JP7697296B2 - System, information processing device, intermediation method and program - Google Patents

Description

The present invention relates to a system, an information processing device, an intermediation method, and a program.

There are known methods for accessing services provided by a destination terminal on an intranet inside a firewall, such as a remote desktop service, from a source terminal in a remote environment. One method is to encrypt communications from within the intranet to the source terminal using a VPN (Virtual Private Network) or similar. Another method is a remote access service that connects via encrypted communications with a cloud server.

Also, in relation to screen virtualization, Japanese Patent No. 5 459 693 (Patent Document 1) discloses a system for providing a screen virtualization service to various terminals. Patent Document 1 discloses a system in which, when a user terminal transmits a system profile to a cloud device, the cloud device generates a list of candidate screen virtualization technologies that the terminal can process from the system profile transmitted from the terminal, checks the device load and processing capability for each technology, and determines the optimal screen virtualization technology candidate based on the system profile of the terminal and the available resources of the device through a screen virtualization technology determination unit depending on whether web services are available, whether RDP (Remote Desktop Protocol)/VNC (Virtual Network Computing) are available, and whether video streaming is available. However, in the conventional technology of Patent Document 1, the server has multiple virtualization technologies, and a process of creating and determining a technology list is required, and it is necessary to check and determine the device load for each technology on the server.

This disclosure has been made in consideration of the above points, and aims to provide a system that makes it possible to select an appropriate output screen quality when using remote access.

In order to solve the above problems, the present disclosure provides a system having the following characteristics. The system mediates the establishment of access from an access source terminal to a service provided by an access destination terminal, relayed through a communication relay means of the same network as the access destination terminal. The system includes a storage unit that stores an index value of a screen quality related to the service, and a determination unit that determines a usage value of the screen quality within a range based on the index value, based on the relationship between the stored index value of the screen quality and a specified value of the screen quality from the access source terminal. The system further includes a control unit that controls the communication relay means to set the screen quality based on the determined usage value.

The above configuration makes it possible to select the appropriate output screen quality when remotely accessing.

FIG. 1 is a diagram showing the overall configuration of a network environment including a remote access support system according to this embodiment. FIG. 2 is a diagram showing the hardware configuration of a computer system that can be used in this embodiment. FIG. 3 is a block diagram showing the functional configuration of the remote access support system according to this embodiment. FIG. 4 is a diagram showing a redundant configuration of an application system in this embodiment. FIG. 5 is a diagram showing a redundant configuration of a relay system according to the present embodiment. FIG. 6 is a diagram showing the configuration of a platform system in this embodiment. FIG. 7 is a diagram illustrating an example of a data structure managed in a database in this embodiment. FIG. 8 is a diagram illustrating an example of a data structure managed in a database in this embodiment. FIG. 9 is a diagram showing a more detailed configuration of the on-site network in this embodiment. FIG. 10 is a diagram showing a more detailed configuration of the communication relay device in this embodiment. FIG. 11 is a flowchart showing the resolution determination process according to this embodiment. FIG. 12 is a sequence diagram showing the login process according to this embodiment. FIG. 13 is a diagram showing examples of various login screens that are displayed on the display screen of the access source terminal. FIG. 14 is a diagram for explaining the process when an end user logs into the remote access support system according to this embodiment, specifies the resolution of the browser display area as a designated value, and uses a remote desktop service. FIG. 15 is a sequence diagram showing a process for a remote desktop connection executed in the remote access support system according to this embodiment. FIG. 16 is a sequence diagram showing a process for a remote desktop connection executed in the remote access support system according to this embodiment. FIG. 17 is a diagram illustrating an embodiment of the modified example. FIG. 18 is a sequence diagram showing a process for reconnection accompanying a change in the resolution of the remote desktop executed in the remote access support system 140 according to the modified embodiment.

The following describes an embodiment of the present invention, but the embodiment of the present invention is not limited to the embodiment described below. Note that the embodiment described below uses a remote access support system 140 as an example of a system.

Figure 1 is a diagram showing the overall configuration of a network environment 100 including a remote access support system 140 according to this embodiment. As shown in Figure 1, the network environment 100 includes the Internet 102, and a first network 104, a second network 106, and a third network 108 connected to the Internet 102. The remote access support system 140 is constructed in such a network environment 100.

The first network 104 is a network in which a system for mediating the establishment of remote access to a specific service via the Internet 102 is located. A remote access support system 140 is deployed on the first network 104, and more specifically, the remote access support system 140 includes an application system 150, a platform system 170, and a relay system 190. In a specific embodiment, the first network 104 is a platform-side network that provides a function of mediating the establishment of remote access and relaying remote access communications as a cloud service.

The second network 106 is a network to which terminals that provide a specific service that is the target of remote access belong. On the second network 106 shown in FIG. 1, an access destination terminal 110 is disposed, and further, a communication relay device 120 is disposed. The second network 106 is also referred to as the on-site network 106.

The third network 108 is a network to which the terminal (access source terminal) of a user who wishes to remotely access a specific service provided by the target access destination terminal 110 belongs. The access source terminal 130 is placed on the third network 108. The access source terminal 130 has a display device, and displays a screen of the specific service provided by the target access destination terminal 110 in a specific display area within the display device. The third network 108 is also referred to as the remote side network 108.

The remote access support system 140 is a system that provides a remote access mediation service that mediates the establishment of access when an access source terminal 130 on a remote side network 108 accesses a specific service provided by an access destination terminal 110 on a site side network 106 via the Internet 102. Here, the specific service provided by the access destination terminal 110 is accessed via a communication relay device 120 installed in the same site side network 106 as the access destination terminal 110.

In the embodiment described below, the specified service is, more specifically, a remote desktop service. In the remote desktop service, the desktop screen of the destination terminal 110 is displayed on the screen of a display device of the source terminal 130.

The application system 150 provides a user interface (UI) that enables mutual communication with the access source terminal 130. The provided UI allows the access source terminal 130 to use remote desktop services. The platform system 170 provides infrastructure functions such as user and device authentication, two-way communication with the communication relay device 120, contract management, and data lake. The relay system 190 mediates the connection between the access source terminal 130 and the communication relay device 120, and relays input/output data (screen information, audio information, operation information) for a specified service provided by the access destination terminal 110.

The access source terminal 130 may be a general desktop or laptop type personal computer running a browser (e.g., a web browser), a smartphone, a tablet terminal, a kiosk terminal, or the like, and the type of terminal is not limited. The access source terminal 130 may be equipped with a dedicated application for using the remote access function, or may be equipped with a general-purpose application such as the above-mentioned browser. The access source terminal 130 may be a general-purpose terminal such as a personal computer or smartphone, or may be an information system such as a warning light device, an electronic paper device, an electronic medical record system, or a process control system, and is not particularly limited.

The destination terminal 110 is an information processing device such as a personal computer, server, or workstation that provides a remote desktop function within the on-site network 106. The remote desktop protocol is not particularly limited, and examples include RDP (Remote Desktop Protocol) and VNC (Virtual Network Computing).

The communication relay device 120 connects to the relay system 190 in response to an instruction from the application system 150, relays data communication with the access source terminal 130, and performs protocol conversion during this process. Note that in the embodiment shown in FIG. 1, the communication relay device 120 is described as being provided separately as a device that exclusively implements the relay function, but is not limited to this. In other embodiments, software that implements the functions of the communication relay device 120 may be installed in the access destination terminal 110 or other terminals in the on-site network 106.

Before describing the remote access service in detail, the hardware configuration of the related devices will be described below. Figure 2 is a hardware configuration diagram of a computer system that can be used as one or more servers that make up the destination terminal 110, source terminal 130, communication relay device 120, and remote access support system 140 according to this embodiment. Here, the hardware configuration of server 9 will be described.

As shown in FIG. 2, the server 9 is constructed by a computer, and includes a CPU 901, a ROM (Read Only Memory) 902, a RAM (Random Access Memory) 903, a HD 904, a HDD (Hard Disk Drive) controller 905, a display 906, an external device connection I/F (Interface) 908, a network I/F 909, a data bus 910, a keyboard 911, a pointing device 912, a DVD-RW (Digital Versatile Disk Rewritable) drive 914, and a media I/F 916.

Of these, the CPU 901 controls the operation of the entire server 9. The ROM 902 stores programs used to drive the CPU 901, such as IPL. The RAM 903 is used as a work area for the CPU 901. The HD 904 stores various data such as programs. The HDD controller 905 controls the reading or writing of various data from the HD 904 according to the control of the CPU 901. The display 906 displays various information such as a cursor, menu, window, character, or image. The external device connection I/F 908 is an interface for connecting various external devices. In this case, the external device is, for example, a USB (Universal Serial Bus) memory or a printer. The network I/F 909 is an interface for data communication using a communication network. The bus line 910 is an address bus, a data bus, or the like for electrically connecting each component such as the CPU 901 shown in FIG. 2.

The keyboard 911 is a type of input means equipped with multiple keys for inputting characters, numbers, various instructions, etc. The pointing device 912 is a type of input means for selecting and executing various instructions, selecting a processing target, moving the cursor, etc. The DVD-RW drive 914 controls the reading and writing of various data from a DVD-RW 913, which is an example of a removable recording medium. Note that this is not limited to a DVD-RW, and may be a DVD-R, etc. The media I/F 916 controls the reading and writing (storing) of data from a recording medium 915, such as a flash memory.

The remote access support system 140 according to this embodiment will be described in more detail below with reference to FIG. 3. FIG. 3 is a block diagram showing the functional configuration of the remote access support system 140 according to this embodiment. FIG. 3 also shows functional blocks 210, 220, and 230 of the destination terminal 110, the communication relay device 120, and the source terminal 130.

The destination terminal 110 provides a remote desktop service 212 on the site network 106. The source terminal 130 is connected to the Internet 102 from the remote network 108, but is not directly connected to the site network 106. Therefore, the source terminal 130 cannot directly access the remote desktop service 212 provided by the destination terminal 110 on the site network 106.

Conventionally, in such cases, in order to access the on-site network 106 from the access source terminal 130, a network is connected from the access source terminal 130 or the remote network 108 to the on-site network 106 using a tunneling technology such as a VPN.

One known method for connecting from the remote network 108 to the on-site network 106 via a VPN is, for example, IPsec (RFC4301 Security Architecture for the Internet Protocol, RFC4306 Internet Key Exchange (IKEv2) protocol). When using this method, it is necessary to change the network settings to communicate correctly with IPsec. For example, it is necessary to properly change the router routing settings and the firewall access control list.

In the case of a VPN connection, once a VPN connection has been established, accessible resources (networks, services, etc.) can be controlled according to the firewall's access control. However, this access control can basically be based on IP addresses or transport layer port numbers (e.g., 3389/tcp). To achieve access control for each logged-in user, it is necessary to link the logged-in user with an identifier such as an IP address, which requires cumbersome work such as changing the existing network configuration.

Another method is a remote access service that connects via encrypted communication with a cloud server. In the remote access service, communication between the service on the cloud and the destination terminal in the intranet is performed using data compressed through protocol conversion, etc. In the remote desktop, the desktop screen of the destination terminal with the specified resolution is sent as image information and displayed on the display device of the access source terminal. In general, the visibility of the output image is worse when data compression is performed than when data compression is not performed. Also, the best visibility is achieved when the image is displayed in a size that is Dot-by-Dot for the resolution setting of the destination terminal. The lower the compression rate of the image data, the better the visibility, but the larger the amount of communication data. The lower the compression rate of the image data and the higher the specified resolution, that is, the higher the quality of the screen, the larger the communication data amount and the load when relaying communication of the communication relay device. If the processing becomes excessive, the operability of the remote desktop may decrease or the connection may be disconnected due to a timeout. Methods can be adopted to limit settings that result in high loads, but typically there is no way for service users to know the appropriate amount of load.

Therefore, in the embodiment described below, a mechanism is provided that allows access to the remote desktop service 212 on the on-site network 106 from the access source terminal 130 on the remote network 108 with simple settings, appropriate screen quality, and secure communication using a browser 232.

The access source terminal 130 starts a browser 232 and connects to the remote access support system 140 (application system 150, platform system 170, and relay system 190) from the browser 232 via the Internet. The access source terminal 130 communicates with the remote access support system 140 and establishes access via the communication relay device 120 to the remote desktop service 212 provided by the access destination terminal 110. The screen of the browser 232 is displayed on a display screen 234 provided by the display device, and after access is established, the desktop screen of the remote desktop service 212 is displayed in a specified area of the display screen 234.

In the embodiment described below, the remote desktop service 212 is used as an example of the service provided by the destination terminal 110, but the service is not limited to this. The service provided by the destination terminal 110 is not limited to other services as long as it is a service that allows IP communication, and may also be a service that does not allow IP communication. For example, in the case of a service that controls a device that can communicate via RS-S32C, it is sufficient to be able to communicate with that device from the communication relay device 120 via the RS-232C protocol.

The application system 150 provides remote access and various management functions to the access source terminal 130 via a UI that supports authentication, and provides information about the relay system 190 in response to a remote access request. The application system 150 also manages information such as users, devices, and various policies of the communication relay device 120, issues instructions such as changing settings for the communication relay device 120 and connecting to the relay system 190, and performs processing related to the resolution setting described below.

As shown in FIG. 3, the functional block 250 of the application system 150 includes a resolution selection UI providing unit 252, a resolution determining unit 254, a resolution setting storage unit 256, and an API (Application Programming Interface) communication unit 258. The API communication unit 258 performs processing related to the API.

The resolution selection UI provision unit 252 provides a UI for allowing the user to select, through operation, the screen resolution setting as the screen quality when using a remote desktop service. Here, the selected screen quality may include the screen resolution and the data compression rate of the screen information, but is preferably the screen resolution, and the following description will continue assuming that the selected screen quality is the screen resolution. In addition, the UI is not particularly limited, but the description will continue assuming that it is a Web UI.

In the embodiment described below, the screen resolution can be selected by selecting one of multiple candidate values (fixed values) and by directly specifying a variable value. When selecting one of multiple candidate values (fixed values), the resolution selection UI providing unit 252 provides multiple candidate values stored in the resolution setting storage unit 256 as options and receives information selected by the user from among them. In this case, the resolution is determined by the remote access support system 140, and the value selected from the options becomes the specified value from the access source terminal 130. When directly specifying a variable value, a code (e.g., JavaScript (registered trademark)) configured to transmit the resolution of the display screen of the access source terminal 130 or the resolution information of the browser display area is provided, and the transmitted resolution information is received. In this case, the access source terminal 130 determines the resolution, and the variable value indicated by the resolution information here becomes the specified value from the access source terminal 130.

The resolution setting storage unit 256 stores an index value of the screen resolution of the remote desktop service 212. In a specific embodiment, the index value specifies the upper limit of the range of resolution appropriate for the communication relay device 120. The resolution setting storage unit 256 constitutes a storage unit in this embodiment that stores the index value of the screen resolution as an index value of the screen quality related to a specified service.

The resolution determination unit 254 determines the usage value of the screen resolution within a range based on the index value, based on the relationship between the index value of the screen resolution stored in the resolution setting storage unit 256 and the specified value of the screen resolution from the access source terminal 130. In this embodiment, the resolution determination unit 254 constitutes a determination unit that determines the usage value of the screen resolution as the usage value of the screen quality for a specified service.

When multiple candidate values are provided as options, multiple candidate values may be provided as options regardless of the index value, and then it may be determined whether or not the selected value is within a range based on the index value. Alternatively, only options that have been determined in advance to be within the range based on the index value may be provided, and a value selected from among these may be received. In either case, this is considered to be included in determining the value to be used within the range based on the index value, based on the relationship between the stored index value and the specified value.

As described above, application system 150 is composed of multiple components, but it may be realized by a single application on a single application server, or by a combination of multiple applications. Application system 150 may also be composed of a single or multiple applications by combining multiple application servers and network devices.

Furthermore, in the embodiment described, the application system 150 assumes access from the browser 232, but in addition to access from the browser 232, operations from a Web API may also be possible, and access from applications other than the browser may also be possible. In the embodiment described, Web access (HTTPS/HTTP) is used as an example of access, but MQTT (Message Queueing Telemetry Transport) and RPC (Remote procedure Call) may also be used.

The platform system 170 provides common services for efficiently providing services, such as authentication of users and devices, two-way communication with communication relay devices, contract management, and data lakes.

As shown in FIG. 3, the functional block 270 of the platform system 170 includes an authentication unit 272, a portal processing unit 274, and a control unit 276. The authentication unit 272 provides user authentication and device authentication. This authentication function realizes user name and password authentication, authentication by certificate, multi-factor authentication, etc. The portal processing unit 274 provides a common portal site.

The control unit 276 is constantly connected to the communication relay device 120 and transmits instructions and settings from the application system 150 to the communication relay device 120. In particular, the control unit 276 controls the communication relay device 120 to set the resolution of the remote desktop screen based on the usage value of the screen resolution determined by the resolution determination unit 254. The control unit 276 constitutes the control unit in this embodiment. Upon receiving the instruction, the communication relay device 120 performs a connection resolution setting process for the remote desktop service 212 provided by the access destination terminal 110 at the start of the service. This constant connection can be realized by MQTT over WebSocket over HTTPS as a configuration for establishing a connection from the communication relay device 120 to the control unit 276, which makes it possible to realize the connection without changing the firewall settings of the field network 106.

In the embodiment described, the platform system 170 is described as managing user information, etc., but the division of roles between the platform system 170 and the application system 150 is merely an example, and the application system 150 may manage user information. Also, in the embodiment described, the application system 150 is described as including a resolution setting storage unit 256 and a resolution determination unit 254, but in other embodiments, the platform system 170 may include one or both of the resolution setting storage unit 256 and the resolution determination unit 254.

The relay system 190 relays input/output data (screen information, voice information, operation information) of the service provided by the access destination terminal 110. As shown in FIG. 3, the function block 290 of the relay system 190 includes a communication relay unit 292.

The communication relay unit 292 relays the connection between the access source terminal 130 and the communication relay device 120. More specifically, the communication relay unit 292 manages WSS (WebSocket over HTTPS) sessions and relays remote access data communication between the browser 232 and the communication relay device 120. Note that the communication relay unit 292 does not need to interpret the contents of WSS communication. The communication relay unit 292 correctly connects the communication between the browser 232 and the relay system 190, and the communication between the communication relay device 120 and the relay system 190, and transfers data between the browser 232 and the communication relay device 120.

The communication relay device 120 connects to the relay system 190 in response to an instruction from the application system 150. The communication relay device 120 relays and/or converts the operation by the access source terminal 130 on the service provided by the access destination terminal 110 and the response from the service to the access source terminal 130. The communication relay device 120 also sets its own relay function, registers devices, executes instructions from the application system 150 such as remote desktop access with a specified resolution setting, and provides a Web UI for its own network settings, etc.

As shown in FIG. 3, the functional block 220 of the communication relay device 120 includes a protocol conversion unit 222 and a connection resolution setting storage unit 224. The connection resolution setting storage unit 224 stores the connection resolution setting when the connection resolution setting process is performed at the start of the service with the destination terminal 110.

The protocol conversion unit 222 has a function of establishing a connection with the relay system 190 upon receiving instructions from the application system 150, and a function of converting the protocol to enable correct control between the accessed service and the access source terminal 130. The protocol conversion unit 222 performs a connection resolution setting process for the accessed service when the service starts. In doing so, it receives information indicating the screen resolution to be used from the remote access support system 140, reflects this in the settings, and generates output screen information corresponding to the resolution set through communication with the accessed service. The above protocol conversion processes image information that is the difference within an image at the specified resolution.

In the embodiment described, the communication relay device 120 is configured to connect to the control unit 276 of the platform system 170 and receive instructions from the application system 150, but it may also be configured to receive instructions by direct communication with the application system 150 without going through the control unit 276.

After access is established between the destination service and the access source terminal 130 through the mediation of the remote access support system 140, the display screen 234 of the access source terminal 130 displays the display area at the screen resolution of the screen information based on the screen information received from the communication relay device 120. The browser 232 transmits operation information indicating the operation input to the communication relay device 120 based on the operation input related to the display area.

In the above description, the destination terminal 110, the communication relay device 120, and the source terminal 130 are described as components that are not included in the system (remote access support system 140) according to this embodiment, but this is not limited to this. The system according to this embodiment may include all or part of the destination terminal 110, the communication relay device 120, and the source terminal 130.

Figure 4 is a diagram showing a redundant configuration 300 of an application system 150 in this embodiment. As shown in Figure 4, the application system 150 includes a load balancing device 302, a web application 310, and a database 316.

In the load balancer 302, the application system 150 receives an HTTPS connection from the access source terminal 130 at the HTTP termination unit 304. The Web application 310 runs multiple instances as shown in FIG. 4. The request analysis unit 306 breaks down the HTTP header, and the assignment determination unit 308 assigns processing to the Web application 310 based on the URL path and other information. In the Web application 310, the Web UI unit 312 calls the Web API unit 314 as an internal process and accesses the database 316 via the Web API unit 314, but the Web UI unit 312 may directly access the database 316. As shown in FIG. 4, the Web application 310 can have a redundant configuration with multiple instances, but this is not particularly limited and may be one instance. Also, while FIG. 4 describes a method for providing computer resources using IaaS (Infrastructure as a Service), it may also be achieved using FaaS (Function as a Service).

Also, as shown in FIG. 4, the database 316 of the application system 150 includes a type list 318, a service list 320, a service group list 322, an action list 324, and a policy list 326.

Figure 5 is a diagram showing a redundant configuration 330 of the relay system 190 in this embodiment. As shown in Figure 5, the relay system 190 includes a load balancing device 332 and a web application 340.

In the load balancer 332, the relay system 190 receives HTTPS connections from the access source terminal 130 and the communication relay device 120 at the HTTP termination unit 334. The web application 340 runs multiple instances as shown in FIG. 5. The request analysis unit 336 breaks down the HTTP header, and the assignment determination unit 338 assigns processing to the web application 340 based on the URL path and other information. As shown in FIG. 5, the web application 340 can have multiple instances for redundancy, but this is not particularly limited and may be a single instance. The relay system 190 connects from the access source terminal 130 and the communication relay device 120 via Web Socket over HTTPS, and tunnels both ends.

Figure 6 is a diagram showing a configuration 350 of a platform system 170 in this embodiment. As shown in Figure 6, the platform system 170 includes a load balancing device 352, an authentication unit 360, a portal processing unit 362, a control unit 364, and a database 316. The authentication unit 360, the portal processing unit 362, and the control unit 364 correspond to the authentication unit 272, the portal processing unit 274, and the control unit 276 shown in Figure 3.

In the load balancer 352, the platform system 170 receives an HTTPS connection from the application system 150 and the like at the HTTP termination unit 354. The request analysis unit 356 breaks down the HTTP header, and the assignment determination unit 358 assigns processing to one of the authentication unit 360, portal processing unit 362, and control unit 364 based on the URL path and other information. As shown in FIG. 6, the database 366 of the platform system 170 includes a tenant list 368, a user list 370, and a user group list 372.

The various data structures managed by databases 316 and 366 are explained below with reference to Figures 7 and 8.

7A illustrates an example of the data structure of the type list 318 held by the database 316 of the application system 150 shown in FIG. 4. As shown in FIG. 7A, the type list 318 has fields for a tenant ID, a type ID, a type name, and a conversion program, and associates a tenant with a type and a conversion program. A tenant corresponds to any organization or individual, such as a government agency, an educational institution, a company, or a group of individuals. A common conversion program and a conversion program for each tenant may be registered in the type list 318. The conversion program includes a predetermined conversion process content. Here, the common type (common) is a type in which the system provider can register a general-purpose module in advance. For the type for each tenant, it is assumed that the administrator or the system provider will register a conversion program unique to the tenant in advance, but the original conversion program may be created. Here, the conversion program may be implemented in any language as long as it can be executed by the communication relay device 120. In the example shown in FIG. 7(A), for the remote desktop (type name: RDP) service, a specific conversion program (app/common/rdp) is registered as a common type.

Figure 7 (B) illustrates an example of the data structure of a service list 320 held by the database 316 of the application system 150 shown in Figure 4. The service list 320 has fields for tenant ID, service ID, service name, type, and destination, and associates tenants, services, types, and destinations. In the example shown in Figure 7 (B), for a remote desktop service, a specific tenant (tenant ID = t_20171384) has a service name "IT department shared PC" and specific destination information (info-pc.info.example.co.jp:3389/TCP) registered. The destination may be an FQDN (Fully Qualified Domain Name) or an IP address. In addition, in the case of a type that cannot perform IP communication, an RS-232C COM port may be used.

Figure 7 (C) illustrates an example of the data structure of the action list 324 held by the database 316 of the application system 150 shown in Figure 4. The action list 324 has fields for the tenant ID, action ID, action name, and action, and associates the tenant with the action and the storage destination of the action. There are common actions and actions defined for each tenant. Within the action, it is possible to define whether to permit, deny, perform multi-factor authentication, etc.

Figure 7 (D) illustrates an example of the data structure of a policy list 326 held by the database 316 of the application system 150 shown in Figure 4. The policy list 326 has fields for tenant ID, policy ID, policy name, priority, user, service, and action, and associates tenant, policy, priority, user, service, and action. As defined in the policy list 326 shown in Figure 7 (D), when an accessing user or user group matches a service or service group, the corresponding action is implemented. In addition, these policies may match multiple accessing users or user groups and service or service group pairs, and therefore priorities are set, and the policy with the higher priority is executed first.

Here, the policy executes the action according to the priority that has been set, but in the case of more detailed settings, it is possible to use a method such as longest match to execute the action, or to continue after executing the action and check whether it matches the next policy, and then execute the action of the next matching policy.

Figure 8 (A) illustrates an example of the data structure of a tenant list 368 held by the database 366 of the platform system 170 shown in Figure 6. As shown in Figure 8 (A), the tenant list 368 has fields for a tenant ID and a tenant name, and associates the tenant ID with the tenant name. Here, there are two tenants, but there may naturally be more than two. Also, here, the list is shown without tenant nesting, but it may have a nested hierarchical structure.

Figure 8 (B) illustrates an example of the data structure of a user list 370 held by the database 366 of the platform system 170 shown in Figure 6. As shown in Figure 8 (B), the user list 370 has fields for tenant ID, user ID, user name, display name, and password, and associates tenants, users, and passwords. Note that in the example shown in Figure 8 (B), the passwords are hashed. Here, passwords are managed, but authentication can also be performed using certificates.

Figure 8 (C) illustrates an example of the data structure of a communication relay device list 380 held by the database 366 of the platform system 170 shown in Figure 6. As shown in Figure 8 (C), the communication relay device list 380 has fields for a tenant ID, a device ID, a UUID (Universally Unique Identifier), and a device name, and associates tenants with devices and settings. Here, the UUID is defined in RFC4122 and is an ID used to uniquely identify a device.

Figure 8 (D) illustrates the data structure of the setting value list 390 held by the resolution setting storage unit 256 of the application system 150 shown in Figure 6. As shown in Figure 8 (D), the setting value list 390 has items and setting value fields. The resolution setting storage unit 256 stores an index value (upper limit value) as an upper limit value used in the process of determining the designated resolution value received by the application system 150, and a list of candidate resolution values (candidate values 1 to 5) provided as options. In the example shown in Figure 8 (D), there is also an item for storing resolution information in each mode, corresponding to the case where the access source terminal 130 can change the display area of the service output screen in two modes (display modes 1 and 2). It is also possible to store multiple items shown in Figure 8 (D) as one set and provide different values depending on the tenant, communication relay device, or service.

Figure 9 is a diagram showing a more detailed configuration 400 of the on-site network 106 in this embodiment. As shown in Figure 9, the on-site network 106 includes a router 402, a firewall 404, multiple terminals 110A and 110B, and multiple services 410 and 412.

The on-site network 106 shown in FIG. 9 is separated into multiple networks 406, 408 to minimize the scope of information leakage even in the event of an attack from the Internet 102. The first network 406 is a network that can access the Internet 102 via a router 402, and the second network 408 is a network that is not connected to the Internet 102.

Although the communication relay device 120 is connected to multiple networks 406 and 408, it does not have a routing function for these multiple networks. On the other hand, after a tunnel is established between the relay system 190 on the Internet 102 and the communication relay device 120, the communication relay device 120 can also access the decision-making service 410 and the attendance service 412 in the second network 408 that is not directly connected to the Internet 102. In the example shown in FIG. 9, the access destination terminal 110 is a terminal 110A in the first network 406 that can access the Internet 102, and is in a network that the communication relay device 120 can access. However, this is not limited to this, and the access destination service may be in the second network 408 that is not connected to the Internet 102, as long as it is accessible by the communication relay device 120, and may be, for example, a terminal 110B.

FIG. 10 is a diagram showing a more detailed configuration 420 of the communication relay device 120 in this embodiment. As shown in FIG. 10, the communication relay device 120 has multiple network interfaces (I/F) 424, 426, and the communication control unit 422 controls the multiple network I/Fs 424, 426. Although two network I/Fs are provided in FIG. 10, a single network I/F may be used. The communication relay device 120 further holds an application control unit 428, an application 432 in the storage 430, a private key 446, a root certificate 448, and settings 450. The settings 450 and the application 432 can have a redundant configuration and can operate even if the firmware update fails. The application 432 is divided into a common area 434 and a tenant area 440 that depends on the tenant. The application is a protocol conversion program. The protocol conversion program converts between HTTP communication and remote desktop protocol (such as RDP), and converts between HTTP communication and HTTP communication (converts sequences).

The process of starting a remote desktop including the resolution determination process according to this embodiment will be described below with reference to Figs. 11 to 13. Fig. 11 is a flowchart showing the resolution determination process according to this embodiment. Note that the process shown in Fig. 11 is executed by the application server in the application system 150. The process shown in Fig. 11 starts from step S100, and in step S101, the application server performs a login process from the access source terminal 130.

Figure 12 is a sequence diagram showing the login process according to this embodiment. Figure 12 shows the process in which an end user logs into the system through the browser 232. The login process shown in Figure 12 starts at step S200, where the browser 232 accepts a browsing instruction from the end user specifying a specific URL. At step S201, the browser 232 accesses the application server 150 specified by the URL (one application server constituting the application system 150 is referenced by the number 150), and at step S202, receives a Web UI.

In step S203, the browser 232 generates authorization request parameters, and in step S204, it saves the generated authorization request parameters in session storage. In step S205, the browser 232 sends the authorization request together with the authorization request parameters to the authentication unit 272 of the platform system 170, and in step S206, it acquires a login redirect destination URL. In step S207, the browser 232 sends a request to display a login screen based on the redirect destination URL, and in step S208, the portal processing unit 274 receives this and sends the login screen. In step S209, the browser 232 displays the login screen.

FIG. 13(A) shows a login screen 460 for performing login processing displayed on the display screen of the access source terminal 130. The login screen 460 includes a dialog box 462, which includes a text box 464 for inputting an account name such as an ID or email address, a text box 466 for inputting a password, and a login button 468 for making a login request based on the currently input information. In the embodiment described, the screen is for inputting an account name (e.g., email address) and password, but it is also possible to link with an account of another system using a mechanism such as OAuth, or to perform multi-factor authentication. The login screen 460 is also a screen for logging in to the remote access support system 140.

Referring again to FIG. 12, the login process continues in step S300 with the browser 232 receiving login information input from the end user on the login screen 460 shown in FIG. 13(A). When information is entered in the text boxes 464 and 466 and the login button 468 is pressed, the input of login information is accepted.

In step S301, the browser 232 sends a login request together with the login information, and in response to this, in step S302, the portal processing unit 274 of the platform system 170 returns a callback destination temporary code. In step S303, the browser 232 issues a token acquisition request together with the temporary code, and in step S304, in response to this, the authentication unit 272 of the platform system 170 returns an access token, a refresh token, and an expiration date. In step S305, the browser 232 issues a login user information acquisition request together with the ID and the access token, and in step S306, in response to this, the authentication unit 272 of the platform system 170 returns the user information. In step S307, the browser 232 executes processing related to screen update, and in step S308, the screen after login is displayed.

The login itself is authenticated using the functions of the platform system 170. Here, authentication linkage is realized between the platform system 170 and the application system 150 using OAuth, which is a mechanism for linking multiple Web services, but this is not limited to this and linkage methods other than OAuth may also be used.

Figure 13 (B) shows a portal screen 470 that is displayed on the display screen of the access source terminal 130 after login. The portal screen 470 includes one or more icons each representing a service associated with the user, and is configured to allow a service to be selected. Figure 13 (B) shows a remote desktop icon 472 for making a remote desktop connection to a specific computer. Figure 13 (B) also shows the case of an end user logging in, and only the service portion is displayed, with the setting portion for administrators not displayed. When the remote desktop icon 472 is pressed, a remote desktop start login screen 480 shown in Figure 13 (C) is displayed.

Figure 13 (C) shows a login screen 480 for starting a remote desktop displayed on the display screen of the access source terminal 130. Screen 480 is a screen for logging in to the remote desktop service 212 provided by the access destination terminal 110. Screen 480 includes a text box 482 for accepting input of a user name, a text box 484 for accepting input of a password, a text box 486 for accepting input of a domain, and a menu box 488 for selecting a resolution, and further includes a connect button 490 for starting a remote desktop based on the input information. Here, a user name, password, domain name, and resolution information are entered, but since authentication has been completed on the login screen of Figure 13 (A), this screen can be skipped and pre-registered settings can be used.

When inputting resolution information, select a variable value or a fixed value. A fixed value may be input directly, or may be specified by displaying and selecting a value stored in the resolution information storage unit in a pull-down format. As a variable value, it is also possible to specify a method for obtaining the monitor size and browser window size of the access source terminal 130 by code (e.g., Javascript) executed by the browser 232.

Referring again to FIG. 11, in step S102, the application server transmits a user interface for specifying a resolution (resolution specification UI) to the access source terminal 130 in response to successful login processing. Here, it is assumed that after login processing, the remote desktop service is selected on the portal screen 470 in FIG. 13(B), and this resolution specification UI corresponds to the remote desktop start login screen 480 shown in FIG. 13(C). In step S103, the application server receives a resolution specification value based on an operation on the resolution specification UI from the access source terminal 130. In step S104, the application server reads an index value from the resolution setting storage unit 256, and branches the process based on the relationship between the index value and the specification value.

If it is determined in step S104 that the specified screen resolution value is equal to or less than the index value (NO), the process branches to step S105. In step S105, the application server transfers the received specified screen resolution value to the communication relay device 120 via the platform system 170 as the value to be used. On the other hand, if it is determined in step S104 that the specified screen resolution value is greater than the index value (YES), the process branches to step S106. In step S106, the application server transmits the stored screen resolution index value to the communication relay device 120 via the platform system 170 as the value to be used. In step S107, the remote desktop service is started.

Figure 13 (D) shows an operation screen 500 displayed on the display screen 234 of the access source terminal 130 after the start of remote desktop. The operation screen 500 is a screen for operating the remote desktop service. In response to mouse operations using the cursor 504 on the desktop screen 502 displayed on the browser 232 or keyboard operations, the event information is transmitted to the communication relay device 120 via the relay system 190, where it is converted into the protocol of the remote desktop service 212 provided by the access destination terminal 110. Then, feedback on the operation from the access destination terminal 110 is returned to the browser 232 in the reverse order. At this time, data from the browser 232 to the access destination terminal 110 and data from the access destination terminal 110 to the browser 232 can be transmitted simultaneously.

The resolution of the remote desktop screen 502 displayed on the operation screen 500 is the resolution determined by the resolution determination process by the application server 150 described above. The access source terminal 130 receives service output data from the communication relay device 120 via the relay system 190, and displays the image information in the service output data in the display area at the resolution size (actual size) of the image information. Note that when displayed at actual size, it does not have to be displayed in the entire browser display area. When the browser 232 is displayed in a window, the browser display area does not match the size of the monitor, but when the browser is displayed full screen, the browser display area matches the monitor size being displayed.

Figure 14 explains the process when an end user logs in to the remote access support system 140 and uses a remote desktop service by specifying the resolution of the display area of the browser 232 as a designated value. When logging in, the end user can select a variable value of the resolution as login information. Here, it is assumed that the number of pixels of the display area of the browser is transmitted from the access source terminal 130 to the application server as the variable value of the resolution.

When the application server 150 receives the resolution information, it compares the variable value (specified value) with the upper limit value stored in the resolution setting storage unit 256 shown in FIG. 8 (D). The comparison of values here is performed from the perspective of both horizontal resolution and vertical resolution, and if the specified value exceeds the index value (upper limit value) in either the horizontal resolution or the vertical resolution, the specified value is determined to be greater than the index value (upper limit value).

As shown in FIG. 14(A), if the resolution (number of pixels in the browser's display area) 510 indicated by the specified value is equal to or less than the resolution 512 indicated by the index value (upper limit), the specified value is transferred to the platform system 170 as the value to be used. The communication relay device 120 starts the service with the connection resolution setting based on the specified value, and generates output screen information 514 corresponding to the resolution based on the specified value. When displaying the output screen at actual size in the browser 232, the service is started at the same size as the display area 510 of the browser 232, as shown in FIG. 14(A), and the desktop screen 514 is displayed at actual size 516 in the browser's display area 510.

On the other hand, if the resolution (number of pixels in the browser's display area) 520 indicated by the specified value is greater than the resolution 522 indicated by the index value (upper limit), the index value (upper limit) is sent to the platform system 170 as the usage value, as shown in FIG. 14(B). The communication relay device 120 starts the service with a connection resolution setting based on the index value (upper limit), and generates output screen information 524 corresponding to the resolution based on the index value (performance value). When the output screen 524 is displayed at actual size in the browser 232, the service is started at a size smaller than the browser's display area, and the desktop screen 524 is displayed at actual size 526 within the browser's display area 520, as shown in FIG. 14(B). In this case, the browser's display area 520 may include a margin area 528 where the desktop screen 524 is not displayed.

In this way, the screen resolution usage value is determined based on the specified resolution value, within the range based on the stored resolution index value. If the specified screen resolution value is outside the range based on the stored screen resolution index value (upper limit), the stored screen resolution index value is determined as the usage value.

The process flow from establishing access to the remote desktop service 212 (login) to terminating the access (logout) will be described below with reference to Figs. 15 and 16. Figs. 15 and 16 are sequence diagrams showing the process related to the remote desktop connection executed in the remote access support system 140 according to this embodiment.

The process shown in FIG. 15 starts at step S401, in which the user instructs the browser 232 to view the portal screen 470. In step S402, the browser 232 requests the application server 150 to access the portal screen 470. In step S403, the API communication unit 258 returns a Web UI to the browser 232. In step S404, the browser 232 displays the portal screen 470 as shown in FIG. 13 (B) on the display device.

In step S405, the end user selects a specific service (here, a service with the service name "IT department shared PC") on the portal screen 470. In step S406, the browser 232 requests the application server to start using the specified service. In step S407, the API communication unit 258 returns a Web UI to the browser 232. In step S408, the browser 232 displays a login screen 480 for starting a remote desktop as shown in FIG. 13 (C).

In step S409, the end user inputs login information (user name, password, domain, resolution information) on screen 480. In step S410, browser 232 requests login from application server 150 by specifying the login information (user name, password, domain, resolution information). In step S411, API communication unit 258 in application server 150 passes resolution information (specified value) included in the request to resolution determination unit 254. In step S412, resolution determination unit 254 executes resolution determination processing based on the passed resolution information (specified value), and in step S413 returns the determined resolution information (used value) to API communication unit 258.

In steps S414 and S415, the API communication unit 258 instructs the communication relay device 120 via the control unit 276 of the platform system 170 to establish a session to the relay server, attaching a session ID. In step S416, the communication relay device 120 requests the relay system 190 to establish a session, attaching the session ID, and establishes the session in step S417. In steps S418 and S419, the API communication unit 258 receives a response from the communication relay device 120 via the control unit 276 of the platform system 170 indicating that the session has been successfully established.

In step S420, the API communication unit 258 instructs the browser 232 to establish a session with the relay server, attaching a session ID. In step S421, the browser 232 requests the relay system 190 to establish a session, attaching the session ID, and in step S422, establishes the session. In steps S423 and S424, the browser 232 transmits data to the communication relay device 120 via the relay system 190. In this data communication, login information and resolution information (usage value) are transmitted.

In step S425, the communication relay device 120 performs protocol conversion. In step S426, the communication relay device 120 uses the received login information and resolution information (usage value) to access the remote desktop service 212 provided by the destination terminal 110, and receives a success response in step S427. In step S428, the communication relay device 120 performs protocol conversion. In steps S429 and S430, the communication relay device 120 transmits data to the browser 232 via the relay system 190 and returns a response. In step S431, the browser 232 displays a remote operation screen.

Continuing to refer to FIG. 16, as shown in step S432, the end user then uses the browser 232 to access the remote desktop service 212 via the relay system 190, remotely operates it, and receives a response.

Continuing with reference to FIG. 16, the logout process from the remote desktop service will be described. The logout starts at step S433, where the end user instructs the browser 232 to logout from the operation screen. At steps S434 and S435, the browser 232 transmits a logout request to the communication relay device 120 via the relay system 190. At step S436, the communication relay device 120 requests the remote desktop service 212 to logout, and at step S437, receives a notification of successful logout. At step S438, the communication relay device 120 converts the protocol, and at steps S439 and S440, performs data communication to inform the browser 232 of the success of the logout via the relay system 190. At step S441, the browser 232 requests the relay system 190 to disconnect the session. In step S442, the relay system 190 instructs the communication relay device 120 to disconnect the session, and in step S443 receives notification that the session was successfully disconnected. In step S444, the relay system 190 notifies the browser 232 that the session was successfully disconnected. In step S445, the browser 232 displays a logout success screen.

The remote desktop operation sequence shown in Figures 15 and 6 can be roughly divided into three parts including a session establishment part (S401 to S431), a remote operation part (S432), and a remote operation end part (S433 to S445). The session establishment part and the remote operation end part are the same regardless of the accessed service, but the remote operation part varies depending on the type of service.

In the session establishment part, a tunnel is established between the browser 232 and the accessed service (remote desktop service 212) by WebSocket over HTTPS. Communication is performed between the browser 232 and the application server 150, and the communication relay device 120 connects to the relay system 190 using a session ID that is unique for each session, and the browser 232 also connects to the relay system 190 using the same session ID.

In the remote operation part, the communication relay device 120 performs protocol conversion processing to transfer operations and responses between the browser 232 and the accessed service (remote desktop service 212). For simplicity, a line is shown connecting the end user and the accessed service, which has been omitted here, but in reality, communication takes place via the relay system 190.

In the remote operation termination part, the session between the browser 232 and the accessed service (remote desktop service 212) is disconnected. The disconnection may be performed by executing a stop procedure from the browser 232, or may be performed from the browser 232, or the end user may end use by closing the browser 232. Therefore, a timeout may be detected after communication from the browser 232 is cut off, and the session may be terminated when the timeout period has elapsed.

In the embodiment described above, if the specified screen resolution value is outside the range based on the stored screen resolution index value, the stored screen resolution index value is determined as the value to be used. The access source terminal 130 then displays the image information in the service output data sent from the communication relay device 120 at the same size as the resolution of the image information. Below, we will explain a modified example of the method of determining the resolution when the specified screen resolution value is outside the range based on the stored index value.

FIG. 17(A) illustrates a modified example of the method of determining the resolution when the designated value of the screen resolution is outside the range based on the stored index value. In the embodiment of the modified example shown in FIG. 17(A), when the designated value of the screen resolution is outside the range based on the index value of the screen resolution stored in the resolution setting storage unit 256, the resolution determination unit 254 determines whether a predetermined integer fraction (e.g., 1/2 or 1/4) of the designated value of the screen resolution is within the range based on the stored index value of the screen resolution. If the predetermined integer fraction is within the range based on the stored index value of the screen resolution, the resolution determination unit 254 can determine the value that is the predetermined integer fraction of the designated value as the value to be used. For example, the example shown in FIG. 17(A) illustrates a case where the resolution (designated value) 530 of the monitor display area of the access source terminal 130 is 1800x1800 pixels, and the resolution index value 532 is a resolution of 900x900 pixels. In this case, the specified screen resolution value 530 is outside the range based on the stored screen resolution index value 532. However, a predetermined integer division of the specified screen resolution value is equal to the stored screen resolution index value, and falls within the range based on the screen resolution index value. In this case, as shown in FIG. 17(A), a resolution 534 that is 1/2 (0.5 times) of the specified screen resolution value is determined as the value to be used. Then, the access source terminal 130 receives an image with a resolution of 1/2 of the specified value and enlarges it to twice the size 536. In this way, by enlarging and displaying the service output screen output at a resolution that is 1/2 a predetermined integer (e.g., 2 or 4) times the size of the specified integer, it becomes possible to display it dot-by-dot on the access source terminal 130, and it becomes possible to improve visibility even when a resolution equal to or greater than the index value is specified.

In the above-described embodiments, the resolution of the remote desktop service was not changed once it was set. Below, a modified embodiment capable of dynamically changing the resolution of the remote desktop will be described with reference to Figs. 17(B) and 18. In the modified embodiment shown in Fig. 17(B), the access source terminal 130 has a first mode (full screen display) in which the size 540 of the display device of the access source terminal 130 is equal to the size of the display area 542 displaying the remote desktop screen, and a second mode (window display) in which the size 540 of the display device of the access source terminal 130 is different from the size of the display area 542 displaying the remote desktop screen.

In the modified embodiment shown in FIG. 17(B), the code (e.g., JavaScript) included in the Web UI is configured to, when the display mode is switched on the access source terminal 130 while using the remote desktop, in response to the switch, retransmit the number of pixels (specified value) of the display area after the switch to the application server 150.

By sending the specified resolution value again in response to the mode change, it becomes possible to use a remote desktop service with a resolution setting appropriate for the new mode. Alternatively, the application server 150 may hold the setting values for each display mode shown in FIG. 8 (D), and the browser may send only information related to mode switching. In this case, switching is possible even if resolution information (specified value) cannot be obtained due to restrictions imposed by differences in the terminal monitor or browser.

Below, with reference to FIG. 18, a session reconnection following a change in the resolution of the remote desktop service 212 will be described. FIG. 18 is a sequence diagram showing the process of reconnecting following a change in the resolution of the remote desktop executed in the remote access support system 140 according to a modified embodiment. FIG. 18 corresponds to the process of reconnecting the session at the switched resolution when the display mode in FIG. 17(B) is switched.

Note that, in this case, the login process to the service has already been completed, and as shown in step S501, the end user is in a state in which he or she can use the browser 232 to access the remote desktop service 212 via the relay system 190, perform remote operations, and receive responses. Step S501 corresponds to step S432 shown in FIG. 6.

In step S502, the end user performs an operation to change the resolution on the operation screen. Here, it is assumed that the display mode has been switched. In step S503, the browser 232 requests the application server 150 to change the resolution by specifying the changed resolution information (specified value). In step S504, in the application server 150, the API communication unit 258 passes the resolution information (specified value) included in the request to the resolution determination unit 254. In step S505, the resolution determination unit 254 executes a resolution determination process based on the passed resolution information (specified value), and in step S506, returns the determined resolution information (used value) to the API communication unit 258.

In steps S507 and S508, the API communication unit 258 instructs the communication relay device 120 to change the resolution via the control unit 276 of the platform system 170. In step S509, the communication relay device 120 uses the received resolution information (usage value) to request a re-session with the remote desktop service 212 provided by the accessed terminal 110, which is successful in step S510. In steps S511 and S512, the API communication unit 258 receives a response from the communication relay device 120 via the control unit 276 of the platform system 170 indicating that the resolution change was successful.

As shown in step S513, the end user then uses the browser 232 to access the remote desktop service 212 at the new resolution via the relay system 190, remotely operates it, and receives the response.

As described above, when changing the display range of the desktop image of the destination terminal 110 on the monitor of the access source terminal 130 while maintaining Dot-by-Dot, it is necessary to change the connection resolution setting for the remote desktop connection of the destination terminal 110 from the communication relay device 120. For example, when displaying the screen of the destination terminal 110 in a browser, since the display area of the browser and the display area of the monitor are different, if you want to switch between browser display and full-screen monitor display, it is necessary to change the connection resolution setting. In this case, if the destination terminal 110 does not support RDP protocol 8.1, it will be necessary to reconnect the session, which may degrade the usability.

As described above, in the embodiment of the modified example described, when switching between modes, the session between the communication relay device 120 and the destination terminal 110 is temporarily disconnected, and the session is re-established at the resolution after switching. This allows high-speed switching by re-establishing the session at a position close to the destination terminal 110, even if the RDP protocol does not support dynamic resolution changes. Note that if the RDP protocol supports dynamic resolution changes (RDP 8.1 or later), it is also possible to change the resolution without first disconnecting the communication relay device 120.

In the above-described embodiment, it is assumed that the application server 150 can obtain the resolution usage value when a remote desktop connection is established. Below, a modified embodiment that can be implemented even when the application server 150 is unable to obtain the resolution usage value after the remote desktop connection is established is described. FIG. 17(C) shows the modified embodiment.

In some cases, due to constraints imposed by differences in the monitor or browser of the access source terminal 130, it may not be possible to obtain resolution information, and therefore it may not be possible to transmit monitor or display area resolution information (specified value). In such cases, it is preferable for the remote access support system 140 (more specifically, the application system 150) to store, for example, the display size at the time of the first use of the service, and to use the magnification information when the image is enlarged or reduced by the user's operation based on the stored display size to adjust to an appropriate resolution setting. Figure 17 (C) shows an embodiment of a modified example in which such magnification information can be used to adjust to an appropriate resolution setting.

In the example shown in FIG. 17C, the access source terminal 130 has a display area 550 of, for example, 1600x1200 pixels, and at the time of the first access, it is connected at a smaller resolution of 800x600 pixels, and the desktop screen 552 is displayed at the same size. Here, it is assumed that the size is adjusted by enlarging or reducing the screen by an operation such as a window resizing operation 554 on the access source terminal 130, and the size to be displayed in the display area is specified. Here, if the horizontal and vertical directions are both changed to 2 times, the magnification becomes 2.0. In this modified embodiment, the browser 232 can calculate the adjusted resolution based on the saved value of the screen resolution used in the past and the enlargement ratio after this change, and send it to the application server 150. Alternatively, the browser 232 can send this magnification ratio as is to the application server 150. In this case, the application server 150 calculates the adjusted resolution based on, for example, a previously used screen resolution stored in the remote access support system 140 (more specifically, the application system 150) and the changed magnification ratio. The resolution determination unit 254 then uses this adjusted resolution value as a specified value to determine the resolution. In the example of FIG. 17(C), the horizontal direction is 800 pixels x 2.0 times = 1600 pixels, and the vertical direction is 400 x 2.0 = 1200 pixels, and the specified value of the adjusted resolution is 1600 x 1200 pixels. After being sent to the application server 150, the service output is updated with the changed resolution, and the size of the browser display area and the service output screen match.

According to the embodiment described above, it is possible to provide a system, information processing device, intermediation method, and program that enable the selection of an appropriate output screen quality in remote access.

In particular, in remote access, (1) the processing capacity of the device used by the system, (2) the monitor size of the access source terminal to which the service is provided, and (3) the size of the area in which the service screen is displayed in the access source terminal are limited. By transmitting appropriate setting values to the remote access service in response to the limitations of (2) and (3), the device used by the system will not be required to have processing capacity greater than the limit of the access source terminal. In addition, since excessive processing capacity is not required, the device will not be overloaded and operability can be improved. In addition, by transmitting the specified value, the remote access service system can recognize the monitor size, making it possible to output a service screen suitable for the monitor size, thereby improving the output image quality. In addition, by setting a value that takes into account the processing capacity of the communication relay device as the index value in advance, it becomes possible to select the quality of the screen according to the performance of the communication relay device.

In addition, when switching between the different sizes of (2) and (3), it may be necessary to recreate the service screen, which may result in a period of inoperability and reduced operability. By configuring the system to reconnect from a communication relay device at a network location close to the accessed service, it is possible to shorten the period of inoperability and further improve operability.

Each function of the above-described embodiments can be realized by one or more processing circuits. In this specification, the term "processing circuit" includes a processor programmed to execute each function by software, such as a processor implemented by an electronic circuit, and devices such as an ASIC (Application Specific Integrated Circuit), DSP (digital signal processor), FPGA (field programmable gate array), and conventional circuit modules designed to execute each function described above.

The above functions can be realized by a computer-executable program written in legacy programming languages such as assembler, C, C++, C#, Java (registered trademark), or object-oriented programming languages, and can be stored on device-readable recording media such as ROM, EEPROM, EPROM, flash memory, flexible disk, CD-ROM, CD-RW, DVD-ROM, DVD-RAM, DVD-RW, Blu-ray Disc, SD card, MO, or distributed via telecommunications lines.

So far, we have described a system, information processing device, intermediation method, and program according to one embodiment of the present invention, but the present invention is not limited to the above-mentioned embodiment, and can be modified within the scope of what a person skilled in the art can imagine, such as adding, changing, or deleting other embodiments, and any aspect is within the scope of the present invention as long as it achieves the functions and effects of the present invention.

100...Network environment, 102...Internet, 104, 1106, 108...Network, 110...Destination terminal, 120...Communication relay device, 130...Source terminal, 140...Remote access support system, 150...Application system, 170...Platform system, 190...Relay system, 212...Remote desktop service, 222...Protocol conversion unit, 224...Connection resolution setting storage unit, 232...Browser, 234...Display screen, 252...Resolution selection UI providing unit, 254...Resolution determination unit, 256...Resolution setting storage unit, 258...API communication unit, 272...Authentication unit, 274...Portal processing unit, 276...Control unit, 292...In communication relay unit, 316...database, 318...type list, 320...service list, 322...service group list, 324...action list, 326...policy list, 366...database, 368...tenant list, 370...user list, 372...user group list, 380...communication relay device, 390...setting value list, 901...CPU, 902...ROM, 903...RAM, 904...HD, 905...HDD controller, 906...display, 908...external device connection I/F, 909...network I/F, 910...data bus, 911...keyboard, 912...pointing device, 914...DVD-RW drive, 916...media I/F

Patent No. 5459693

Claims (14)

A system for mediating the establishment of an access from an access source terminal to a service provided by an access destination terminal via a communication relay means of the same network as the access destination terminal, comprising:
a storage unit for storing an index value of the quality of the screen related to the service;
a determination unit that determines a usage value of the screen quality within a range based on the index value based on a relationship between the stored index value of the screen quality and a designated value of the screen quality from the access source terminal;
a control unit that controls the communication relay means to set the quality of the screen based on the determined usage value. The system of claim 1, wherein the screen quality is the resolution of the screen output by the service. The system of claim 2, wherein the determination unit determines the stored index value of the screen resolution as the usage value when the specified value of the screen resolution is outside a range based on the stored index value of the screen resolution. The system according to claim 2, wherein the determination unit determines, as the usage value, a value that is a predetermined integer division of the specified value of the screen resolution when the specified value of the screen resolution is outside a range based on the stored index value of the screen resolution and when a predetermined integer division of the specified value of the screen resolution is within a range based on the stored index value of the screen resolution. The system according to any one of claims 2 to 4, wherein the access source terminal has a first mode in which the size of the display device of the access source terminal is equal to the size of the display area in which the screen is displayed, and a second mode in which the size is different, and is configured to transmit information indicating the resolution of the display area in response to switching between the first mode and the second mode. The system according to claim 5, wherein the communication relay means is configured to, when switching between the first mode and the second mode, temporarily disconnect the session between the communication relay means and the destination terminal, and then re-establish the session at the resolution after switching. The system according to any one of claims 2 to 6, wherein the determination unit, when a specified value for the screen resolution is not received from the access source terminal, first determines a saved value of the screen resolution held by the system as the usage value, and in response to a change in the display area for displaying the screen on the access source terminal, calculates the usage value of the screen resolution from the magnification of the change. The system according to any one of claims 2 to 7, further comprising a providing unit that provides a user interface that enables mutual communication with the access source terminal, the providing unit receiving a resolution specification for use of the service through an operation, and the resolution specification being performed by a value selected from a plurality of candidate values or a variable value. The system according to any one of claims 2 to 8, wherein the access source terminal is on a second network separated from the network via the Internet, and the system further includes a relay server that relays communication via the Internet relating to one or both of screen information and operation information between the communication relay means and the access source terminal. The access source terminal,
a display unit that displays a display area at a screen resolution that the screen information has based on the screen information received from the communication relay means;
The system according to claim 9 , further comprising: a transmitting unit configured to transmit, to said communication relay means, said operation information indicating said operation input based on said operation input related to said display area. The system according to any one of claims 2 to 10, wherein the service is a remote desktop service, the access source terminal has a display area for displaying the screen on a display device, and the communication relay means sets up the remote desktop service with the access destination terminal based on the determined usage value of the screen resolution, generates an output screen corresponding to the resolution set through communication with the service, and performs protocol conversion of input/output data of the service provided by the access destination terminal. An information processing device that mediates the establishment of an access from an access source terminal to a service provided by an access destination terminal via a communication relay means of the same network as the access destination terminal,
a storage unit for storing an index value of the quality of the screen related to the service;
a determination unit that determines a usage value of the screen quality within a range based on the index value based on a relationship between the stored index value of the screen quality and a designated value of the screen quality from the access source terminal ;
a transmission unit that transmits the determined usage value to the communication relay means via a platform or directly to the communication relay means so that the communication relay means uses the usage value when setting the quality of the screen;
An information processing device comprising : A method for mediating the establishment of an access from an access source terminal to a service provided by an access destination terminal via a communication relay means of the same network as the access destination terminal, comprising:
reading an index value of the quality of the screen related to the service;
determining a usage value of the screen quality within a range based on the index value based on a relationship between the stored index value of the screen quality and a designated value of the screen quality from the access source terminal;
and a step of controlling the communication relay means to set the quality of the screen based on the determined usage value. A program for implementing an information processing device that mediates the establishment of an access from an access source terminal to a service provided by an access destination terminal via a communication relay means of the same network as the access destination terminal, the program comprising:
a storage unit for storing an index value of the quality of the screen related to the service ;
a determination unit that determines a usage value of the screen quality within a range based on the index value based on a relationship between the stored index value of the screen quality and a designated value of the screen quality from the access source terminal ; and
a transmission unit that transmits the determined usage value to a platform connected to the communication relay unit or to the communication relay unit so that the communication relay unit uses the usage value when setting the quality of the screen.
A program that functions as a