Information processing device, access control system, program, and information processing method

Abstract

To provide a relay server and an access control system which are highly convenient and are more safe for a user by a terminal of a user on the Internet, regarding the access to an on-premises server.SOLUTION: There is generated unique reference information which allows access to an on-premises server on the basis of information of the on-premises server. Whether a user is to be authenticated is determined in a case where an access from a terminal of a user is received. If the authentication of the user is permitted, the reference information is presented to the terminal of the user. The communication between the terminal of the user which is permitted to be authenticated and the on-premises server is relayed.SELECTED DRAWING: Figure 3

Description

[Technical field]

[0001] The present invention relates to a relay server and an access control system. [Background technology]

[0002] In recent years, a system known as cloud computing has enabled users to access services from anywhere via the Internet, improving user convenience.

[0003] On the other hand, from a security standpoint, many users prefer to operate their systems on-premise, where information in devices located within the user's environment (e.g., within a company) is read. On-premise systems are said to be less susceptible to external attacks and to have a lower risk of information leaks.

[0004] Furthermore, in the prior art, there is a technology that sets up a virtual dedicated line on the Internet called a VPN (Virtual Private Network), establishes a dedicated network that can only be used by specific people, and performs mutual communication between a terminal connected to the Internet and an on-premise environment. There is also a technology that connects a mutually authenticated Transport Layer Security (TLS) tunnel between a cloud (off-premise platform) and an on-premise platform environment to transfer data (see paragraph 0032 of Patent Document 1). [Prior art documents] [Patent documents]

[0005] [Patent Document 1] Patent Publication No. 2021-501929 Summary of the Invention [Problem to be solved by the invention]

[0006] In addition, if a user's terminal connected via the Internet can also access on-premise, it will be more convenient for the user. However, since the terminal is connected via the Internet, there is also a risk of information leakage.

[0007] VPN can be used as a method for users' terminals to access on-premise, but it is expensive to install and places a heavy burden on users. VPN also has problems such as the fact that if an on-premise server is infiltrated, other services and other servers in the LAN area can be easily accessed, the inconvenience of having to log in again after a connection is lost, and the fact that communication speeds can slow down due to congestion.

[0008] The present invention has been made in consideration of the above-mentioned problems, and its purpose is to provide a relay server and an access control system that are highly convenient for users and have improved security when a user's terminal on the Internet accesses an on-premise server. [Means for solving the problem]

[0009] (1) The present invention provides A relay server is connected to a user's terminal and an on-premise server via the Internet, and the relay server is connected to the terminal and the on-premise server via the Internet, Accessing the on-premise server based on the information of the on-premise server a query generator for generating a unique query that can be generated based on the query; A user control unit that manages user information of a user; an authentication processing unit that, when an access is accepted from a user terminal, determines whether or not the user should be authenticated; a presentation unit that presents the query information to a terminal of the user when authentication of the user is permitted; a relay processing unit that relays communication between a terminal of the user whose authentication has been permitted and the on-premise server; The present invention relates to a relay server including:

[0010] The present invention also relates to a program for causing a computer to function as each unit of the relay server, and to an information storage medium on which the program is stored.

[0011] According to the present invention, when user authentication is permitted, unique query information that can access the on-premise server is presented to the user's terminal, and communication between the terminal of the user whose authentication has been permitted and the on-premise server is relayed, thereby preventing access to the on-premise server from unauthorized users and improving security.

[0012] (2) The server, program, and information storage medium of the present invention are The inquiry information generating unit Different query information may be generated for each on-premise server.

[0013] According to the present invention, when there are multiple on-premise servers, different query information is generated for each on-premise server, so that each of the multiple on-premise servers can be appropriately managed and communications can be relayed.

[0014] (3) The server, program, and information storage medium of the present invention are The inquiry information generating unit Different inquiry information may be generated for each service.

[0015] According to the present invention, when an on-premise server provides multiple services, different query information is generated for each service, so that each of the multiple services can be appropriately managed and communications can be relayed.

[0016] (4) The server, program, and information storage medium of the present invention are The user control unit: For each user, determine whether the user is allowed to access each piece of inquiry information based on the user information of the user; The presentation unit is For each user, the query information that the user can access may be presented on the user's terminal.

[0017] According to the present invention, for each user, whether or not the user can access each piece of query information is determined based on the user's user information, making it possible to control the query information so that certain users can access it and other users cannot access it, thereby enabling control that takes into consideration both convenience and security.

[0018] (5) The present invention provides The user's terminal, the on-premise server, and the relay server each have access to the Internet. An access control system connected via The relay server includes: a query information generating unit configured to generate unique query information that can be accessed by the on-premise server based on information of the on-premise server; A user control unit that manages user information of a user; an authentication processing unit that, when an access is accepted from a user terminal, determines whether or not the user should be authenticated; a presentation unit that presents the query information to a terminal of the user when authentication of the user is permitted; a relay processing unit that relays communication between a terminal of the user whose authentication has been permitted and the on-premise server, The on-premise server includes: The present invention relates to an access control system that, when access based on the query information is received from a terminal of a user whose authentication has been permitted via the relay server, presents information indicated in the query information to the user's terminal via the relay server.

[0019] According to the present invention, when user authentication is permitted, unique query information that can access the on-premise server is presented to the user's terminal, and communication between the terminal of the user whose authentication has been permitted and the on-premise server is relayed, thereby preventing access to the on-premise server from unauthorized users and improving security. [Brief description of the drawings]

[0020] [Figure 1] FIG. 2 is an example of a network diagram of the access control system according to the present embodiment. [Diagram 2] FIG. 2 is a functional block diagram of a relay server 10 according to the present embodiment. [Diagram 3] FIG. 4 is a diagram for explaining a relay process according to the embodiment; [Figure 4] 13 shows an example of an access permission flag for each piece of inquiry information for each user in the present embodiment. [Diagram 5] FIG. 4 is a diagram showing an example of a screen displayed on the terminal of the embodiment. [Figure 6] FIG. 4 is a flowchart showing the flow of processing according to the embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0021] The present embodiment will be described below. Note that the present embodiment described below does not unduly limit the contents of the present invention described in the claims. Furthermore, not all of the configurations described in the present embodiment are necessarily essential components of the present invention.

[0022] [1] Network 1 shows an example of a network diagram of an access control system. In the access control system of this embodiment, a relay server 10, a user terminal 20, and an on-premise server 30 are connected to each other via a network (the Internet).

[0023] In other words, the relay server 10 of this embodiment is a server that is connected to each of the user's terminal 20 and the on-premise server 30 via the Internet, and is configured for the purpose of relaying communication between the terminal 20 and the server 30.

[0024] The relay server 10 of this embodiment is an information processing device that manages user information and performs user authentication processing.

[0025] The terminal 20 is a client device, and is an information processing device such as a smartphone, a mobile phone, a PHS, a computer, a game device, a PDA, or an image generating device, and is a device that can be connected to the relay server 10 via a network such as the Internet (WAN) or a LAN.

[0026] The on-premise server 30 is a server constructed and operated by a user (eg, a company), and is an information processing device installed in a facility managed by the user.

[0027] The on-premise server 30 basically operates services that are kept private from the outside (Internet) (for example, services used only within a company or group, services for confidential information, an internal mail server, an internal conference system), but as described below, in this embodiment, the on-premise server 30 is controlled so that it can be accessed from the terminals 20 of some users who have been authenticated via the relay server 10.

[0028] [2] Configuration Fig. 2 is an example of a functional block diagram of the relay server 10 of the present embodiment. Note that the relay server 10 of the present embodiment does not need to include all the units in Fig. 2, and may have a configuration in which some of them are omitted.

[0029] The storage unit 170 stores programs and various data for causing a computer to function as each unit of the processing unit 100, and also functions as a storage area for the processing unit 100.

[0030] The storage unit 170 includes a temporary storage area and storage. The storage is a device that permanently stores data, such as a hard disk, an optical disk, a flash memory, or a magnetic tape. The storage unit 170 may also store programs and data stored in the information storage medium 180.

[0031] The storage unit 170 of this embodiment includes a main storage unit 171 used as a work area, a user information storage unit 172, and a query information storage unit 173. Note that some of these may be omitted.

[0032] The main storage unit 171 can be realized by a RAM etc. The main storage unit 171 is a storage area used in the processing of this embodiment.

[0033] User information storage unit 172 stores user information (user account, password, email address, etc.) User information storage unit 172 may be configured with a DB (DB is an abbreviation for database, the same applies below).

[0034] The query information storage unit 173 stores query information (URL). The query information storage unit 173 may be configured with a DB.

[0035] Information storage medium 180 (computer-readable medium) stores programs, data, etc., and its functions can be realized by storage such as an optical disk (CD, DVD), magneto-optical disk (MO), magnetic disk, hard disk, magnetic tape, or memory (ROM).

[0036] The communication unit 196 performs various controls for communicating with the outside (e.g., terminals, other servers, or other network systems), and its functions can be realized by hardware such as various processors or communication ASICs, programs, etc.

[0037] The processing unit 100 performs various processes of this embodiment based on programs (data) stored in the storage unit 170 or the information storage medium 180 .

[0038] The processing unit 100 (processor) uses the main memory unit 171 in the memory unit 170 as a work area. The functions of the processing unit 100 can be realized by hardware such as various processors (CPU, DSP, etc.) or programs.

[0039] The processing unit 100 includes a user control unit 111 , an authentication processing unit 112 , a query information generating unit 113 , a presenting unit 114 , a relay processing unit 115 , and a Web processing unit 120 .

[0040] The user control unit 111 manages user information of users. Furthermore, the user control unit 111 may determine, for each user, whether or not the user is permitted to access each piece of inquiry information (each URL) based on the user information of the user.

[0041] When an access is received from a user terminal, the authentication processing unit 112 determines whether or not the user should be authenticated.

[0042] The reference information generating unit 113 generates unique reference information (for example, a URL) that can access the on-premise server 30 based on the information of the on-premise server 30.

[0043] For example, when there are multiple on-premise servers 30, the query information generating unit 113 may generate different query information for each on-premise server 30. Furthermore, when there are multiple services, the query information generating unit 113 may generate different query information for each service.

[0044] If the authentication of the user is permitted, the presenting unit 114 presents the query information to the terminal 20 of the user.

[0045] The relay processing unit 115 relays communication between the terminal 20 of a user who has been authorized for authentication and the on-premise server 30.

[0046] The Web processing unit 120 performs processing to transmit (provide) data such as HTML (HyperText Markup Language) documents and images in response to requests from client software such as a Web browser installed in the terminal 20 via HTTP (Hypertext Transfer Protocol), and processing to receive data accepted by the Web browser of the terminal. The server then processes emails, updates the DB, and so on, based on information received from each terminal of the administrator or user.

[0047] The Web processing unit 120 may perform processing to send (provide) data for management settings, etc. to the administrator's terminal 20 in response to an access request from the Web browser of the administrator's terminal 20, and may also perform processing to receive information from the administrator's terminal 20.

[0048] That is, the Web processing unit 120 may add, delete, update, and so on each piece of data to the DB based on an input from the administrator. Note that only the administrator is given the authority to access the Web page (URL) for the administrator.

[0049] Furthermore, the Web processing unit 120 performs a login process and, in response to a request from the Web browser of the terminal 20, a process of controlling a Web page of information related to the logged-in user so that the user can view the Web page.

[0050] Note that some or all of the processing of the processing unit 100 and the memory unit 170 may be executed by a single device, or each process may be distributed to different devices depending on the purpose of the process.

[0051] [3] Agent Description As shown in Fig. 3, an agent program is installed in a given on-premise device that exists in the on-premise network (LAN). In other words, the on-premise device in which the agent program is installed can be called an agent (agent device).

[0052] For example, the on-premise device may be the on-premise server 30 (server 30A or server 30B) or may be a terminal 20X (not shown) connected to the on-premise server 30 (server 30A or server 30B). The terminal 20X is an information processing device that exists in the same network environment (LAN) as the on-premise server 30.

[0053] The agent stores in advance in a storage unit of the agent "information on the on-premise server 30" including the IP address, host name, and information on each service (each port number) of the on-premise server 30.

[0054] Here, "service" refers to a service for the TCP / IP network protocol. "Service" may also be interpreted as a port number for identifying the service.

[0055] For example, when an agent is installed in the on-premise server 30, “information on the on-premise server 30” is stored in the storage unit of the on-premise server 30. When an agent is installed in the terminal 20X, “information on the on-premise server 30” is stored in the storage unit of the terminal 20X.

[0056] An agent may manage multiple on-premise servers 30 (e.g., server 30A and server 30B). Also, an agent may manage only one on-premise server 30 (e.g., server 30A). In such a case, there is one agent corresponding to one on-premise server 30.

[0057] Also, the agent may manage multiple services (e.g., service SA and service SB) of the on-premise server 30. Also, the agent may manage only one service (e.g., service SA) of the on-premise server 30. In such a case, there is one agent corresponding to one service.

[0058] The agent also controls the starting (enabling) and stopping (disabling) of the services of the on-premise server 30 that the agent manages. For example, the agent can control the starting or stopping of the services of the on-premise server 30 based on input information from an administrator of the access control system.

[0059] [4] Explanation of the generation of referral information The relay server 10 generates unique reference information that can be accessed by the on-premise server 30 based on the information of the on-premise server 30 .

[0060] The reference information is a global URL that the relay server 10 makes public to users who have been authorized to be authenticated. For example, it is a URL for a user's terminal 20 that is located outside (outside an organization, outside a company) on the Internet or the like to access a network within an organization (for example, within a company).

[0061] Here, the "reference information" refers to information that uniquely identifies a web page on the Internet using protocols such as HTTP (Hyper Text Transfer Protocol) and HTTPS (Hyper Text Transfer Protocol Secure). The query information may be a URL for specifying the server to which the query is sent. The query information may be information of a server capable of transmitting and receiving data by other communication protocols such as FTP (File Transfer Protocol). For example, when the query information is a URL, the query information is generated according to a predetermined URL format.

[0062] When an agent starts a service, it establishes a TCP connection (e.g., a long-lived TCP connection) to the relay server 10 and transmits a request for generating query information to the relay server 10. Then, when the relay server 10 receives the request for generating query information from the agent, it generates query information corresponding to the service of the server managed by the agent. The connection may be called a tunnel.

[0063] For example, when an agent starts a service SA (e.g., a Web service on port 80) of the on-premise server 30A, a TCP connection is established between the service SA and the relay server 10, and a request for generating query information for the service SA is transmitted to the relay server 10. Then, upon receiving the request for generating query information from the agent, the relay server 10 generates query information L1 (e.g., "https: / / example1.com.hennge.io / ") corresponding to the service SA. This connection and the query information L1 are in a corresponding relationship.

[0064] Specifically, the relay server 10 executes an application program that is a tunneling tool to generate a URL. This application program performs processing to make a service running in a local environment publicly available so that it can be accessed from the Internet.

[0065] For example, the relay server 10 executes the application program based on the information on the service SA of the on-premise server 30A stored in the agent (e.g., the host name, IP address, and port number "80" of the service SA of the on-premise server 30A, etc.) to obtain a URL that can be made public (e.g., "https: / / xxxx.xxxx.io / "). The obtained URL may be the query information itself, but In the embodiment, the domain of the acquired URL is changed to the domain of the relay server 10 by setting the DNS (Domain Name Server) based on the administrator's input information, and the resulting URL (for example, "https: / / example1.com.hennge.io / ") is used as the query information L1.

[0066] In addition, when the agent activates service SB of on-premise server 30A, service SC, and service SD of on-premise server 30B, relay server 10 generates query information corresponding to each service, similar to when service SA is activated.

[0067] That is, when the agent starts a service SB (e.g., an HTTPS service on port 443) of the on-premise server 30A, a TCP connection is established between the service SB and the relay server 10, and the relay server 10 transmits a request for generating query information for the service SB. Then, the relay server 10 generates query information L2 (e.g., "https: / / example2.com.hennge.io / ") corresponding to the service SB at the timing when the relay server 10 receives the request for generating query information from the agent. The relay server 10 generates the query information L2 based on the information of the service SB of the on-premise server 30A stored in the agent (e.g., the host name, IP address, and port number "443" of the service SB of the on-premise server 30A, etc.).

[0068] In addition, the agent may request a service SC (e.g., port When the agent starts the service SC (Web service No. 80), a TCP connection is established between the service SC and the relay server 10, and the relay server 10 transmits a request for generating query information for the service SB to the relay server 10. Then, the relay server 10 generates query information L3 (e.g., "https: / / example3.com.hennge.io / ") corresponding to the service SC at the timing when the relay server 10 receives the request for generating query information from the agent. The relay server 10 generates query information L3 based on the information on the service SC of the on-premise server 30B stored in the agent (e.g., the host name, IP address, and port number "80" of the service SC of the on-premise server 30B, etc.).

[0069] Furthermore, when the agent activates a service SD of the on-premise server 30B (e.g., an HTTPS service on port 443), a TCP connection is established between the service SD and the relay server 10, and the relay server 10 transmits a request for generating query information for the service SD. Then, upon receiving the request for generating query information from the agent, the relay server 10 generates query information L4 corresponding to the service SD (e.g., "https: / / example4.com.hennge.io / "). The relay server 10 generates the query information L4 based on the information on the service SD of the on-premise server 30B stored in the agent (e.g., the host name, IP address, and port number "443" of the service SD of the on-premise server 30B of the on-premise server 30B, etc.).

[0070] That is, when there are multiple on-premise servers 30, the relay server 10 generates different reference information for each on-premise server 30. As a result, in this embodiment, access can be finely controlled for each on-premise server.

[0071] Furthermore, when there are multiple services, the relay server 10 generates different reference information for each service. That is, in this embodiment, access can be finely controlled on a service-by-service (port-by-port) basis.

[0072] [5] Explanation of User Information The relay server 10 manages user information of users. In particular, the relay server 10 of the present embodiment determines, for each user, whether or not the user is permitted to access each piece of inquiry information (each URL) based on the user information of the user.

[0073] For example, the relay server 10 may determine whether each piece of reference information is accessible based on various information (server host name and service) of the on-premise server 30 corresponding to each piece of reference information. The user information includes information on attributes to which the user belongs (group name, department name, job title, etc.). The relay server 10 may determine whether each piece of reference information is accessible based on the user attributes.

[0074] For example, as shown in Fig. 4, an access permission flag for each piece of query information is set in association with a user ID for each user. If access is possible, "1" is set, and if access is not possible (access is prohibited), "0" is set. The relay server 10 may store the access permission flag for each piece of query information associated with a user ID for each user in the query information storage unit 173.

[0075] For example, user A (user ID=A) can access query information L1, L2, and L3. User B (user ID=B) can access only query information L2. User C (user ID=C) can access query information L1, L3, and L4. User D (user ID=D) can access only query information L4.

[0076] In this manner, in this embodiment, the on-premise server 30 that can be accessed is set for each user. In this embodiment, the services that can be accessed by the on-premise server 30 can be determined for each user. In this way, the minimum amount of necessary information can be disclosed to the users who need it. Also, the traffic on the network related to the service can be kept to a minimum.

[0077] The relay server 10 may manage user information for each organization (for example, each company, each group, each school, each department).

[0078] [6] Explanation of authentication process When the relay server 10 receives an access from a user, it judges whether to permit authentication of the user. In this embodiment, if it is judged that the user is legitimate in at least one of the following methods (A) to (H), it judges that authentication of the user is permitted. On the other hand, if it is judged that the user is not legitimate in any of the methods, it judges that authentication of the user is denied.

[0079] Since multi-factor authentication can improve security, it may be determined that the user is permitted to be authenticated if at least two of the multiple methods (A) to (H) (e.g., (A) and (B)) are determined to be valid.

[0080] (A) Password authentication There are various possible authentication methods. For example, an account (user ID) and a password are defined in advance for each user, the user inputs the account and password, and the user's terminal 20 transmits the account and password to the relay server 10. If the user's account and password received from the user's terminal 20 match the user's account and password registered in the relay server 10, the relay server 10 determines that the user is legitimate.

[0081] Also, the password may be a one-time password that is valid only once. For example, a one-time password generation program that generates a one-time password with the same algorithm as that of the relay server 10 is installed in advance in the terminal 20, and authentication is performed using the one-time password. For example, the algorithm and seed number of the one-time password generation program installed in the terminal 20 and the one-time password generation program installed in the relay server 10 match, and as a result, the one-time password generated on the terminal side and the password generated by the relay server 10 match. For example, the one-time password generation program performs a process of generating a one-time password based on the time and seed number at a predetermined cycle (for example, every 30 seconds).

[0082] (B) External authentication When the relay server 10 accepts access from a user, it delegates authentication of the user to an external authentication server (authentication authority).

[0083] For example, the relay server 10 judges the authentication of the user by an external authentication server (authentication authority) and judges the legitimacy of the user based on the information received from the authentication server. If the information received from the authentication server includes user information (e.g., email address), and if the user information matches the user information managed by the relay server 10, the relay server 10 judges that the user is legitimate.

[0084] In this embodiment, the user is required to register in advance user information (eg, account and password) corresponding to the destination user in an external authentication server.

[0085] Also, there may be multiple types of authentication servers, such as Google (registered trademark), Amazon (registered trademark), Facebook (registered trademark), etc., and an instruction to select one authentication server may be received from the user. Then, the relay server 10 delegates authentication to the selected authentication server.

[0086] (C) Biometric authentication For example, biometric information (face, fingerprint, veins) for each user is registered in advance in the relay server 10, and the user inputs the biometric information and transmits it to the relay server 10. If the biometric information of the user received from the user's terminal 20 matches the biometric information of the user registered in the relay server 10, the user is determined to be legitimate.

[0087] (D) Authentication using a second device (such as a smartphone) For example, the relay server 10 may register the terminal identification information of the second terminal in advance in association with the user's account by a given method, and may determine the legitimacy of the user by using the terminal identification information of the second terminal.

[0088] (E) Phone Number Verification For example, the relay server 10 may register the telephone number of the user by a given method and use the telephone number of the user to determine the legitimacy of the user.

[0089] (F)SSL Client Certificate The relay server 10 may determine whether or not an SSL (Secure Socket Layer) client certificate transmitted from the terminal 20 is valid, and if the SSL client certificate is valid, determine that the user is valid.

[0090] (G) A process for authenticating users without using a password The relay server 10 may execute a process for performing user authentication without using a password (public key-based user authentication process). For example, the relay server 10 may determine the validity of a user by using an authentication process of FIDO (registered trademark) or FIDO2. For example, FIDO2 is composed of CTAP (Client To Authenticator Protocol) and WebAuthn (Web Authentication API), and enables user authentication via a web browser of the terminal 20.

[0091] (H) Authentication process for other users The relay server 10 may determine the validity of the user by using various authentication processes other than those described above.

[0092] [7] Explanation of the presentation of reference information When the user authentication is permitted, the relay server 10 presents the query information to the user's terminal 20. Here, "presenting" means notifying or displaying the query information by a Web page. "Presenting" may also mean that the relay server 10 makes it possible to present the query information to the user's terminal 20.

[0093] In addition, "presentation" may mean that the relay server 10 sends to the terminal 20 an e-mail (which may be a mail magazine, etc.) sent and received via SMTP, that is, sending via a given protocol not limited to SMTP, that a push notification is sent (that is, a message window is displayed in a partial area (such as the top) of the terminal (smartphone) screen), or that a specified screen of a specified application (a banner display screen, a notification screen, a pop-up screen, etc.) is displayed (controlled so that it can be viewed).

[0094] Note that the relay server 10 may transmit information to the terminal 20 of the user in response to a request from the terminal 20, which may be regarded as one aspect of the "presentation."

[0095] When the on-premise server 30 receives access based on query information from a terminal 20 of a user whose authentication has been permitted via the relay server, the on-premise server 30 presents the information indicated in the query information to the terminal 20 of the user via the relay server 10.

[0096] For example, taking user A as an example, when the relay server 10 accepts access from the terminal 20A of user A, the relay server 10 first presents an authentication screen. Then, when the authentication of user A is permitted, the relay server 10 presents, on the terminal 20A of user A, a screen Sc1 (query information list screen) presenting the query information accessible by user A, as shown in FIG. 5.

[0097] For example, as shown in Fig. 4, user A can access the query information L1, L2, and L3. Therefore, as shown in Fig. 5, the query information L1, L2, and L3 are presented on the on-premise information screen Sc1. Note that, as shown in Fig. 5, the relay server 10 may present information on the on-premise servers corresponding to each of the query information L1, L2, and L3. Note that, for convenience of explanation, the query information displayed on the screen Sc1 is displayed in the form of a URL, but a link (hyperlink) to the query information may be displayed.

[0098] When user A wants to access the service SA of the on-premise server 30A, user A can easily access the service SA of the on-premise server 30A with one click of the query information L1. For example, when the relay server 10 accepts an access of the query information L1 from the terminal 20A of user A, the relay server 10 receives information corresponding to the query information L1 (for example, information of a web page of the query information L1) from the on-premise server 30A and transmits it to the user terminal 20.

[0099] [8] Explanation of relay processing Next, the relay process performed by the relay server 10 will be specifically described with reference to Fig. 3. For example, as shown in Fig. 3, the services SA and SB of the on-premise server 30A and the services SC and SD of the on-premise server 30B are activated by agents corresponding to the services, and a TCP connection is established to the relay server 10.

[0100] For example, an example will be described in which the relay server 10 relays communication between a terminal 20A of a user A and a service SA of an on-premise server 30A.

[0101] First, when the relay server 10 accepts access to the query information L1 from the terminal 20A of user A, it judges whether or not to permit authentication of user A. Note that the relay server 10 may omit the process of judging whether or not to permit authentication of user A if it is within a predetermined period from the time when authentication of user A is permitted (for example, within a period of 10 minutes from the time when authentication of user A is permitted).

[0102] Furthermore, when the relay server 10 receives the query information "https: / / example1.com.hennge.io / " from the terminal 20A, this means that the relay server 10 has received access to the web server "example1.com.hennge.io" of the relay server 10 via a protocol (e.g., HTTPS protocol) specified by the query information (e.g., URL) from the terminal 20A.

[0103] Then, when the authentication of the user A is permitted, the relay server 10 can determine that the access to the query information L1 is an access to the service SA of the on-premise server 30A, and therefore uses the connection of the service SA that has been established in advance to establish a connection between the service SA and the terminal 20A. relays communications between

[0104] In addition, the agent corresponding to the service SA determines that the information transmitted through the connection is the service SA (port 80) of the on-premise server 30, and sends (transmits) the information to that service SA (port 80).

[0105] As a result, the terminal 20A becomes able to access the on-premise server 30A from outside via the relay server 10.

[0106] The relay server 10 relays communication between the terminal 20 of the user whose authentication has been permitted and the service SA only while the agent is running the service SA. In other words, when the service SA is stopped, the relay server 10 cannot communicate between the terminal 20 of the user whose authentication has been permitted and the service SA.

[0107] Furthermore, the agent can manage multiple services, and establishes a connection with the relay server 10 for each service. Therefore, for example, if the agent manages the service SA and the service SB, when the authenticated terminal 20A accesses the query information L1, the relay server 10 uses the connection of the service SA corresponding to the query information L1. When the authenticated terminal 20A accesses the query information L2, the relay server 10 uses the connection of the service SB corresponding to the query information L2.

[0108] The agent then determines which service (which port) of the on-premise server 30A the information transmitted by the terminal 20A via the relay server 10 will reach. For example, if the information received by the agent is information transmitted via a service SA connection, the agent transmits the information to service SA (port 80) of the on-premise server 30A, and if the information received is information transmitted via a service SB connection, the agent transmits the information to service SB (port 443) of the server 30A.

[0109] As described above, in this embodiment, a secure network environment can be realized because the terminal 20A does not directly access the on-premise server 30A without going through the relay server 10. Also, in this embodiment, permission of user authentication is a condition for accessing the on-premise server, so unauthorized access can be prevented.

[0110] In addition, in this embodiment, when the terminal 20 communicates with the on-premise server 30 via the relay server 10, data may be encrypted using SSL or TLS.

[0111] [9] Flowchart The flow of processing of the relay server of this embodiment will be described with reference to Fig. 6. For convenience of explanation, processing related to user A will be described. First, based on information of the on-premise server 30, reference information that can be accessed from the on-premise server 30 is generated (step S1).

[0112] Then, it is determined whether or not access has been accepted from the terminal 20A of the user A (step S2). If access has been accepted from the terminal 20A of the user A (Y in step S2), it is determined whether or not authentication of the user A is permitted (permission is denied) (step S3).

[0113] If authentication of user A is permitted (Y in step S3), the query information is presented to terminal 20A of user A (step S4). On the other hand, if authentication of user A is not permitted (rejected) (N in step S3), the process ends.

[0114] Then, it is determined whether or not access for the reference information has been accepted from user A's terminal 20A (step S5). If access for the reference information has been accepted from user A's terminal 20A (Y in step S5), the relay server 10 relays communication between user A's terminal 20A and the on-premise server 30 (step S6). For example, the relay server 10 receives information from the terminal 20A and transmits it to the on-premise server 30, and receives information corresponding to the reference information from the on-premise server 30 and transmits it to the terminal 20A. This ends the process.

[0115]

[10] Authentication of on-premise devices Furthermore, after permitting authentication of the user, the relay server 10 may further delegate authentication to an on-premise device (e.g., an agent). In other words, the relay server 10 may control so that communication between the terminal 20 and the on-premise server 30 is enabled when authentication is finally permitted by the on-premise device.

[0116]

[11] Cloud services and single sign-on The relay server 10 may be an information processing device capable of providing a terminal 20 connected to the relay server 10 via the Internet with secure access to a given cloud service and performing authentication. Examples of cloud services include Microsoft365 (registered trademark), Google (registered trademark), Slack (registered trademark), and Zoom (registered trademark). The relay server 10 controls the cloud service so that it can be provided to a user who has been authorized to be authenticated.

[0117] For example, the relay server 10 may be configured to be able to control so that a user can use a plurality of cloud services collectively with a single sign-on by using SAML (Security Assertion Markup Language).

[0118]

[12] Other The present invention is not limited to the above-described embodiment, and various modifications are possible. For example, a term cited as a broadly defined or synonymous term in the description in the specification or drawings can be replaced with a broadly defined or synonymous term in other descriptions in the specification or drawings. [Explanation of symbols]

[0119] 10 servers, 20 terminals, 30 on-premise servers, 100 Processing unit, 111 User control unit, 112 Authentication processing unit, 113 Query information generating unit, 114 Presentation unit, 115 Relay processing unit, 120 Web processing unit, 170 Storage unit, 171 Main storage unit, 172 User information storage unit, 173 Query information storage unit, 180 Information storage medium, 196 Communication unit

Claims

1. An information processing device in which a user's terminal and an on-premise server are connected via the Internet, and the terminal and the on-premise server are connected via the Internet, a query information generating unit configured to generate a unique URL that can access the on-premise server based on information of the on-premise server; A user control unit that manages user information of a user; an authentication processing unit that, when an access is accepted from a user terminal, determines whether or not the user should be authenticated; a presentation unit that presents the URL to a terminal of the user if authentication of the user is permitted; a relay processing unit that relays communication between a terminal of the user who has been authenticated and the on-premise server when access to the URL is received from the terminal of the user who has been authenticated; 13. An information processing device comprising:

2. An information processing device in which a user's terminal and an on-premise server are connected via the Internet, and the terminal and the on-premise server are connected via the Internet, a query information generating unit configured to generate a unique URL that can access a service of the on-premise server based on information of the on-premise server; A user control unit that manages user information of a user; an authentication processing unit that, when an access is accepted from a user terminal, determines whether or not the user should be authenticated; a presentation unit that presents the URL to a terminal of the user if authentication of the user is permitted; a relay processing unit that relays communication between a terminal of the user who has been authenticated and the service of the on-premise server when access to the URL is received from the terminal of the user who has been authenticated; 13. An information processing device comprising:

3. In claim 1 or 2, The user control unit: For each user, determine whether the user is allowed to access the URL based on the user information of the user; The presentation unit is An information processing apparatus that presents, for each user, URLs accessible by that user to a terminal of that user.

4. An access control system in which a user terminal, an on-premise server, and an information processing device are each connected via the Internet, The information processing device includes: a query information generating unit configured to generate a unique URL that can access the on-premise server based on information of the on-premise server; A user control unit that manages user information of a user; an authentication processing unit that, when an access is accepted from a user terminal, determines whether or not the user should be authenticated; a presentation unit that presents the URL to a terminal of the user if authentication of the user is permitted; a relay processing unit that relays communication between a terminal of the user who has been authorized for authentication and the on-premise server when access to the URL is received from the terminal of the user, The on-premise server comprises: An access control system characterized in that, when access via the URL is accepted from the terminal of a user who has been authorized for authentication via the information processing device, the information indicated in the URL is presented to the user's terminal via the information processing device.

5. In claim 4, An agent device that exists in the same network environment as the on-premise server; The agent device includes: Establishing a connection between each on-premise server and the information processing device; The relay processing unit includes: When the access to the URL is accepted, the on-premise server uses a connection of the on-premise server corresponding to the URL to relay communication between the terminal of the user and the on-premise server; The agent device includes: An access control system characterized by controlling the start or stop of services of the on-premise server.

6. An access control system in which a user terminal, an on-premise server, and an information processing device are each connected via the Internet, The information processing device includes: a query information generating unit configured to generate a unique URL that can access a service of the on-premise server based on information of the on-premise server; A user control unit that manages user information of a user; an authentication processing unit that, when an access is accepted from a user terminal, determines whether or not the user should be authenticated; a presentation unit that presents the URL to a terminal of the user if authentication of the user is permitted; a relay processing unit that relays communication between a terminal of the user who has been authorized to be authenticated and the service of the on-premise server when access to the URL is received from the terminal of the user, The on-premise server comprises: An access control system characterized in that, when access via the URL is accepted from the terminal of a user who has been authorized for authentication via the information processing device, the information indicated in the URL is presented to the user's terminal via the information processing device.

7. In claim 6, An agent device that exists in the same network environment as the on-premise server; The agent device includes: Establishing a connection between each service and the information processing device; The relay processing unit includes: When the access to the URL is accepted, the service relays communication between the user's terminal and the service using a connection of the service corresponding to the URL; The agent device includes: An access control system characterized by controlling the start or stop of services of the on-premise server.

8. A program for an information processing device in which a user's terminal and an on-premise server are connected via the Internet, and the terminal and the on-premise server are connected via the Internet, a query information generating unit configured to generate a unique URL that can access the on-premise server based on information of the on-premise server; A user control unit that manages user information of a user; an authentication processing unit that, when an access is accepted from a user terminal, determines whether or not the user should be authenticated; a presentation unit that presents the URL to a terminal of the user if authentication of the user is permitted; A program that causes a computer to function as a relay processing unit that relays communication between a terminal of a user who has been authorized for authentication and the on-premise server when access to the URL is received from the terminal of the user.

9. A program for an information processing device in which a user's terminal and an on-premise server are connected via the Internet, and the terminal and the on-premise server are connected via the Internet, a query information generating unit configured to generate a unique URL that can access a service of the on-premise server based on information of the on-premise server; A user control unit that manages user information of a user; an authentication processing unit that, when an access is accepted from a user terminal, determines whether or not the user should be authenticated; a presentation unit that presents the URL to a terminal of the user if authentication of the user is permitted; A program that causes a computer to function as a relay processing unit that relays communication between a terminal of a user who has been authorized for authentication and the service of the on-premises server when access to the URL is received from the terminal of the user.

10. An information processing device in which a user's terminal and an on-premise server are connected via the Internet, and the terminal and the on-premise server are each connected via the Internet. An information processing method for a device, comprising: generating a unique URL that can access the on-premise server based on information of the on-premise server; Managing user information of a user; a step of determining whether or not to permit authentication of a user when access is received from the user's terminal; presenting the URL to a terminal of the user if authentication of the user is permitted; An information processing method characterized by including a step of relaying communication between the user's terminal and the on-premises server when access to the URL is accepted from the user's terminal whose authentication has been permitted.

11. An information processing method of an information processing device in which a user's terminal and an on-premise server are connected via the Internet, and the terminal and the on-premise server are connected via the Internet, comprising: generating a unique URL that can access a service of the on-premise server based on information of the on-premise server; Managing user information of a user; a step of determining whether or not to permit authentication of a user when access is received from the user's terminal; presenting the URL to a terminal of the user if authentication of the user is permitted; An information processing method characterized by including a step of relaying communication between the user's terminal and the service of the on-premises server when access to the URL is accepted from the user's terminal whose authentication has been permitted.

Images