Remote maintenance system and remote maintenance program

Abstract

To provide a remote maintenance system capable of reducing burden on a maintenance person while securing security.SOLUTION: A remote maintenance system performs maintenance via a dedicated line between a first gateway device to which a maintenance person terminal is connected and a second gateway device to which a maintained person terminal is connected. The first gateway device acquires call identification information and a transmission destination IP address of an IP line call between the maintenance person terminal and the maintained person terminal. The second gateway device acquires call identification information of the IP line call and a transmission source IP address. The first gateway device routes a log-in packet relative to a transmission destination IP address from the maintenance person terminal to the dedicated line. The second gateway device permits reception of the log-in packet by using the transmission source IP address, and performs authentication by using the call identification information included in the log-in packet.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to a remote maintenance system for remotely maintaining a maintenance target device via a network. [Background technology]

[0002] 2. Description of the Related Art A remote maintenance system that remotely maintains a network device such as a gateway device from a maintenance operator terminal connected via a network has been put to practical use.

[0003] When remotely maintaining a device to be maintained in a network where IP addresses are dynamically assigned to network devices, the maintenance operator terminal needs to obtain IP address information of the device to be maintained in order to access the device to be maintained. Also, the security settings of the device to be maintained need to be changed so that the maintenance operator terminal can access the device to be maintained.

[0004] Therefore, in a conventional remote maintenance system, a method has been proposed in which a maintenance operator terminal acquires information on the IP address of a device to be maintained so that the maintenance operator terminal can access the device to be maintained (see, for example, Patent Documents 1 and 2).

[0005] For example, Patent Document 1 proposes a method in which a maintenance operator device transmits a specified maintenance request signal to a device to be maintained, and the device to be maintained determines whether to allow maintenance based on the request signal, and if maintenance is permitted, generates a response signal including an IP address of the device to be maintained and transmits it to the maintenance operator device.

[0006] Furthermore, Patent Document 2 proposes a method of connecting a maintenance operator terminal to a device to be maintained via a public telephone line, setting account information for the maintenance operator terminal to access the device to be maintained, and obtaining the IP address of the device to be maintained. [Prior art documents] [Patent documents]

[0007] [Patent Document 1] JP 2005-244306 A [Patent Document 2] JP 2010-206657 A Summary of the Invention [Problem to be solved by the invention]

[0008] In Patent Document 1, a request signal for acquiring an IP address needs to be sent from a maintenance operator terminal to a maintenance target device. In Patent Document 2, the maintenance operator terminal also needs to set account information for accessing the maintenance target device via a public telephone line, which causes a problem of a large workload for the maintenance operator.

[0009] The present invention has been made to solve these problems, and has an object to provide a remote maintenance system that can reduce the burden on maintainers while ensuring security when performing remote maintenance. [Means for solving the problem]

[0010] In order to achieve the above object, a remote maintenance system according to the present invention is a remote maintenance system in which a first gateway device to which a maintainer terminal is connected performs maintenance of the second gateway device via a dedicated line between the first gateway device and a maintainee terminal, the first gateway device having a control unit that refers to call identification information and IP address information of an IP line call between the maintainer terminal and the maintainee terminal, and acquires the call identification information and second IP address information of the second gateway device, and the second gateway device refers to the call identification information and IP address information of the IP line call, and acquires the call identification information and second IP address information of the first gateway device. the control unit of the first gateway device is configured to perform name resolution by responding with the second IP address information in response to an access to a predetermined maintenance URL from the maintenance person terminal, and to route a login packet having the call identification information as authentication information to the dedicated line, and the control unit of the second gateway device is configured to perform authentication using the call identification information included in the login packet when a connection source address of the login packet received via the dedicated line matches the first IP address information, and to determine whether to permit access to the maintenance URL.

[0011] In one configuration example of the above-mentioned remote maintenance system according to the present invention, a control unit of the first gateway device is configured to acquire the call identification information and second IP address information of the second gateway device when a predetermined voice is detected in the IP line call, and a control unit of the second gateway device is configured to acquire the call identification information and the first IP address information of the first gateway device when a predetermined voice is detected in the IP line call.

[0012] In one configuration example of the above-mentioned remote maintenance system according to the present invention, the control unit of the second gateway device is configured to permit reception of the login packet only during the IP line call or for a certain period of time after the IP line call is ended.

[0013] In order to achieve the above object, a remote maintenance program is provided for causing a computer to function as a remote maintenance system in which a first gateway device to which a maintenance person terminal is connected and a second gateway device to which a maintainee terminal is connected, via a dedicated line between the first gateway device and a maintainee terminal, the remote maintenance program causing the first gateway device to execute a step of acquiring the call identification information and second IP address information of the second gateway device by referring to call identification information and IP address information of an IP line call between the maintenance person terminal and the maintainee terminal, and causing the second gateway device to execute a step of acquiring the call identification information and second IP address information of the second gateway device by referring to the call identification information and IP address information of the IP line call, The method includes the steps of: acquiring identification information and first IP address information of the first gateway device; causing the first gateway device to perform name resolution by responding with the second IP address information in response to access to a predetermined maintenance URL from the maintenance personnel terminal; and routing a login packet having the call identification information as authentication information to the dedicated line; and causing the second gateway device to perform authentication using the call identification information included in the login packet when the source address of the login packet received via the dedicated line matches the first IP address information, and determining whether to permit access to the maintenance URL. Effect of the Invention

[0014] According to the present invention, it is possible to provide a remote maintenance system that can reduce the burden on a maintenance person while ensuring security when performing remote maintenance. [Brief description of the drawings]

[0015] [Figure 1] FIG. 1 is a system configuration diagram of a remote maintenance system according to an embodiment of the present invention. [Diagram 2] FIG. 2 shows an example of an operation sequence of the remote maintenance system according to the embodiment of the present invention. [Diagram 3]FIG. 3 shows an example of an operation sequence of the remote maintenance system according to the embodiment of the present invention. [Figure 4] FIG. 4 is an example of an operation flowchart of the gateway (maintenance operator side) of the remote maintenance system according to the embodiment of the present invention. [Diagram 5] FIG. 5 is an example of an operation flowchart of the gateway (maintainee side) of the remote maintenance system according to the embodiment of the present invention. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0016] DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS The present invention will be described in detail with reference to the accompanying drawings. The present invention can be embodied in various forms and is not limited to the embodiments of the invention described below.

[0017] <Features of the remote maintenance system of the present invention> 1 is a configuration diagram of a remote maintenance system according to an embodiment of the present invention. The remote maintenance system according to the embodiment of the present invention is a remote maintenance system including a gateway device 10 (first gateway device) on the maintainer side to which a maintainer terminal 20 is connected, and a gateway device 30 (second gateway device) on the maintainer side to which a maintainee terminal 40 is connected.

[0018] The communication network NW includes a dedicated line such as a Next Generation Network (NGN) or the Internet. The gateway device 10 is installed on a path that relays a maintenance person terminal 20 connected to a subordinate LAN to the communication network NW, and is configured to route received packets to a dedicated line such as an NGN or the Internet.

[0019] In the remote maintenance system of this embodiment, a maintenance person terminal 20 connected to a gateway device 10 performs remote maintenance of the gateway device 30 on the maintainee side via a dedicated line such as NGN set up between the gateway device 10 and the gateway device 30. Since the maintenance person terminal 20 performs maintenance via the dedicated line between the gateway device 10 and the gateway device 30, there is no risk of packets being intercepted, and maintenance work can be performed safely.

[0020] In order to access the gateway device 30, which is a device to be maintained, via a dedicated line, the maintenance person terminal 20 needs to acquire IP address information of the gateway device 30. Also, it is necessary to change the security settings of the gateway device 30 so that the maintenance person terminal 20 can access the gateway device 30.

[0021] In this embodiment, the IP address information of the gateway device 30 is acquired and the security settings of the gateway device 30 are changed by utilizing an IP line call between the maintainer terminal 20 and the maintained terminal 40.

[0022] Since the IP line call between the maintainer terminal 20 and the maintained terminal 40 includes the IP address information of the gateway device 10 and the gateway device 30, the gateway device 10 can obtain the IP address information of the gateway device 30 by referring to the IP line call, and can access the gateway device 30.

[0023] On the other hand, the gateway device 30 can obtain information on the IP address of the gateway device 10 by referring to the IP line call, and change the security settings so that the maintenance terminal 20 can access via the gateway device 10.

[0024] Here, by temporarily permitting a specific maintenance person terminal 20 performing maintenance work to access the gateway device 30, which is the device to be maintained, it is possible to prevent security risks due to unauthorized access.

[0025] In this embodiment, gateway device 10 and gateway device 30 refer to IP line calls to obtain IP address information and change security settings, eliminating the need to create and send new signals to obtain IP address information or change security settings, thereby reducing the burden on maintenance personnel in performing maintenance work.

[0026] Furthermore, in this embodiment, IP address information for accessing the gateway device 30 is held by the gateway device 10 on the maintenance person side, and the gateway device 10 performs name resolution, allowing the maintenance person terminal 20 to access the gateway device 30. Furthermore, authentication information for accessing the gateway device 30 is also held by the gateway device 10 on the maintenance person side. Since the maintenance person terminal 20 does not need to manage authentication information or IP address information, the burden of managing confidential information such as account information for IP addresses is reduced, and the risk of confidential information leaking is also reduced.

[0027] <Gateway device configuration> The gateway device 10 on the maintenance operator side is installed on a path that relays the maintenance operator terminal 20 connected to the subordinate LAN to the communication network NW. As shown in Fig. 1, the gateway device 10 has, as its main circuit configuration, a network side I / F 11, a LAN side I / F 12, a storage unit 13, and a control unit 14. The gateway device 30 on the maintenance operator side has a configuration similar to that of the gateway device 10 on the maintenance operator side.

[0028] <Network side I / F, LAN side I / F> The network side I / F 11 is an I / F for performing data communication with a communication network NW such as the Internet via a communication line L. The LAN side I / F 12 is an I / F for performing data communication with a maintenance person terminal 20 via a LAN.

[0029] In the communication network NW, an IP line call between the maintainer terminal 20 and the maintained user terminal 40, and a dedicated line between the gateway device 10 and the gateway device 30 are set up. To the communication network NW, a SIP server 50 for carrying out an IP line call between the maintainer terminal 20 and the maintained user terminal 40, and a DNS server 60 for performing name resolution when connecting to the Internet are connected.

[0030] When the gateway device 10 connects to the Internet of the communication network NW, it requests name resolution from a DNS server. In this embodiment, however, the gateway device 10 is configured to perform name resolution in order for the maintenance terminal 20 to perform remote maintenance of the gateway device 30 via a dedicated line such as NGN set up between the gateway device 10 and the gateway device 30.

[0031] <Storage section> The storage unit 13 is generally composed of a storage unit such as a semiconductor memory. The storage unit 13 stores, as maintenance information for performing maintenance, call identification information (CALL-ID) of IP line calls, IP address information of gateways, and remote maintenance programs executed by the control units 14 of the gateway devices 10 and 30.

[0032] The remote maintenance program executed by the control unit 14 is a processing program that cooperates with the CPU of the control unit 14 to realize various processing units for performing name resolution processing, packet routing processing, filter processing for changing security settings, browser access authentication processing, etc., and causes the computer to function as a remote maintenance system equipped with a gateway device.

[0033] <Configuration of the control unit of the gateway device> The control unit 14 has a CPU and its peripheral circuits, and by having the CPU cooperate with the program in the memory unit 13, is provided with a call information acquisition unit 14A that acquires call identification information and IP address information by referring to IP line calls, a routing processing unit 14B that performs name resolution processing and packet routing processing, a filter processing unit 14C that performs filter processing to change security settings, and an authentication processing unit 14D that executes authentication processing for browser access.

[0034] The call information acquisition unit 14A of the control unit 14 of the gateway device 10 on the maintenance person side refers to the call identification information and IP address information of the IP line call between the maintenance person terminal 20 and the maintained person terminal 40, and acquires the call identification information and the IP address information of the gateway device 30 (destination IP address information, second IP address information).

[0035] On the other hand, the call information acquisition unit 14A of the control unit 14 of the gateway device 30 on the maintained party side refers to the call identification information and IP address information of the IP line call between the maintainer terminal 20 and the maintained party terminal 40, and acquires the call identification information and the IP address information of the gateway device 10 (source IP address information, first IP address information).

[0036] The routing processing unit 14B of the control unit 14 of the gateway device 10 on the maintenance operator side is configured to respond to access to a specified maintenance URL from the maintenance operator terminal 20 by responding with the IP address information (destination IP address information) of the gateway device 30 acquired by the call information acquisition unit 14A, perform name resolution, and route a login packet, which uses the call identification information acquired by the call information acquisition unit 14A as authentication information, to a dedicated line.

[0037] The filter processing unit 14C of the control unit 14 of the gateway device 30 on the maintained party side allows reception of the login packet when the source address of the login packet received via the dedicated line matches the IP address information (source IP address information) of the gateway device 10, and the authentication processing unit 14D is configured to perform authentication using the call identification information included in the login packet and the call identification information acquired by the call information acquisition unit 14A, and to determine whether to allow access to the maintenance URL.

[0038] In this embodiment, when a certain time has elapsed since the end of an IP line call, the gateway device 10 and the gateway device 30 delete the maintenance information of the call identification information and the IP address information, and cancel the maintenance settings such as the settings of name resolution, routing, filters, and authentication. When the maintenance information is deleted and the maintenance settings are canceled, the maintenance person terminal 20 cannot perform maintenance on the gateway device 30. By temporarily permitting a specific terminal performing maintenance work to access the device to be maintained, it is possible to prevent security risks due to unauthorized access.

[0039] <Address resolution process sequence> The operation sequence of the remote maintenance system will be described with reference to Figures 2 and 3. Figure 2 shows an example of an operation sequence of the remote maintenance system according to an embodiment of the present invention. Figure 2 shows an operation sequence from the start of an IP line call to maintenance setup. In the sequence of Figure 2, the maintenance sequence starts after the IP line call ends.

[0040] The maintainer terminal 20 performs an outgoing IP line call operation to the maintainee terminal 40 connected to the gateway device 30 that is the maintenance target (step 102). The outgoing signal is provided with call identification information (CALL-ID) for identifying the IP line call.

[0041] The gateway device 10 relays the outgoing signal to the SIP server, and the SIP server relays the outgoing signal to the gateway device 30 on the maintained side (steps 103-105).

[0042] The gateway device 30 relays the outgoing signal relayed from the SIP server to the maintained terminal 40, and when the maintained terminal 40 performs a response operation, an IP line call is initiated between the maintainer terminal 20 and the maintained terminal 40 (steps 106-112).

[0043] The gateway device 10 on the maintenance operator side detects the transition to maintenance based on the contents of the IP line call between the maintenance operator terminal 20 and the maintained terminal 40, and refers to the call identification information and IP address information of the IP line call between the maintenance operator terminal 20 and the maintained terminal 40, obtains the call identification information and the IP address information of the gateway device 30 (destination IP address information), and stores them in a memory unit (steps 200, 201).

[0044] Meanwhile, the gateway device 30 on the maintained party side also detects the transition to maintenance based on the IP line call, and by referring to the call identification information and IP address information of the IP line call between the maintainer terminal 20 and the maintained party terminal 40, acquires the call identification information and the IP address information of the gateway device 10 (source IP address information), and stores them in a memory unit (steps 204, 205).

[0045] 2, a transition to maintenance is detected by detecting a predetermined voice (e.g., a conversation related to maintenance) in an IP line call between the maintainer terminal 20 and the maintained terminal 40 by voice recognition, and call identification information and IP address information are obtained. The method of detecting a transition to maintenance is not limited to voice recognition.

[0046] For example, other methods may be used, such as detecting push button operation by voice guidance on the maintenance operator terminal 20 or the maintained terminal 40 to detect the transition to maintenance, or specifying the start of maintenance using additional information in an IP packet.

[0047] The gateway device 10 on the maintenance person side is set to perform name resolution by responding with the acquired IP address information (destination IP address information) of the gateway device 30 in response to an access from the maintenance person terminal 20 to a predetermined maintenance URL (for example, "saxa_Maintenance_access") (step 202). This eliminates the need for the maintenance person terminal 20 to manage the IP address information of the gateway device 30.

[0048] The gateway device 10 is set to route the login packet to the maintenance URL to the dedicated line (step 203). The login packet stores the acquired call identification information, which is used as authentication information for authentication in the gateway device 30. Since the gateway device 10 stores the call identification information in the login packet, the maintenance person terminal 20 does not need to manage information for accessing the gateway device 30.

[0049] The gateway device 30 on the maintained party side sets a filter to permit reception of the login packet if the source address of the login packet received via the dedicated line matches the IP address information (source IP address information) of the gateway device 10 (step 206).

[0050] The gateway device 30 on the side of the person to be maintained is set so as to perform authentication using the call identification information contained in the login packet and the stored call identification information (step 207).

[0051] The gateway device 10 on the maintenance operator side and the gateway device 30 on the maintained party side perform various settings for performing the above-mentioned maintenance, and also establish an IP line call between the maintenance operator terminal 20 and the maintained party terminal 40 to connect a dedicated line between the gateway device 10 and the gateway device 30 (step 208).

[0052] Fig. 3 shows an example of an operation sequence of the remote maintenance system according to the embodiment of the present invention, from the start of maintenance to the end of maintenance.

[0053] In response to an access from the maintenance operator terminal 20 to a specific maintenance URL (e.g., "saxa_Maintenance_access"), the gateway device 10 on the maintenance operator side responds with the acquired IP address information (destination IP address information) of the gateway device 30 to perform name resolution, stores the acquired call identification information as authentication information in a login packet to the maintenance URL, and routes the login packet to the dedicated line (steps 300-304).

[0054] If the gateway device 30 on the maintained party side determines that the source address of the login packet received via the leased line matches the IP address information (source IP address information) of the gateway device 10, it permits receipt of the login packet and performs authentication using the call identification information contained in the login packet and the stored call identification information (steps 305-307).

[0055] If the authentication result is OK, the gateway device 30 responds with a browser screen and permits browser access by the maintenance person terminal 20 (steps 308-310), and the maintenance person terminal 20 starts maintenance of the gateway device 30 (step 400).

[0056] When a certain time has elapsed since the end of the IP line call, the gateway device 10 and the gateway device 30 delete the maintenance information of the call identification information and the IP address information, and cancel the maintenance settings of the name resolution, routing, filter, authentication settings, etc. (steps 500, 501).

[0057] 2 and 3, the maintenance information is deleted and the maintenance setting is cancelled when a certain time has passed since the IP line call ended, but the maintenance information may be held only during the IP line call, the maintenance setting may be maintained, and the maintenance information may be deleted and the maintenance setting may be cancelled when the IP line call ends. By temporarily allowing a specific terminal performing maintenance work to access the device to be maintained, security risks due to unauthorized access can be prevented.

[0058] <Gateway (maintenance side) operation flowchart> FIG. 4 is an example of an operation flowchart of the gateway (maintenance operator side) of the remote maintenance system according to the embodiment of the present invention.

[0059] When the gateway (maintenance provider side) detects the transition to maintenance, it references the call identification information and IP address information of the IP line call and stores the call identification information and destination IP address of the IP line call (S1-1, S1-2, S1-3).

[0060] When the gateway (maintenance provider side) receives an access to the maintenance URL, it responds with the destination IP address and performs name resolution (S1-4, S1-5).

[0061] When the gateway (maintenance operator side) receives the login packet to the maintenance URL, it stores the call identification information as authentication information in the login packet and routes the login packet to the leased line (S1-6, S1-7, S1-8).

[0062] <Gateway (maintenance side) operation flowchart> FIG. 5 is an example of an operation flowchart of the gateway (maintainee side) of the remote maintenance system according to the embodiment of the present invention.

[0063] When the gateway (maintained party side) detects the transition to maintenance, it references the call identification information and IP address information of the IP line call and stores the call identification information and source IP address of the IP line call (S2-1, S2-2, S2-3).

[0064] When the gateway (maintainee side) receives a login packet to the maintenance URL, it judges whether the source address of the login packet matches the source IP address and whether the authentication information of the login packet matches the call identification information. If the source address matches the source IP address and the authentication information matches the call identification information, it allows access to the maintenance URL (S2-4, S2-5, S2-6, S2-7). <Effects of this embodiment> In this embodiment, the IP line communication between the maintainer terminal 20 and the maintained terminal 40 is utilized to obtain the IP address information of the gateway device 30 and to change the security settings of the gateway device 30.

[0065] Since the IP line call between the maintainer terminal 20 and the maintained terminal 40 includes IP address information of the gateway device 10 and the gateway device 30, by referring to the IP line call, the gateway device 10 can obtain the IP address information of the gateway device 30 and access the gateway device 30. On the other hand, the gateway device 30 can change the security setting so that the gateway device 10 can be accessed.

[0066] In this embodiment, gateway device 10 and gateway device 30 refer to IP line calls to obtain IP address information and change security settings, eliminating the need to create and send new signals to obtain IP address information or change security settings, thereby reducing the burden on maintenance personnel in performing maintenance work.

[0067] Furthermore, in this embodiment, the IP address information for accessing the gateway device 30 is held in the gateway device 10 on the maintenance person's side, so that the maintenance person terminal 20 does not need to manage the IP address information. This reduces the burden of managing the address information and also reduces the risk of leakage of account information such as IP addresses.

[0068] Furthermore, in this embodiment, the gateway device 30 is configured to permit reception of login packets only during an IP line call or for a certain period of time after the IP line call is terminated, thereby allowing a specific terminal performing maintenance work to temporarily access the device under maintenance, thereby preventing security risks due to unauthorized access.

[0069] <Extended embodiment> Although the present invention has been described above with reference to the embodiment, the present invention is not limited to the above embodiment. Various modifications that can be understood by those skilled in the art can be made to the configuration and details of the present invention within the scope of the present invention. [Explanation of symbols]

[0070] 10...gateway device (maintenance provider side), 11...network side I / F, 12...LAN side I / F, 13...memory unit, 14...control unit, 20...maintenance provider terminal, 30...gateway device (maintenance provider side), 40...maintenance provider terminal, 50...SIP server, L...communication line, NW...communication network.

Claims

1. A remote maintenance system in which a maintenance operator terminal performs maintenance on a first gateway device to which a maintenance operator terminal is connected and a second gateway device to which a maintainee terminal is connected via a dedicated line between the first gateway device and the second gateway device, The first gateway device is a control unit that refers to call identification information and IP address information of an IP line call between the maintainer terminal and the maintained terminal, and acquires the call identification information and second IP address information of the second gateway device; The second gateway device is a control unit that refers to call identification information and IP address information of the IP line call and acquires the call identification information and first IP address information of the first gateway device; The control unit of the first gateway device a login packet having the call identification information as authentication information is routed to the dedicated line, the login packet being configured to respond to an access from the maintenance person terminal to a predetermined maintenance URL with the second IP address information, and The control unit of the second gateway device When the source address of the login packet received via the dedicated line matches the first IP address information, authentication is performed using the call identification information contained in the login packet to determine whether to permit access to the maintenance URL. Remote maintenance system.

2. The control unit of the first gateway device when detecting a predetermined voice in the IP line call, the call identification information and second IP address information of the second gateway device are acquired; The control unit of the second gateway device When a predetermined voice is detected in the IP line call, the call identification information and the first IP address information of the first gateway device are acquired. The remote maintenance system according to claim 1 .

3. The control unit of the second gateway device The reception of the login packet is permitted only during the IP line call or for a certain period of time after the IP line call is ended.

3. The remote maintenance system according to claim 1 or 2.

4. A remote maintenance program for causing a computer to function as a remote maintenance system in which a maintenance operator terminal performs maintenance on a first gateway device to which a maintenance operator terminal is connected and a second gateway device to which a maintainee terminal is connected via a dedicated line between the first gateway device and the second gateway device, the program comprising: The first gateway device, executes a step of acquiring call identification information and second IP address information of the second gateway device by referring to call identification information and IP address information of an IP line call between the maintainer terminal and the maintained terminal; The second gateway device, executes a step of acquiring call identification information and first IP address information of the first gateway device by referring to call identification information and IP address information of the IP line call; The first gateway device, a step of performing name resolution by responding with the second IP address information in response to an access to a predetermined maintenance URL from the maintenance person terminal, and routing a login packet having the call identification information as authentication information to the dedicated line; The second gateway device, When the connection source address of the login packet received via the dedicated line matches the first IP address information, authentication is performed using the call identification information included in the login packet, and a step of determining whether to permit access to the maintenance URL is executed. Remote maintenance programs.

Images