JP4908609B2 - Network system - Google Patents

Description

The present invention relates to a network system.
More specifically, it solves the problems of the conventional virtual private network (“VPN”) and realizes flexible operability and strong security by adding extremely lightweight software and hardware. about the new virtual private network system.

  Today, IP networks originating from the Internet are indispensable for our social life and corporate activities. A company has a LAN in the office, and a server such as a file server including confidential company information is also connected to the LAN. An employee uses a terminal such as a personal computer connected to a LAN to perform business using information resources provided by the server. Generally, a corporate LAN is provided with a firewall at the connection point between the LAN and the Internet in order to protect servers including confidential information. Thus, the LAN is configured so that a malicious third party cannot easily enter the corporate LAN from the Internet.

This firewall is a hindrance when employees want to work while connected to the corporate LAN using a laptop computer or other terminal. VPN is used as a technology for securely connecting to the corporate LAN from the Internet through a firewall.
There are various types of VPNs depending on their connection form, but they can be roughly classified into two types.
One is a method of assigning an IP address belonging to a LAN subnet to a terminal existing outside the LAN.
The other is a technique called port forwarding or static NAT (Network Address Translation).

JP 2009-227771 A

“Introduction to PacketiX VPN-Features of PacketiX VPN” Soft Ether Co., Ltd. [Search on March 25, 2010], Internet <URL: http://www.softether.co.jp/jp/vpn2/introduction/about_vpn.aspx> “Special Feature: Broadband Router Thorough Strategy Guide” IT Media Co., Ltd. [Search on March 25, 2010], Internet <URL: http://www.atmarkit.co.jp/fpc/special/bbrouter_desc/portforward_dmz.html> "Let's manage the server with ssh over the Internet-@IT" IT Media Co., Ltd. [Search March 25, 2010], Internet <URL: http://www.atmarkit.co.jp/fnetwork/rensai /tcp27/01.html>

First, the former method of assigning an IP address belonging to a LAN subnet to a terminal existing outside the LAN will be described. This is a technique disclosed in Non-Patent Document 1.
Most corporate LANs use IPv4 private addresses. Therefore, a private address belonging to the subnet of the corporate LAN is also assigned to a terminal connected to the outside of the LAN, that is, the Internet. However, a network interface card (hereinafter referred to as “NIC”) provided in the terminal has already been assigned a global IP address by an Internet service provider (hereinafter referred to as “ISP”). Therefore, a virtual NIC is realized by software, and an IP address belonging to the subnet of the corporate LAN is assigned to this. The communication with the virtual NIC is encrypted and passed through the firewall.

The problem with this method is that the terminal belongs to the LAN subnet but is not protected by a firewall, or is directly connected to the Internet. In other words, there are very security issues. The terminal is exposed to threats such as computer viruses, worms, and denial of service attacks called DoS. There is also a high possibility of information leakage.
Furthermore, when the IP address assigned by the ISP is a private address, the IP address assigned by the ISP may collide with the IP address assigned by the VPN. Even now, in public Internet connection bases such as cable television ISPs and Internet cafes, private addresses are assigned to terminals. In addition to this, “Carrier Grade NAT” (http://itpro.nikkeibp.co.jp/article/COLUMN/20080625/309452/), which is expected to spread with the exhaustion of IPv4 addresses, will be widely implemented in the future. Then, the possibility of IP address collision can be expected to increase dramatically.

Next, the latter method called port forwarding or static NAT will be described. This is a technique disclosed in Non-Patent Document 2 and Non-Patent Document 3.
For example, assume that a private network of 192.168.0.0/24 is built in a certain home. If you want to build a web server in this home LAN and publish it to the Internet via a broadband router, you can send a packet with a specific port number called "Port Forward Setting" or "Static NAT Setting" to the broadband router. Set to redirect to a specific machine (server).

Now, the broadband gateway is assigned the default gateway “192.168.10.1” as the IP address of the home LAN, and the dynamic global IP address assigned by the ISP is “203.178.83. 194 ". In the broadband router, a packet coming to port 80 of “203.178.83.194” is sent to port 80 of a machine to which another IP address “192.168.10.2” of the home LAN is assigned. Set to forward to No. The broadband router rewrites the destination IP address of the packet from “203.178.83.194” to “192.168.10.2” and transfers the packet to the server. Thus, the server in the LAN can provide a service as a web server to the outside (the Internet). This is the technique disclosed in Non-Patent Document 2. In addition, not only the IP address but also the port number can be rewritten with respect to the packet.
Such a technique called static NAT is often implemented as a kernel function (driver) of a POSIX OS such as Linux (registered trademark).

Since the broadband router simply redirects packets coming from the Internet into the LAN, there is a problem in security. Therefore, a technique for improving security with encryption and authentication of a communication path is an application such as OpenSSH (http://www.openssh.com/en/). This is disclosed in Non-Patent Document 3.
However, OpenSSH requires time and effort to generate and distribute a public key for each connected user, and it is necessary to install an SSH client and a public key in a terminal that is a client. Also, technologies such as OpenSSH have not completely eliminated potential security risks. In other words, it depends on the level of security vulnerability of OpenSSH itself. Since the SSH server, which is an Open SSH server, opens port 22 by default, there is a risk of DoS attacks on port 22 and the like. Furthermore, since OpenSSH does nothing about the security of the terminal itself as a client, it is necessary to take measures in consideration of the security of the terminal separately.

  All of the VPN methods described above are specially constructed only for the purpose of “connecting from the Internet to a server in the LAN”. In addition, the connection technology is not perfect because there are many setting items and the possibility of connection failure cannot be eliminated. Security measures must be taken into consideration separately.

The present invention provides a novel network system that solves such problems, solves the problems of the conventional VPN described above, and realizes flexible operability and strong security by adding extremely lightweight software and hardware. The purpose is to do.

In order to solve the above-described problems, a network system according to the present invention includes a terminal connected to the Internet, a behavior restriction unit that is provided inside the terminal and restricts the operation of the terminal, and a boundary between the private network and the Internet. A reverse proxy server configured to operate and transfer a packet transmitted from the terminal by operating a corresponding reverse proxy, a server connected to the terminal by a reverse proxy disposed on the private network and operating on the reverse proxy server, and the terminal The device identification ID is provided between the terminal and the Internet and uniquely identifies each device. When connecting to the reverse proxy server, terminal authentication is performed using the device identification ID. If the terminal authentication is successful, the reverse proxy server and the specified information are After forming the control session for receiving, terminal which terminal uses to access the server, the terminal resource string is a string the application program identifies the information resource of the connection partner running on the terminal is stored A virtual resource table having a resource string field for a terminal and a target address field for a terminal in which an IP address used when the terminal accesses the server is obtained from the reverse proxy server through a control session, and based on the virtual resource table In response to a specific connection request of the terminal, the port forward forming apparatus forms a data session based on port forwarding for the terminal to transmit / receive predetermined data to / from the server .

In order to solve the above problems, a network system of the present invention is connected to the Internet, a first server arranged on a private network, a second server arranged on the private network, and a first server. A terminal connected to the server and the second server, a behavior restriction unit provided inside the terminal, for restricting the operation of the terminal, and a boundary between the private network and the Internet. When the connection request is issued, the first reverse proxy is activated, and when the terminal issues a connection request to the second server, the reverse proxy server is activated and the terminal is provided inside the terminal, or the terminal A device-specific ID that can be used to uniquely identify each device When connecting to the server, performs terminal authentication using the device specific ID, after forming a control session for transmitting and receiving a reverse proxy server and the predetermined information when the terminal authentication is successful, the terminal uses to access the server Stores a terminal resource character string field in which a terminal resource character string, which is a character string for identifying an information resource of a connection partner, by an application program running on the terminal, and an IP address used when the terminal accesses the server a virtual resource table and a target address field terminal to be, obtained from the reverse proxy server through the control session, based on the virtual resource table, when the terminal issues a connection request to the first server, the terminal is first for sending and receiving server and predetermined data, the first Li Forming a first data session based on the port forwarding corresponding to Supurokishi, transmission and reception based on the virtual resource table, when the terminal issues a connection request to the second server, the terminal is a second server and predetermined data And a port forward forming device for forming a second data session based on port forwarding corresponding to the second reverse proxy.

  After the port forward forming device performs authentication through the control session, if the terminal requests connection to a server in the private network existing ahead of the reverse proxy server, the port forward forming device performs port forwarding, and the reverse proxy server performs reverse proxy. To form a data session between the terminal and the server. By constructing the network system in this way, it is possible to realize a connection to a server of a terminal across a firewall in a virtual connection form without private address collision. Furthermore, since the behavior restriction unit strongly restricts the behavior of the terminal at the time of connection, security vulnerability can be protected.

According to the present invention, it is possible to provide a novel network system that realizes flexible operability and strong security by adding extremely lightweight software and hardware.

It is the schematic of the network system of this embodiment. It is the schematic of the network system which paid its attention to the 1st terminal. It is the schematic of the network system which paid its attention to the 2nd terminal. It is an external appearance perspective view of INI-BOX. It is a block diagram which shows the hardware constitutions of INI-BOX. It is a functional block diagram of INI-BOX. It is a functional block diagram of software INI. It is a functional block diagram of RTA. It is a functional block diagram of NC. It is a time chart which shows the flow of operation | movement until a terminal connects to the internet and completes authentication. It is a time chart which shows the flow of operation | movement until a terminal connects to the internet and completes authentication. It is a time chart which shows the flow of operation | movement which starts an application from a terminal and connects to the server in LAN. It is the schematic of a server table, a virtual resource table, and a user resource table.

[Outline of Embodiment]
An outline of the present embodiment will be described.
The present invention provides a mechanism for securely connecting to a server in a LAN through the Internet. As an example, there is a mechanism for an employee to securely connect to a server connected to a corporate LAN from the outside or home via the Internet. In order to realize this mechanism, the following apparatuses and programs are newly provided. The three types of devices and programs described below are all uniquely named by the inventor and the applicant because there is no device or the like that provides an equivalent function in the conventional network technology.

・ Network Center (hereinafter abbreviated as “NC”)
The NC, which can also be called a reverse proxy server, is provided between the LAN and the Internet, activates a reverse proxy as necessary, and connects a terminal connected to the Internet to a server in the LAN. At first glance, the NC appears to be a gateway on which the reverse proxy server operates, but through the terminal authentication, the reverse proxy process is activated only when a connection request is received from the terminal. Therefore, unlike a normal server, the NC cannot open a port unnecessarily, which is advantageous in terms of security.

・ Intelligent Network Interface (hereinafter referred to as “INI”)
The INI, which can also be called a port forward forming device, includes a device identification ID indicating that the device itself is qualified to connect to the NC, and performs terminal authentication (individual authentication) and user authentication (personal authentication) for the NC. Perform double authentication. First, when terminal authentication is completed, the INI forms a control communication path with the NC. This is called a control session. Once the control session is created, the INI then performs user authentication. When the user authentication is completed, the INI receives control setting information including information related to a server (virtual resource table) that the user can connect to the terminal and information for performing various controls (restriction information) from the NC.
When the user operates the terminal to issue a request to connect to the server, the INI transmits a connection request to the server to the NC through the control session. When the request is approved by the NC, an encrypted communication path (data session) for the NC and the server is formed, and a packet filter and port forwarding are set.

The packet filter is set to limit the operation of the terminal only to the connection with the server, and to eliminate the cause of the accident such as inadvertently connecting to an arbitrary server on the Internet. In the restriction information transmitted from the NC, a range of IP addresses for which transmission / reception is prohibited (or transmission / reception is permitted) is listed, and a packet filter is set according to the restriction information.
By port forwarding, a packet transmitted to and received from a server that is transmitted / received via the NC serving as a reverse proxy is rewritten as a packet for the NIC located on the local side of the terminal, and the port number is rewritten as necessary. The terminal can communicate with a server in the LAN as if it were communicating with a local NIC.

The INI is configured in two forms: one configured as hardware connected to the terminal (hereinafter “INI-BOX”) and one configured as software installed in the terminal (hereinafter “soft INI”). There is. Both provide the same functions. The difference is that the INI-BOX performs port forwarding to the built-in local NIC, while the software INI performs port forwarding to the loopback virtual NIC built in the network OS as a standard.
The INI is a device and a program in which functions have been further rearranged and improved based on the technology disclosed in Patent Document 1 filed by the inventor in the past.
Hereinafter, when simply describing “INI”, it is defined as a word indicating both INI-BOX and software INI.

Real-time agent (RealTime Agent: hereinafter abbreviated as “RTA”)
If the terminal is connected to the Internet and further connected to a server in the LAN through the INI and NC, various security concerns arise. Therefore, in order to strongly restrict the operation of the terminal, this RTA is installed in the terminal.
The RTA, which can also be called a behavior restriction unit, communicates with the INI to provide a user interface for user authentication, and when communication between the INI and the NC is established, some application program interfaces (hereinafter referred to as “Application Program Interface”) of the OS. API ").
The restriction information transmitted from the NC and given through the INI lists application programs that are prohibited from being executed (or permitted to be executed), files that are prohibited from being viewed, edited, moved, or deleted. The RTA monitors the hooked API according to the restriction information and strongly restricts the behavior of the terminal.

  RTA also provides a shell function. When user authentication ends normally, the RTA displays a window on the terminal screen and displays an icon in the window. The icon includes an application startup parameter (command line), and an application name that permits execution and a server name of a server that permits access are specified as arguments of the application. Since the application is started as a child process of RTA, the RTA can easily grasp the behavior of the application.

  RTA uses API hook technology such as virus checker and malware. Since the RTA is under the control of the NC, if an abnormal behavior is detected by the hooked API, the execution can be stopped immediately and reported to the NC. If this technology is applied to a high level, it will be possible to defend against unknown viruses. Therefore, the “zero-day attack” (a program security hole has been announced and a patch that corrects the security hole of the program has become a problem in recent years. It is also possible to cope with an attack that actually attacks the security hole by a malicious person or a malicious program that exploits the security hole appears at a time before the provision of the security hole. Even if a virus is accidentally mixed in the terminal, once the RTA is started and connected to the NC, the suspicious behavior is immediately identified from the result of the API hook, so the NC forcibly connects the terminal. Emergency measures such as cutting can be executed instantly.

As described above, with the three devices and programs, a terminal existing on the Internet can connect to a server in the LAN through port forwarding by INI and reverse proxy by NC. At that time, only the communication with the server is permitted by the RTA for the behavior of the terminal, and the other behavior is greatly limited.
In this connection form, the IP address attached to the packet is rewritten twice in each of the port forwarding and the reverse proxy. As a result, the terminal is not in a state of being given an IP address in the LAN as disclosed in Non-Patent Document 1, but is in a state close to the port forwarding connection mode disclosed in Non-Patent Document 3. Become.

[overall structure]
FIG. 1 is a schematic diagram of a network system according to the present embodiment.
A LAN 102 is laid inside a company (not shown) of a company, and a first server 103, a second server 104, a first terminal 105, and a second terminal 106 are connected to the LAN 102. An NC 108 that also functions as a firewall is connected between the LAN 102 and the Internet 107.
The first terminal 105 and the second terminal 106 are notebook personal computers, and employees can take them out or at home.
Now, employee A (not shown) takes the first terminal 105 out of the company building and tries to continue working at home (not shown). The employee A connects the INI-BOX 109 to the first terminal 105 and connects the INI-BOX 109 to a modem (not shown) provided by the first ISP 110. Then, the first terminal 105 is connected to the Internet 107 through the INI-BOX 109 and the first ISP 110. When the INI-BOX 109 is connected to the Internet 107, it immediately tries terminal authentication with respect to the NC. However, even if terminal authentication ends normally, as long as user authentication is not performed, the first terminal 105 can connect to the Internet and a desired web server on the Internet 107 as in the normal state. Conversely, connection to the first server 103 or the second server 104 in the LAN 102 through the NC 108 is not possible.

  When the employee A operates the first terminal 105 to execute user authentication, the first terminal 105 is connected to the NC 108 by the action of the RTA 111 and the INI-BOX 109 installed in the first terminal 105. Then, the first terminal 105 cannot connect to a desired web server or the like on the Internet 107 that has been able to be executed up to that point. Next, when the employee A clicks on the icon for connecting to the first server 103 displayed by the RTA 111, an application with the command name embedded in the icon is started, and the application is connected to the NC 108 through the INI-BOX 109. A connection request for one server 103 is transmitted. When the NC 108 receives the connection request from the INI-BOX 109, the NC 108 activates a reverse proxy for connecting the first server 103 to the first terminal 105, and forms a data session between the NC 108 and the INI-BOX 109. On the other hand, the INI-BOX 109 sets port forwarding and forms a communication path for connecting the first terminal 105 to the first server 103. In this way, the employee A can operate the first terminal 105 to connect to the first server 103 and continue the desired work.

  Next, the employee B takes the second terminal 106 out of the company building and tries to continue working from the outside using an Internet connection. Employee B connects the second terminal 106 to an Internet connection service provided by the second ISP 112. Then, the second terminal 106 is connected to the Internet 107 through the second ISP 112. When the second terminal 106 is connected to the Internet 107, the software INI 113 installed in the second terminal 106 immediately tries terminal authentication with respect to the NC 108. However, even if terminal authentication ends normally, as long as user authentication is not performed, the second terminal 106 can connect to the Internet and a desired web server on the Internet 107 as in the normal state. Conversely, connection to the first server 103 or the second server 104 in the LAN 102 through the NC 108 is not possible.

  When the employee B operates the second terminal 106 to perform user authentication, the second terminal 106 is connected to the NC 108 by the action of the RTA 111 and the software INI 113 installed in the second terminal 106. Then, the second terminal 106 cannot connect to a desired web server or the like on the Internet 107 that has been able to be executed up to this point. Next, when employee B clicks on the icon for connecting to the second server 104 displayed by the RTA 111, an application with the command name embedded in the icon is started, and the application is connected to the NC 108 through the software INI 113 to the second NC 108. A connection request to the server 104 is transmitted. When the NC 108 receives the connection request from the software INI 113, the NC 108 activates a reverse proxy for connecting the second server 104 to the second terminal 106, and forms a data session between the NC 108 and the software INI 113. On the other hand, the software INI 113 sets port forwarding and forms a communication path for connecting the second terminal 106 to the second server 104. In this way, the employee B can operate the second terminal 106 to connect to the second server 104 and continue the desired work.

  The first terminal 105 is connected to the Internet 107 via the INI-BOX 109. On the other hand, since the software INI 113 is installed in the second terminal 106, the network system configured in the OS directly connected to the Internet 107. In any case, it is possible to connect to the first server 103 and the second server 104 in the LAN 102.

FIG. 2 is a schematic diagram of the network system focused on the first terminal 105. For the sake of space, the description of the Internet 107 to which the NC 108 is connected is omitted in FIG. 2 and FIG. 3 described later.
An OS 201 is installed in the first terminal 105, and an application program such as the third application 203 is executed through the shell 202 that is a part of the OS 201. In addition to this, an RTA 111 is installed in the first terminal 105 and is executed by a predetermined operation.
The OS 201 is a general multitasking network OS, and is, for example, Windows (registered trademark). Hereinafter, the description will be made on the assumption that Windows (registered trademark) is installed in the first terminal 105 and the second terminal 106. However, the OS 201 is not limited to Windows (registered trademark), for example, Linux (registered trademark). A POSIX OS such as the above may be used.
The OS 201 grasps data input / output with the storage 204 such as a hard disk, the operation unit 205 such as a keyboard and a mouse, the display unit 206 such as a liquid crystal display, and the built-in USB interface 207, which are the hardware of the first terminal 105. An API is provided to allow applications to easily use these hardware.

  When the INI-BOX 109 completes the user authentication, the RTA 111 hooks some APIs of the OS 201 to greatly limit the behavior of the first terminal 105 as a whole. Further, when an abnormality is detected, the occurrence status at that time is reported to the NC 108 through the INI-BOX 109.

  Further, the RTA 111 also provides a function as the shell 202. The user interface provided by the RTA 111 for the user to connect to the first server 103 is the dedicated shell 208. When user authentication ends normally, the dedicated shell 208 of the RTA 111 displays a window on the terminal screen and displays an icon in the window. The icon includes an application startup parameter (command line), and an application name that permits execution and a server name of a server that permits access are specified as arguments of the application. The application programs started as child processes of the RTA 111 in this way are the first application 209 and the second application 210 in FIG. Since the application is started as a child process of the RTA 111, the RTA 111 can easily grasp the behavior of the application.

  In FIG. 2, a first application 209 and a second application 210 started from the dedicated shell 208 are displayed. On the other hand, the shell 202 and the third application 203 of the OS 201 that are already executed until the first terminal 105 completes the user authentication are in a state of being activated separately. Since these are not applications started as child processes of the dedicated shell 208 of the RTA 111, the behavior is greatly limited by the API hook function of the RTA 111. In addition, activation of an application that is prohibited from being executed or a file that is prohibited from the “open file” operation is inhibited by the RTA 111 and cannot be executed.

  An INI-BOX 109 is connected to the built-in USB interface 207 of the first terminal 105. The INI-BOX 109 incorporates a DHCP client, which will be described later, and can be connected to the Internet by being connected to the first ISP 110. The first ISP 110 is a provider that provides an Internet connection environment to an end user, but for convenience of explanation, the first ISP 110 is assumed to be a gateway between a DHCP server that provides a dynamic global IP address for Internet connection and the Internet 107. .

  When the INI-BOX 109 is connected to the Internet 107 through the first ISP 110, the NC 108 can also be connected. When the INI-BOX 109 recognizes that it is connected to the Internet 107, it immediately tries terminal authentication with respect to the NC 108. The NC 108 incorporates a terminal table described later, and device identification IDs included in the INI-BOX 109 are listed in the terminal table. The NC 108 indicates that the INI-BOX 109 or the software INI 113 that has requested terminal authentication is a terminal that permits the NC 108 to connect to the server, and the device identification ID of the INI-BOX 109 or the software INI 113 in the terminal table. Recognize the presence of, and notify the other party that it has been successfully authenticated.

  When the INI-BOX 109 succeeds in terminal authentication, the INI-BOX 109 reports the terminal authentication success to the RTA 111 through the built-in USB interface 207. At this time, the RTA 111 transmits / receives predetermined control information and the like to / from the INI-BOX 109 through the IP network constructed on the built-in USB interface 207. In response to the successful terminal authentication, the RTA 111 displays an input screen for user authentication on the display unit 206 and accepts the operation of the operation unit 205 by the user.

FIG. 3 is a schematic diagram of a network system focused on the second terminal 106.
The difference between the second terminal 106 and the first terminal 105 is that the software INI 113 is installed in the second terminal 106 instead of the INI-BOX 109, and is interposed between the OS 201 and the RTA 111, The second terminal 106 is connected to the second ISP 112 via the built-in NIC 301. Therefore, in the first terminal 105, the first ISP 110 assigns a dynamic global IP address to the INI-BOX 109, but in the second terminal 106, the second ISP 112 directly adds the dynamic global IP address to the built-in NIC 301 built in the second terminal 106. An IP address will be assigned. Since the software INI 113 is installed in the second terminal 106, message passing, shared memory, or the like without performing transmission / reception of predetermined control information via the IP network as in the case of the INI-BOX 109 with the first terminal 105. Can use general interprocess communication mechanisms such as named pipes.

[INI-BOX109]
4A and 4B are external perspective views of the INI-BOX 109. FIG.
FIG. 4A is an external perspective view of the INI-BOX 109 as seen obliquely from the front. Two USB-A connectors 402 are provided on the front surface of the INI-BOX 109. A personal authentication information generating device (not shown) is connected to the USB-A connector 402.
FIG. 4B is an external perspective view of the INI-BOX 109 viewed from an oblique back surface. One USB-B connector 403 and one network connector 404 are provided on the back surface of the INI-BOX 109. The USB-B connector 403 is connected to a terminal through a USB-B cable (not shown). A LAN cable is connected to the network connector 404, and a modem (not shown) provided by the first ISP 110 is connected to the network connector 404.

FIG. 5 is a block diagram showing a hardware configuration of the INI-BOX 109.
The INI-BOX 109 formed of a microcomputer includes a CPU 502, a RAM 503, a flash memory 504 serving as a nonvolatile storage also serving as a ROM, a first USB interface 505, a second USB interface 506, and a first NIC 507 connected to a bus 508. Yes.
The flash memory 504 stores an OS kernel, a library, and main parts such as management commands. The OS is, for example, Linux (registered trademark).
The INI-BOX 109 receives power supply from the first terminal 105, which is a personal computer, through a USB cable. That is, the INI-BOX 109 is a bus powered device.
A second NIC not described in FIG. 5, which will be described later with reference to FIG. 6, is virtually created by the OS and application program stored in the flash memory 504.

FIG. 6 is a functional block diagram of the INI-BOX 109.
The INI-BOX 109 includes two network interfaces.
The first NIC 507 is a NIC configured as hardware as illustrated in FIG. 5, and is connected to the Internet 107 via the first ISP 110.
Although not shown in FIG. 5, the second NIC 601 is virtually created by an OS and application programs stored in the flash memory 504. When viewed from the first terminal 105, the second NIC 601 is recognized as an external NIC connected by USB. In other words, the second NIC 601 is a device that is included in a subnet configured by the network system of the first terminal 105 and can be directly accessed from the first terminal 105.

  When the first NIC 507 of the INI-BOX 109 is connected to the first ISP 110, the DHCP client 602 transmits a network such as an IP address, a netmask, a default gateway, and a name resolver from a DHCP server (not shown) of the first ISP 110 through the first NIC 507. The configuration information is received, and the first NIC 507 is set so that the first NIC 507 can connect to the network.

  Next, the address duplication avoiding unit 603 refers to the network configuration information acquired by the DHCP client 602, and if the IP address to be assigned to the second NIC 601 belongs to the subnet of the first NIC 507, the second NIC 601 In order to belong to a network of a different subnet from the first NIC 507, the startup parameters of the DHCP server 604 are adjusted. Specifically, when a global IP address is assigned to the first NIC 507, the second NIC 601 has a default value of 192.168.8.0, which is an IP address belonging to the network address 192.168.0.0/24. 1. If the network address of the first NIC 507 is 192.168.0.0/24, the IP address of 192.168.1.0/24 is 192.168.1. 1 is given.

  In a state where the first NIC 507 of the INI-BOX 109 is connected to the first ISP 110 and a private IP address is also assigned to the second NIC 601, the port forward setting unit 605 configures a general dynamic NAT. Thereby, the Internet connection is established between the first NIC 507 and the second NIC 601 without any trouble. At this time, the encrypted communication processing unit 606 does not perform encryption processing and decryption processing of a packet flowing between the second NIC 601 and the first NIC 507.

  On the other hand, when the authentication control unit 607 knows that the Internet connection is completed between the first NIC 507 and the second NIC 601, it immediately tries terminal authentication with respect to the NC 108. The device identification ID 608 used for terminal authentication is encrypted by the encrypted communication processing unit 606 controlled through the control session management unit 609 and transmitted to the NC 108. Upon receiving notification of successful terminal authentication from the NC 108 via the encrypted communication processing unit 606, the authentication control unit 607 notifies the RTA 111 of the first terminal 105 of successful terminal authentication. At this point, a control session is formed between the INI-BOX 109 and the NC.

  When the authentication control unit 607 receives user authentication information from the RTA 111 through the second NIC 601 or from an external personal authentication device connected to the second USB interface 506, the authentication control unit 607 transmits the information to the NC 108 again through the encrypted communication processing unit 606. And attempt user authentication. There are various types of user authentication information. When receiving from the RTA 111, it is a general user ID and password. When receiving from the second USB interface 506, a device for realizing personal authentication, such as a fingerprint authentication device or an IC card reader, is connected to the second USB interface 506, and information used for personal authentication can be obtained from these devices. Further, the user ID and password may be received from the RTA 111, the authentication data may be received from the IC card reader, and these may be collectively transmitted to the NC 108. Hereinafter, information for authenticating a user who uses these terminals is collectively referred to as personal authentication information.

  The personal authentication information is encrypted by the encrypted communication processing unit 606 controlled through the control session management unit 609 and transmitted to the NC 108. When the notification of the success of the personal authentication is received from the NC 108 through the encrypted communication processing unit 606, the authentication control unit 607 transfers this notification to the RTA 111. Upon receiving notification from the RTA 111 that the personal authentication has been completed normally, the authentication control unit 607 notifies the control session management unit 609 of the success of the personal authentication. Then, control of the entire INI-BOX 109 is left to the control session management unit 609.

  Upon receiving the control transfer notification from the authentication control unit 607, the control session management unit 609 requests the NC 108 to transmit control setting information 610 related to the user currently using the first terminal 105 through the control session. . In response to the transmission request for the control setting information 610, the NC 108 creates control setting information 610 corresponding to the user who has performed personal authentication from a user table and a server table, which will be described later, and transmits them to the INI-BOX 109. Upon receiving the control setting information 610 from the NC 108, the control session management unit 609 stores it in the RAM 503.

  Next, the control session management unit 609 reads the packet filtering setting information described in the restriction information that is a part of the control setting information 610 received from the NC 108 and controls the packet filter setting unit 611. The packet filter setting unit 611 configures a packet filter in accordance with the packet filtering setting information given from the control session management unit 609.

  Next, the control session management unit 609 transmits the control setting information 610 received from the NC 108 to the RTA 111 of the first terminal 105. The RTA 111 reads the API hook setting information described in the restriction information which is a part of the control setting information 610, and sets the API hook. In addition, an icon is provided, and link information for accessing a server to which the user is permitted to access is embedded in the icon. In the case of FIG. 1, since the user of the first terminal 105 is permitted to access the first server 103, the application for accessing the first server 103 and the link information for accessing the first server 103 are: An icon is provided in the GUI screen of the RTA 111.

  The form of link information varies depending on the protocol. If it is HTTP, it is a URL (Uniform Resource Locator), and if it is a CIFS (Common Internet File System: Protocol of the Windows (registered trademark) file sharing service (SMB) is an extended protocol), the server name Alternatively, it is a character string in a format in which the full path name of the file is added to the IP address of the server. In the case of RDP (Remote Desktop Protocol), only the server name or the IP address of the server is used.

When the user clicks on an icon provided by the RTA 111 with a pointing device such as a mouse, the application embedded as the application program name in the icon is started through the dedicated shell 208 of the RTA 111, and the application is linked information described as a startup parameter. To generate a packet indicating an access request. When the INI-BOX 109 receives this packet, the control session management unit 609 requests the NC 108 to connect to the server corresponding to the packet. The NC 108 activates a reverse proxy corresponding to the server requested by the user. On the other hand, the control session management unit 609 controls the port forward setting unit 605 to set the port forwarding so that the packet reaches the server through the reverse proxy of the NC 108.
Thus, the first terminal 105 can connect to the first server 103 via the INI-BOX 109 and the NC 108.

[Soft INI]
FIG. 7 is a functional block diagram of the software INI 113.
The software INI 113 includes two network interfaces.
The built-in NIC 301 is a NIC built in the second terminal 106 as hardware, and is connected to the Internet 107 via the second ISP 112.
The loopback virtual NIC 701 is a known loopback interface that is installed in the second terminal 106 and is provided as a standard in the network OS of the IPv4 protocol. Even if the terminal is not equipped with a NIC, as long as the OS 201 supports the IPv4 protocol, a loopback interface to which an IP address of 127.0.0.1 is always assigned is configured in the OS 201. Unless special settings are made, the packet transmitted to the loopback interface is sent to the packet reception target of the terminal itself. In other words, “loop back” returns to the starting point, that is, the terminal itself so that the transmitted packet draws a circle.

  In the case of the INI-BOX 109, the first NIC 507 is not a device that can be accessed directly from the first terminal 105. However, in the case of the software INI 113, both the built-in NIC 301 and the loopback virtual NIC 701 are devices that can be equally accessed from the OS 201 and applications of the second terminal 106.

  When the built-in NIC 301 of the software INI 113 is connected to the second ISP 112, the DHCP client 702 built in the OS 201 receives an IP address, a netmask, a default gateway, a name resolver, and the like from a DHCP server (not shown) of the second ISP 112 through the built-in NIC 301. The network configuration information is received, and the built-in NIC 301 is set so that the built-in NIC 301 can be connected to the network.

  In the case of the INI-BOX 109, after this procedure, it was necessary to perform processing so that the subnets of the first NIC 507 and the second NIC 601 do not overlap, but the loopback virtual NIC 701 is assigned a global or private IP address. Since the network segment does not necessarily overlap with the built-in NIC 301, there is no need to provide the address duplication avoiding unit 603. Further, since the loopback address is fixed, the DHCP server 604 is also unnecessary.

  In a state where the built-in NIC 301 of the software INI 113 is connected to the second ISP 112, the port forward setting unit 705 does nothing. Also, the packet filter setting unit 706 does nothing. Thereby, the OS 201 and the application can connect to the Internet through the built-in NIC 301 without any trouble. At this time, the encrypted communication processing unit 606 does not perform encryption processing and decryption processing of a packet flowing between the loopback virtual NIC 701 and the built-in NIC 301.

  On the other hand, when the authentication control unit 607 knows that the Internet connection of the built-in NIC 301 has been completed, it immediately tries terminal authentication with respect to the NC 108. The device identification ID 608 used for terminal authentication is encrypted by the encrypted communication processing unit 606 controlled through the control session management unit 609 and transmitted to the NC 108. Upon receiving notification of successful terminal authentication from the NC 108 through the encrypted communication processing unit 606, the authentication control unit 607 notifies the RTA 111 of the second terminal 106 of successful terminal authentication. At this time, a control session is formed between the software INI 113 and the NC 108.

  Upon receiving personal authentication information from the RTA 111 or from an external personal authentication device connected to the built-in USB interface 207, the authentication control unit 607 transmits this information to the NC 108 again through the encrypted communication processing unit 606, and attempts user authentication. .

  The personal authentication information is encrypted by the encrypted communication processing unit 606 controlled through the control session management unit 609 and transmitted to the NC 108. When the notification of the success of the personal authentication is received from the NC 108 through the encrypted communication processing unit 606, the authentication control unit 607 transfers this notification to the RTA 111. Upon receiving notification from the RTA 111 that the personal authentication has been completed normally, the authentication control unit 607 notifies the control session management unit 609 of the success of the personal authentication. Then, control of the entire software INI 113 is left to the control session management unit 609.

  Upon receiving the control transfer notification from the authentication control unit 607, the control session management unit 609 requests the NC 108 to transmit control setting information 610 related to the user currently using the second terminal 106 through the control session. . In response to the transmission request for the control setting information 610, the NC 108 creates control setting information 610 corresponding to the user who has performed personal authentication from a user table and a server table, which will be described later, and transmits them to the software INI 113. Upon receiving the control setting information 610 from the NC 108, the control session management unit 609 stores it in a RAM 503 (not shown).

  Next, the control session management unit 609 reads the packet filtering setting information described in the restriction information that is a part of the control setting information 610 received from the NC 108 and controls the packet filter setting unit 706. The packet filter setting unit 706 configures a packet filter in accordance with the packet filtering setting information given from the control session management unit 609.

  In the case of the INI-BOX 109, next, the control session management unit 609 follows the procedure of transmitting the control setting information 610 to the RTA 111 of the second terminal 106. In the case of the software INI 113, the software INI 113 and the RTA 111 are connected to the second terminal 106. The control setting information 610 received from the NC 108 can immediately refer to the RTA 111 as well. Therefore, the procedure in which the software INI 113 transmits the control setting information 610 to the RTA 111 of the second terminal 106 cannot essentially occur.

  The RTA 111 reads the API hook setting information described in the restriction information which is a part of the control setting information 610 stored in the RAM 503 (not shown), and sets the API hook. In addition, an icon is provided, and link information for accessing a server to which the user is permitted to access is embedded in the icon. In the case of FIG. 1, since the user of the second terminal 106 is permitted to access the second server 104, the application for accessing the second server 104 and the link information for accessing the second server 104 are An icon is provided in the GUI screen of the RTA 111.

When the user clicks on an icon provided by the RTA 111 with a pointing device such as a mouse, the application embedded as the application program name in the icon is started through the dedicated shell 208 of the RTA 111, and the application is linked information described as a startup parameter. To generate a packet indicating an access request. The destination IP address of this packet is that of the loopback virtual NIC 701 or an IP address within the range of the subnet (127.0.0.0/8) to which the loopback virtual NIC 701 belongs. When the control session management unit 609 of the software INI 113 receives this packet, the control session management unit 609 requests the NC 108 to connect to the server corresponding to the packet. The NC 108 activates a reverse proxy corresponding to the server requested by the user. On the other hand, the control session management unit 609 controls the port forward setting unit 705 to set the port forwarding so that the packet reaches the server through the reverse proxy of the NC 108. Then, a packet transmitted / received by the application to / from the loopback virtual NIC 701 or a specific port in the subnet to which the loopback virtual NIC 701 belongs is transmitted / received to / from the NC 108 via the port forward setting unit 705.
In this way, the second terminal 106 can connect to the second server 104 via the software INI 113 and the NC 108.

The INI-BOX 109 and the software INI 113 have been described above.
As is apparent from the above description, the INI operates on the OS 201 running on the terminal or through the OS 201 based on an instruction from the NC 108, specifically, restriction information that is part of the control setting information 610 created by the NC 108. A packet filter is used to limit communications generated from applications that perform Then, in order to realize a virtual connection to the server permitted by the user, port forwarding for the NC 108 is set.
By performing port forwarding, the terminal can connect to the server via the Internet 107 and a firewall in the same state as when connecting to the server in the LAN 102.

  The control setting information 610 created by the NC 108 includes restriction information that is setting information for controlling the operation of the INI and the RTA 111, and a virtual resource table necessary for name resolution, which will be described later. The description of the role of the control setting information 610 described so far has been the role of restriction information. The virtual resource table will be described in detail in the explanation of name resolution described later.

[RTA111]
FIG. 8 is a functional block diagram of the RTA 111.
As is apparent from the above description, the RTA 111 determines the application to be started on the terminal and the operation of the application based on the instruction of the NC 108, specifically, the restriction information that is part of the control setting information 610 created by the NC 108. It monitors the devices used with it, performs control such as restricting the operation as necessary, and manages log recording and the like. In order to realize such a function, the RTA 111 hooks an API provided in the OS 201 and constantly monitors the behavior of the application and the OS 201. If the API matches the restriction condition described in the restriction information, the RTA 111 prevents the API from starting and reports it to the NC 108 through the INI.

In FIG. 8, the OS 201 and applications that are indispensable when describing the RTA 111 are also expressed as functional blocks.
Although various functions are included in the OS 201, when describing the present embodiment, the OS 201 can be considered as a collection of device drivers for making hardware easy to handle from an application. The device driver can be said to be a collection of APIs. In FIG. 8, functional blocks are described mainly focusing on these hardware and device drivers.

The main hardware provided in the terminal includes an operation unit 205 that is a pointing device such as a keyboard and a mouse, a display unit 206 such as a liquid crystal display, a storage 204 such as a hard disk, and a NIC. However, in the case of the first terminal 105 described above, the NIC is virtually provided in the INI-BOX 109. In any case, the NIC exists as long as it is connected to the Internet 107.
The operation driver 801 delivers operation information issued by the operation unit 205 to the application and the shell 202.
The display control unit 802 converts screen drawing instruction information generated from the application or the shell 202 into actual screen drawing information and passes it to the display unit 206.

The file system 803 configures files and directories in the storage 204, and operates the files and directories in accordance with instructions from the application and the shell 202.
The process control unit 804 controls execution and termination of applications and libraries existing in the storage 204 through the applications and the shell 202.
The clipboard buffer 805 functions as a temporary buffer for copying, moving, and deleting data objects between applications and shells 202.
A network driver 806 that can also be called a TCP / IP protocol stack establishes an environment in which communication can be performed between the application or shell 202 and the network, and controls the communication.

  The network driver 806 also includes a DHCP client 702. When using the INI-BOX 109, the DHCP client 602 in the INI-BOX 109 gives a dynamic IP address to the second NIC 601 in the INI-BOX 109 based on the network configuration information received from the DHCP server 604 in the INI-BOX 109. . When using the software INI 113, the DHCP client 702, which is a function of the network driver 806, gives a dynamic IP address to the built-in NIC 301 based on the network configuration information received from the DHCP server 604 of the second ISP 112.

  When the RTA 111 is started by an initial startup process of the OS 201, a user operation through the shell 202, or automatically executed by connecting a USB memory to a terminal while being stored in the USB memory, the RTA 111 is first started with an API. The hook setting unit 807 tries to communicate with the INI-BOX 109 or the software INI 113. If the communication with the INI-BOX 109 or the software INI 113 is successful, the API hook setting unit 807 next waits for reception from the INI-BOX 109 or the software INI 113 that the terminal authentication is successful. When a report indicating that the terminal authentication is successful is received from the INI-BOX 109 or the software INI 113, the API hook setting unit 807 next executes user authentication. If the external personal authentication device is connected to the INI-BOX 109 or the terminal, it is given priority. If not, a screen for inputting the user ID and password is displayed on the display unit 206, and the user input is awaited.

Upon receiving a report from the NC 108 through the INI-BOX 109 or the software INI 113 that the user authentication has been successful, the API hook setting unit 807 next checks whether or not the control setting information 610 exists.
In the case of the software INI 113, if the user authentication is successful, the software INI 113 downloads the control setting information 610 from the NC 108 and holds the control setting information 610 in the RAM (not shown) of the terminal. Without any action, you can immediately move to the next action.
In the case of the INI-BOX 109, the API hook setting unit 807 requests the control setting information 610 from the INI-BOX 109. The control setting information 610 is downloaded from the INI-BOX 109 and the control setting information 610 is stored in the RAM 503.

  When the control setting information 610 is obtained from the NC 108, the API hook setting unit 807, according to the information described in the restriction information that is a part of the control setting information 610, the operation information acquisition unit 808, the screen capture processing unit 809, the file system Settings are made in the monitoring unit 810, the process monitoring unit 811, the clipboard monitoring unit 812, and the API hook processing unit 813.

The file system monitoring unit 810 monitors copying, moving, deleting, and renaming as behaviors for a specific file or directory specified by the restriction information.
The process monitoring unit 811 monitors the activation of a process such as a specific application specified by the restriction information and the self-process concealing action.
The clipboard monitoring unit 812 monitors operations such as copying, moving, and deleting data objects with respect to the clipboard buffer 805 by a specific application specified by the restriction information.

In the API hook processing unit 813, the file system monitoring unit 810 performs API hook processing for the file system 803, the process monitoring unit 811 performs API hook processing for the process control unit 804, and the clipboard monitoring unit 812 performs API hook processing for the clipboard buffer 805. , Each realized.
When the shell 202 or application tries to cause some operation on a file or process by the API hook processing unit 813, the file system monitoring unit 810 or the process monitoring unit 811 is called each time, and should the corresponding API be executed? It is determined whether or not.

The operation information acquisition unit 808 reports the operation information obtained from the operation driver 801 to the NC 108 through the INI-BOX 109 or the software INI 113 when the conditions described in the information are met according to the information described in the restriction information. .
When the screen capture processing unit 809 meets the conditions described in the information according to the information described in the restriction information, the screen capture processing unit 809 transmits the bitmap screen information obtained from the display control unit 802 to the NC 108 through the INI-BOX 109 or the software INI 113. Report to

  The dedicated shell 208 includes an application program name of an application that the user is allowed to execute and a server resource name (resource: “information resource”) that the user is allowed to access according to the description of the control setting information 610. Create an icon. The contents of the icon are a command line character string, and the name of the application program to be executed and the resource name of the server are described as arguments. Further, depending on the application program, various option switches required at the time of activation are also included. Application programs started by clicking this icon with a pointing device such as a mouse are the first application 209 and the second application 210 in FIG. Since the first application 209 and the second application 210 are started as child processes of the dedicated shell 208, the behavior of the first application 209 and the second application 210 can be completely grasped through the dedicated shell 208.

  On the other hand, the OS 201 has a shell 202 provided as a standard. Of course, there is also an application program started from the shell 202. The process monitoring unit 811 has a file system monitoring unit 810, a process monitoring unit 811, and a clipboard monitoring unit 812 for the shell 202 and the application that do not pass through the dedicated shell 208 (the third application 203 corresponds to this in FIG. 8). Monitor the behavior closely and immediately cease operations that could pose a security threat to the server. In addition, the process monitoring unit 811 forcibly terminates the application program whose activation itself is prohibited.

[NC108]
FIG. 9 is a functional block diagram of the NC 108.
The NC 108 of this embodiment also serves as a gateway for the LAN 102. The third NIC 901 connected to the Internet 107 is assigned a fixed global IP address, and the fourth NIC 902 connected to the LAN 102 is assigned a fixed private IP address serving as the gateway address of the LAN 102. Between the third NIC 901 and the fourth NIC 902, a dynamic NAT function for a terminal connected to the LAN 102 to connect to the Internet 107, and a terminal and a server in the LAN 102 due to security threats on the Internet 107 A firewall 903 having a packet filtering function for protecting the network is provided.

The encrypted communication processing unit 904 connected to the third NIC 901 makes a pair with the encrypted communication processing unit 606 provided in the INI-BOX 109 and the software INI 113. That is, transmission / reception of INI and authentication information, and encryption of a control session and a data session are performed.
The authentication unit 905 performs terminal authentication and user authentication with reference to the terminal table 906 and the user table 907. Further, the authentication unit 905 writes the combination of the device identification ID 608 and the user ID in the authenticated ID list 908 for a terminal for which user authentication has been completed normally.

  The control session management unit 909 makes a pair with the control session management unit 609 provided in the INI-BOX 109 and the software INI 113. That is, a control session is formed with the INI, and various control information is transmitted to and received from the terminal. In particular, the restriction information is stored for each user in the user table 907, and the control session management unit 909 reads the restriction information of the user from the user table 907 and transmits it to the INI in response to the INI request.

  The data session management unit 910 activates a reverse proxy corresponding to the server through the control session management unit 909 in response to a connection request from the INI to the server, and forms a data session between the INI and the NC 108. . As shown in FIG. 9, the process activated by the data session management unit 910 increases or decreases according to the number of data sessions formed between the first reverse proxy 911, the second reverse proxy 912,. To do.

The terminal table 906 is a table in which the INI device identification IDs 608 that the NC 108 permits connection are listed.
The user table 907 stores personal authentication information such as user IDs and passwords of users permitted to be connected by the NC 108, restriction information of the users, and server names of servers to which the users are permitted to connect.
The server table 913 stores a user ID, a server name of a server that can be used by the user of the user ID, a protocol type used for accessing the server, a corresponding reverse proxy program name, and the like. This server table 913 stores information necessary for the “name resolution” mechanism necessary for correctly specifying the server to which the terminal wants to connect.

When the terminal completes user authentication, the control session management unit 909, from the server table 913, in order for the user to access the server, the virtual resource table that is information necessary for the terminal and the user that is information necessary for the reverse proxy Create a resource table.
The virtual resource table constitutes control setting information 610 together with the restriction information of the user table 907 and is transmitted to the INI.
The user resource table is created for each user, stored in the resource table directory 914 of the NC 108, and used for starting the reverse proxy.

  A reverse proxy server program (not shown) is prepared according to a protocol used when accessing the server. If HTTP, the proxy mode result code is implemented. In the case of CIFS or RDP, only IP address rewriting is performed.

  As is clear from the above description, the NC 108 performs dual authentication of terminal authentication and user authentication on the INI, and forms a control session with the INI. Then, in order to realize a connection with the server for the user who operates the terminal, a data session is formed between the INI and the NC 108, and a reverse proxy connected to the data session is activated between the server and the INI.

In the explanation of the INI, when the INI performs port forwarding, the terminal can connect to the server via the Internet 107 and the firewall 903 in the same state as when connecting to the server in the LAN 102. explained. This will be described in detail.
If the terminal simply connects to a server that exists on the other side of the firewall 903, a reverse proxy may be set in a gateway of the LAN 102 or a device arranged at the boundary between the LAN 102 and the Internet 107. However, in this case, the terminal connects to the global IP address of the machine where the reverse proxy operates. Such a connection form may cause various adverse effects depending on the security setting originally provided in the application.

  Specifically, for example, in a web browser “Internet Explorer” (hereinafter abbreviated as “IE”) provided as standard in Windows (registered trademark) of Microsoft Corporation, the IP address of the web server to be connected, FQDN (Full Security settings such as whether to execute scripts or external applications embedded in HTML (Hyper Text Markup Language) documents according to host names that do not include a Qualified Domain Name (fully qualified domain name) or domain name It has a function to change. Web applications are built on the assumption that the web server in the LAN 102 is accessed from a terminal in the LAN 102. Scripts that are dangerous and cannot be executed on the web server on the Internet 107 also prioritize convenience. Are included in the HTML document. In other words, if the reverse proxy alone is used, it is not possible to guarantee that a desired application such as an IE will operate normally even if it is connected from the Internet 107 to a server in the LAN 102. high.

  In order to solve this problem, a mechanism that “makes the user feel as if connected to a server in the LAN 102” is required for an application running on a terminal such as an IE. The solution for this is port forwarding. Connecting to a server through port forwarding means connecting to a private address in the same subnet as the terminal in the case of INI-BOX 109, and to a loopback address in the case of software INI 113. In any case, when viewed from the IE, the destination IP address attached to the packet belongs to the “local intranet” that can lower the security setting of the application. In this way, the terminal realizes access as a “local intranet” without restriction to a server beyond the firewall 107, beyond the Internet 107.

[Operation]
10 and 11 are time charts showing the flow of operations until the terminal completes authentication after connecting to the Internet 107.
The operation of the terminal connecting to the Internet 107 is slightly different between the INI-BOX 109 and the software INI 113.
In the case of the first terminal 105 to which the INI-BOX 109 is connected, the first NIC 507 of the INI-BOX 109 is connected to the modem provided by the first ISP 110.
In the case of the second terminal 106 incorporating the aforementioned software INI 113, the built-in NIC 301 of the second terminal 106 is connected to the modem provided by the second ISP 112.
Then, in the case of the INI-BOX 109, the DHCP client 702 built in the INI-BOX 109 is activated (S1001), and in the case of the software INI 113, the DHCP client 702 built in the OS 201 is activated (S1002), and the DHCP server provided in the ISP is activated. By receiving the network configuration information from the network and applying predetermined settings to the NIC (S1003), the terminal establishes a connection with the Internet 107 (S1004).

When detecting that the terminal is connected to the Internet 107, the INI authentication control unit 607 transmits a device identification ID 608 to the NC 108 and attempts terminal authentication (S1005). The authentication unit 905 of the NC 108 performs verification (S1006) and returns the result of terminal authentication to the INI.
If the terminal authentication result returned from the NC 108 is “normally authenticated (authentication OK)” (YES in S1007), the INI authentication control unit 607 reports that fact to the RTA 111 (S1008). At this time, a communication channel for control, that is, a control session is formed between the NC 108 and the software INI 113.
Conversely, if the authentication result returned from the NC 108 is “normal authentication could not be performed (authentication NG)” (NO in S1007), the process ends abnormally (S1009). In the case of abnormal termination, since the terminal is not qualified to connect to the NC 108, there are no further processing items.

When the API hook setting unit 807 of the RTA 111 receives a report that the terminal authentication has been normally completed from the INI, the API hook setting unit 807 uses a screen for inputting the user ID and password on the display unit 206 of the terminal or an external personal authentication device. The user authentication operation guidance screen is displayed (S1010), and input of personal authentication information is awaited (S1011). When the personal authentication information is input, the API hook setting unit 807 transmits the personal authentication information to the INI (S1012). The INI authentication control unit 607 transfers the received personal authentication information to the NC 108 (S1013).
The authentication unit 905 of the NC 108 searches the user table 907 with the received personal authentication information, and verifies whether the personal authentication information is valid (S1014). The authentication unit 905 returns the verification result to the INI (S1015). The INI authentication control unit 607 transfers the received user authentication result to the RTA 111 (S1016).

  If the user authentication result returned from the NC 108 is “normally authenticated (authentication OK)” (YES in S1017), the API hook setting unit 807 of the RTA 111 waits for the control setting information 610 to be transmitted from the INI. . On the contrary, if the authentication result returned from the NC 108 is “normal authentication could not be performed (authentication NG)” (NO in S1017), an error screen is displayed on the display unit 206 (S1018), and the user authentication screen is displayed again. Is displayed (S1010). That is, since the terminal authentication is completed but the user authentication is not completed, the user authentication operation is repeated until the user authentication is normally completed.

If the verification result of the user authentication received from the authentication unit 905 of the NC 108 is valid, the INI authentication control unit 607 notifies the control session management unit 909 of successful personal authentication. Then, control of the entire software INI 113 is left to the control session management unit 909.
Upon receiving the control transfer notification from the authentication control unit 607, the control session management unit 909 requests the NC 108 to transmit control setting information 610 related to the user currently using the terminal through the control session (S1019).
In response to the transmission request for the control setting information 610 issued by the INI, the control session management unit 909 of the NC 108 creates control setting information 610 corresponding to the user who has performed personal authentication from the user table 907 and the server table 913, It transmits to INI (S1020).
Upon receiving the control setting information 610 from the NC 108, the INI control session management unit 909 stores the control setting information 610 in the RAM 503. In the case of the INI-BOX 109, the RAM 503 of the INI-BOX 109, and in the case of the software INI 113, the RAM 503 provided in the terminal.

  Next, the INI control session management unit 909 reads the packet filtering setting information described in the control setting information 610 received from the NC 108 and controls the packet filter setting unit 706. The packet filter setting unit 706 configures a packet filter in accordance with the packet filtering setting information given from the control session management unit 909 (S1021).

The description will be continued with reference to FIG.
Next, the INI control session management unit 909 transmits the control setting information 610 received from the NC 108 to the RTA 111 (S1122). However, this operation is only for the INI-BOX 109. In the case of the software INI 113, since the control setting information 610 received by the software INI 113 itself is stored in the RAM 503 of the terminal as it is, the RTA 111 can also directly access the control setting information 610, so that there is no need for transfer.

The RTA 111 performs predetermined settings for various functional blocks including the API hook processing unit 813 according to the contents of the control setting information 610 (S1123).
Thus, RTA 111 constituted an API hook and INI constituted a packet filter.

Subsequent operations are loop operations.
The API hook setting unit 807 of the RTA 111 detects an abnormal operation described in the control setting information 610 from the file system monitoring unit 810, the process monitoring unit 811, and the clipboard monitoring unit 812 (YES in S1124), and is called an API. Is blocked (S1125), and the NC 108 is notified of detailed information (S1126).
When the INI packet filter detects an abnormal packet described in the control setting information 610 (YES in S1127), the flow of the packet is blocked (S1128), and the NC 108 is notified of detailed information (S1129). .
When the NC 108 receives the report of the abnormal state, it records it in a log (not shown) (S1130).

FIG. 12 is a time chart showing a flow of operations for starting an application from a terminal and connecting to a server in the LAN 102.
When the user operates the terminal to activate an application that intends to use the server (S1201), a packet indicating an access request from the application to the server is generated (S1202).
When the INI control session management unit 909 detects a packet indicating an access request generated from the terminal, the INI control session management unit 909 determines a server to which the terminal application requests connection from the destination IP address and port number of the packet. Then, an access request for the server is transmitted to the NC 108 through the control session (S1203).

  Upon receiving an access request for the server from the INI (S1204), the control session management unit 909 of the NC 108 refers to a user resource table to be described later and delivers the reverse proxy program name corresponding to the server to the data session management unit 910. . The data session management unit 910 activates the reverse proxy program designated by the control session management unit 909 (S1205).

  On the other hand, the INI control session management unit 909 sets port forwarding (S1206). Thus, the application establishes a virtual connection with the server through the virtual connection between the application and the INI (S1207), the port forwarding between the INI and the NC 108 (S1208), and the reverse proxy connection between the NC 108 and the server (S1209) (S1209). S1210).

Name resolution
In a TCP / IP network, when a client connects to a server, in most cases, a name resolution mechanism called a name resolver that converts a host name or FQDN to an actual IP address is required. Name resolution according to this embodiment will be described.
FIGS. 13A, 13B, and 13C are schematic diagrams of the server table 913, the virtual resource table, and the user resource table.

FIG. 13A shows an example of the contents of the server table 913.
The “user ID” field is a field that stores a user ID that is common to the user table 907.
The “server name” field is a field in which the name of a server used in the LAN 102 is stored. The server name stored in the “server name” field may be an FQDN or a host name that does not include a domain name.
The “protocol” field is a field in which the name of the protocol of the service provided by the server is stored.

The “reverse proxy resource character string” field is a character string for specifying an information resource provided by the server, which is used when the reverse proxy accesses the server. For example, in the case of HTTP, it is “ServerRoot” indicating the starting directory of the server.
The “port number” field is a port number used for a service provided by the server.

The “terminal resource character string” field is a character string that is used when the terminal accesses the server and the terminal application program identifies the information resource of the connection partner, and is embedded in an icon provided by the RTA dedicated shell. It is also an argument. For example, in the case of HTTP, it is a URL, and in the case of CIFS, it is a resource name indicating a route through which a server provides a resource.
The “reverse proxy program name” field is a program name of a reverse proxy that is activated to connect the terminal and the server. For example, HTTP (http://www.squid-cache.org/), delegate (http://www.delegate.org/delegate/), RDP and CIFS stone (http: //gw.gcd .org / sengoku / stone / Welcome.ja.html).

When the terminal completes user authentication, the control session management unit 909 narrows down and searches the server table 913 using the user ID of the user as a search key. Then, the record obtained by narrowing down becomes a list of servers available to the user. Note that, for the sake of space, FIG. 13A shows an example in which the user ID “sugiyayama” is narrowed down in advance. Accordingly, the server table 913 differs only in the contents of the “user ID” field, and there may exist records in which the contents of the fields other than the “user ID” field are exactly the same.
Next, the control session management unit 909 assigns a virtual IP address used by the terminal to the record obtained by the narrow-down search of the server table 913. As a method for assigning virtual IP addresses, IP addresses belonging to the subnet of the NIC that performs port forwarding are assigned in order. At this time, among IP addresses belonging to the subnet, an IP address which is often used as a broadcast address, a network address, and a normal default gateway and in which only the least significant bit of the host part is “1” is assigned from the IP address to be assigned. Is excluded.

In the case of the INI-BOX 109, it starts from “192.168.0.2”, is incremented by 1, and is assigned up to “192.168.0.254”.
In the case of the software INI 113, it starts from “127.0.0.2”, is incremented by 1, and is allocated to “127.0.0.254”.
This is a general class C IP address range, and addresses that are generally available within the class C range, excluding network addresses, broadcast addresses, and default gateways, from “2” to “254”. This is due to the fact that the number is 253.

When the virtual IP address is assigned, a virtual resource table and a user resource table are created from these records.
The virtual resource table is data obtained by removing the “user ID” field and the “reverse proxy resource character string” field from the records obtained by the narrow-down search of the server table 913. The control session management unit 909 configures the control setting information 610 together with the restriction information of the user table 907, and transmits it to the INI.
The user resource table is data obtained by removing the “user ID” field and the “terminal resource character string” field from the records obtained by the narrow-down search of the server table 913. The control session management unit 909 creates a file with the file name using the user ID and stores it in the resource table directory 914.

  As is well known, a server does not necessarily provide a single service from a single server. In particular, in HTTP, when accessing a server with a different FQDN while having the same IP address as in the “virtualhost” function of Apache (http://httpd.apache.org/), it is connected to a completely different server. Thus, there is a function that can obtain different contents, and it is widely used. In order to deal with such various “services”, it is necessary to make the access method for the resources provided by the server correspond to the virtual connection of the terminal.

  The “reverse proxy resource character string” is a character string that specifies a resource for the reverse proxy program to access the server resource as a client to the server. Although the server name is used as it is in FIG. 13, this assumes that a private DNS server is operating in the LAN 102. If the DNS server for resolving the name of the server on the LAN 102 is not operating in the LAN 102, the private IP address attached to the server is used instead of the host name of the “reverse proxy resource character string”. It will be filled in directly.

  On the other hand, the “terminal resource character string” is a character string for designating a resource for the program to access the server when a predetermined program is started on the terminal. However, this string can be converted by a reverse proxy. Even without using Apache's virtual host function, it is possible to realize a function equivalent to virtual host only by devising the setting of “resource string for reverse proxy” and “resource string for terminal” in server table 913. it can.

  On the other hand, if Apache is already running on the web server and virtualhost is set, the virtual host set to Apache in the “terminal resource character string” is necessary in order for the virtualhost function to work correctly. The name must be included. This is because Apache's virtualhost function determines which virtual host is set to “ServerRoot” by viewing the FQDN sent with the “HOST” option of the HTTP “GET” method by Apache, which is a web server. .

  In any case, the server table 913 manages the “reverse proxy resource character string” and the “terminal resource character string” separately, thereby satisfying the functions required of today's web server without excess or deficiency. I can do it.

  When the application program reads “terminal resource character string” designated as an argument, the application program extracts the FQDN, host name, or IP address from the terminal resource character string. If it is an IP address, a connection request packet with the IP address as the destination IP address is issued as it is. If not, the application program attempts name resolution.

In the present embodiment, there are several means for name resolution.
One is to describe the correspondence between the FQDN or host name extracted from the “terminal resource character string” in the user resource table and “terminal target address” in “hosts” which is a text file.
The other is that the INI or RTA configures a DNS server and returns a “terminal target address” in response to an FQDN or host name query generated from an application.
The other is that when the INI or RTA hooks the API of the network and detects the FQDN or host name query generated from the application, the “target address for the terminal” is set in place of the DNS server referred to by the network system. To return.

  As can be seen from the description of FIGS. 12 and 13, in the network system of this embodiment, when a terminal application tries to connect to a server, a data session is first formed with a port different from the control session. If the server to which the terminal is to connect is different, a different data session is formed each time. The NC manages the server resources that can be used for each user by the server table. When the user authentication is completed, the virtual resource table for port forwarding and the user resource table for the reverse proxy are automatically created from the server table. A virtual connection service can be easily provided to a large number of users without causing an accident such as duplication of data sessions.

[Web browser virtual connection]
Web technology is indispensable not only for the use of the Internet 107 but also for today's LAN 102. The web browser is not only a tool for browsing information, but also constitutes a user interface of a web application. Even in the virtual connection of this embodiment, it is a necessary condition that the web browser operates without trouble.
However, HTML, which is the basic technology of the web, has a technology called “link”. This link, specifically, “<a href="...”>”, “A tag” describing a URL character string indicates an information source of a web server other than the web server that outputs the HTML document. There are many.

  As described above, in the virtual connection of the present embodiment, the terminal is restricted from connecting directly to the Internet 107. However, there are many cases where resources on the Internet 107 are indicated by A tags in HTML documents. In this state, the HTML document cannot be displayed correctly.

  Therefore, in this embodiment, the web browser activated from the dedicated shell 208 of the RTA 111 is crafted. Specifically, when starting the web browser, the proxy server is forcibly set. The proxy server address is the IP address of the destination of port forwarding for virtual connection. When the web browser is set in this way, the web browser tries to acquire all the content specified by the A tag from the LAN 102 at a remote location through port forwarding and reverse proxy. Resources on the Internet 107 can also be acquired through a gateway called NC108. The advantage of this connection method is that the security policy applied to the LAN 102 is directly reflected on the terminal. The same security policy as that when the terminal exists in the LAN 102 is also applied on the Internet 107.

This embodiment can be applied as follows.
(1) The terminal table 906 and the user table 907 of the NC 108 may be placed on a different server from the NC 108 and referred to by the authentication unit 905 through the network.
Further, the authentication unit 905, the terminal table 906, and the user table 907 may be provided as an authentication server different from the NC 108. In this case, a correspondence relationship between the device identification ID and the user ID is written in the authenticated ID list 908 and received from the authentication server.

  (2) A multi-stage reverse proxy can be configured by providing a plurality of NCs 108.

  (3) INI can also access a plurality of NCs 108 simultaneously. In this case, the INI reports the terminal target address assigned by the previously connected NC immediately after completing the user authentication to the NC to be connected later. It is necessary to mediate so as not to overlap.

  In the terminal target address given in FIG. 13B, the original port number is used as it is. Instead of incrementing the terminal target address by 1, it is possible to fix the terminal target address and change the port number. Especially in the case of HTTP, it is widely performed to change the port number. Therefore, in the case of HTTP, connection to a different server is performed by assigning a different port number with the same terminal target address. Thus, consumption of the target address for the terminal can be reduced.

In the present embodiment, a network driver 806 and a port forward forming device (INI-BOX 109, software INI 113), a terminal management device (RTA 111), and a reverse proxy server (NC 108) used for the network driver 806 are disclosed.
After the INI-BOX 109 or the software INI 113 and the NC 108 execute device authentication and user authentication through the control session, if the terminal requests connection to a server in the private network existing ahead of the NC 108, the INI-BOX 109 or the software INI 113 For port forwarding, NC 108 sets up a reverse proxy to form a data session between the terminal and the server. By constructing the network system 101 in this way, it is possible to realize a connection to a terminal server beyond the firewall 903 in a virtual connection form with no private address collision. Furthermore, since the RTA 111 strongly restricts the behavior of the terminal at the time of connection, security vulnerabilities can be protected.

  Generally, the BSD socket programming method for configuring a server is to open a port that waits for a client connection, and when a client is connected, open the port again to wait for the next client connection. It is. In other words, the server always has a specific port open. If the port is left open, a malicious third party can search for the vulnerability of the server program through the port.

  The inventor, in order to eliminate the possibility of being exploited by a third party, a vulnerability that may exist in a plurality of reverse proxy programs corresponding to a plurality of protocols held by the NC 108, Separated ports for connecting data. The data session formed by the NC 108 is different from the server method in the original BSD socket programming, and even if the data session is established, the port corresponding to the same data session is not opened. As long as there is no connection request from the terminal, a data session is not formed and a port for that purpose is not opened. When a third party port scans NC 108, it appears that only the port for the control session is open.

  The idea of separating the control session and the data session is similar to FTP (File Transfer Protocol) that has existed for a long time. In the case of FTP, the service port is fixed at 21 and the data port is any port of 20 in the PORT mode and 1024 or more in the PASV mode. In dynamic NAT, which is mandatory in today's routers, it is a SYN packet. It is criticized today as an implementation that is not very good in terms of security, because it is difficult to form a NAT setting based on it and passwords transmitted and received at the service port are not encrypted. However, it is a matter pointed out as a feature of a single protocol in a situation where each protocol is independently and randomly organized, and it can be regarded as a technical idea of a higher-level protocol that manages and manages each protocol. It turns out that this is a very easy-to-use basic technology.

Furthermore, a device identification ID 608 for uniquely identifying each terminal is given to the terminal connected to the network system according to the present embodiment. This device identification ID 608 is different from the IP address and is used only as authentication information in the control session.
Here, the packet flowing in the data session of the network system of this embodiment will be considered and described.

In the case of the software INI 113, the packet issued from the terminal is the source IP address is the loopback address (127.0.0.1), and the destination IP address is included in the class C subnet to which the loopback address belongs. Address (127.0.0.x). In the case of the INI-BOX 109, the source IP address is a private address (192.168.0.1), and the destination IP address is an address (192.168.8.0.x) included in the class C subnet to which the private address belongs. ).
The source IP address and destination IP address (and the port number if necessary) are rewritten by port forwarding in the software INI 113 or INI-BOX 109. The IP address assigned to the software INI 113 or INI-BOX 109 from the ISP is rewritten as the transmission source IP address, and the global IP address of the NC 108 and the port number for the data session are rewritten as the transmission destination IP address.

Further, the source IP address and destination IP address (and port number if necessary) of these packets are rewritten again by the reverse proxy of the NC 108. The source IP address is rewritten to the NC 108 global IP address, and the destination IP address and port number are rewritten to the server private address and port number, respectively.
Thus, in the situation where the IP address of the packet passing through the communication path is rewritten one after another every time it passes through the base, the device identification ID 608 that is information for guaranteeing the uniqueness of the terminal must be used for what. It can be understood that the device identification ID 608 is information indicating that the terminal has the qualification to connect to the server. This information does not necessarily have to be held by a server that provides a service to the terminal, and it is only necessary that a device (NC 108) capable of executing predetermined authentication exists.

  As is well known, IPv4 faces an urgent problem that addresses are running out. So why are addresses running out? At first glance, you would normally think that there are not enough bits in the IP address. However, a more fundamental problem is that an attempt is made to obtain the uniqueness of a terminal in an IP address that determines a destination of a packet that passes through a communication path. The IP address is defined as a protocol and is a bit string that is always attached to a packet. Therefore, it must have a fixed length, and the bit string cannot be easily expanded. The inventor thought that this was the source of the mistake.

  The information for determining the uniqueness of the terminal may be used only for the situation for determining the uniqueness of the terminal, that is, for authentication, and should be clearly distinguished from the information for determining the destination of the packet. Based on this technical idea, the inventor denies that the uniqueness of the terminal is obtained from the IP address, and the IP address is divisible by information used only for the destination of the packet, and the communication path is virtualized and authenticated. Based on the behavior, we tried to reconstruct the network system. This is the present embodiment.

  The device identification ID 608 included in the INI of the present embodiment is data that is defined only as a protocol and is used only for authentication, not an IP address incorporated as a packet header. Therefore, even if an action such as enlarging the bit string or changing the format as many times as necessary according to the scale of the network system or the necessity, the packet format does not change, so no problem occurs. In the present embodiment, the inventor assigned 12 bytes to the device identification ID 608 when creating the prototype, but of course, a longer bit string may be used.

Furthermore, in the present embodiment, an embodiment in which a terminal connects to a server through a firewall 903 by using a new “virtual private connection” technology that replaces an existing VPN has been disclosed. It is not a technique that is applied only as a technique for connecting to a server connected to the LAN 102. The technology of this embodiment is also a technology for connecting devices to which private addresses are assigned. Therefore, the server to which the private address is assigned may be a web server that assumes general public access. The NC 108 of this embodiment provides a mechanism equivalent to an existing DNS, that is, a mechanism for performing name resolution from an FQDN to an IP address. The NC 108 causes the INI-BOX 109 or the software INI 113 of the terminal to perform name resolution from the FQDN to the virtual IP address provided by the INI-BOX 109 or the software INI 113 instead of the global IP address. Then, the NC 108 directs the packet transferred by the port forwarding to the target server. When the NC 108 is configured in this way and the network of this embodiment is developed and spread, the server does not need a global IP address. Of course, the terminal does not require a global IP. The global IP address is used only for packet transmission / reception control between bases, and it is no longer necessary to acquire a global IP address when attempting to build a server for some business or hobby purpose. A security concern that arises at this time is to set the IP address for port forwarding to an IP address other than the “local intranet”. For example, a private IP address that is not the network address of the subnet to which the terminal belongs is assigned to the IP address targeted for port forwarding, and the IP address is equivalent to a global IP address that is not a “local intranet” for the application Recognize
As described above, the network system according to the present embodiment also includes one aspect as a technique for expanding the possibility of the IPv4 protocol.

  The embodiment of the present invention has been described above. However, the present invention is not limited to the above-described embodiment, and other modifications may be made without departing from the gist of the present invention described in the claims. Includes application examples.

  DESCRIPTION OF SYMBOLS 101 ... Network system, 102 ... LAN, 103 ... 1st server, 104 ... 2nd server, 105 ... 1st terminal, 106 ... 2nd terminal, 107 ... Internet, 109 ... INI-BOX, 110 ... 1st ISP, 111 , RTA, 112, second ISP, 113, software INI, 202, shell, 203, third application, 204, storage, 205, operation unit, 206, display unit, 207, built-in USB interface, 208, dedicated shell, 209 ... 1st application, 210 ... 2nd application, 301 ... Built-in NIC, 402 ... USB-A connector, 403 ... USB-B connector, 404 ... Network connector, 502 ... CPU, 503 ... RAM, 504 ... Flash memory, 505 ... First USB interface, 50 ... second USB interface, 507 ... first NIC, 508 ... bus, 601 ... second NIC, 602 ... DHCP client, 603 ... address duplication avoiding unit, 604 ... DHCP server, 605 ... port forward setting unit, 606 ... encryption Communication processing unit, 607 ... authentication control unit, 608 ... device identification ID, 609 ... control session management unit, 610 ... control setting information, 611 ... packet filter setting unit, 701 ... loopback virtual NIC, 702 ... DHCP client, 705 ... Port forward setting unit, 706 ... Packet filter setting unit, 801 ... Operation driver, 802 ... Display control unit, 803 ... File system, 804 ... Process control unit, 805 ... Clipboard buffer, 806 ... Network driver, 807 ... API hook setting unit 808 ... Operation information acquisition unit, 809 ... Screen capture processing unit, 810 ... File system monitoring unit, 811 ... Process monitoring unit, 812 ... Clipboard monitoring unit, 813 ... API hook processing unit, 901 ... Third NIC, 902 ... Fourth NIC, 903: Firewall, 904: Encrypted communication processing unit, 905 ... Authentication unit, 906 ... Terminal table, 907 ... User table, 908 ... Authenticated ID list, 909 ... Control session management unit, 910 ... Data session management unit, 911 ... First reverse proxy, 912 ... Second reverse proxy, 913 ... Server table, 914 ... Resource table directory

Claims (8)

A device connected to the Internet,
A behavior restriction unit provided inside the terminal and restricting the operation of the terminal;
A reverse proxy server that is arranged at a boundary between a private network and the Internet and operates a corresponding reverse proxy to transfer a packet transmitted from the terminal; and
A server disposed on the private network and connected to the terminal by the reverse proxy operating on the reverse proxy server;
When the device identification ID is provided inside the terminal or between the terminal and the Internet and includes a device identification ID that can uniquely identify each device and connects to the reverse proxy server, the device identification ID The terminal is used to access the server after forming a control session for transmitting and receiving predetermined information to and from the reverse proxy server when the terminal authentication is successful. Stores a terminal resource character string field in which a terminal resource character string, which is a character string for identifying an information resource of a connection partner, and an IP address used when the terminal accesses the server. A virtual resource table having a target address field for a terminal. Obtained from the reverse proxy server through a session, on the basis of the virtual resource table, the relative specific connection request from the terminal, the terminal for transmitting and receiving the server and the predetermined data, data session based on the port forwarding A network system comprising a port forward forming apparatus for forming a network.   The network system according to claim 1, wherein the behavior restriction unit forms a screen for performing user authentication with the reverse proxy server through the port forward forming apparatus after the port forward forming apparatus completes the terminal authentication. .   The port forward forming device performs user authentication for further authenticating a user who uses the terminal after completing the terminal authentication, and the behavior restriction unit applies a restriction to the operation of the terminal when the user authentication is successful. The network system according to claim 1, wherein restriction information that is information is received from the reverse proxy server. The terminal further includes
Storage,
A file system for forming files and directories in the storage;
A process control unit for controlling the start and end of the application program,
The behavior restriction unit receives the restriction information received by the port forward forming device and monitors the file system of the terminal for copying, moving, deleting and / or renaming the file and / or directory. Monitoring the activation of a specific process and / or the self-process concealment with respect to the process control unit of the terminal,
The network system according to claim 3. A first server located on a private network;
A second server located on the private network;
A terminal connected to the Internet and connected to the first server and the second server;
A behavior restriction unit provided inside the terminal and restricting the operation of the terminal;
Located at the boundary between the private network and the Internet, when the terminal issues a connection request to the first server, the first reverse proxy operates and the terminal issues a connection request to the second server. Then, the reverse proxy server that operates the second reverse proxy,
When the device identification ID is provided inside the terminal or between the terminal and the Internet and includes a device identification ID that can uniquely identify each device and connects to the reverse proxy server, the device identification ID The terminal is used to access the server after forming a control session for transmitting and receiving predetermined information to and from the reverse proxy server when the terminal authentication is successful. Stores a terminal resource character string field in which a terminal resource character string, which is a character string for identifying an information resource of a connection partner, and an IP address used when the terminal accesses the server. A virtual resource table having a target address field for a terminal. Obtained from the reverse proxy server through the session, said based on the virtual resource table, when the terminal issues a connection request to the first server, for the terminal to transmit and receive the first server and predetermined data of the first data session is formed based on a corresponding port forwarding to the first reverse proxy, and based on the said virtual resource table, when the terminal issues a connection request to said second server, said terminal Forming a second data session based on port forwarding corresponding to the second reverse proxy for transmitting and receiving predetermined data to and from the second server .   6. The network system according to claim 5, wherein the behavior restriction unit forms a screen for performing user authentication with the reverse proxy server through the port forward forming apparatus after the port forward forming apparatus completes the terminal authentication. .   The port forward forming device performs user authentication for further authenticating a user who uses the terminal after completing the terminal authentication, and the behavior restriction unit applies a restriction to the operation of the terminal when the user authentication is successful. The network system according to claim 5, wherein restriction information that is information is received from the reverse proxy server. The terminal further includes
Storage,
A file system for forming files and directories in the storage;
A process control unit for controlling the start and end of the application program,
The behavior restriction unit receives the restriction information received by the port forward forming device and monitors the file system of the terminal for copying, moving, deleting and / or renaming the file and / or directory. Monitoring the activation of a specific process and / or the self-process concealment with respect to the process control unit of the terminal,
The network system according to claim 7.

Images