Relay device, information processing terminal, secure information system, relay method, and program

Abstract

To contribute to a reduction in various hacking risks and information leaks in an access to private networks required to have a high level of security from an information processing device.SOLUTION: A relay device comprises a virtual closed network control unit which establishes a virtual closed network with an information processing terminal connected to a first closed network and communicates with the information processing terminal via the virtual closed network. The virtual closed network control unit assigns, to the information processing terminal, a virtual network communication address which the information processing terminal uses as a source address within the virtual closed network, and realizes communication between the information processing terminal and the private network via the virtual closed network using the virtual network communication address.SELECTED DRAWING: Figure 2

Description

[Technical field]

[0001] The present invention relates to a relay device, an information processing terminal, a secure information system, a relay method, and a program. [Background technology]

[0002] As working from home becomes more common, there is also an increasing number of people accessing private networks (e.g., in-house information systems) established by companies from mobile devices such as smartphones and tablets, or personal computers used with the BYOD (Bring Your Own Device) initiative.

[0003] 2. Description of the Related Art There is a technique for establishing a highly secure communication path in a mobile VPN (Virtual Private Network) connection environment in which a private network is accessed from a public network such as a public wireless LAN system (see, for example, Patent Document 1). [Prior art documents] [Patent documents]

[0004] [Patent Document 1] JP 2005-204086 A Summary of the Invention [Problem to be solved by the invention]

[0005] The following analysis has been provided by the inventors of the present invention.

[0006] When making it possible to access an in-house information system from a mobile terminal or the like, security concerns are always present. The technology disclosed in Patent Document 1 resolves these concerns by establishing a VPN. However, the technology disclosed in Patent Document 1 does not provide stable communication quality because the in-house information system is accessed from a public network.

[0007] On the other hand, there is a technology that allows access to in-house information systems using closed networks provided by telecommunications carriers (such as mobile phone carriers). Among the services provided by telecommunications carriers is a closed network service that separates communication paths from general users to enhance security. By using this closed network service, highly secure communications can be achieved with high communication quality.

[0008] However, as hackers become more organized and their technical skills improve, there is a growing risk of hacking into closed networks provided by telecommunications carriers and relay networks between telecommunications carriers and in-house information systems. This can result in information leaks. In addition, since mobile terminals are easily transportable among information processing devices, information leaks can also occur when the mobile terminals themselves are stolen.

[0009] The present invention has been made in consideration of the above circumstances, and aims to provide a technology that contributes to reducing various hacking risks and information leaks when accessing a private network, which requires a high level of security, from an information processing device. [Means for solving the problem]

[0010] According to a first aspect of the present invention, a virtual private network control unit for establishing a virtual private network between an information processing terminal connected to the first closed network and for communicating with the information processing terminal via the virtual private network; The virtual private network control unit includes: assigning to said information processing terminal a virtual network communication address to be used by said information processing terminal as a source address within said virtual private network; There is provided a relay device which realizes communication between the information processing terminal and a private network via the virtual closed network by using the virtual network communication address.

[0011] According to a second aspect of the present invention, An information processing unit; A volatile storage unit; A non-volatile storage unit, The information processing unit includes: Connecting to a relay device via a first closed network; the non-volatile storage unit stores information necessary for connecting to the relay device via the first closed network, The information processing unit stores the virtual network communication address received from the relay device in the volatile storage unit, An information processing terminal is provided, in which the virtual network communication address is an address used as a source address in communication via the virtual closed network established by the relay device.

[0012] According to a third aspect of the present invention, A relay device; An information processing terminal; A private network; the relay device includes a virtual closed network control unit that establishes a virtual closed network between the relay device and the information processing terminal connected to the first closed network and communicates with the information processing terminal via the virtual closed network; The virtual private network control unit includes: assigning to said information processing terminal a virtual network communication address to be used by said information processing terminal as a source address within said virtual private network; A communication between the information processing terminal and the private network is realized via the virtual closed network by using the virtual network communication address; The information processing terminal includes: An information processing unit; A volatile storage unit; A non-volatile storage unit, the non-volatile storage unit stores information necessary for connecting to the relay device via the first closed network, The information processing unit stores the virtual network communication address received from the relay device in the volatile storage unit.

[0013] According to a fourth aspect of the present invention, A method for relaying communication between an information processing terminal connected to a first closed network and a private network by a computer, comprising the steps of: a virtual network construction step of constructing a virtual closed network between the information processing terminal and the virtual network construction step; an address assignment step of assigning to the information processing terminal a virtual network communication address to be used by the information processing terminal as a source address within the virtual private network; and a relay step of performing communication between the information processing terminal and the private network via the virtual closed network using the virtual network communication address.

[0014] According to a fifth aspect of the present invention, Computer, A program that functions as a virtual closed network control means for constructing a virtual closed network between an information processing terminal connected to a first closed network and communicating with the information processing terminal via the virtual closed network, The virtual private network control means assigning to said information processing terminal a virtual network communication address to be used by said information processing terminal as a source address within said virtual private network; A program is provided for realizing communication between the information processing terminal and a private network via the virtual closed network using the virtual network communication address.

[0015] According to a sixth aspect of the present invention, A computer having information necessary for connecting to a relay device via a first closed network stored in a non-volatile storage unit, a means for connecting to the relay device via the first closed network; A program is provided that functions as a means for storing in a volatile memory a virtual network communication address received from the relay device and used as a source address in communication via the virtual closed network established by the relay device.

[0016] These programs can be recorded on a computer-readable storage medium. The storage medium can be a non-transient medium such as a semiconductor memory, a hard disk, a magnetic recording medium, an optical recording medium, etc. The present invention can also be embodied as a computer program product. Effect of the Invention

[0017] According to the present invention, it is possible to contribute to reducing various hacking risks and information leakage when an information processing device accesses a private network that requires a high level of security. [Brief description of the drawings]

[0018] [Figure 1] FIG. 1A is a diagram for explaining the risk of information leakage when accessing an internal information system from a mobile terminal, and FIG. 1B is a diagram for explaining an overview of a secure information system according to one embodiment of the present disclosure. [Diagram 2] 1 is a system configuration diagram of a secure information system according to an embodiment of the present disclosure. [Diagram 3] FIG. 11 is another example of a system configuration diagram of the secure information system according to an embodiment of the present disclosure. [Figure 4] 1A and 1B are diagrams for explaining a normal IP address table and a VPN IP address table, respectively, according to an embodiment of the present disclosure. [Diagram 5] 1A to 1C are diagrams for explaining branch server management information, an application server IP list, and an application usage information table, respectively, according to an embodiment of the present disclosure. [Figure 6] 1A and 1B are diagrams for explaining information stored in a non-volatile storage unit and a volatile storage unit, respectively, of a mobile terminal according to an embodiment of the present disclosure. [Figure 7] FIG. 11 is a diagram for explaining a startup process according to an embodiment of the present disclosure. [Figure 8]11 is a flowchart of a startup process according to an embodiment of the present disclosure. [Figure 9] FIG. 2 is a diagram for explaining a virtual network construction process according to an embodiment of the present disclosure. [Figure 10] 1 is a flowchart of a virtual network construction process according to an embodiment of the present disclosure. [Figure 11] FIG. 11 is a diagram for explaining a branch server access information acquisition process according to an embodiment of the present disclosure. [Figure 12] 13 is a flowchart of a branch server access information acquisition process according to an embodiment of the present disclosure. [Figure 13] FIG. 11 is a diagram for explaining an access process to a branch server according to an embodiment of the present disclosure. [Figure 14] FIG. 2 is a hardware configuration diagram of a relay device according to an embodiment of the present disclosure. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0019] An outline of one embodiment of the present invention (hereinafter, referred to as the present embodiment) will be described below with reference to the drawings. Note that the reference symbols in the drawings are given to each element for convenience as an example to aid understanding, and are not intended to limit the present invention to the illustrated form. Furthermore, the connection lines between blocks in the drawings and the like referred to in the following description include both bidirectional and unidirectional lines. Unidirectional arrows are used to diagrammatically indicate the flow of the main signal (data), and do not exclude bidirectionality.

[0020] In addition, although there are ports and interfaces at the connection points of input and output of each block in the figure, they are not shown in the figure. In the following explanation, "A and / or B" means A or B, or A and B.

[0021] First, an outline of an embodiment of the present invention will be described. Here, an example will be described in which a mobile terminal 200B is used to access an in-house information system (internal information system) 400B, which is a private network, from outside a company. Note that the mobile terminal 200B accesses the in-house information system 400B via a closed network provided by a telecommunications carrier, not via a public network such as the Internet.

[0022] Before describing the outline, the inherent risk of information leakage in the above-mentioned system will be described. Fig. 1(a) is a diagram for explaining the inherent risk of information leakage in the current system.

[0023] The communication between the mobile terminal 200B and the base station of the facility of the telecommunications carrier (carrier) is a closed network communication using a communication standard for mobile terminals provided by the carrier. The communication standard used is, for example, LTE (Long Term Evolution) or 5G (5th Generation). The communication between them is encrypted by the carrier.

[0024] Within the carrier, communication is performed between communication equipment such as base stations, core equipment / routers, etc. Also, communication between the carrier's communication equipment and the in-house information system 400B is, for example, communication by IP-VPN (Internet Protocol VPN). IP-VPN is a communication technology that uses a closed IP network provided by the carrier to connect bases. In general, IP-VPN does not encrypt packets, but transmits data by "MPLS (Multi Protocol Label Switching)". MPLS is a forwarding technology that identifies the destination by attaching header information to the label instead of the address. Unlike routing, which selects the shortest route based on the header information of the packet, this technology identifies the destination by indicating the forwarding route in the label. Since a network is created that is logically divided for each user, security can be ensured without encrypting packets.

[0025] It should be noted that the user of mobile terminal 200B can also access each site from mobile terminal 200B via the Internet through carrier facilities.

[0026] In such a situation, the points at which hacking can occur are between mobile terminal 200B and the carrier's base station, within the carrier's facilities, etc. Communications at risk of eavesdropping include communications between mobile terminal 200B and in-house information system 400B that pass through the carrier's facilities, communications between mobile terminal 200B and each site on the Internet, email transmission from each site to mobile terminal 200B, push-type communications, etc.

[0027] In such a situation, for example, a malicious fake LTE base station may be installed and connected to it. In this case, if the user of the mobile terminal 200B mistakenly accepts the forged CA certificate and server certificate inserted into the communication by the fake LTE base station, the subsequent communication cannot be protected. For example, when communication is performed using a Web application or the like, a warning may be displayed. However, the warning is merely displayed, and the communication can be continued by a user operation. Note that there is a method for avoiding the warning message, and in the case of an advanced attack using such a method, a fraudulent certificate can be used without displaying a warning, allowing the communication to continue.

[0028] There is also a risk of information being stolen by network devices on the relay route due to capture. There is a risk of encryption keys being stolen by packet capture or unauthorized proxy connections due to man-in-the-middle (MITM) devices available on the market. In addition, in the case of https (SSL (Secure Socket Layer) encryption), analysis techniques are widely known, and there is a possibility of information being stolen by decryption.

[0029] There is also a risk that the encryption key will be decrypted. https, which was developed to perform authentication and encryption in HTTP communications, uses protocols such as SSL / TLS (Secure Socket Layer / Transport Layer Security) to authenticate the server, encrypt the communication contents, and detect tampering. In the case of SSL, the encryption key is updated at fixed intervals depending on the specifications of the SSL library. This means that there is a risk of decryption by packet capture.

[0030] To counter these threats, in this embodiment, as shown in Fig. 1(b), a relay device 300B is placed between the closed network provided by the carrier and an in-house information system 400B. This relay device 300B further constructs a virtual private network (VPN) space on the closed network service provided by the carrier. This makes it impossible for an intruder to decipher communications even if he or she intrudes into the closed network service provided by the carrier.

[0031] Furthermore, relay device 300B further assigns a VPN IP address to mobile terminal 200B for use in the constructed VPN space. This VPN IP address is different from the IP address (normal IP address) assigned by the carrier in the closed network service provided by the carrier. This allows the intruder's access to be easily denied on the intruder's side, even if the network between the carrier and in-house information system 400B is intruded into.

[0032] In this embodiment, various information and IP addresses required for communication in the VPN space are issued from relay device 300B after the mobile terminal is powered on, and are stored in the volatile memory of mobile terminal 200B. Therefore, all information is erased when the power is turned off. This reduces the risk of information leakage when the mobile terminal is stolen.

[0033] <<First embodiment>> Hereinafter, one embodiment (first embodiment) of the present invention will be described with reference to the drawings.

[0034] A configuration diagram of a secure information system 100A of this embodiment is shown in Fig. 2. The secure information system 100A of this embodiment includes a mobile terminal 200A, a relay device 300A, and an in-house information system 400A which is a private network. The mobile terminal 200A and the relay device 300A are connected via a closed network (first closed network) 500A provided by a closed network service provided by a carrier. The closed network service provided by a carrier is, for example, a service which provides a communication path dedicated to specific users by separating the communication path from that of general users, thereby enhancing security.

[0035] The relay device 300A relays communication between the mobile terminal 200A and each server in the in-house information system 400A. As described above, the relay device 300A is disposed between the in-house information system 400A and the first closed network 500A.

[0036] The relay device 300A is provided with a virtual closed network control unit 320A that establishes a virtual closed network with the mobile terminal 200A connected to the first closed network 500A and communicates with the mobile terminal 200A via the established virtual closed network.

[0037] The virtual private network control unit 320A also assigns to the mobile terminal 200A a VPN IP address (address for virtual network communication) to be used as a source address by the mobile terminal 200A within the virtual private network. The assigned VPN IP address is different from the IP address (normal IP address) assigned for use in the first closed network 500A. The VPN IP address is registered in advance in a VPN IP address table 360A of the storage device 340A included in the relay device 300A.

[0038] The virtual private network control unit 320A realizes communication between the mobile terminal 200A and the in-house information system 400A via a virtual private network established using this VPN IP address.

[0039] The mobile terminal 200A is an information processing terminal that a user uses when accessing the in-house information system 400A.

[0040] The mobile terminal 200A of this embodiment includes an information processing unit 220A, a volatile storage unit 240A, and a non-volatile storage unit 250A.

[0041] The non-volatile storage unit 250A stores in advance information required for accessing the relay device 300A, such as contract information with the carrier and the virtual private network control unit 320A. The mobile terminal 200A connects to the first private network 500A using the contract information with the carrier. The information stored in the non-volatile storage unit 250A is set by initial setting (kitting) of the mobile terminal 200A.

[0042] The information processing unit 220A connects to the relay device 300A via the first closed network 500A. Furthermore, it requests the relay device 300A to establish a virtual closed network. Then, when the virtual closed network is established and an IP address for VPN is transmitted from the relay device 300A, the IP address for VPN is stored in the volatile storage unit 240A. The information processing unit 220A uses the IP address for VPN to access the in-house information system 400A using the established virtual closed network.

[0043] As described above, according to this embodiment, the relay device 300A is placed between the closed network (first closed network 500A) provided by the carrier and the in-house information system 400A. The relay device 300A further constructs a virtual private network (VPN) space on the service of the first closed network 500A. The mobile terminal 200A accesses the in-house information system 400A through this virtual private network. Therefore, even if the first closed network 500A is intruded into, the communication between the mobile terminal 200A and the in-house information system 400A cannot be deciphered.

[0044] The relay device 300A also assigns to the mobile terminal 200A an IP address (VPN IP address) in the VPN space that is different from the IP address assigned by the carrier for the service of the first closed network 500A. The relay device 300A then causes the mobile terminal 200A to communicate using this VPN IP address within the virtual closed network. The in-house information system 400A then does not accept access from a source that does not use this VPN IP address. This allows the in-house information system 400A to easily reject access even if there is an intruder on the relay network between the carrier facility and the in-house information system 400A, as long as the VPN IP address is not known.

[0045] Various information such as a normal IP address required for communication in the first closed network 500A and a VPN IP address used for communication in the virtual closed network is issued from the relay device 300A after the power supply of the mobile terminal 200A is turned on and stored in the volatile storage unit 240A. Therefore, all information is erased when the power supply is turned off. This reduces the risk of information leakage when the mobile terminal 200A is stolen.

[0046] According to this embodiment, these can be realized by initial setting (kitting) of the mobile terminal 200A, which makes it possible to easily connect to the secure in-house information system 400A.

[0047] <<Second embodiment>> Next, a second embodiment of the present invention will be described. This embodiment is a more detailed embodiment of the first embodiment.

[0048] 3 is an overall configuration diagram of the secure information system 100 of this embodiment. As shown in this figure, the secure information system 100 of this embodiment includes a mobile terminal 200, a relay device 300, and an in-house information system 400. The mobile terminal 200 is connected to the facility of a carrier (telecommunications company) to which the relay device 300 is connected, via a first closed network 500 provided by the carrier.

[0049] Each component will be described below.

[0050] [Internal Information System] The in-house information system 400 includes one or more server devices (hereinafter, referred to as branch servers 410 for convenience) connected via a private network, and each branch server 410 includes one or more application servers 411, 412. The application servers 411, 412 are servers that provide various business processes to the user of the mobile terminal 200, and are equipped with business applications (business apps). In other words, the branch server 410 is a group of application servers that control business processes. The user accesses each application server 411, 412 via the mobile terminal 200 and performs the necessary processes.

[0051] In addition, the branch server 410 is set with general access permission information for servers having Web and FTP (File Transfer Protocol) functions.

[0052] [Repeater] 3, the relay device 300 includes a RADIUS (Remote Authentication Dial In User Service) server 310, a VPN server 320, and a distribution server 330. The relay device 300 also includes a storage device 340, which stores a normal IP address table 350, a VPN IP address table 360, an application server IP list 370, an application usage information table 380, and branch server management information 390 in advance.

[0053] The RADIUS server 310 dynamically assigns an IP address (normal IP address) from an address pool to the requesting mobile terminal in response to RADIUS access via the first closed network 500 provided by the carrier. Specifically, the RADIUS server 310 extracts (assigns) one normal IP address from those stored in advance in the normal IP address table 350 of the storage device 340, and assigns it to the requesting mobile terminal 200.

[0054] The normal IP address is an IP address used for normal communication with the mobile terminal 200 via the first closed network 500. The RADIUS server 310 receives, for example, authentication information included in the subscriber information or the like that the mobile terminal 200 transmits to the carrier's facility as a request for establishing a PPP (Point to Point Protocol) communication session, performs authentication, and if the authentication is successful, assigns a normal IP address.

[0055] In this embodiment, the mobile terminal 200 transmits its own mobile base station number (IMEI: International Mobile Equipment Identity) together with the subscriber information when making a PPP session establishment request. The IMEI is identification information that is given to the device itself in advance to uniquely identify the device itself, the mobile terminal 200.

[0056] For example, the RADIUS server 310 stores the assigned normal IP address in the normal IP address table 350 in association with the IMEI of the assigned mobile terminal 200 .

[0057] An example of the normal IP address table 350 is shown in Fig. 4(a). As shown in this figure, the normal IP address table 350 is an address pool in which usable normal IP addresses 351 are pooled. The normal IP address 351 assigned in response to a PPP session establishment request is registered in association with the IMEI 352 of the mobile terminal 200 to which the address is assigned.

[0058] When a PPP session is disconnected, in response to an instruction from the carrier facility, the RADIUS server 310 erases the IMEI 352. In response to an instruction from the carrier facility that has received a PPP session establishment request, the RADIUS server 310 refers to this normal IP address table 350, and selects a new normal IP address to be assigned from the normal IP addresses 351 that are not assigned to the IMEI 352.

[0059] The VPN server 320 establishes a VPN path (VPN tunnel) with the mobile terminal 200. That is, a virtual network is constructed between the mobile terminal 200 and the VPN server 320.

[0060] The VPN server 320 establishes a VPN tunnel according to normal procedures, such as those for establishing an IP-VPN. In the VPN tunnel, the transmission / reception units of the upper protocol are stored and "encapsulated" in the "payload," which is the main body of the protocol data. The data to be transmitted and received is then made into a nested structure so that only a specified party can decapsulate the encapsulation. The encapsulation and decapsulation of the transmission / reception units are performed automatically at both ends of the VPN tunnel. To enable these processes, the VPN server 320 shares data structure information and encryption procedures with the mobile terminal 200, and provides an authentication process for data exchange.

[0061] In constructing a virtual network, for example, message exchange is performed between the VPN server 320 and the mobile terminal 200 to match information on data structure, information on encryption procedures, etc. In this way, a VPN tunnel (virtual network) is constructed.

[0062] After the VPN tunnel is established, the VPN server 320 extracts one of the VPN IP addresses stored in advance in the VPN IP address table 360 ​​in the storage device 340, and assigns it to the requesting mobile terminal 200. After the VPN tunnel is established, the VPN server 320 relays communication between the mobile terminal 200 and other functions in the relay device 300 and outside the relay device, using the VPN IP address. The VPN server 320 includes the function of the virtual closed network control unit of the first embodiment.

[0063] As described above, the VPN IP address is an IP address used by the mobile terminal 200 when establishing a VPN tunnel. When the VPN server 320 receives a VPN tunnel establishment request, it extracts an unused VPN IP address 361 from the VPN IP address table 360 ​​and assigns it to the mobile terminal 200 that made the request.

[0064] An example of the VPN IP address table 360 ​​is shown in Fig. 4(b). As shown in this figure, the VPN IP address table 360 ​​pools available VPN IP addresses 361. Among them, the assigned VPN IP address 361 is registered in association with the IMEI 362 of the mobile terminal 200 to which it is assigned. The VPN server 320 may obtain the IMEI to be associated and registered as the IMEI 362 by, for example, extracting the normal IP address 351 from the sender address of the VPN tunnel establishment request, referring to the normal IP address table 350, and extracting the IMEI 352 registered in association with the normal IP address 351. The VPN tunnel establishment request may be configured to include the IMEI of the requesting mobile terminal 200.

[0065] When a VPN session is disconnected, the VPN server 320 deletes the corresponding IMEI 362 from the VPN IP address table 360 ​​.

[0066] The distribution server 330 functions as a distribution management unit that provides the mobile terminal 200 with application server information of the branch server 410. The distribution server 330 manages, for example, application addresses that are access addresses to the application servers 411 and 412 included in the branch server 410. When the distribution server 330 receives an acquisition request for application information including the IP addresses of the application servers 411 and 412 from the mobile terminal 200, it provides the information to the mobile terminal 200.

[0067] In this embodiment, the distribution server 330 receives the acquisition request from the mobile terminal 200 via a virtual private network (VPN tunnel) (i.e., via the VPN server 320). In this embodiment, the distribution server 330 refers to the branch server management information 390, the application server IP list 370, and the application usage information table 380 stored in the storage device 340, and provides the necessary information to the mobile terminal 200.

[0068] Here, examples of the branch server management information 390, the application server IP list 370, and the application usage information table 380 will be described with reference to FIG. 5(a) to FIG. 5(c).

[0069] The branch server management information 390 is a table for managing devices (mobile terminals, etc.) belonging to each branch. In this embodiment, as shown in Fig. 5(a), the IMEI of the device to be managed (belonging device IMEI 392) is registered in association with information (branch server ID 391) for identifying the branch server 410.

[0070] 5B, in the application server IP list 370, a list of IP addresses (application addresses) of the application servers 411, 412 managed by the branch server 410 (application server IP address list 372) is registered in association with the branch server ID 391 in the application server IP list 370. The IP addresses registered as application addresses are addresses for accessing the application servers 411, 412.

[0071] 5(c), in the application usage information table 380, various application usage information 382 is registered in association with the branch server ID 391. The various application usage information 382 stores, for example, an extension phone number, authentication information, and information for identifying an individual (email address, etc.).

[0072] For example, the distribution server 330 first refers to the VPN IP address table 360 ​​and identifies the IMEI 362 associated with the VPN IP address 361 of the sender of the acquisition request. This allows the distribution server 330 to identify the branch office to which the sender mobile terminal 200 belongs. Then, the distribution server 330 refers to the branch server management information 390 and identifies the branch server ID 391 in which the IMEI is registered as the device IMEI 392 to which the server belongs.

[0073] The distribution server 330 refers to the application server IP list 370 and the application usage information table 380, extracts the application server IP address list 372 and the various application usage information 382 associated with the identified branch server ID 391, and returns them to the source mobile terminal 200. In this embodiment, the return also passes through the virtual closed network, so the distribution server 330 requests the VPN server 320 to transmit the return to the VPN IP address 361 used by the source mobile terminal 200.

[0074] The mobile terminal 200 uses an IP address included in the transmitted application server IP address list 372 to access the application servers 411 and 412 in the branch server 410 to which the user of the mobile terminal 200 belongs (to which access is permitted).

[0075] [Mobile device] The mobile terminal 200 is a device used by a user to access the in-house information system 400. That is, the user uses the mobile terminal 200 to access the application servers 411 and 412 of the branch server 410 of the in-house information system 400 and executes necessary processing. The mobile terminal 200 accesses the relay device 300 through a VPN tunnel established on a closed network (first closed network 500) provided by the carrier, and securely accesses the branch server 410 via the relay device 300.

[0076] As shown in FIG. 3, the mobile terminal 200 includes an information processing unit 220, a transmission / reception unit 210, a non-volatile storage unit 250, a volatile storage unit 240, and a user interface (I / F) 230.

[0077] The information processing unit 220 processes the information acquired via the user I / F 230 or via the transmission / reception unit 210 , and outputs the information via the user I / F 230 or the transmission / reception unit 210 .

[0078] The transmitting / receiving unit 210 is a communication I / F. In this embodiment, for example, communication is realized with a facility of a carrier (telecommunications company) via a first closed network 500.

[0079] The user I / F 230 accepts input from a user and presents to the user the results of processing by the information processing unit 220. For example, the user I / F 230 includes an ON / OFF switch, a touch panel display, a speaker, and the like.

[0080] The non-volatile storage unit 250 is a storage device that retains memory without being supplied with power. For example, a ROM (Read Only Memory), a flash memory, etc. are used for the non-volatile storage unit 250. For example, as shown in Fig. 6(a), the non-volatile storage unit 250 stores in advance, as kitting data, an IP address of the VPN server 320 of the relay device 300 and an IP address of the distribution server 330.

[0081] The volatile storage unit 240 is a storage device that retains memory only while power is being supplied. For example, a RAM (Random Access Memory) or the like is used. In this embodiment, as shown in FIG. 6(b), for example, a normal IP address 351, a VPN IP address 361, an application server IP address list 372, and various application use information 382 acquired via the transmission / reception unit 210 are stored.

[0082] During initial setup (kitting), mobile terminal 200 secures in advance in volatile storage unit 240 a normal IP address storage unit 241, a VPN IP address storage unit 242, an application server IP address list storage unit 243, and an application use various information storage unit 244 as areas for storing these data. Note that the information stored in volatile storage unit 240 may be erasable from an external device such as relay device 300.

[0083] In this embodiment, in order to realize communication with the carrier's facilities via the first closed network 500, the mobile terminal 200 holds subscriber information (telephone number, user identification number, email address, etc.) with the carrier. In general, this information is stored in a SIM (Subscriber Identity Module) card, which is an external storage device.

[0084] The flow of each process will be explained below.

[0085] [Startup processing] The flow of processing when mobile terminal 200 is started will be described. The flow of processing at this time is shown in Fig. 7 and Fig. 8. Here, relay device 300 assigns a communication IP address to mobile terminal 200. The following flow follows a general service procedure provided by a carrier.

[0086] First, the information processing unit 220 of the mobile terminal 200 receives a start-up instruction (power ON) from the user (step S1101). In response to this, the information processing unit 220 requests the relay device 300 via the transmitting / receiving unit 210 to allocate a normal IP address 351 used for normal communication via the carrier facility.

[0087] Specifically, a PPP (Point to Point Protocol) session establishment request is transmitted from mobile terminal 200 to RADIUS server 310 of relay device 300 via carrier equipment (step S1102). This PPP session establishment request includes subscriber information included in the SIM card of mobile terminal 200 and the IMEI of mobile terminal 200.

[0088] When the RADIUS server 310 receives a PPP session establishment request from the mobile terminal 200 via the carrier facility, it performs authentication. Here, it determines whether the user is a legitimate user based on the subscriber information transmitted from the mobile terminal 200, and if it is determined that the user is a legitimate user, it determines that the authentication is successful. If the authentication is successful, it assigns a normal IP address 351 from the normal IP address table 350 in the storage device 340 (step S1103).

[0089] If the RADIUS server 310 determines that the user is an authorized user, it establishes a PPP session with the mobile terminal 200, and transmits the assigned normal IP address 351 to the requesting mobile terminal 200 (step S1104).

[0090] At this time, the RADIUS server 310 registers the IMEI 352 of the mobile terminal 200 to which the address is to be assigned in the normal IP address table 350 in association with the assigned normal IP address 351.

[0091] The mobile terminal 200 registers the transmitted normal IP address 351 in the normal IP address storage unit 241 of the volatile storage unit 240 (step S1105).

[0092] As a result, the mobile terminal 200 can communicate via a closed network (first closed network 500) provided by the carrier using this normal IP address 351. In the case of communication via a normal carrier's (relay) device, the mobile terminal 200 performs a task using the mobile terminal 200 by application communication or web access via the carrier's closed network (first closed network 500) using the normal IP address 351 after this connection process.

[0093] [Virtual network construction process] Next, the virtual network construction process of this embodiment will be described. Figures 9 and 10 are diagrams for explaining the flow of the virtual network construction process of this embodiment. This process is performed after the mobile terminal 200 has completed the above-mentioned startup process and has become accessible via the carrier's closed network.

[0094] First, the mobile terminal 200 makes a request to establish a VPN tunnel to the VPN server 320 of the relay device 300 (step S1201). At this time, as the source IP address, the normal IP address 351 received in the startup process and stored in the normal IP address storage unit 241 of the volatile storage unit 240 is used. Also, as the IP address of the VPN server 320 that is the request destination (access destination), the VPN server IP address 251 stored in the non-volatile storage unit 250 is used.

[0095] When receiving the VPN tunnel establishment request, the VPN server 320 assigns an unused VPN IP address 361 to the mobile terminal 200 that is the sender (requester) from the VPN IP address table 360 ​​in the storage device 340 (step S1202). Here, the unused VPN IP address 361 is extracted, and stored in association with the IMEI 362 as information for identifying the mobile terminal 200 to which the address is to be assigned.

[0096] Thereafter, the VPN server 320 establishes a virtual closed communication line (VPN tunnel) between the VPN server 320 and the mobile terminal 200 (the transmission / reception unit 210) on the carrier's closed network service, and transmits the assigned VPN IP address 361 to the mobile terminal 200 (step S1203). The virtual network is established, for example, by the method described above.

[0097] The mobile terminal 200 stores the received VPN-use IP address 361 in the VPN-use IP address storage unit 242 of the volatile storage unit 240 (step S1204). This allows the mobile terminal 200 to use the newly assigned VPN-use IP address 361 in the established VPN tunnel. Furthermore, since the VPN-use IP address 361 is held in the volatile storage unit 240, it is erased when the power is turned off.

[0098] [Branch server access information acquisition process] Next, a process flow for acquiring access information of the application servers 411 and 412 of the branch server 410 accessed by the mobile terminal 200 will be described. Figures 11 and 12 are diagrams for explaining the process flow.

[0099] First, the mobile terminal 200 makes an access information acquisition request to the distribution server 330 (step S1301). The requested access information includes the application server IP address list 372 and the various application usage information 382 of the application servers 411 and 412 to be accessed.

[0100] In this embodiment, at this time, the mobile terminal 200 uses the VPN IP address 361 stored in the VPN IP address storage unit 242 of the volatile storage unit 240 as its own IP address. Also, the distribution server IP address 252 stored in the non-volatile storage unit 250 is used as the IP address of the distribution server 330, which is the destination.

[0101] At this time, mobile terminal 200 accesses distribution server 330 via the already established VPN tunnel. Therefore, in reality, first, VPN server 320 is accessed, and VPN server 320 transfers the data to distribution server 330 within relay device 300 using destination distribution server IP address 252 as a clue.

[0102] Furthermore, at this time, from the viewpoint of access to the in-house information system 400, the legitimacy of the mobile terminal 200 itself or the user of the mobile terminal 200 may be authenticated using authentication information such as a password. In this case, the access information acquisition request includes the authentication information.

[0103] The password used is different from the password included in the subscriber information transmitted to the RADIUS server 310 during the startup process. Instead of a password, face authentication or the like may be used for authentication.

[0104] The distribution server 330 that has received the authentication information such as the password acquires, from the storage device 340, the application server IP address list 372 and various application usage information 382 of the branch server 410 in which the requesting mobile terminal 200 is registered, as access information (step S1302).

[0105] Distribution server 330 determines (authenticates) the validity of requesting mobile terminal 200 using a password or the like. If authenticated, it extracts source VPN IP address 361 (of requesting mobile terminal 200). Using this, for example, in the procedure described above, it identifies the IMEI of requesting mobile terminal 200, and extracts and acquires application server IP address list 372 and various application usage information 382.

[0106] Thereafter, the distribution server 330 returns the acquired application server IP address list 372 and various application utilization information 382 to the mobile terminal 200 that has made the request (step S1303).

[0107] Here, the distribution server 330 returns the above information through a VPN tunnel built on a closed network provided by a carrier. Therefore, the above information is first transmitted to the VPN server 320, and the VPN server 320 transmits the information to the mobile terminal 200 through the VPN tunnel.

[0108] The mobile terminal 200 receives the application server IP address list 372 and the various application utilization information 382 and stores them in the application server IP address list storage unit 243 and the various application utilization information storage unit 244 of the volatile storage unit 240, respectively (step S1304).

[0109] This allows the mobile terminal 200 to obtain the access information required to access the branch server 410. In addition, since the access information is transmitted and received within the established VPN tunnel, the possibility of leakage to the outside is greatly reduced. Furthermore, since the obtained access information is stored in the volatile storage unit 240, it is erased when the power is turned off.

[0110] [Access process to branch office server] Next, a procedure for accessing the branch server 410 from the mobile terminal 200 will be described.

[0111] The mobile terminal 200 extracts the addresses stored in the application server IP address list storage unit 243 of the volatile storage unit 240 and the information stored in the application utilization various information storage unit 244 (step S1401). For example, when a plurality of addresses are listed in the application server IP address list 372, the address of an application server for a desired business may be selected from the addresses.

[0112] Then, using the VPN IP address 361 as the source address and an address in the application server IP address list as the destination address, communication is performed with application servers 411 and 412 of the in-house information system 400 via the virtual private network and the VPN server 320 that controls the virtual private network (steps S1402, S1403, S1404).

[0113] For example, as shown in FIG. 1(b), a mobile terminal 200 (200B) accesses application servers 411, 412 in a branch server of an in-house information system 400 (400B) via a VPN tunnel established on a first closed network provided by a carrier.

[0114] As described above, according to this embodiment, after the mobile terminal 200 is connected to the VPN, an IP address used on the VPN (VPN IP address 361), an IP address list for the branch server 410 accessed by the mobile terminal 200, and personal information (extension telephone numbers, etc.) for using the application servers 411 and 412 are delivered to the mobile terminal 200 by a unique communication protocol. This information is delivered to the mobile terminal 200 securely.

[0115] Furthermore, according to this embodiment, when establishing a VPN tunnel, a method is adopted in which the International Mobile Equipment Identity Number (IMEI) managed by the telecommunications carrier is used instead of a mobile phone number or user ID, and connections from outside the carrier's closed network are not accepted.

[0116] Furthermore, according to this embodiment, similar to the first embodiment, the mobile terminal 200 accesses the application servers 411 and 412 in the in-house information system 400 via a virtual closed network space constructed on the first closed network 500 by the relay device 300 disposed between the first closed network 500 provided by the carrier and the in-house information system 400. Therefore, similar to the first embodiment, even if the first closed network 500 is intruded, the communication between the mobile terminal 200 and the in-house information system 400 cannot be decrypted.

[0117] Furthermore, the mobile terminal 200 uses a VPN IP address 361, which is different from the normal IP address 351 assigned by the first closed network 500, for communication with the in-house information system 400. Therefore, according to this embodiment, as in the first embodiment, even if there is an intruder on the relay network between the carrier facility and the in-house information system 400, the in-house information system 400 can easily deny access as long as the VPN IP address 361 is not known.

[0118] In addition, the normal IP address 351 required for communication in the first closed network 500, the VPN IP address 361 used for communication in the virtual closed network, and access information to the application servers 411 and 412 are stored in the volatile storage unit 240 of the mobile terminal 200. Therefore, all information is erased when the mobile terminal 200 is turned off, and the risk of information leakage when the mobile terminal 200 is stolen can be reduced.

[0119] As described above, according to the present embodiment, it is possible to provide a system that reduces the risk of hacking in communications and information leakage when a terminal is stolen. In particular, it is possible to promote the introduction of mobile terminals and the like as terminals for accessing existing business servers in companies and government offices.

[0120] Moreover, the above-mentioned functions can be realized by initially setting (kiting) only the settings related to access to the relay device 300 in the mobile terminal 200. That is, the information required to access each application server 411, 412 in the branch server 410 is set from the relay device 300 after the mobile terminal 200 is powered on. Therefore, no operation is required on the mobile terminal 200 side. Therefore, the introduction is easy. Also, the user can easily connect to the secure in-house information system 400 using the mobile terminal 200.

[0121] Furthermore, access settings to the branch server 410 are managed centrally by the relay device 300. Therefore, transfer of the mobile terminal 200 between branches can be easily handled.

[0122] By applying this embodiment to companies and government agencies that are promoting remote work, and to information systems that require a high level of security, it is possible to reduce the risk of hacking that cannot be prevented by conventional VPN connections or HTTPS connections. For example, by applying this embodiment to an integrated cloud (government cloud) for government agencies and registering information on the access destination (corresponding to the branch server 410) in the relay device 300, employees can securely access the information system no matter where they are or what device they use.

[0123] [Hardware configuration] The relay devices 300, 300A, and 300B (hereinafter, represented by the relay device 300; the same applies to the other devices) are realized, for example, by a general-purpose information processing device.

[0124] A general-purpose information processing device includes, for example, a CPU (Central Processing Unit) 691, a main memory device (memory) 692, an auxiliary memory device 693, a communication I / F 694, and an expansion I / F 695, which are interconnected by an internal bus, as shown in FIG. 14.

[0125] The CPU 691, for example, loads a program stored in the auxiliary storage device 693 into the main storage device 692 and executes it to realize the above-mentioned functions and to comprehensively control the entire relay device 300. Note that the CPU 691 may be replaced by one or more processors such as an MPU (Micro Processing Unit).

[0126] The main storage device 692 is a memory such as a RAM (Random Access Memory), etc. The main storage device 692 is a work area when the CPU 691 processes the programs executed by the relay device 300, etc.

[0127] The auxiliary storage device 693 is, for example, a read only memory (ROM), a hard disk drive (HDD), or a solid state drive (SSD). The auxiliary storage device 693 stores various programs executed by the relay device 300. The auxiliary storage device 693 may include a storage medium such as a flexible disk, a hard disk, an optical disk, a CD-ROM, a CD-R, a magnetic tape, a non-volatile memory card, or a DVD.

[0128] The programs stored in the auxiliary storage device 693 can be provided as program products recorded on a non-transitory computer-readable storage medium. The auxiliary storage device 693 can be used to store various programs recorded on the non-transitory computer-readable storage medium for a medium to long term.

[0129] The communication I / F 694 is an interface for inputting and outputting signals and data by wire or wirelessly. The relay device 300 transmits and receives information (data) required for processing between the carrier facility (the mobile terminal 200) and a server in the in-house information system 400 via the communication I / F 694.

[0130] The expansion I / F 695 is an interface for connecting a display device, an input device, etc. The display device is, for example, a liquid crystal monitor, etc. The input device is, for example, a device that accepts user operations such as a keyboard or a mouse.

[0131] The above-mentioned functions (each server) of the relay device 300 are realized by the CPU 691 loading a program stored in the auxiliary storage device 693 into the main storage device 692 and executing the program.

[0132] Furthermore, the storage device 340 is constructed in, for example, an auxiliary storage device 693 .

[0133] The hardware configuration of the relay device 300 is not limited to this. Each server may be independently provided with the above hardware. Also, the server may include hardware not shown.

[0134] In addition, a program for implementing each of the above-mentioned functions of the relay device 300 of this embodiment can be recorded in a computer-readable storage medium. The storage medium can be a non-transient medium such as a semiconductor memory, a hard disk, a magnetic recording medium, or an optical recording medium. The present invention can also be embodied as a computer program product.

[0135] In addition, each function (server) of relay device 300 may be implemented, for example, by an integrated circuit (IC) dedicated to each process, an application specific integrated circuit (ASIC), a system on chip (SOC), a field programmable gate array (FPGA), or the like.

[0136] Moreover, the mobile terminal 200 and the application servers 411 and 412 of the branch server 410 in each of the above embodiments may be configured with a general-purpose information processing device, similar to the relay device 300. In this case, the hardware configuration is the same as that of the relay device 300 shown in Fig. 11. Furthermore, each function of these devices may be implemented, for example, by an integrated circuit (IC) dedicated to each process, an application specific integrated circuit (ASIC), a system on chip (SOC), a field programmable gate array (FPGA), or the like.

[0137] <Variation 1> In the above embodiments, the case where the mobile terminal 200 is used as the device used by the user when accessing the in-house information system 400 has been described as an example. However, the device used is not limited to the mobile terminal 200. For example, any information processing device (information processing terminal) having a communication function, an information processing function, a volatile storage device, and a non-volatile storage device, such as a tablet or a notebook PC (Personal Computer), may be used.

[0138] The information processing device does not necessarily have to be a portable information processing device, but may be a stationary information processing device, or may be a dedicated terminal having the above functions.

[0139] In this embodiment, regardless of the device, a personal PC (Personal Computer) used with BYOD (Bring Your Own Device) can easily and safely access a private network (e.g., an in-house information system 400) established in a company or the like.

[0140] <Variation 2> In addition, in the above embodiment, the mobile terminal 200 is described as having the above functions and the addresses of the VPN server 320 and the distribution server 330 are set in advance during initial configuration (kitting) of the mobile terminal 200, but this is not limited to the above.

[0141] The above-mentioned functions of mobile terminal 200 may be realized, for example, by acquiring them as application programs (apps), storing them in non-volatile storage unit 250, and expanding them in volatile storage unit 240 and executing them by CPU 691. The above-mentioned information (addresses of VPN server 320 and distribution server 330) to be stored in non-volatile storage unit 250 may be acquired together with the application programs. Mobile terminal 200 may acquire the necessary functions and information by installing the application programs as necessary.

[0142] For example, the relay device 300 may hold an application program for implementing the above functions, and after the mobile terminal 200 is powered on, authenticated by the RADIUS server 310, and connected to the first closed network 500, the application program may be sent to the mobile terminal 200 at the same time as the VPN IP address 361 is sent. The mobile terminal 200 then installs the application program and performs the subsequent processes.

[0143] <Variation 3> After the relay device 300 assigns the VPN IP address 361 to the mobile terminal 200, the relay device 300 may notify the in-house information system 400 of the IP address. This allows the in-house information system 400 to know the VPN IP address 361 used for communication from the mobile terminal 200, and efficiently reject packets from other source addresses. This further improves security.

[0144] <Modification 4> In addition, in the above-mentioned embodiments and modifications, the first closed network 500 is described as being provided by a carrier (communications carrier), but is not limited to this. When using a closed network provided by a party other than a carrier, access to the closed network may be started by a means other than turning on the power. Even when using a closed network provided by a carrier, access may be started by a means other than turning on the power.

[0145] In the process flow used in the above description, multiple steps (processes) are described in order, but the order of execution of each step is not limited to the order described. For example, the order of the steps shown in the figure can be changed to a range that does not affect the content, such as executing each process in parallel.

[0146] Although the embodiments and modifications of the present invention have been described above, the present invention is not limited to the above-mentioned embodiments, and various modifications that can be understood by those skilled in the art can be made. Each embodiment and modification can be appropriately combined with other embodiments. For example, the network configuration and the configuration of each element shown in each drawing are examples to help understand the present invention, and the present invention is not limited to the configurations shown in these drawings.

[0147] Finally, preferred embodiments of the present invention will be summarized as follows: A part or all of the above-described embodiments can be described as follows, but are not limited to the following. (Appendix 1) a virtual private network control unit for establishing a virtual private network between an information processing terminal connected to the first closed network and for communicating with the information processing terminal via the virtual private network; The virtual private network control unit includes: assigning to said information processing terminal a virtual network communication address to be used by said information processing terminal as a source address within said virtual private network; A relay device which realizes communication between the information processing terminal and a private network via the virtual closed network using the virtual network communication address. (Appendix 2) 2. The relay device according to claim 1, A distribution management unit that manages an application address that is an access address to an application server included in the private network, It is preferable that the distribution management unit provides the application address to the virtual network communication address that is the source of the request to obtain the application address, via the virtual closed network. (Appendix 3) 3. The relay device according to claim 2, The distribution management unit further managing the virtual network communication address and identification information of the information processing terminal to which the virtual network communication address is assigned in association with each other; managing the identification information of the information processing terminal that is permitted to access each of the application servers; It is preferable to provide the application address of the application server that is permitted to be accessed by the information processing terminal identified by the identification information managed in correspondence with the virtual network communication address of the sender of the acquisition request via the virtual closed network. (Appendix 4) 4. The relay device according to claim 3, The identification information is preferably a unique number that is preset in the main body of the information processing terminal. (Appendix 5) An information processing unit; A volatile storage unit; A non-volatile storage unit, The information processing unit includes: Connecting to a relay device via a first closed network; the non-volatile storage unit stores information necessary for connecting to the relay device via the first closed network, The information processing unit stores the virtual network communication address received from the relay device in the volatile storage unit, The virtual network communication address is an address used as a source address in communication via the virtual closed network established by the relay device. (Appendix 6) In the information processing terminal according to claim 5, The information processing unit includes: storing the application address received from the relay device in the volatile storage unit; The application address is preferably an access address to an application server included in a private network accessed by the information processing terminal. (Appendix 7) A relay device; An information processing terminal; A private network; the relay device includes a virtual closed network control unit that establishes a virtual closed network between the relay device and the information processing terminal connected to the first closed network and communicates with the information processing terminal via the virtual closed network; The virtual private network control unit includes: assigning to said information processing terminal a virtual network communication address to be used by said information processing terminal as a source address within said virtual private network; A communication between the information processing terminal and the private network is realized via the virtual closed network by using the virtual network communication address; The information processing terminal includes: An information processing unit; A volatile storage unit; A non-volatile storage unit, the non-volatile storage unit stores information necessary for connecting to the relay device via the first closed network, The information processing unit stores the virtual network communication address received from the relay device in the volatile storage unit. (Appendix 8) A method for relaying communication between an information processing terminal connected to a first closed network and a private network by a computer, comprising the steps of: a virtual network construction step of constructing a virtual closed network between the information processing terminal and the virtual network construction step; an address assignment step of assigning to the information processing terminal a virtual network communication address to be used by the information processing terminal as a source address within the virtual private network; a relay step of performing communication between said information processing terminal and said private network via said virtual closed network using said virtual network communication address. (Appendix 9) Computer, A program that functions as a virtual closed network control means for constructing a virtual closed network between an information processing terminal connected to a first closed network and communicating with the information processing terminal via the virtual closed network, The virtual private network control means assigning to said information processing terminal a virtual network communication address to be used by said information processing terminal as a source address within said virtual private network; A program for realizing communication between the information processing terminal and a private network via the virtual closed network using the virtual network communication address. (Appendix 10) A computer having information necessary for connecting to a relay device via a first closed network stored in a non-volatile storage unit, a means for connecting to the relay device via the first closed network; A program that functions as a means for storing in a volatile memory a virtual network communication address received from the relay device and used as a source address in communication via the virtual closed network established by the relay device. The form of Appendix 7 can be developed into the form of Appendix 2-4 and / or Appendix 6, similar to Appendix 1 and / or Appendix 5. The forms of Appendix 8 and Appendix 9 can be developed into the form of Appendix 2-4, similar to Appendix 1. The form of Appendix 10 can be developed into the form of Appendix 6, similar to Appendix 5.

[0148] The disclosures of the above patent documents and the like are incorporated herein by reference. Within the framework of the entire disclosure of the present invention (including the scope of claims), and further based on the basic technical idea, modifications and adjustments of the embodiments and modifications are possible. Furthermore, within the framework of the disclosure of the present invention, various combinations and selections of various disclosed elements (including each element of each claim, each element of each embodiment or modification, each element of each drawing, etc.) are possible. In other words, the present invention naturally includes various modifications and corrections that a person skilled in the art would be able to make according to the entire disclosure including the scope of claims and the technical idea. In particular, with regard to the numerical ranges described in this specification, any numerical value or subrange included in the range should be interpreted as being specifically described even if not otherwise specified. [Explanation of symbols]

[0149] 100: Secure information system, 100A: Secure information system, 200: mobile terminal, 200A: mobile terminal, 200B: mobile terminal, 210: transmission / reception unit, 220: information processing unit, 220A: information processing unit, 230: user I / F, 240: volatile storage unit, 240A: volatile storage unit, 241: normal IP address storage unit, 242: VPN IP address storage unit, 243: application server IP address list storage unit, 244: application usage various information storage unit, 250: non-volatile storage unit, 250A: non-volatile storage unit, 251: VPN server IP address, 252: distribution server IP address, 300: relay device, 300A: relay device, 300B: relay device, 310: RADIUS server, 320: VPN server, 320A: virtual private network control unit, 330: distribution server, 340: storage device, 340A: storage device, 350: normal IP address table, 351: normal IP address, 352: IMEI, 360: VPN IP address table, 360A: VPN IP address table, 361: VPN IP address, 362: IMEI, 370: application server IP list, 372: application server IP address list, 380: application usage information table, 382: various application usage information, 390: branch office server management information, 391: branch office server ID, 392: affiliated device IMEI, 400: In-house information system, 400A: In-house information system, 400B: In-house information system, 410: Branch office server, 410A: Branch office server, 411: Application server, 412: Application server, 500: First closed network, 500A: First closed network, 691: CPU, 692: main memory device, 693: auxiliary memory device, 694: communication I / F, 695: expansion I / F

Claims

1. a virtual private network control unit for establishing a virtual private network between an information processing terminal connected to the first closed network and for communicating with the information processing terminal via the virtual private network; The virtual private network control unit includes: assigning to said information processing terminal a virtual network communication address to be used by said information processing terminal as a source address within said virtual private network; A relay device which realizes communication between the information processing terminal and a private network via the virtual closed network by using the virtual network communication address.

2. 2. The relay device according to claim 1, A distribution management unit that manages an application address that is an access address to an application server included in the private network, The delivery management unit provides the application address to the virtual network communication address that is a source of a request to obtain the application address, via the virtual closed network.

3. 3. The relay device according to claim 2, The distribution management unit further managing the virtual network communication address and identification information of the information processing terminal to which the virtual network communication address is assigned in association with each other; managing the identification information of the information processing terminal that is permitted to access each of the application servers; a relay device that provides, via the virtual private network, the application address of the application server that is permitted to be accessed by the information processing terminal identified by the identification information that is managed in correspondence with the virtual network communication address of the sender of the acquisition request.

4. 4. The relay device according to claim 3, The identification information is a unique number that is preset in the main body of the information processing terminal.

5. An information processing unit; A volatile storage unit; A non-volatile storage unit, The information processing unit includes: Connecting to a relay device via a first closed network; the non-volatile storage unit stores information necessary for connecting to the relay device via the first closed network, The information processing unit stores the virtual network communication address received from the relay device in the volatile storage unit, The virtual network communication address is an address used as a source address in communication via the virtual closed network established by the relay device.

6. 6. An information processing terminal according to claim 5, The information processing unit includes: storing the application address received from the relay device in the volatile storage unit; The application address is an access address to an application server included in a private network accessed by the information processing terminal.

7. A relay device; An information processing terminal; A private network; the relay device includes a virtual closed network control unit that establishes a virtual closed network between the relay device and the information processing terminal connected to the first closed network and communicates with the information processing terminal via the virtual closed network; The virtual private network control unit includes: assigning to said information processing terminal a virtual network communication address to be used by said information processing terminal as a source address within said virtual private network; A communication between the information processing terminal and the private network is realized via the virtual closed network by using the virtual network communication address; The information processing terminal includes: An information processing unit; A volatile storage unit; A non-volatile storage unit, the non-volatile storage unit stores information necessary for connecting to the relay device via the first closed network, The information processing unit stores the virtual network communication address received from the relay device in the volatile storage unit.

8. A method for relaying communication between an information processing terminal connected to a first closed network and a private network by a computer, comprising the steps of: a virtual network construction step of constructing a virtual closed network between the information processing terminal and the virtual network construction step; an address assignment step of assigning to the information processing terminal a virtual network communication address to be used by the information processing terminal as a source address within the virtual private network; a relay step of performing communication between said information processing terminal and said private network via said virtual closed network using said virtual network communication address.

9. Computer, A program that functions as a virtual closed network control means for constructing a virtual closed network between an information processing terminal connected to a first closed network and communicating with the information processing terminal via the virtual closed network, The virtual private network control means assigning to said information processing terminal a virtual network communication address to be used by said information processing terminal as a source address within said virtual private network; A program for realizing communication between the information processing terminal and a private network via the virtual closed network using the virtual network communication address.

10. A computer having information necessary for connecting to a relay device via a first closed network stored in a non-volatile storage unit, a means for connecting to the relay device via the first closed network; A program that functions as a means for storing in a volatile memory a virtual network communication address received from the relay device and used as a source address in communication via the virtual closed network established by the relay device.

Images