JP7587782B2 - Information processing device, access control system, program, and information processing method - Google Patents

Description

The present invention relates to a relay server and an access control system.

In recent years, a system known as cloud computing has made it possible for users to access the internet from anywhere, improving user convenience.

On the other hand, from a security standpoint, many users prefer to operate their systems on-premise, where information is read from devices located within the user's environment (e.g., within a company). On-premise systems are said to be less susceptible to external attacks and have a lower risk of information leaks.

In addition, conventional technology includes a technology that sets up a virtual dedicated line on the Internet called a VPN (Virtual Private Network), establishes a dedicated network that can only be used by specific people, and enables intercommunication between terminals connected to the Internet and on-premise. There is also technology that connects a mutually authenticated TLS (Transport Layer Security) tunnel between a cloud (off-premise platform) and an on-premise platform environment to transfer data (see paragraph 0032 of Patent Document 1).

JP 2021-501929 A

In addition, if a user's terminal connected via the Internet can also access on-premise, it will be more convenient for the user, but since the terminal is connected via the Internet, there is also a risk of information leakage.

A VPN can also be used as a method for users' devices to access on-premise systems, but this comes with the problem of high implementation costs and a large burden on users. VPNs also have the problem that if an on-premise server is compromised, other services and other servers in the LAN area can easily be accessed, and there are also problems with the need to log in again after a connection is lost, as well as slow communication speeds due to congestion.

The present invention has been made in consideration of the above-mentioned problems, and its purpose is to provide a relay server and an access control system that is convenient for users and provides improved security when a user's terminal on the Internet accesses an on-premise server.

(1) The present invention provides
A relay server is connected to a user's terminal and an on-premise server via the Internet, and the relay server is connected to the terminal and the on-premise server via the Internet,
a query information generating unit configured to generate unique query information that can be accessed by the on-premise server based on information of the on-premise server;
A user control unit that manages user information of a user;
an authentication processing unit that, when an access is accepted from a user terminal, determines whether or not the user should be authenticated;
a presentation unit that presents the query information to a terminal of the user when authentication of the user is permitted;
a relay processing unit that relays communication between a terminal of the user whose authentication has been permitted and the on-premise server;
The present invention relates to a relay server including:

The present invention also relates to a program that causes a computer to function as each part of the relay server. The present invention also relates to an information storage medium on which the program is stored.

According to the present invention, when user authentication is permitted, unique query information that can be used to access the on-premise server is presented to the user's terminal, and communication between the terminal of the user whose authentication has been permitted and the on-premise server is relayed, thereby preventing unauthorized users from accessing the on-premise server and improving security.

(2) The server, program, and information storage medium of the present invention are
The inquiry information generating unit
Different query information may be generated for each on-premise server.

According to the present invention, when multiple on-premise servers exist, different query information is generated for each on-premise server, so that each of the multiple on-premise servers can be appropriately managed and communications can be relayed.

(3) The server, the program, and the information storage medium of the present invention are
The inquiry information generating unit
Different inquiry information may be generated for each service.

According to the present invention, when an on-premise server provides multiple services, different query information is generated for each service, so that each of the multiple services can be appropriately managed and communications can be relayed.

(4) The server, program, and information storage medium of the present invention are
The user control unit:
For each user, determine whether the user is allowed to access each piece of inquiry information based on the user information of the user;
The presentation unit is
For each user, the query information that the user can access may be presented on the user's terminal.

According to the present invention, the accessibility of each user to each piece of inquiry information is determined for each user based on the user information of the user, so that it is possible to control the accessibility of the inquiry information to specific users and to make the inquiry information inaccessible to other users, thereby enabling control that takes into consideration both convenience and security.

(5) The present invention provides
An access control system in which a user terminal, an on-premise server, and a relay server are each connected via the Internet,
The relay server includes:
a query information generating unit configured to generate unique query information that can be accessed by the on-premise server based on information of the on-premise server;
A user control unit that manages user information of a user;
an authentication processing unit that, when an access is accepted from a user terminal, determines whether or not the user should be authenticated;
a presentation unit that presents the query information to a terminal of the user when authentication of the user is permitted;
a relay processing unit that relays communication between a terminal of the user whose authentication has been permitted and the on-premise server,
The on-premise server comprises:
The present invention relates to an access control system that, when access based on the query information is received from a terminal of a user whose authentication has been permitted via the relay server, presents information indicated in the query information to the user's terminal via the relay server.

According to the present invention, when user authentication is permitted, unique query information that can be used to access the on-premise server is presented to the user's terminal, and communication between the terminal of the user whose authentication has been permitted and the on-premise server is relayed, thereby preventing unauthorized users from accessing the on-premise server and improving security.

FIG. 2 is an example of a network diagram of the access control system according to the present embodiment. FIG. 2 is a functional block diagram of a relay server 10 according to the present embodiment. FIG. 4 is a diagram for explaining a relay process according to the embodiment; 13 shows an example of an access permission flag for each piece of inquiry information for each user in the present embodiment. FIG. 4 is a diagram showing an example of a screen displayed on the terminal of the embodiment. FIG. 4 is a flowchart showing the flow of processing according to the embodiment.

The present embodiment will be described below. Note that the present embodiment described below does not unduly limit the content of the present invention described in the claims. Furthermore, not all of the configurations described in the present embodiment are necessarily essential components of the present invention.

[1] Network Fig. 1 shows an example of a network diagram of an access control system. In the access control system of this embodiment, a relay server 10, a user terminal 20, and an on-premise server 30 are connected to each other via a network (the Internet).

In other words, the relay server 10 of this embodiment is a server that is connected to each of the user's terminal 20 and the on-premise server 30 via the Internet and is configured for the purpose of relaying communication between the terminal 20 and the server 30.

The relay server 10 in this embodiment is an information processing device that manages user information and performs user authentication processing.

The terminal 20 is a client device, an information processing device such as a smartphone, a mobile phone, a PHS, a computer, a game device, a PDA, or an image generating device, and is a device that can be connected to the relay server 10 via a network such as the Internet (WAN) or a LAN.

The on-premise server 30 is a server that is constructed and operated by a user (e.g., a company) and is an information processing device that is installed in facilities managed by the user.

The on-premise server 30 basically operates services that are not made available to the outside world (Internet) (for example, services used only within a company or group, services for confidential information, an internal mail server, an internal conference system), but as described below, in this embodiment, the on-premise server 30 is controlled so that it can be accessed from the terminals 20 of some users who have been authenticated via the relay server 10.

[2] Configuration Fig. 2 is an example of a functional block diagram of the relay server 10 of the present embodiment. Note that the relay server 10 of the present embodiment does not need to include all of the units in Fig. 2, and may have a configuration in which some of them are omitted.

The memory unit 170 stores programs and various data for causing the computer to function as each part of the processing unit 100, and also functions as a memory area for the processing unit 100.

The memory unit 170 includes a temporary storage area and storage. Storage is a device that permanently stores data, such as a hard disk, optical disk, flash memory, or magnetic tape. The memory unit 170 may also store programs and data stored in the information storage medium 180.

The storage unit 170 of this embodiment includes a main storage unit 171 used as a work area, a user information storage unit 172, and a query information storage unit 173. Note that some of these may be omitted.

The main memory unit 171 can be realized by a RAM or the like. The main memory unit 171 is a memory area used in the processing of this embodiment.

The user information storage unit 172 stores user information (user account, password, email address, etc.). The user information storage unit 172 may be configured with a DB (DB is an abbreviation for database, the same applies below).

The query information storage unit 173 stores query information (URL). The query information storage unit 173 may be configured as a database.

The information storage medium 180 (a computer-readable medium) stores programs, data, etc., and its functions can be realized by storage such as optical disks (CD, DVD), magneto-optical disks (MO), magnetic disks, hard disks, magnetic tapes, or memory (ROM).

The communication unit 196 performs various controls for communicating with the outside (e.g., terminals, other servers, or other network systems), and its functions can be realized by hardware such as various processors or communication ASICs, programs, etc.

The processing unit 100 performs various processes of this embodiment based on the programs (data) stored in the storage unit 170 or the information storage medium 180.

The processing unit 100 (processor) performs various processes using a main memory unit 171 in the memory unit 170 as a work area. The functions of the processing unit 100 can be realized by hardware such as various processors (CPU, DSP, etc.) or programs.

The processing unit 100 includes a user control unit 111, an authentication processing unit 112, a query information generation unit 113, a presentation unit 114, a relay processing unit 115, and a Web processing unit 120.

The user control unit 111 manages the user information of the user. The user control unit 111 may also determine, for each user, whether the user can access each piece of inquiry information (each URL) based on the user information of the user.

When access is received from a user's terminal, the authentication processing unit 112 determines whether or not to permit authentication of the user.

The query information generation unit 113 generates unique query information (e.g., a URL) that can access the on-premise server 30 based on the information of the on-premise server 30.

For example, when there are multiple on-premise servers 30, the query information generating unit 113 may generate different query information for each on-premise server 30. Also, when there are multiple services, the query information generating unit 113 may generate different query information for each service.

If the user authentication is permitted, the presentation unit 114 presents the query information to the user's terminal 20.

The relay processing unit 115 relays communication between the terminal 20 of a user who has been authorized for authentication and the on-premise server 30.

The Web processing unit 120 performs processing to send (provide) data such as HTML (HyperText Markup Language) documents and images in response to requests from client software such as a Web browser installed on the terminal 20 via HTTP (Hypertext Transfer Protocol), and to receive data accepted by the terminal's Web browser. The server then processes emails and updates the database based on information received from each of the administrator's and user's terminals.

The web processing unit 120 may perform a process of sending (providing) data for management settings, etc. to the administrator's terminal 20 in response to an access request from the web browser of the administrator's terminal 20, and may also perform a process of receiving information from the administrator's terminal 20.

In other words, the web processing unit 120 may add, delete, update, and perform other processing on each piece of data in the DB based on input from the administrator. Note that only the administrator is given the authority to access the web page (URL) for the administrator.

The web processing unit 120 also performs login processing and processing to control the browsing of web pages containing information related to the logged-in user in response to a request from the web browser of the terminal 20.

Note that some or all of the processing of the processing unit 100 and the storage unit 170 may be executed by a single device, or each process may be distributed to different devices depending on the purpose of the process.

[3] Description of Agent As shown in Fig. 3, an agent program is installed in a given on-premise device that exists in the on-premise network (LAN). In other words, the on-premise device in which the agent program is installed can be called an agent (agent device).

For example, the on-premise device may be an on-premise server 30 (server 30A or server 30B) or, although not shown, may be a terminal 20X connected to the on-premise server 30 (server 30A or server 30B). The terminal 20X is an information processing device that exists in the same network environment (within a LAN) as the on-premise server 30.

The agent stores "information about the on-premise server 30" in the agent's storage unit in advance, the information including the IP address, host name, and information about each service (each port number) of the on-premise server 30.

Here, "service" refers to a service for the TCP/IP network protocol. "Service" may also be interpreted as a port number for identifying the service.

For example, when an agent is installed on an on-premise server 30, "information on the on-premise server 30" is stored in the memory of the on-premise server 30. Also, when an agent is installed on a terminal 20X, "information on the on-premise server 30" is stored in the memory of the terminal 20X.

An agent may manage multiple on-premise servers 30 (e.g., server 30A and server 30B). Also, an agent may manage only one on-premise server 30 (e.g., server 30A). In such a case, there will be one agent corresponding to one on-premise server 30.

The agent may also manage multiple services (e.g., service SA and service SB) of the on-premise server 30. The agent may also manage only one service (e.g., service SA) of the on-premise server 30. In such a case, there will be one agent corresponding to one service.

The agent also controls the starting (enabling) and stopping (disabling) of the services of the on-premise server 30 that the agent manages. For example, the agent can control the starting or stopping of the services of the on-premise server 30 based on input information from the administrator of the access control system.

[4] Description of Generation of Reference Information The relay server 10 generates unique reference information that can be accessed by the on-premise server 30 based on the information of the on-premise server 30 .

The query information is a global URL that the relay server 10 makes public to users who have been authorized to be authenticated. For example, it is a URL that allows a user's terminal 20 located outside (outside the organization, outside the company) on the Internet to access a network within the organization (for example, within the company).

Here, the "query information" may be, for example, a URL for uniquely specifying a web page on the Internet using a protocol such as HTTP (Hyper Text Transfer Protocol) or HTTPS (Hyper Text Transfer Protocol Secure). Note that the query information may also be information on a server capable of transmitting and receiving data using other communication protocols such as FTP (File Transfer Protocol). For example, when the query information is a URL, the query information is generated according to a predetermined URL format.

When the agent starts a service, it establishes a TCP connection (e.g., a Long-Lived TCP Connection) to the relay server 10 and transmits a request for generating query information to the relay server 10. Then, when the relay server 10 receives the request for generating query information from the agent, it generates query information corresponding to the service of the server managed by the agent. Note that the connection may also be called a tunnel.

For example, when an agent starts a service SA (e.g., a Web service on port 80) of the on-premise server 30A, a TCP connection is established between the service SA and the relay server 10, and a request for generating query information for the service SA is sent to the relay server 10. Then, upon receiving the request for generating query information from the agent, the relay server 10 generates query information L1 (e.g., "https://example1.com.henge.io/") corresponding to the service SA. This connection and query information L1 are in a corresponding relationship.

Specifically, the relay server 10 executes an application program that is a tunneling tool to generate a URL. This application program performs processing that allows the services running in the local environment to be made public so that they can be accessed from the Internet.

For example, the relay server 10 executes the application program based on the information on the service SA of the on-premise server 30A stored in the agent (e.g., the host name, IP address, and service SA port number "80" of the on-premise server 30A, etc.) to obtain a URL that can be made public (e.g., "https://xxxx.xxxx.io/"). The obtained URL may be the query information itself, but in this embodiment, the domain of the obtained URL is changed to the domain of the relay server 10 by setting the DNS (Domain Name Server) based on the administrator's input information, and the URL (e.g., "https://example1.com.henge.io/") is used as query information L1.

In addition, when the agent starts service SB of on-premise server 30A, service SC, and service SD of on-premise server 30B, relay server 10 generates query information corresponding to each service, just as when service SA is started.

That is, when the agent starts the service SB (e.g., HTTPS service on port 443) of the on-premise server 30A, a TCP connection is established between the service SB and the relay server 10, and the relay server 10 transmits a request for generating query information for the service SB. Then, the relay server 10 generates query information L2 (e.g., "https://example2.com.henge.io/") corresponding to the service SB at the timing when the relay server 10 receives the request for generating query information from the agent. The relay server 10 generates query information L2 based on the information on the service SB of the on-premise server 30A stored in the agent (e.g., the host name, IP address, and port number "443" of the service SB of the on-premise server 30A, etc.).

Also, when the agent starts the service SC of the on-premise server 30B (e.g., a Web service on port 80), a TCP connection is established between the service SC and the relay server 10, and the relay server 10 transmits a request for generating query information for the service SB to the relay server 10. Then, the relay server 10 generates query information L3 (e.g., "https://example3.com.henge.io/") corresponding to the service SC at the timing when the relay server 10 receives the request for generating query information from the agent. The relay server 10 generates the query information L3 based on the information of the service SC of the on-premise server 30B stored in the agent (e.g., the host name, IP address, and port number "80" of the service SC of the on-premise server 30B, etc.).

When the agent starts the service SD of the on-premise server 30B (e.g., HTTPS service on port 443), a TCP connection is established between the service SD and the relay server 10, and a request for generating query information for the service SD is sent to the relay server 10. Then, when the relay server 10 receives the request for generating query information from the agent, it generates query information L4 corresponding to the service SD (e.g., "https://example4.com.henge.io/"). The relay server 10 generates query information L4 based on the information on the service SD of the on-premise server 30B stored in the agent (e.g., the host name, IP address, and port number "443" of the service SD of the on-premise server 30B of the on-premise server 30B, etc.).

In other words, when there are multiple on-premise servers 30, the relay server 10 generates different query information for each on-premise server 30. This allows for detailed access control on an on-premise server basis in this embodiment.

In addition, when multiple services exist, the relay server 10 generates different query information for each service. In other words, in this embodiment, access can be controlled in detail on a per-service (per-port) basis.

[5] Description of User Information The relay server 10 manages user information of users. In particular, the relay server 10 of the present embodiment determines, for each user, whether or not the user can access each piece of inquiry information (each URL) based on the user information of the user.

For example, the relay server 10 may determine whether each piece of query information is accessible based on various information (server host name and service) of the on-premise server 30 corresponding to each piece of query information. In addition, the user information includes information on attributes to which the user belongs (group name, department name, job title, etc.). The relay server 10 may determine whether each piece of query information is accessible based on the user attributes.

For example, as shown in FIG. 4, an accessibility flag for each piece of query information is set in association with the user ID for each user. If access is possible, a "1" is set, and if access is not possible (access prohibited), a "0" is set. The relay server 10 may store the accessibility flag for each piece of query information associated with the user ID for each user in the query information storage unit 173.

For example, user A (user ID=A) can access query information L1, L2, and L3. User B (user ID=B) can access query information L2 only. User C (user ID=C) can access query information L1, L3, and L4. User D (user ID=D) can access query information L4 only.

In this manner, in this embodiment, the on-premise server 30 that can be accessed is set for each user.
In the present embodiment, the services that can be accessed by the on-premise server 30 can be determined for each user. In this way, the minimum amount of necessary information can be disclosed to the users who need it. Also, traffic on the network related to the service can be kept to a necessary minimum.

The relay server 10 may also manage user information for each organization (e.g., each company, each group, each school, each department).

[6] Description of Authentication Processing When the relay server 10 receives access from a user, it judges whether or not to permit authentication of the user. In this embodiment, if it is judged that the user is legitimate in at least one of the following multiple methods (A) to (H), it is judged that authentication of the user is permitted. On the other hand, if it is judged that the user is not legitimate in any of the methods, it is judged that authentication of the user is denied.

In addition, since multi-factor authentication can improve security, it may be determined that the user's authentication is permitted if at least two of the multiple methods (A) to (H) (e.g., (A) and (B)) are determined to be valid.

(A) Password Authentication There are various possible authentication methods. For example, an account (user ID) and a password are defined in advance for each user, the user inputs the account and password, and the user's terminal 20 transmits the account and password to the relay server 10. If the user's account and password received from the user's terminal 20 match the user's account and password registered in the relay server 10, the relay server 10 determines that the user is legitimate.

The password may also be a one-time password that is valid only once. For example, a one-time password generation program that generates a one-time password with the same algorithm as the relay server 10 is installed in advance on the terminal 20, and authentication is performed using the one-time password. For example, the algorithm and seed number of the one-time password generation program installed on the terminal 20 and the one-time password generation program installed on the relay server 10 match, and as a result, the one-time password generated on the terminal side and the password generated on the relay server 10 match. For example, the one-time password generation program performs a process of generating a one-time password based on the time and seed number at a predetermined interval (for example, every 30 seconds).

(B) External Authentication When the relay server 10 accepts access from a user, it delegates authentication of the user to an external authentication server (authentication authority).

For example, the relay server 10 determines whether a user is authenticated by an external authentication server (authentication authority) and determines the legitimacy of the user based on the information received from the authentication server. If the information received from the authentication server includes user information (e.g., an email address), and if the user information matches the user information managed by the relay server 10, the relay server 10 determines that the user is legitimate.

In this embodiment, the user must register user information (e.g., account and password) corresponding to the destination user in advance on an external authentication server.

There may be multiple types of authentication servers, such as Google (registered trademark), Amazon (registered trademark), and Facebook (registered trademark), and an instruction to select one authentication server may be received from the user. The relay server 10 then delegates authentication to the selected authentication server.

(C) Biometric Authentication For example, biometric information (face, fingerprint, veins) for each user is registered in advance with the relay server 10, the user inputs the biometric information and transmits it to the relay server 10, and if the user's biometric information received from the user's terminal 20 matches the user's biometric information registered in the relay server 10, the user is determined to be legitimate.

(D) Authentication using a second terminal (such as a smartphone) For example, the relay server 10 may register the terminal identification information of the second terminal in advance in association with the user's account using a given method. Then, the relay server 10 may use the terminal identification information of the second terminal to determine the legitimacy of the user.

(E) Phone Number Authentication For example, the relay server 10 may register the phone number of the user by a given method and use the phone number of the user to determine the legitimacy of the user.

(F) SSL Client Certificate The relay server 10 may determine whether or not a Secure Socket Layer (SSL) client certificate sent from the terminal 20 is valid, and if the SSL client certificate is valid, may determine that the user is valid.

(G) User Authentication Process Without Using a Password The relay server 10 may execute a process for performing user authentication without using a password (public key-based user authentication process). For example, the relay server 10 may determine the validity of a user by using authentication processes of FIDO (registered trademark) and FIDO2. For example, FIDO2 is composed of CTAP (Client To Authenticator Protocol) and WebAuthn (Web Authentication API), and enables user authentication via a web browser of the terminal 20.

(H) Other User Authentication Processes The relay server 10 may determine the validity of a user by using various authentication processes other than those described above.

[7] Explanation regarding presentation of query information When user authentication is permitted, the relay server 10 presents the query information to the user's terminal 20. Here, "present" means to notify or display the query information by a web page. "Present" may also mean that the relay server 10 makes it possible to present the query information to the user's terminal 20.

Note that "presentation" may mean that the relay server 10 sends to the terminal 20 an email (which may be a mail magazine, etc.) sent and received via SMTP, or that it sends via a given protocol other than SMTP, or that it sends a push notification (displaying a message window in a partial area (such as the top edge) of the terminal (smartphone) screen), or that it presents (controls so that it can be displayed and viewed) a specific screen of a specific application (a banner display screen, a notification screen, a pop-up screen, etc.).

In addition, the relay server 10 may also "present" information to the user's terminal 20 in response to a request from the terminal 20.

Then, when the on-premise server 30 receives access based on the inquiry information from the terminal 20 of a user whose authentication has been permitted via the relay server, the on-premise server 30 presents the information indicated in the inquiry information to the terminal 20 of the user via the relay server 10.

For example, taking user A as an example, when the relay server 10 accepts access from user A's terminal 20A, it first presents an authentication screen. Then, when authentication of user A is permitted, as shown in FIG. 5, the relay server 10 presents, on user A's terminal 20A, screen Sc1 (query information list screen) presenting the query information that user A can access.

For example, as shown in FIG. 4, user A can access the query information L1, L2, and L3. Therefore, as shown in FIG. 5, the query information L1, L2, and L3 are presented on the on-premise information screen Sc1. Note that as shown in FIG. 5, the relay server 10 may present information on the on-premise servers corresponding to each of the query information L1, L2, and L3. Note that, for convenience of explanation, the query information displayed on the screen Sc1 is displayed in the form of a URL, but a link (hyperlink) to the query information may also be displayed.

When user A wants to access the service SA of the on-premise server 30A, user A can easily access the service SA of the on-premise server 30A with one click of the query information L1. For example, when the relay server 10 accepts access of the query information L1 from user A's terminal 20A, it receives information corresponding to the query information L1 (for example, information of the web page of the query information L1) from the on-premise server 30A and transmits it to the user terminal 20.

[8] Description of Relay Processing Next, the relay processing performed by the relay server 10 will be specifically described with reference to Fig. 3. For example, as shown in Fig. 3, the services SA and SB of the on-premise server 30A and the services SC and SD of the on-premise server 30B are activated by agents corresponding to the services, and a TCP connection is established with the relay server 10.

For example, we will explain an example in which relay server 10 relays communication between user A's terminal 20A and service SA of on-premise server 30A.

First, when the relay server 10 accepts access to the inquiry information L1 from the terminal 20A of the user A, it determines whether or not to permit authentication of the user A. Note that the relay server 10 may omit the process of determining whether or not to permit authentication of the user A if it is within a predetermined period of time from the time when authentication of the user A is permitted (for example, within a period of 10 minutes from the time when authentication of the user A is permitted).

When the relay server 10 receives the query information "https://example1.com.henge.io/" from the terminal 20A, this means that the relay server 10 has received access to the web server "example1.com.henge.io" of the relay server 10 via a protocol (e.g., HTTPS protocol) specified by the query information (e.g., URL) from the terminal 20A.

Then, when authentication of user A is permitted, the relay server 10 can determine that access to the query information L1 is access to the service SA of the on-premise server 30A, and therefore relays communication between the service SA and the terminal 20A using a connection of the service SA that has been established in advance.

The agent corresponding to the service SA determines that the information transmitted over the connection is the service SA (port 80) of the on-premise server 30, and transmits (communicates) the information to that service SA (port 80).

As a result, terminal 20A can access on-premise server 30A from outside via relay server 10.

Note that the relay server 10 relays communication between the terminal 20 of a user who has been authorized to authenticate and the service SA only while the agent is running the service SA. In other words, when the service SA is stopped, the relay server 10 does not allow communication between the terminal 20 of a user who has been authorized to authenticate and the service SA.

The agent can manage multiple services, and establishes a connection with the relay server 10 for each service. Therefore, for example, if the agent manages service SA and service SB, when the authenticated terminal 20A accesses query information L1, the relay server 10 uses the connection for service SA corresponding to query information L1. When the authenticated terminal 20A accesses query information L2, the relay server 10 uses the connection for service SB corresponding to query information L2.

The agent then determines which service (which port) of the on-premise server 30A the information sent by terminal 20A via relay server 10 will reach. For example, if the information received by the agent is information transmitted via a service SA connection, the agent transmits the information to service SA (port 80) of the on-premise server 30A, and if the information received is information transmitted via a service SB connection, the agent transmits the information to service SB (port 443) of server 30A.

As described above, in this embodiment, the terminal 20A does not directly access the on-premise server 30A without going through the relay server 10, so a secure network environment can be realized. Also, in this embodiment, permission to authenticate the user is a condition for accessing the on-premise server, so unauthorized access can be prevented.

In addition, in this embodiment, when the terminal 20 communicates with the on-premise server 30 via the relay server 10, data may be encrypted using SSL or TLS.

[9] Flowchart The flow of processing by the relay server of this embodiment will be described with reference to Fig. 6. For convenience of explanation, the processing related to user A will be described. First, based on the information of the on-premise server 30, query information that can be accessed from the on-premise server 30 is generated (step S1).

Then, it is determined whether or not access has been accepted from user A's terminal 20A (step S2). If access has been accepted from user A's terminal 20A (Y in step S2), it is determined whether or not to permit authentication of user A (permission or rejection) (step S3).

If authentication of user A is permitted (Y in step S3), the inquiry information is presented to user A's terminal 20A (step S4). On the other hand, if authentication of user A is not permitted (rejected) (N in step S3), the process ends.

Then, it is determined whether or not access to the inquiry information has been received from user A's terminal 20A (step S5). If access to the inquiry information has been received from user A's terminal 20A (Y in step S5), the relay server 10 relays communication between user A's terminal 20A and the on-premise server 30 (step S6). For example, the relay server 10 receives information from terminal 20A and transmits it to the on-premise server 30, and receives information corresponding to the inquiry information from the on-premise server 30 and transmits it to terminal 20A. This ends the process.

[10] Authentication of on-premise device After authorizing the authentication of the user, the relay server 10 may further delegate the authentication to an on-premise device (e.g., an agent). In other words, the relay server 10 may control so that communication between the terminal 20 and the on-premise server 30 is enabled when the authentication in the on-premise device is finally authorized.

[11] Cloud Services and Single Sign-On The relay server 10 may be an information processing device capable of providing secure access to and authentication of a given cloud service to the terminal 20 connected to the relay server 10 via the Internet. Examples of cloud services include Microsoft 365 (registered trademark), Google (registered trademark), Slack (registered trademark), and Zoom (registered trademark). The relay server 10 controls the cloud service so that it can be provided to a user who has been authorized to be authenticated.

For example, the relay server 10 may be able to control the use of SAML (Security Assertion Markup Language) to allow a user to use multiple cloud services at once with a single sign-on.

[12] Others The present invention is not limited to the above-described embodiment, and various modifications are possible. For example, a term cited in the description of the specification or drawings as a term with a broad meaning or synonymous meaning can be replaced with a term with a broad meaning or synonymous meaning in other descriptions of the specification or drawings.

10 Server, 20 Terminal, 30 On-premise server,
REFERENCE SIGNS LIST 100 Processing section, 111 User control section, 112 Authentication processing section, 113 Inquiry information generating section, 114 Presentation section, 115 Relay processing section, 120 Web processing section, 170 Storage section, 171 Main storage section, 172 User information storage section, 173 Inquiry information storage section, 180 Information storage medium, 196 Communication section

Claims (13)

An information processing device in which a user's terminal and an on-premise server are connected via the Internet, and the terminal and the on-premise server are connected via the Internet,
a query information generating unit configured to generate a unique URL that can access the on-premise server based on information of the on-premise server;
A user control unit that manages user information of a user;
an authentication processing unit that, when an access is accepted from a user terminal, determines whether or not the user should be authenticated;
a presentation unit that presents the URL to a terminal of the user if authentication of the user is permitted;
a relay processing unit that relays communication between a terminal of the user who has been authorized for authentication and the on-premise server when access to the URL is received from the terminal of the user;
Including,
The inquiry information generating unit
When there are multiple on-premise servers, a different URL is generated for each on-premise server,
The presentation unit is
An information processing device that presents URLs of a plurality of on-premise servers on one screen of the user terminal. An information processing device in which a user's terminal and an on-premise server are connected via the Internet, and the terminal and the on-premise server are connected via the Internet,
a query information generating unit configured to generate a unique URL that can access the on-premise server based on information of the on-premise server;
A user control unit that manages user information of a user;
an authentication processing unit that, when an access is accepted from a user terminal, determines whether or not the user should be authenticated;
a presentation unit that presents the URL to a terminal of the user if authentication of the user is permitted;
a relay processing unit that relays communication between a terminal of the user who has been authenticated and the on-premise server when access to the URL is received from the terminal of the user who has been authenticated;
Including,
The inquiry information generating unit
When multiple services are running on one on-premise server, a different URL is generated for each service,
The presentation unit is
An information processing device which displays URLs of a plurality of services on one screen of the user terminal. In claim 1 or 2,
The user control unit:
For each user, determine whether the user is allowed to access each URL based on the user information of the user;
The presentation unit is
An information processing apparatus that presents, for each user, URLs accessible by that user to a terminal of that user. An access control system in which a user terminal, an on-premise server, and an information processing device are each connected via the Internet,
The information processing device includes:
a query information generating unit configured to generate a unique URL that can access the on-premise server based on information of the on-premise server;
A user control unit that manages user information of a user;
an authentication processing unit that, when an access is accepted from a user terminal, determines whether or not the user should be authenticated;
a presentation unit that presents the URL to a terminal of the user if authentication of the user is permitted;
a relay processing unit that relays communication between a terminal of the user who has been authorized to be authenticated and the on-premise server when access to the URL is received from the terminal of the user,
The inquiry information generating unit
When there are multiple on-premise servers, a different URL is generated for each on-premise server,
The presentation unit is
Presenting URLs of each of a plurality of on-premise servers on one screen of the user terminal;
The on-premise server comprises:
An access control system characterized in that, when access via the URL is accepted from the terminal of a user who has been authorized for authentication via the information processing device, the information indicated in the URL is presented to the user's terminal via the information processing device. In claim 4,
An agent device that exists in the same network environment as the on-premise server;
The agent device includes:
Establishing a connection between each on-premise server and the information processing device ;
The relay processing unit includes:
An access control system characterized in that, when access to the URL is accepted, communication between the user's terminal and the on-premise server is relayed using a connection of the on-premise server corresponding to the URL . An access control system in which a user terminal, an on-premise server, and an information processing device are each connected via the Internet,
The information processing device includes:
a query information generating unit configured to generate a unique URL that can access the on-premise server based on information of the on-premise server;
A user control unit that manages user information of a user;
an authentication processing unit that, when an access is accepted from a user terminal, determines whether or not the user should be authenticated;
a presentation unit that presents the URL to a terminal of the user if authentication of the user is permitted;
a relay processing unit that relays communication between a terminal of the user who has been authorized for authentication and the on-premise server when access to the URL is received from the terminal of the user,
The inquiry information generating unit
When multiple services are running on one on-premise server, a different URL is generated for each service,
The presentation unit is
Presenting URLs of each of a plurality of services on one screen of the user terminal;
The on-premise server comprises:
An access control system characterized in that, when access via the URL is accepted from the terminal of a user who has been authorized for authentication via the information processing device, the information indicated in the URL is presented to the user's terminal via the information processing device. In claim 6,
An agent device that exists in the same network environment as the on-premise server;
The agent device includes:
Establishing a connection between each service and the information processing device ;
The relay processing unit includes:
When access to the URL is accepted, the access control system relays communication between the user's terminal and the service using a connection for the service corresponding to the URL . An access control system in which a user terminal, an on-premise server, and an information processing device are each connected via the Internet,
An agent device that exists in the same network environment as the on-premise server;
The agent device includes:
Establishing a connection between the on-premise server and the information processing device ;
The information processing device includes:
a query information generating unit configured to generate a unique URL that can access the on-premise server based on information of the on-premise server;
A user control unit that manages user information of a user;
an authentication processing unit that, when an access is accepted from a user terminal, determines whether or not the user should be authenticated;
a presentation unit that presents the URL to a terminal of the user if authentication of the user is permitted;
a relay processing unit that relays communication between a terminal of the user who has been authorized for authentication and the on-premise server when access to the URL is received from the terminal of the user,
The inquiry information generating unit
generating a URL corresponding to the on-premise server;
The relay processing unit includes:
When the access to the URL is accepted, the on-premise server uses a connection of the on-premise server corresponding to the URL to relay communication between the terminal of the user and the on-premise server;
The on-premise server comprises:
An access control system characterized in that, when access via the URL is accepted from the terminal of a user who has been authorized for authentication via the information processing device, the information indicated in the URL is presented to the user's terminal via the information processing device. An access control system in which a user terminal, an on-premise server, and an information processing device are each connected via the Internet,
An agent device that exists in the same network environment as the on-premise server;
The agent device includes:
Establishing a connection between the on-premise server service and the information processing device ;
The information processing device includes:
a query information generating unit configured to generate a unique URL that can access the on-premise server based on information of the on-premise server;
A user control unit that manages user information of a user;
an authentication processing unit that, when an access is accepted from a user terminal, determines whether or not the user should be authenticated;
a presentation unit that presents the URL to a terminal of the user if authentication of the user is permitted;
a relay processing unit that relays communication between a terminal of the user who has been authorized for authentication and the on-premise server when access to the URL is received from the terminal of the user,
The inquiry information generating unit
Generate a URL corresponding to a service of the on-premise server;
The relay processing unit includes:
When the access to the URL is accepted, the service relays communication between the user's terminal and the service using a connection of the service corresponding to the URL ;
The on-premise server comprises:
An access control system characterized in that, when access via the URL is accepted from the terminal of a user who has been authorized for authentication via the information processing device, the information indicated in the URL is presented to the user's terminal via the information processing device. A program for an information processing device in which a user's terminal and an on-premise server are connected via the Internet, and the terminal and the on-premise server are connected via the Internet,
a query information generating unit configured to generate a unique URL that can access the on-premise server based on information of the on-premise server;
A user control unit that manages user information of a user;
an authentication processing unit that, when an access is accepted from a user terminal, determines whether or not the user should be authenticated;
a presentation unit that presents the URL to a terminal of the user if authentication of the user is permitted;
when access to the URL is received from a terminal of the user who has been authenticated, causing the computer to function as a relay processing unit that relays communication between the terminal of the user and the on-premise server;
The inquiry information generating unit
When there are multiple on-premise servers, a different URL is generated for each on-premise server,
The presentation unit is
A program that presents URLs of a plurality of on-premise servers on one screen of the user terminal. A program for an information processing device in which a user's terminal and an on-premise server are connected via the Internet, and the terminal and the on-premise server are connected via the Internet,
a query information generating unit configured to generate a unique URL that can access the on-premise server based on information of the on-premise server;
A user control unit that manages user information of a user;
an authentication processing unit that, when an access is accepted from a user terminal, determines whether or not the user should be authenticated;
a presentation unit that presents the URL to a terminal of the user if authentication of the user is permitted;
when access to the URL is received from a terminal of the user who has been authenticated, causing the computer to function as a relay processing unit that relays communication between the terminal of the user and the on-premise server;
The inquiry information generating unit
When multiple services are running on one on-premise server, a different URL is generated for each service,
The presentation unit is
A program for presenting URLs of a plurality of services on one screen of the user terminal. An information processing method of an information processing device in which a user's terminal and an on-premise server are connected via the Internet, and the terminal and the on-premise server are connected via the Internet,
generating a unique URL that can access the on-premise server based on information of the on-premise server;
Managing user information of a user;
a step of determining whether or not to permit authentication of a user when access is received from the user's terminal;
presenting the URL to a terminal of the user if authentication of the user is permitted;
When an access to the URL is received from a terminal of the user who has been authenticated, relaying communication between the terminal of the user and the on-premise server;
The step of generating a URL includes:
When there are multiple on-premise servers, a different URL is generated for each on-premise server,
The presenting step includes:
An information processing method comprising presenting URLs of a plurality of on-premise servers on one screen of the user terminal. An information processing method of an information processing device in which a user's terminal and an on-premise server are connected via the Internet, and the terminal and the on-premise server are connected via the Internet,
generating a unique URL that can access the on-premise server based on information of the on-premise server;
Managing user information of a user;
a step of determining whether or not to permit authentication of a user when access is received from the user's terminal;
presenting the URL to a terminal of the user if authentication of the user is permitted;
When an access to the URL is received from a terminal of the user who has been authenticated, relaying communication between the terminal of the user and the on-premise server;
The step of generating a URL includes:
When multiple services are running on one on-premise server, a different URL is generated for each service,
The presenting step includes:
An information processing method comprising presenting URLs of a plurality of services on one screen of the user terminal.

Images