JP7467865B2 - Information processing system and information processing method - Google Patents

Description

The present invention relates to an information processing system and an information processing method .

Traditionally, when remote conferences are held over a communication network via the Internet at locations (offices, conference rooms, classrooms, laboratories, libraries, etc.) scattered throughout large facilities such as companies, universities, and hospitals, in addition to voice-only conferences, web conferencing systems that allow the sharing of video and conference materials are used.

However, some communication terminal devices, such as electronic whiteboards, which are tools for facilitating meetings, and on-premise conference systems, do not support remote communication via the Internet (for example, they do not support communication encryption, proxy support, firewalls, etc.).

As a result, for example, a method of using a communication network via the Internet to hold remote conferences between communication terminal devices that do not support remote communication via the Internet can be considered, such as building a site-to-site connection VPN (Virtual Private Network) (see, for example, Patent Documents 1 and 2 below).

However, with conventional technology, when the connection destination of a network control device (e.g., a VPN box, etc.) changes for each user, for example when making a temporary communication connection to a VPN from a rental office, it is necessary to manually change the connection destination settings on the network control device each time. For this reason, with conventional technology, there is a risk of various problems occurring, such as time-consuming settings and incorrect settings.

The present invention aims to solve the problems of the conventional technology described above by making it possible to eliminate the need to set the connection destination for a network control device when the connection destination of the network control device changes for each user.

In order to solve the above-mentioned problems, the information processing device of the present invention is an information processing device connected to a network control device provided on a local network via the network, and includes a login information acquisition unit that acquires login information input for the network control device and identification information of the network control device, a user authentication unit that performs authentication processing based on the login information, a connection destination information acquisition unit that acquires connection destination information associated with the login information from a connection destination information storage unit that stores connection destination information for connecting to a relay device as a connection destination of the network control device when the authentication processing by the user authentication unit is successful, and a connection destination information setting unit that sets the connection destination information acquired by the connection destination information acquisition unit to the network control device specified by the identification information acquired by the login information acquisition unit, thereby communicatively connecting the network control device to the relay device.

The present invention can eliminate the need to configure the connection destination of a network control device when the connection destination of the network control device changes for each user.

FIG. 1 is a diagram showing a configuration of an information processing system according to an embodiment of the present invention. Server and PC hardware configuration diagram Hardware configuration of the electronic whiteboard Video conferencing terminal hardware configuration diagram FIG. 2 is a diagram showing the functional configuration of a VPN server and a VPN box according to an embodiment of the present invention. 1 is a flowchart showing a procedure of a process performed by a VPN box according to an embodiment of the present invention. FIG. 1 is a diagram showing a flow of using a VPN box according to an embodiment of the present invention. FIG. 13 is a diagram showing an example of a login screen according to an embodiment of the present invention. FIG. 1 is a diagram showing an example of an IP address set in each device in an information processing system according to an embodiment of the present invention. FIG. 1 is a diagram showing an example of connection destination information stored in a connection destination information storage unit according to an embodiment of the present invention; 1 is a flowchart showing a procedure for a connection destination information setting process performed by a VPN server according to an embodiment of the present invention. FIG. 1 is a sequence diagram showing a processing sequence of an information processing system according to an embodiment of the present invention.

One embodiment of the present invention will be described below with reference to the drawings.

[Configuration of information processing system 10]
Fig. 1 is a diagram showing a configuration of an information processing system 10 according to an embodiment of the present invention. The information processing system 10 shown in Fig. 1 is a system that enables communication between a communication terminal device provided in a first local network 20A in a rental office 20 outside a cloud environment 14 (an example of a "global network") and a communication terminal device provided in a second local network 30A in a corporate network 30 outside the cloud environment 14 by dynamically forming a VPN via a relay server 500B provided in the cloud environment 14.

(Cloud environment 14)
As shown in FIG. 1, the information processing system 10 of this embodiment includes a VPN server 500A, a relay server 500B, an authentication server 500C, and a print server 500D in a cloud environment 14.

VPN server 500A is an example of an "information processing device." VPN server 500A controls communication connections by VPN boxes 21 and 31. Specifically, when a user who uses VPN box 21 or 31 successfully logs in, VPN server 500A automatically sets destination information in VPN box 21 or 31 for connecting to a relay device corresponding to the user. This allows VPN box 21 or 31 to automatically establish a communication connection to a relay device (e.g., relay server 500B) corresponding to the user who successfully logged in.

The relay server 500B is an example of a "relay device." The relay server 500B is connected to both the VPN boxes 21 and 31 for communication. As a result, the relay server 500B relays communication between the communication terminal device (electronic whiteboard 200, MFP 900, etc.) connected to the VPN box 21 and the communication terminal device (video conference terminal 700, conference server 500E, etc.) connected to the VPN box 31. Specifically, when a user who uses the VPN box 21 in the rental office 20 successfully logs in, the relay server 500B is automatically relayed from the VPN box 21 via the second communication path 12B. In addition, when a user who uses the VPN box 31 in the corporate network 30 successfully logs in, the relay server 500B is automatically relayed from the VPN box 31 via the second communication path 12B. As a result, relay server 500B is in a relay-connected state to both VPN boxes 21 and 31, and can relay communication between the communication terminal device connected to VPN box 21 and the communication terminal device connected to VPN box 31. Note that relay server 500B is in a sleep state when it is not connected to either VPN box 21 or 31, and may be switched to an active state in response to a request from VPN server 500A when a communication connection is made from either VPN box 21 or 31. Alternatively, relay server 500B may be in an active state at all times, regardless of the communication connection state of VPN boxes 21 and 31.

In response to a request from the VPN server 500A, the authentication server 500C authenticates the user who uses the VPN boxes 21 and 31. Specifically, when the user uses the VPN boxes 21 and 31, the authentication server 500C obtains from the VPN server 500A the login information entered from the PCs 500F and 500G. The authentication server 500C then performs user authentication based on the login information obtained from the VPN server 500A. Furthermore, the authentication server 500C returns the result of the user authentication ("success" or "failure") to the authentication server 500C.

The print server 500D is communicatively connected to the relay server 500B via the second communication path 12B. This allows the print server 500D to provide print services to devices communicatively connected to the relay server 500B (e.g., the electronic whiteboard 200 and MFP 900 connected to the VPN box 21, the video conference terminal 700 connected to the VPN box 31, the conference server 500E, etc.).

(Rental Office 20)
A VPN box 21 (an example of a "first network control device") is provided in the first local network 20A of the rental office 20. The VPN box 21 can automatically establish a communication connection as a VPN client to a relay device (e.g., relay server 500B) corresponding to a user who has successfully logged in, via a dynamically formed second communication path 12B, under the control of the VPN server 500A. This allows the VPN box 21 to perform inter-device communication from a communication terminal device connected to the VPN box 21 via the relay device (e.g., relay server 500B).

In addition, since communication data is encrypted by the second communication path 12B between the VPN box 21 and the relay server 500B, the communication terminal device connected to the VPN box 21 does not need to have an encryption function.

In addition, a communication terminal device connected to the VPN box 21 can communicate with a communication terminal device connected to the VPN box 31 via the relay server 500B, thereby passing through the firewall between the communication terminal device and the cloud environment 14.

In the example shown in FIG. 1, the VPN box 21 is communicatively connected to the electronic whiteboard 200 and the MFP 900 as examples of "communication terminal devices" by fixed IP addresses. In the example shown in FIG. 1, the VPN box 21 is communicatively connected to the PC 500F provided in a guest network outside the first local network 20A as an example of a "communication terminal device" by a dynamic IP address via the virtual bridge 22.

The VPN box 21 is also configured to automatically establish a communication connection to the VPN server 500A as a VPN client when the power is switched ON, and to form a first communication path 12A between the VPN box 21 and the VPN server 500A.

(Corporate Network 30)
A VPN box 31 (an example of a "second network control device") is provided in the second local network 30A of the corporate network 30. The VPN box 31 can automatically establish a communication connection as a VPN client to a relay device (e.g., relay server 500B) corresponding to a user who has successfully logged in, through a dynamically formed second communication path 12B, under the control of the VPN server 500A. This allows the VPN box 31 to perform inter-device communication from a communication terminal device connected to the VPN box 31 via the relay device (e.g., relay server 500B).

Note that since communication data is encrypted by the second communication path 12B between the VPN box 31 and the relay server 500B, the communication terminal device connected to the VPN box 31 does not need to have an encryption function.

In addition, a communication terminal device connected to the VPN box 31 can communicate with a communication terminal device connected to the VPN box 21 via the relay server 500B, thereby passing through the firewall between the communication terminal device and the cloud environment 14.

In the example shown in FIG. 1, a video conference terminal 700 and a conference server 500E are communicatively connected to the VPN box 31 by fixed IP addresses as examples of "communication terminal devices." In the example shown in FIG. 1, a PC 500G provided in a guest network outside the second local network 30A is communicatively connected to the VPN box 31 by a dynamic IP address via the virtual bridge 32 as an example of a "communication terminal device."

The VPN box 31 is also configured to function as a VPN client and automatically establish a communication connection to the VPN server 500A when the power is switched ON, and to form a first communication path 12A between the VPN box 31 and the VPN server 500A.

[Hardware configuration of each device]
Next, the hardware configuration of each device included in the information processing system 10 will be described with reference to FIGS.

(Hardware configuration of server and PC 500)
Fig. 2 is a hardware configuration diagram of the server, PC 500. In the following, the servers 500A to 500E and the PCs 500F, 500G shown in Fig. 1 will be collectively referred to as "server, PC 500".

As shown in FIG. 2, the server, PC 500, is constructed by a computer, and as shown in FIG. 2, includes a CPU 501, a ROM 502, a RAM 503, a HD 504, a HDD (Hard Disk Drive) controller 505, a display 506, an external device connection I/F (Interface) 508, a network I/F 509, a bus line 510, a keyboard 511, a pointing device 512, a DVD-RW (Digital Versatile Disk Rewritable) drive 514, and a media I/F 516.

Of these, the CPU 501 controls the operation of the server and the PC 500 as a whole. The ROM 502 stores programs used to drive the CPU 501, such as IPL. The RAM 503 is used as a work area for the CPU 501. The HD 504 stores various data such as programs. The HDD controller 505 controls the reading or writing of various data from the HD 504 according to the control of the CPU 501. The display 506 displays various information such as a cursor, menu, window, character, or image. The external device connection I/F 508 is an interface for connecting various external devices. In this case, the external device is, for example, a USB (Universal Serial Bus) memory or a printer. The network I/F 509 is an interface for data communication using the communication network 12. The bus line 510 is an address bus, a data bus, or the like for electrically connecting each component such as the CPU 501 shown in FIG. 2.

The keyboard 511 is a type of input means equipped with multiple keys for inputting characters, numbers, various instructions, etc. The pointing device 512 is a type of input means for selecting and executing various instructions, selecting a processing target, moving the cursor, etc. The DVD-RW drive 514 controls the reading and writing of various data from the DVD-RW 513, which is an example of a removable recording medium. Note that this is not limited to a DVD-RW, and may be a DVD-R, etc. The media I/F 516 controls the reading and writing (storing) of data from the recording medium 515, such as a flash memory.

(Hardware Configuration of the Electronic Whiteboard 200)
Fig. 3 is a hardware configuration diagram of the electronic whiteboard 200. As shown in Fig. 3, the electronic whiteboard 200 includes a central processing unit (CPU) 201, a read only memory (ROM) 202, a random access memory (RAM) 203, a solid state drive (SSD) 204, a network I/F 205, and an external device connection interface (I/F) 206.

Of these, the CPU 201 controls the overall operation of the electronic whiteboard 200. The ROM 202 stores the CPU 201 and programs used to drive the CPU 201, such as an IPL (Initial Program Loader). The RAM 203 is used as a work area for the CPU 201. The SSD 204 stores various data, such as programs for the electronic whiteboard 200. The network I/F 205 controls communication with the communication network 12. The external device connection I/F 206 is an interface for connecting various external devices. In this case, the external devices are, for example, a USB (Universal Serial Bus) memory 230 and external devices (a microphone 240, a speaker 250, and a camera 260).

The electronic whiteboard 200 also includes a capture device 211, a GPU (Graphics Processing Unit) 212, a display controller 213, a contact sensor 214, a sensor controller 215, an electronic pen controller 216, a short-range communication circuit 219, an antenna 219a for the short-range communication circuit 219, a power switch 222, and selection switches 223.

Of these, the capture device 211 displays video information as still images or moving images on the display of an external PC (Personal Computer) 270. The GPU 212 is a semiconductor chip that specializes in graphics. The display controller 213 controls and manages the screen display to output the output image from the GPU 212 to the display 280, etc. The contact sensor 214 detects that the electronic pen 290 or the user's hand H has touched the display 280. The sensor controller 215 controls the processing of the contact sensor 214. The contact sensor 214 inputs and detects coordinates using an infrared blocking method. The method of inputting and detecting coordinates is a method in which two light receiving and emitting devices installed at both ends of the upper side of the display 280 emit multiple infrared rays parallel to the display 280, and receive the light that is reflected by a reflecting member installed around the display 280 and returns along the same optical path as the optical path of the light emitted by the light receiving element. The contact sensor 214 outputs the ID of the infrared light emitted by the two light receiving and emitting devices that was blocked by the object to the sensor controller 215, and the sensor controller 215 identifies the coordinate position that is the contact position of the object. The electronic pen controller 216 communicates with the electronic pen 290 to determine whether the tip or the end of the pen has touched the display 280. The short-range communication circuit 219 is a communication circuit such as NFC (Near Field Communication) or Bluetooth (registered trademark). The power switch 222 is a switch for switching the power of the electronic whiteboard 200 ON/OFF. The selection switches 223 are, for example, a group of switches for adjusting the brightness and color of the display 280.

Furthermore, the electronic whiteboard 200 is equipped with a bus line 210. The bus line 210 is an address bus, a data bus, etc., for electrically connecting each component such as the CPU 201 shown in FIG. 3.

The contact sensor 214 is not limited to an infrared blocking type, and may use various detection means such as a capacitive touch panel that identifies the contact position by detecting a change in capacitance, a resistive film touch panel that identifies the contact position by a voltage change between two opposing resistive films, or an electromagnetic induction touch panel that identifies the contact position by detecting electromagnetic induction caused by a contacting object touching the display unit. The electronic pen controller 216 may also determine whether or not the tip and end of the electronic pen 290 have been touched, as well as the part of the electronic pen 290 that the user holds, or other parts of the electronic pen.

(Hardware Configuration of Video Conference Terminal 700)
Fig. 4 is a hardware configuration diagram of the video conference terminal 700. As shown in Fig. 4, the video conference terminal 700 includes a CPU 701, a ROM 702, a RAM 703, a flash memory 704, an SSD 705, a media I/F 707, an operation button 708, a power switch 709, a bus line 710, a network I/F 711, a CMOS sensor 712, an image sensor I/F 713, a microphone 714, a speaker 715, an audio input/output I/F 716, a display I/F 717, an external device connection I/F (Interface) 718, a short-range communication circuit 719, and an antenna 719a of the short-range communication circuit 719. Of these, the CPU 701 controls the operation of the entire video conference terminal 700. The ROM 702 stores a program used to drive the CPU 701, such as an IPL. The RAM 703 is used as a work area for the CPU 701. The flash memory 704 stores various data such as communication programs, image data, and sound data. The SSD 705 controls reading and writing of various data from and to the flash memory 704 under the control of the CPU 701. Note that a HDD may be used instead of the SSD. The media I/F 707 controls reading and writing (storing) of data from and to a recording medium 706 such as a flash memory. The operation button 708 is a button that is operated when selecting a destination of the video conference terminal 700, etc. The power switch 709 is a switch for switching the power of the video conference terminal 700 ON/OFF.

The network I/F 711 is an interface for data communication using a communication network such as the Internet. The CMOS (Complementary Metal Oxide Semiconductor) sensor 712 is a type of built-in imaging means that captures an image of a subject under the control of the CPU 701 to obtain image data. Note that the imaging means may be a CCD (Charge Coupled Device) sensor or the like instead of a CMOS sensor. The imaging element I/F 713 is a circuit that controls the driving of the CMOS sensor 712. The microphone 714 is a built-in circuit that converts sound into an electrical signal. The speaker 715 is a built-in circuit that converts an electrical signal into physical vibrations to generate sounds such as music and voice. The sound input/output I/F 716 is a circuit that processes input and output of sound signals between the microphone 714 and the speaker 715 under the control of the CPU 701. The display I/F 717 is a circuit that transmits image data to an external display under the control of the CPU 701. The external device connection I/F 718 is an interface for connecting various external devices. The short-range communication circuit 719 is a communication circuit such as NFC (Near Field Communication) or Bluetooth (registered trademark).

The bus line 710 is an address bus, a data bus, etc., for electrically connecting each component such as the CPU 701 shown in FIG. 4.

The display 720 is a type of display means configured with liquid crystal or organic EL (Electro Luminescence) for displaying an image of a subject, operation icons, etc. The display 720 is also connected to the display I/F 717 by a cable. This cable may be a cable for analog RGB (VGA) signals, a cable for component video, or a cable for HDMI (High-Definition Multimedia Interface) (registered trademark) or DVI (Digital Video Interactive) signals.

The CMOS (Complementary Metal Oxide Semiconductor) sensor 712 is a type of built-in imaging means that captures an image of a subject under the control of the CPU 701 to obtain image data. Instead of a CMOS sensor, an imaging means such as a CCD (Charge Coupled Device) sensor may be used. External devices such as an external camera, an external microphone, and an external speaker can be connected to the external device connection I/F 718 via a USB cable or the like. When an external camera is connected, the external camera is driven under the control of the CPU 701 in preference to the built-in CMOS sensor 712. Similarly, when an external microphone or an external speaker is connected, the external microphone or external speaker is driven under the control of the CPU 701 in preference to the built-in microphone 714 or the built-in speaker 715, respectively.

The recording medium 706 is detachable from the video conference terminal 700. In addition, the recording medium 706 is not limited to the flash memory 704, and may be an EEPROM or the like, as long as it is a non-volatile memory that reads or writes data under the control of the CPU 701.

[Functional configuration of VPN server 500A and VPN box 21]
FIG. 5 is a diagram showing the functional configuration of a VPN server 500A and a VPN box 21 according to an embodiment of the present invention.

(Functional configuration of VPN server 500A)
As shown in FIG. 5, the VPN server 500A includes a login information acquisition unit 531, a user authentication unit 532, a connection destination information storage unit 533, a connection destination information acquisition unit 534, a connection destination information setting unit 535, and a VPN communication control unit 536.

The login information acquisition unit 531 acquires the login information entered by the user. For example, the login information acquisition unit 531 acquires the login information entered by the user from the PC 500F (or other communication terminal device) via the VPN box 21. This login information includes the user ID, password, and VPN box ID.

The user authentication unit 532 authenticates the user based on the login information acquired by the login information acquisition unit 531. For example, in this embodiment, the user authentication unit 532 transmits the login information acquired by the login information acquisition unit 531 to the authentication server 500C, thereby causing the authentication server 500C to authenticate the user. If the combination of the user ID and password included in the login information transmitted from the user authentication unit 532 matches a combination of the user ID and password stored in advance, the authentication server 500C returns "success" as the result of the user authentication to the user authentication unit 532. On the other hand, if the combination of the user ID and password included in the login information transmitted from the user authentication unit 532 does not match a combination of the user ID and password stored in advance, the authentication server 500C returns "failure" as the result of the user authentication to the user authentication unit 532.

The connection destination information storage unit 533 stores connection destination information for connecting to a predetermined relay device for each user and group. For example, as shown in FIG. 10, the connection destination information stored in the connection destination information storage unit 533 includes a user ID for uniquely identifying a user, a group ID for uniquely identifying a group, an IP address for connecting to a predetermined relay device, and client certificate information for permitting connection to the relay device.

If the user authentication unit 532 is successful in authenticating the user, the connection destination information acquisition unit 534 acquires the connection destination information (IP address and client certificate information) corresponding to the user ID of the user from the connection destination information storage unit 533.

The connection destination information setting unit 535 sets the connection destination information (IP address and client certificate information) acquired by the connection destination information acquisition unit 534 to the VPN box 21 used by the user. Specifically, the connection destination information setting unit 535 identifies the VPN box 21 used by the user by the VPN box ID acquired by the login information acquisition unit 531. Then, the connection destination information setting unit 535 sets the connection destination information (IP address and client certificate information) acquired by the connection destination information acquisition unit 534 to the VPN box 21 via communication with the VPN box 21 by the VPN communication control unit 536 that has been established in advance (i.e., communication via the first communication path 12A).

The VPN communication control unit 536 controls the communication between the VPN server 500A and the VPN box 21 via the first communication path 12A. For example, the VPN server 500A controls the establishment of a communication connection, the sending and receiving of data, etc., in the communication between the VPN server 500A and the VPN box 21.

(Functional Configuration of VPN Box 21)
As shown in FIG. 5, the VPN box 21 includes a first communication connection unit 550, a second communication connection unit 551, a third communication connection unit 552, a login information acquisition unit 553, a login information transmission unit 554, a setting reception unit 555, and a fourth communication connection unit 556.

The first communication connection unit 550 performs communication connection and communication control with communication terminal devices (in this embodiment, the electronic whiteboard 200 and the MFP 900) that are connected to the VPN box 21 using fixed IP addresses. For example, Ethernet is used for the communication connection by the first communication connection unit 550.

The second communication connection unit 551 performs communication connection and communication control with a communication terminal device (in this embodiment, PC 500F) that is temporarily connected to the VPN box 21 using a dynamic IP address. For example, Wi-Fi is used for the communication connection by the second communication connection unit 551.

As a VPN client, the third communication connection unit 552 performs communication connection and communication control via the FireWall, Proxy 23 to the VPN server 500A by the first communication path 12A (see FIG. 1). In this embodiment, when the power of the VPN box 21 is switched ON, the third communication connection unit 552 automatically performs communication connection to the FireWall, Proxy 23 using a preset IP address, and forms the first communication path 12A with the VPN server 500A.

The login information acquisition unit 553 acquires the login information entered by the user from the PC 500F via the second communication connection unit 551. For example, the login information includes a user ID, a password, and a VPN box ID for uniquely identifying the VPN box 21.

The login information transmission unit 554 transmits the login information acquired by the login information acquisition unit 553 to the VPN server 500A via the third communication connection unit 552. The VPN server 500A authenticates the user based on the user ID and password included in the login information. The VPN server 500A also identifies the VPN box 21 used by the user (i.e., the VPN box 21 for which destination information should be set) based on the VPN box ID included in the login information.

If the VPN server 500A successfully authenticates the user, the setting reception unit 555 accepts the setting of destination information (e.g., IP address and client certificate information) for connecting to the relay server 500B from the VPN server 500A (destination information setting unit 535).

When the setting reception unit 555 receives the setting of the connection destination information, the fourth communication connection unit 556 uses the connection destination information to perform communication connection and communication control to the relay server 500B via the second communication path 12B (see FIG. 1) as a VPN client. This enables inter-device communication between the communication terminal devices (in this embodiment, the electronic whiteboard 200 and the MFP 900) connected to the first communication connection unit 550 and the relay server 500B connected to the fourth communication connection unit 556.

Each function of the above-described embodiments can be realized by one or more processing circuits. In this specification, the term "processing circuit" includes a processor programmed to execute each function by software, such as a processor implemented by an electronic circuit, and devices such as an ASIC (Application Specific Integrated Circuit), DSP (digital signal processor), FPGA (field programmable gate array), and conventional circuit modules designed to execute each function described above.

[Processing Procedure by VPN Box 21]
FIG. 6 is a flowchart showing a procedure of a process performed by the VPN box 21 according to an embodiment of the present invention.

First, when the power supply of the VPN box 21 is switched ON (step S601), the third communication connection unit 552 automatically establishes a communication connection to the FireWall, Proxy 23 using a preset IP address, and establishes a first communication path 12A between the VPN server 500A (step S602).

Next, the first communication connection unit 550 establishes a communication connection to a communication terminal device (e.g., electronic whiteboard 200) installed in the rental office 20 (step S603).

After that, when a connection request is made from PC 500F to VPN box 21, second communication connection unit 551 establishes a communication connection with PC 500F (step S604). Also, login information acquisition unit 553 acquires the login information entered by the user from PC 500F via second communication connection unit 551 (step S605). This login information includes a user ID, a password, and a VPN box ID.

Then, the login information transmission unit 554 transmits the login information acquired in step S605 to the VPN server 500A via the third communication connection unit 552 (step S606).

If user authentication is successful in the VPN server 500A, the setting reception unit 555 accepts the setting of destination information (IP address and client certificate information) for connecting to the relay server 500B from the VPN server 500A (destination information setting unit 535) (step S607).

Then, the fourth communication connection unit 556 uses the connection destination information received in step S607 to establish a communication connection to the relay server 500B as a VPN client, and establishes a second communication path 12B between the relay server 500B (step S608).

[Flow of using VPN box 21]
FIG. 7 is a diagram showing a flow of using the VPN box 21 according to an embodiment of the present invention.

(1) First, the user 16 who comes to the rental office 20 connects the VPN box 21 he or she brought with him or her to the FireWall, Proxy 23 of the rental office 20. (2) The user 16 also connects the communication terminal device (e.g., the electronic whiteboard 200) to the VPN box 21 via Ethernet.

(3) Next, the user 16 turns on the DHCP server function of the VPN box 21 that he or she brought with him or her. The DHCP server function of the VPN box 21 may be automatically turned on by a setting. (4) The user 16 also switches on the Wi-Fi function of the PC 500F that he or she brought with him or her, and inputs into the PC 500F the SSID and password for when the VPN box 21 is used as an access point. (5) This causes the PC 500F to be connected to the VPN box 21 via Wi-Fi. Note that (4) and (5) may be completed before (3).

(6) Next, when user 16 launches a browser on PC 500F and enters an address (e.g., the URL of an existing search site), the HTTP request sent from PC 500F is sent via VPN box 21 to the IP address of VPN server 500A that is preset in VPN box 21, using reverse proxy technology. (7) As a result, an HTML file of the login screen is sent from VPN server 500A via VPN box 21 to PC 500F, and PC 500F displays the login screen on the browser.

(8) On the login screen, the user 16 inputs the login information, including the user ID, password, and VPN box ID (an ID that uniquely identifies the VPN box 21; for example, it is written on the surface of the housing of the VPN box 21). (9) If the user authentication based on this login information is successful, the VPN box 21 automatically establishes a communication connection with the relay server 500B.

In addition, in the corporate network 30, after the PC 500G and the communication terminal device are connected to the VPN box 31, if user authentication based on the login information entered from the PC 500G is successful, the VPN box 31 is automatically connected to the relay server 500B for communication. As a result, inter-device cooperation between the rental office 20 and the corporate network 30 becomes possible via the second communication path 12B.

After that, when disconnection of the Wi-Fi connection between the PC 500F and the VPN box 21 (an example of a "predetermined termination condition") is detected, the VPN box 21 performs a logout process for the user 16, and the fourth communication connection unit 556 of the VPN box 31 automatically disconnects the communication connection with the relay server 500B. As a result, the VPN box 21 becomes available to another user, and when the authentication of the other user is successful, the VPN box 21 is automatically connected to the relay device corresponding to the other user. Note that although the VPN box 31 has been described as a portable housing, it may also be used as a stationary type that is not intended to be portable. Even in the case of a stationary type of use, when disconnection of the Wi-Fi connection is detected, the VPN box 21 performs a logout process for the user 16, and the fourth communication connection unit 556 of the VPN box 31 automatically disconnects the communication connection with the relay server 500B.

[Example of login screen]
Fig. 8 is a diagram showing an example of a login screen according to an embodiment of the present invention. The login screen 800 shown in Fig. 8 is a login screen displayed on the browser of the PC 500F when a specific address is input from the browser of the PC 500F. As shown in Fig. 8, the login screen 800 allows input of a user ID, a password, and a VPN box ID. The user 16 of the PC 500F can automatically connect the VPN box 21 provided in the rental office 20 to a relay device corresponding to the logged-in user by inputting the user ID, password, and VPN box ID as login information into the login screen 800.

[Example of IP address set for each device]
FIG. 9 is a diagram showing an example of IP addresses set to each device in the information processing system 10 according to an embodiment of the present invention. As shown in FIG. 9, the IP addresses set to each device in the information processing system 10 are classified into fixed addresses and dynamic addresses. The fixed addresses are fixed IP addresses that are set when the device is connected to a local network. The dynamic addresses are dynamic IP addresses that are set by a DHCP server function (for example, provided in the VPN boxes 21 and 31) when the device is connected to a local network. For example, in the example shown in FIG. 9, a "PC" connected to a local network 20A in the rental office 20 and a "PC" connected to a local network 30A in the corporate network 30 are devices that are temporarily connected to the local network, so dynamic addresses are set.

Also, as shown in FIG. 9, the fixed address set for each device in the first local network 20A of the rental office 20 is a local IP address used uniquely in the first local network 20A. Similarly, the fixed address set for each device in the second local network 30A of the corporate network 30 is a local IP address used uniquely in the second local network 30A.

As a result, the fixed addresses set for each device in the first local network 20A and the fixed addresses set for each device in the second local network 30A may overlap. For example, in the example shown in FIG. 9, the fixed address set for the "electronic whiteboard" in the first local network 20A and the fixed address set for the "video conference terminal" in the second local network 30A are both "172.16.10.1".

In this case, when the "electronic whiteboard" in the first local network 20A and the "video conference terminal" in the second local network 30A communicate with each other via the VPN, the local IP addresses of both are the same, so the local IP addresses collide. Therefore, in the information processing system 10 of this embodiment, the NAPT (Network Address and Port Translation) function provided in each of the VPN boxes 21 and 31 is used to convert the IP address and port number of the communication terminal device connected to the VPN box 21 or 31 in two stages using the NAPT function of the VPN box 21 and the NAPT function of the VPN box 31, thereby avoiding the problem of IP address collision between devices with the same local IP address.

In addition, in the rental office 20, when a "PC" (corresponding to PC500F shown in FIG. 1), which is a communication terminal device connected to a guest network outside the first local network 20A, is to be connected to the VPN, the "PC" can be connected to the VPN by connecting the interface for connecting to the guest network and the interface for connecting to the VPN via the virtual bridge 22 formed in the VPN box 21.

Similarly, in the corporate network 30, when a "PC" (corresponding to PC500G shown in FIG. 1), which is a communication terminal device connected to a guest network outside the second local network 30A, is to be connected to the VPN, the "PC" can be connected to the VPN by connecting the interface for connecting to the guest network and the interface for connecting to the VPN via the virtual bridge 32 formed in the VPN box 31.

[An example of connection destination information stored in the connection destination information storage unit 533]
Fig. 10 is a diagram showing an example of destination information stored in the destination information storage unit 533 according to an embodiment of the present invention. As shown in Fig. 10, the destination information storage unit 533 stores, for each group and for each user, a group ID for uniquely identifying the group, a user ID for uniquely identifying the user, an IP address for communication connection to a relay device predetermined for the group and the user, and client certificate information for permitting communication connection to the relay device, in association with each other.

For example, in the example shown in FIG. 10, the IP address "104.76.7.3" pre-assigned to the relay server 500B is associated with the user ID "USER001" belonging to the group ID "GROUP001". This is because it is pre-defined that the relay device of the communication connection destination of the VPN box 21 is the relay server 500B in order for the user having the user ID "USER001" to connect to the corporate network 30 from the rental office 20 via the relay server 500B. Also, in the example shown in FIG. 10, the client certificate information "XXXXX..." is associated with the user ID "USER001" belonging to the group ID "GROUP001". This is used for permitting the communication connection on the relay server 500B side when the communication connection is made from the VPN box 21 to the relay server 500B.

[Procedure for connection destination information setting process by VPN server 500A]
11 is a flowchart showing the procedure of a connection destination information setting process by the VPN server 500A according to an embodiment of the present invention. Here, an example will be described in which the VPN server 500A sets connection destination information in the VPN box 21 in the first local network 20A of the rental office 20, and connects the VPN box 21 to the relay server 500B for communication.

First, the login information acquisition unit 531 acquires the login information entered by the user from the PC 500F from the VPN box 21 (step S1101). This login information includes the user ID, password, and VPN box ID.

In addition, instead of transmitting the login information to the VPN server 500A via the VPN box 21, the PC 500F may transmit the login information directly to the VPN server 500A without passing through the VPN box 21. In addition, the method of authenticating the user is not limited to using a user ID and a password, and any known authentication method (e.g., card authentication, fingerprint authentication, etc.) may be used.

Next, the user authentication unit 532 performs user authentication processing based on the login information acquired in step S1101 (step S1102). Specifically, the user authentication unit 532 transmits the login information acquired in step S1101 to the authentication server 500C, thereby causing the authentication server 500C to perform user authentication processing.

Next, the user authentication unit 532 determines whether the user authentication process in step S1102 was successful (step S1103).

If it is determined in step S1103 that the user authentication process has not been successful (step S1103: No), the user authentication unit 532 notifies the PC 500F via the VPN box 21 that the user authentication process has failed (step S1104). Then, the VPN server 500A ends the series of processes shown in FIG. 11.

On the other hand, if it is determined in step S1103 that the user authentication process has been successful (step S1103: Yes), the user authentication unit 532 notifies the PC 500F via the VPN box 21 that the user authentication process has been successful (step S1105).

Then, the connection destination information acquisition unit 534 acquires the connection destination information corresponding to the user ID of the user who has been successfully authenticated from the connection destination information storage unit 533 (step S1106). For example, if the user ID of the user who has been successfully authenticated is "USER001", the connection destination information acquisition unit 534 acquires the IP address "104.76.7.3" (i.e., the IP address of the relay server 500B) and the client certificate information "XXXXX..." as the connection destination information from the connection destination information storage unit 533 illustrated in FIG. 10. The connection destination information acquisition unit 534 may dynamically acquire the client certificate information temporarily issued by the VPN server 500A or the like, instead of from the connection destination information storage unit 533. In this case, it is not necessary to set the client certificate information in advance in the connection destination information storage unit 533. In addition, if the client certificate information is not required for communication connection to the relay server 500B, the connection destination information acquisition unit 534 may not acquire the client certificate information.

Furthermore, the destination information setting unit 535 sets the destination information (IP address and client certificate information) acquired in step S1106 in the VPN box 21 used by the user through communication with the VPN box 21 by the VPN communication control unit 536 (step S1107). This allows the VPN box 21 to automatically establish a communication connection to the relay server 500B. At this time, the VPN box 21 is certified as a legitimate client by the client certificate information, and is permitted to connect to the relay server 500B.

By performing processing similar to that shown in FIG. 11, when a user uses a VPN box 31 in the second local network 30A of the corporate network 30, the VPN server 500A can set connection destination information in the VPN box 31 and automatically connect the VPN box 31 to the relay server 500B.

As a result, each of the VPN boxes 21 and 31 is communicatively connected to the relay server 500B, and device-to-device communication (e.g., a remote conference between the electronic whiteboard 200 and the video conference terminal 700) can be performed between each communication terminal device connected to the VPN box 21 (e.g., the electronic whiteboard 200, the MFP 900, etc.) and each communication terminal device connected to the VPN box 31 (e.g., the video conference terminal 700, the conference server 500E, etc.) via the relay server 500B.

(Processing sequence by information processing system 10)
12 is a sequence diagram showing a processing sequence by the information processing system 10 according to an embodiment of the present invention. Here, an example will be described in which, when a user uses the VPN box 21 in the first local network 20A of the rental office 20, in response to logging in from the PC 500F, the VPN server 500A sets connection destination information in the VPN box 21 and connects the VPN box 21 to the relay server 500B for communication.

First, the PC 500F, which is connected to the VPN box 21 for communication, accepts input of login information from the user (step S1201). This login information includes a user ID, a password, and a VPN box ID. The PC 500F then transmits the input login information to the VPN box 21 (step S1202).

Next, when the VPN box 21 receives the login information sent from the PC 500F (step S1203), it transfers the login information to the VPN server 500A (step S1204).

Next, when the VPN server 500A receives the login information sent from the VPN box 21 (step S1205), it performs the connection destination information setting process shown in FIG. 11 (step S1206).

As a result, the VPN box 21 receives destination information from the VPN server 500A (step S1207) and automatically establishes a communication connection with the relay server 500B based on the destination information (step S1208).

As a result, the communication terminal devices (electronic whiteboard 200, MFP 900, etc.) connected to the VPN box 21 can connect to the relay server 500B via the VPN box 21, and perform inter-device communication with each communication terminal device (video conference terminal 700, conference server 500E, etc.) in the second local network 30A of the corporate network 30 via the relay server 500B.

Furthermore, the communication terminal device connected to the VPN box 21 can use external services provided by external servers connected to the relay server 500B (e.g., location-free printing services provided by the print server 500D, file services provided by a file server, etc.) via the relay server 500B, and can perform inter-device communication with communication terminal devices connected to the relay server 500B (e.g., electronic whiteboards, etc.). In addition, the availability of external services by a user who logs in from the PC 500F may be determined based on the contract information of the user, etc.

In addition, by performing processing similar to that shown in FIG. 12, when a user uses a VPN box 31 in the second local network 30A of the corporate network 30, the information processing system 10 can set connection destination information from the VPN server 500A in the VPN box 31 and automatically connect the VPN box 31 to the relay server 500B.

As a result, each of the VPN boxes 21 and 31 is communicatively connected to the relay server 500B, and device-to-device communication (e.g., a remote conference between the electronic whiteboard 200 and the video conference terminal 700) can be performed between each communication terminal device connected to the VPN box 21 (e.g., the electronic whiteboard 200, the MFP 900, etc.) and each communication terminal device connected to the VPN box 31 (e.g., the video conference terminal 700, the conference server 500E, etc.) via the relay server 500B.

As described above, the VPN server 500A according to one embodiment of the present invention is a VPN server 500A provided in the cloud environment 14, and includes a login information acquisition unit 531 that acquires login information input by a user and identification information of the VPN boxes 21 and 31 when the user uses the VPN boxes 21 and 31 provided in a local network outside the cloud environment 14, a user authentication unit 532 that authenticates the user based on the login information, a destination information acquisition unit 534 that acquires destination information associated with the successfully authenticated user from a destination information storage unit that stores destination information for connecting to a relay device provided in the cloud environment 14 for each user or group when the user authentication process by the user authentication unit 532 is successful, and a destination information setting unit 535 that sets the destination information acquired by the destination information acquisition unit 534 to the VPN box 21 or 31 identified by the identification information acquired by the login information acquisition unit 531, thereby connecting the VPN box 21 or 31 to the relay device for communication.

As a result, when a user uses the VPN boxes 21, 31, the VPN server 500A according to one embodiment of the present invention can automatically set connection destination information for the VPN boxes 21, 31 to connect to a relay device appropriate for the user, and can automatically connect the VPN boxes 21, 31 to a relay device appropriate for the user. Therefore, according to the VPN server 500A according to one embodiment of the present invention, it is possible to eliminate the need to set the connection destination for the network control device when the connection destination of the network control device is changed each time it is used.

In one embodiment of the present invention, the relay device is a relay server 500B provided in the cloud environment 14. As a result, when a user uses a VPN box 21, 31, the VPN server 500A according to one embodiment of the present invention automatically connects the VPN box 21, 31 to the relay server 500B for communication, thereby enabling the user to communicate with a communication terminal device provided at another location and to use an external service (e.g., a printing service, a storage service, a business collaboration service, etc.) via the relay server 500B.

In addition, in the VPN server 500A according to one embodiment of the present invention, when the authentication process of a first user using the VPN box 21 provided in the first local network 20A in the rental office 20 is successful, the connection destination information setting unit 535 automatically connects the VPN box 21 to the relay server 500B for communication, and when the authentication process of a second user using the VPN box 31 provided in the second local network 30A in the corporate network 30 is successful, the connection destination information setting unit 535 automatically connects the VPN box 31 to the relay server 500B for communication, thereby enabling communication between the first communication terminal device communicatively connected to the VPN box 21 and the second communication terminal device communicatively connected to the VPN box 31 via the relay server 500B.

As a result, the VPN server 500A according to one embodiment of the present invention can realize inter-device communication between a first communication terminal device provided in the first local network 20A and a second communication terminal device provided in the second local network 30A via the relay server 500B simply by the first user and the second user successfully logging in.

Although the preferred embodiments of the present invention have been described in detail above, the present invention is not limited to these embodiments, and various modifications and variations are possible within the scope of the gist of the present invention as described in the claims.

The devices described in the examples are merely illustrative of one of several computing environments for implementing the embodiments disclosed herein. In one embodiment, the VPN server 500A includes a plurality of computing devices, such as a server cluster. The plurality of computing devices are configured to communicate with each other over any type of communication link, including a network, shared memory, etc., and to implement the processes disclosed herein.

The "information processing device" is not limited to a server, so long as it is a device that has the functions of the embodiments described above. The "information processing device" may be, for example, a PC. In addition, while the login information includes a user ID, password, and VPN box ID, it may also be configured to require the user to enter a PIN code (a password for legitimate use of the VPN box itself) in order to prevent unauthorized use of the VPN box itself.

10 Information processing system 12A First communication path 12B Second communication path 14 Cloud environment (global network)
20 Rental office 20A First local network 21 VPN box (First network control device)
30 Corporate network 30A Second local network 31 VPN box (second network control device)
200 Electronic whiteboard (communication terminal equipment)
500 PC, server 500A VPN server (information processing device)
500B Relay server 500C Authentication server 500D Print server 500E Conference server (communication terminal device)
500F, 500G PC (communication terminal equipment)
531 Login information acquisition unit 532 User authentication unit 533 Connection destination information storage unit 534 Connection destination information acquisition unit 535 Connection destination information setting unit 536 VPN communication control unit 550 First communication connection unit 551 Second communication connection unit 552 Third communication connection unit 553 Login information acquisition unit 554 Login information transmission unit 555 Setting reception unit 556 Fourth communication connection unit 700 Video conference terminal (communication terminal device)
900 MFP (communication terminal device)

JP 2015-156592 A JP 2017-28393 A

Claims (7)

an information processing device connected to a network control device provided on a local network via the network;
A relay device as a connection destination of the network control device;
a network control device provided in the local network;
The information processing device includes:
a login information acquisition unit that acquires login information input for the network control device and identification information of the network control device;
a user authentication unit that performs authentication processing based on the login information;
a connection destination information acquiring unit that acquires, when an authentication process by the user authentication unit is successful, connection destination information associated with the login information from a connection destination information storage unit that stores connection destination information for connecting to a relay device as a connection destination of the network control device;
a connection destination information setting unit that sets the connection destination information acquired by the connection destination information acquisition unit to the network control device specified by the identification information acquired by the login information acquisition unit, thereby communicatively connecting the network control device to the relay device,
the relay device is a relay server provided in a global network,
The connection destination information setting unit is
when a first authentication process for a first network control device provided in the first local network is successful, connecting the first network control device to the relay server for communication;
When a second authentication process for a second network control device provided in the second local network is successful, the second network control device is communicatively connected to the relay server,
enabling inter-device communication via the relay server between a first communication terminal device connected to the first network control device and a second communication terminal device connected to the second network control device;
An information processing system characterized in that, when the IP address of the first communication terminal device and the IP address of the second communication terminal device overlap, the IP address of the first communication terminal device and the IP address of the second communication terminal device are converted in two stages using the NAPT function of the first network control device and the NAPT function of the second network control device, thereby avoiding IP address collisions. 2. The information processing system according to claim 1, wherein the connection destination information includes an IP address of the relay device and certificate information for permitting a connection to the relay device. 3. The information processing system according to claim 2, wherein the connection destination information is temporarily issued to the relay device. The information processing device includes:
4. The information processing system according to claim 1, wherein the relay device is started up when the network control device is communicatively connected to the relay device. The connection destination information setting unit is
The information processing system according to any one of claims 1 to 4, characterized in that by communicatively connecting the network control device to the relay device, it is possible to use an external device connected to the relay device from a communication terminal device connected to the network control device. The external device is
6. The information processing system according to claim 5, wherein the information processing system is a print server that provides a location-free print service. an information processing device connected to a network control device provided on a local network via the network;
A relay device as a connection destination of the network control device;
and a network control device provided in the local network.
a login information acquisition step of acquiring login information input for the network control device and identification information of the network control device;
a user authentication process based on the login information;
a connection destination information acquiring step of acquiring, when an authentication process in the user authentication step is successful, connection destination information associated with the login information from a connection destination information storage unit that stores connection destination information for connecting to a relay device as a connection destination of the network control device;
a connection destination information setting step of setting the connection destination information acquired in the connection destination information acquisition step for the network control device specified by the identification information acquired in the login information acquisition step, thereby communicatively connecting the network control device to the relay device,
the relay device is a relay server provided in a global network,
The connection destination information setting step includes:
when a first authentication process for a first network control device provided in the first local network is successful, connecting the first network control device to the relay server for communication;
When a second authentication process for a second network control device provided in the second local network is successful, the second network control device is communicatively connected to the relay server,
enabling inter-device communication via the relay server between a first communication terminal device connected to the first network control device and a second communication terminal device connected to the second network control device;
An information processing method characterized in that, when the IP address of the first communication terminal device and the IP address of the second communication terminal device overlap, IP address collisions are avoided by converting the IP address of the first communication terminal device and the IP address of the second communication terminal device in two stages using a NAPT function of the first network control device and a NAPT function of the second network control device .

Images