not located in the company, so using a terminal 500 such as a PC or laptop in a remote location (home, etc.) It may refer to a system that can perform work by accessing the data management system 620 of the internal network 600.

Only authorized users' terminals 500 must be able to access the internal network 600. To this end, an external terminal can access the internal network 600 through a virtual private network (VPN) 800 or a dedicated private network. Since dedicated private networks are inefficient in terms of cost, etc., most remote work systems adopt a VPN connection method by equipping the internal network 600 with VPN equipment (e.g., VPN gateway 610, etc.). The authorized user's terminal 500 corresponds to a VPN client installed with a VPN application for connection to the VPN gateway 610 of the internal network 600. The terminal 500 requests connection to the internal network 600 using the IP address assigned according to the execution of the VPN application, and the VPN gateway 610 of the internal network 600 responds to the IP address included in the connection request. Based on this, access may be permitted or denied.

Meanwhile, in general, the internal network 600 may be equipped with a high-level security management solution (data loss prevention (DLP), digital rights management (DRM), etc.) to prevent various security threats such as data leakage or hacking. there is. On the other hand, the security management level for external terminals 500, such as personal PCs at home, may be relatively low compared to the internal network 600. Accordingly, an attacker may attempt a cyber attack on the corporate network 600 through the terminal 500 and VPN 800 by exploiting the security vulnerability of the terminal 500. Additionally, when the terminal 500 connects to the terminal 630 of the internal network 600 through a remote control service, security problems in the internal network 600 may occur due to security vulnerabilities in the remote control application.

Accordingly, the terminal 500, the terminal 630 of the internal network 600, and the security policy server 700 provide a remote control service with improved security as described above in FIGS. 3 and 4, thereby The security of (600) can be effectively improved.

The above-described present invention can be implemented as computer-readable code on a recording medium on which a program is recorded. Computer-readable recording media include all types of recording devices that store data that can be read by a computer system. Examples of computer-readable media include HDD (Hard Disk Drive), SSD (Solid State Disk), SDD (Silicon Disk Drive), ROM, RAM, CD-ROM, magnetic tape, floppy disk, optical data storage device, etc. Includes. Accordingly, the above detailed description should not be construed as restrictive in all respects and should be considered illustrative. The scope of the present invention should be determined by reasonable interpretation of the appended claims, and all changes within the equivalent scope of the present invention are included in the scope of the present invention.

Claims (11)

In a control method for improving the security of remote control services,
A security policy server connected to a client terminal and a remote terminal, respectively, receiving identification information from the client terminal that has received a remote control service provision request;
Identifying the remote terminal matching the client terminal based on received identification information, wherein the remote terminal is in a state in which the remote control service is deactivated, and deactivation of the remote control service is performed by the remote terminal, Disabling the remote control service is accomplished by stopping the service for running the remote control protocol, setting a policy on the firewall to block the communication port for the remote control protocol, and blocking the execution of the remote control application process;
generating port information for connecting the client terminal to the identified remote terminal;
transmitting the generated port information and remote control service activation command to the identified remote terminal;
transmitting remote terminal access information including the port information to the client terminal; and
Comprising the step of providing a remote control service based on the connection between the client terminal and the remote terminal,
method.
According to paragraph 1,
The identification information includes at least one unique information related to the client terminal or user,
method.
According to paragraph 2,
The step of identifying a remote terminal matching the client terminal,
Among the service authentication information stored for each of a plurality of remote terminals, identifying a remote terminal having information that matches or matches unique information in the identification information received from the client terminal as a remote terminal matching the client terminal. doing,
method.
According to paragraph 1,
The step of generating the port information is,
randomly selecting one of port numbers that are not being used in the remote terminal; and
Comprising the step of generating the port number including any one randomly selected port number,
method.
According to paragraph 1,
Activating a remote control service of the remote terminal in response to the port information and a remote control service activation command,
The activating step is,
Modifying, by the remote terminal, registry information or port setting information to enable connection to the client terminal through a port number corresponding to the port information; and
Including setting a policy on a firewall to allow communication related to a remote control service to the port number,
method.
According to clause 5,
Further comprising the step of the client terminal connecting to the remote terminal based on the remote terminal connection information,
The connection step is,
Comprising the step of, by the client terminal, running an installed remote control application program based on the port information included in the remote terminal connection information.
method.
According to clause 6,
The step of transmitting the generated port information and remote control service activation command to the identified remote terminal,
Transmitting the port information, a remote control service activation command, and a connection request to the port number corresponding to the IP address information and the port information of the client terminal to the remote terminal,
The step of the client terminal connecting to the remote terminal is,
In response to the connection request, when the remote control application of the remote terminal confirms that the IP address of the client terminal matches the received IP address information, the client terminal connects to the remote terminal. containing,
method.
According to paragraph 1,
detecting termination of the remote control service; and
Further comprising transmitting connection termination information based on the detection result to the security policy server,
The step of detecting termination of the remote control service includes:
detecting termination of a remote control application associated with the remote control service; or
Including detecting termination of communication of the port corresponding to the port information,
method.
According to clause 8,
transmitting, by the security policy server, a remote control service deactivation command to the remote terminal in response to received connection termination information; and
Further comprising, by the remote terminal, deactivating the remote control service in response to a received remote control service deactivation command,
method.
According to clause 9,
The step of disabling the remote control service is:
Modifying registry information or port setting information to disable communication of the port corresponding to the port information;
deleting a policy of a firewall set to allow communication related to a remote control service to a port number corresponding to the port information; and
At least one of blocking execution of an application process associated with the remote control service,
method.
A computer program combined with a computer as hardware and stored in a computer-readable recording medium so as to perform the method of claim 1.