COMMUNICATION SYSTEM, COMMUNICATION METHOD, AND PROGRAM

Abstract

To allow a web browser of an access source terminal connectable to the Internet to easily use a web service provided by a web server connected with a local network.SOLUTION: A communication system is a communication system that remotely accesses, from an information terminal connected with a first network, a web server connected with a second network different from the first network, and the communication system has: a communication management unit that receives, via the first network, a request for connecting to a web service provided by the web server from the information terminal; a first communication control unit that, in response to the request from the communication management unit, connects, from the second network, to a relay server connected with the first network; and a second communication control unit that connects to the relay server from the information terminal. The communication system transmits and receives requests and responses between a web browser included in the information terminal and the web service provided by the web server through the relay sever and the first communication control unit.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to a communication system, a communication method, and a program. [Background technology]

[0002] In recent years, due to work style reforms and the spread of telecommuting, there is an increasing need for communication systems that allow remote access from a source terminal that can connect to the Internet to a destination information processing device that is connected to a local network, for example, within a company.

[0003] There is also known a technology (hereinafter referred to as Proxy-PAC technology) that uses a Proxy Auto-Configuration (PAC) file to switch the destination to a proxy server depending on the access destination or the time of access, etc. (see, for example, Patent Document 1). Summary of the Invention [Problem to be solved by the invention]

[0004] There is a demand for using a web service provided by a web server connected to a local network from a web browser of an access source terminal connectable to the Internet, without making significant changes to the processing of the web server.

[0005] However, with conventional technology, it was difficult to use web services provided by web servers connected to a local network from a web browser on a terminal that can connect to the Internet, and this problem cannot be solved by applying Proxy-PAC technology alone.

[0006] One embodiment of the present invention has been made in consideration of the above problems, and makes it possible to easily use web services provided by a web server connected to a local network from a web browser on an access source terminal that can connect to the Internet. [Means for solving the problem]

[0007] In order to solve the above problems, a communication system according to one embodiment is a communication system for remotely accessing a web server connected to a second network different from the first network from an information terminal connected to a first network, the communication system including: a communication management unit that receives a connection request from the information terminal via the first network to a web service provided by the web server; In response to the connection request received by the communication management unit a first communication control unit that connects from the second network to a relay server that is connected to the first network in response to a request from the communication management unit; The information terminal has a second communication control unit that connects to the relay server, and transmits and receives requests and responses between a web browser provided in the information terminal and the web service provided by the web server via the relay server and the first communication control unit. Effect of the Invention

[0008] According to one embodiment of the present invention, it becomes possible to easily use web services provided by a web server connected to a local network from a web browser on an access source terminal that can connect to the Internet. [Brief description of the drawings]

[0009] [Figure 1] FIG. 1 is a diagram illustrating an example of a system configuration of a communication system according to an embodiment. [Diagram 2] FIG. 2 is a diagram illustrating an example of a hardware configuration of a computer according to an embodiment. [Diagram 3] 2 is a diagram illustrating an example of a functional configuration of a management server and a relay server according to the first embodiment; FIG. [Figure 4] FIG. 1 is a diagram illustrating an example of a functional configuration of a communication device according to a first embodiment. [Diagram 5] FIG. 2 is a diagram illustrating an example of a functional configuration of the information device according to the first embodiment. [Figure 6] FIG. 2 is a diagram illustrating an example of a functional configuration of an information terminal according to the first embodiment. [Figure 7] FIG. 4 is a sequence diagram illustrating an example of a login process according to the first embodiment. [Figure 8] FIG. 1 is a sequence diagram (1) showing an example of processing of the communication system according to the first embodiment. [Figure 9] FIG. 2 is a sequence diagram (2) illustrating an example of processing in the communication system according to the first embodiment. [Figure 10] FIG. 4 is a diagram showing an example of a login screen according to the first embodiment. [Figure 11] FIG. 4 is a diagram showing an example of a service list screen according to the first embodiment. [Figure 12] FIG. 4 is a diagram showing an example of an operation page screen according to the first embodiment. [Figure 13] FIG. 4 is a diagram showing an example of a page configuration of an operation page according to the first embodiment. [Figure 14] FIG. 4 is a diagram showing a data flow after a tunnel is established according to the first embodiment. [Figure 15] 13 is a diagram illustrating an example of a functional configuration of a management server and a relay server according to a second embodiment. FIG. [Figure 16] FIG. 11 is a diagram illustrating an example of a functional configuration of a secure box according to a second embodiment. [Figure 17] FIG. 11 is a diagram illustrating an example of a functional configuration of an information terminal according to a second embodiment. [Figure 18] FIG. 11 is a diagram for explaining settings of a web browser according to the second embodiment. [Figure 19] FIG. 11 is a diagram illustrating an example of a Proxy-PAC according to the second embodiment. [Figure 20] FIG. 11 is a sequence diagram (1) illustrating an example of processing in a communication system according to a second embodiment. [Figure 21] FIG. 11 is a sequence diagram (2) illustrating an example of processing in the communication system according to the second embodiment. [Figure 22] FIG. 11 is a diagram showing an example of a business portal screen according to the second embodiment. [Figure 23] FIG. 11 is a diagram showing a data flow after a tunnel is established according to the second embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0010] Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings. <System configuration> 1 is a diagram showing an example of a system configuration of a communication system according to an embodiment. The communication system 1 includes, for example, an application server 11 connected to a communication network 2 such as the Internet, a service platform 12, a relay server 13, and a secure box 14 connected to a local network 100. The communication system 1 is a system for using a web service provided by a web server such as a server device 101 connected to the local network 100 from a web browser provided in an information terminal 111 connected to a network external to the local network 100.

[0011] Generally, a web browser has a mechanism for preventing unauthorized access from programs outside the scope by using security mechanisms such as a sandbox or a same-origin policy.

[0012] For example, when content is displayed in a frame such as an iframe (inline frame) on a web page, the content in the frame cannot be controlled from a script outside the frame. As another example, the Proxy-PAC technology, which uses a proxy automatic configuration file to switch the destination to a proxy server depending on the access destination, etc., has the limitation that the cookie value included in the page cannot be included in the request to the proxy server.

[0013] The communication system 1 of this embodiment has a system configuration as shown in FIG. 1 so that web services within the local network 100 can be used from a web browser provided on the information terminal 111, while taking into consideration the security restrictions (mechanisms) described above.

[0014] The remote network 110 is an example of a first network that is an external network of the local network 100, which is provided, for example, at home or a remote office and can be connected to a communication network 2 such as the Internet. The information terminal 111 is not limited to the remote network 110, and may be connected to the communication network 2 such as the Internet from a remote location, for example, by using a wide area network (WAN) or a public wireless local area network (LAN). The communication network 2 is another example of a first network that is an external network of the local network 100. Here, the following description will be given assuming, as an example, that the information terminal 111 is connected to the remote network 110 provided in a remote office, and that the communication network 2 is the Internet.

[0015] The information terminal (access source terminal) 111 is a computer equipped with a web browser function, such as a PC (Personal Computer), a tablet terminal, or a smartphone, used by a user. The information terminal 111 can access the application server 11 and the relay server 13, etc., via the remote network 110 and the communication network 2. The information terminal 111 is an example of an information terminal connected to the first network. As described above, the information terminal 111 may be connected to the Internet (communication network 2).

[0016] The local network (second network) 100 is, for example, a network such as an in-house LAN (Local Area Network) in which access from external networks such as the communication network 2 and the remote network 110 is restricted by a firewall or the like. The local network 100 is an example of a second network different from the first network.

[0017] 1, the service platform 12 and the secure box 14 are set in advance to be able to communicate with each other, for example, by the MQTT (Message Queue Telemetry Transport) protocol, etc. For example, at the time of startup, the secure box 14 requests the service platform 12 to connect using the MQTT protocol, etc., to establish communication, and maintains a state in which communication is possible.

[0018] It is also assumed that access from the information terminal 111, the relay server 13, etc. to the secure box 14 and the server device 101, etc. in the local network 100 is prohibited.

[0019] The server device 101 is a computer connected to the local network 100, or a system including a plurality of computers, and has a function of a web server that provides web services such as a business system and a time attendance management system.

[0020] The application server 11 is, for example, a computer connected to the communication network 2, or a system including a plurality of computers. The application server 11 provides, for example, a web page or the like for accessing (connecting to) a web service provided by the server device 101 in the local network 100 to the information terminal 111 using the communication system 1. The application server 11 may also have a function of providing, for example, a web page for setting up the communication system 1 to an information terminal (management terminal) used by an administrator or the like who manages the communication system 1.

[0021] The service platform 12 is, for example, a computer connected to the communication network 2, or a system including multiple computers. The service platform 12 executes, for example, an authentication process for authenticating a user who uses the information terminal 111, and a process for communicating with the secure box 14, etc.

[0022] The application server 11 and the service platform 12 may be included in one management server 10, or may be distributed across more servers. Since the application server 11 and the service platform 12 can have various system configurations, in the following description, the application server 11 and the service platform 12 may be simply referred to as the management server 10 without any particular distinction.

[0023] The relay server 13 is, for example, a computer connected to the communication network 2, or a system including multiple computers. The relay server 13 relays communication between the information terminal 111 and the secure box 14. Note that the relay server 13 (or the function of the relay server 13) may be included in the management server 10.

[0024] The secure box (communication device) 14 is, for example, a communication device having a computer configuration and a communication function. The secure box 14 connects to the relay server 13 under control of the management server 10, and realizes remote access from the information terminal 111 to the server device 101 connected to the local network 100. The secure box 14 may have, for example, a function of a router or a firewall, or may be provided separately from the router or the firewall. The function of the secure box 14 may also be included in an information processing device such as the server device 101.

[0025] (Connection process overview) In the above system configuration, when a user of information terminal 111 uses a web service provided by server device 101, the user accesses a specific web page provided by application server 11 using a web browser or the like. The user can request a connection to the web service provided by server device 101 by selecting the web service provided by server device 101 from this web page.

[0026] When the application server 11 accepts a connection request from the information terminal 111, it generates a session ID, which is identification information for identifying a session. Furthermore, the application server 11 uses the service platform 12 to notify the secure box 14 of the generated session ID and to request a connection to the relay server 13. The application server 11 also notifies the requesting information terminal 111 of the issued session ID.

[0027] In response to a request from the management server 10, the secure box 14 uses the notified session ID to connect to the relay server 13 through the encrypted first communication 3. For example, the secure box 14 connects to the relay server 13 through the first communication 3 using Web Socket over HTTPS (Hypertext Transfer Protocol Secure) (hereinafter referred to as wws).

[0028] Furthermore, the information terminal 111 connects to the relay server 13 through the encrypted second communication 4 using the session ID notified from the management server 10. For example, the information terminal 111 connects to the relay server 13 through the second communication 4 using wws.

[0029] The relay server 13 relays between the first communication 3 and the second communication 4, which are connected to the relay server 13 using the same session ID (connection information). For example, the relay server 13 tunnels the first communication 3 and the second communication 4, thereby connecting the information terminal 111 and the secure box 14 so that they can communicate with each other.

[0030] Through the above process, the information terminal 111 can connect to the secure box 14 by WSS. The secure box 14 also has a proxy server function, and the information terminal 111 can access the web service provided by the server device 101 by using the proxy server function provided by the secure box 14.

[0031] By the above process, the information terminal 111 can use the proxy server function provided by the secure box 14 via the relay server 13, for example, in the same way as an information terminal connected to the local network 100. Therefore, according to the communication system 1 according to this embodiment, it becomes possible to easily use web services provided by a web server (server device 101) connected to the local network 100 from a web browser of an access source terminal (information terminal 111) that can connect to the Internet.

[0032] <Hardware configuration> The information terminal 111 and the secure box 14 have, for example, the hardware configuration of a computer 200 as shown in Fig. 2. Furthermore, the management server 10, the application server 11, the service platform 12, the relay server 13, the server device 101, etc. are each configured by one or more computers 200.

[0033] Fig. 2 is a diagram showing an example of a hardware configuration of a computer according to an embodiment. For example, as shown in Fig. 2, the computer 200 includes a CPU (Central Processing Unit) 201, a ROM (Read Only Memory) 202, a RAM (Random Access Memory) 203, a HD (Hard Disk) 204, a HDD (Hard Disk Drive) controller 205, a display 206, an external device connection I / F (Interface) 207, one or more network I / Fs 208, a keyboard 209, a pointing device 210, a DVD-RW (Digital Versatile Disk Rewritable) drive 212, a media I / F 214, and a bus line 215.

[0034] Of these, the CPU 201 controls the overall operation of the computer 200. The ROM 202 stores programs used to start up the computer 200, such as an IPL (Initial Program Loader). The RAM 203 is used, for example, as a work area for the CPU 201. The HD 204 stores programs such as an OS (Operating System), applications, device drivers, and various data. The HDD controller 205 controls the reading and writing of various data from and to the HD 204 under the control of the CPU 201, for example.

[0035] The display 206 displays various types of information, such as a cursor, a menu, a window, characters, or an image. The display 206 may be provided outside the computer 200. The external device connection I / F 207 is an interface for connecting various external devices to the computer 200. The one or more network I / Fs 208 are interfaces for performing data communication using, for example, the communication network 2, the local network 100, or the remote network 110.

[0036] The keyboard 209 is a type of input means having a plurality of keys for inputting characters, numbers, various instructions, etc. The pointing device 210 is a type of input means for selecting and executing various instructions, selecting a processing target, moving a cursor, etc. The keyboard 209 and the pointing device 210 may be provided outside the computer 200.

[0037] The DVD-RW drive 212 controls reading and writing of various data from and to a DVD-RW 211, which is an example of a removable recording medium. The DVD-RW 211 is not limited to a DVD-RW, and may be another removable recording medium. The media I / F 214 controls reading and writing (storing) of data from and to a medium 213 such as a flash memory. The bus line 215 includes an address bus, a data bus, various control signals, and the like for electrically connecting the above components.

[0038] 2 is an example of the configuration of the computer 200. As long as the computer 200 has, for example, a CPU 201, a ROM 202, a RAM 203, one or more network I / Fs 208, and a bus line 215, the rest of the configuration may be arbitrary.

[0039] <Functional configuration> Next, the functional configuration of each device related to the communication system 1 will be described.

[0040] [First embodiment] (Management Server Functionality Configuration) 3A shows an example of the functional configuration of the management server according to the first embodiment. The management server 10 realizes, for example, a communication unit 301, an authentication unit 302, a communication management unit 303, and a storage unit 306 by executing a predetermined program on one or more computers 200. At least a part of the above functional configurations may be realized by hardware.

[0041] The communication unit 301 uses, for example, the network I / F 208 to connect the management server 10 to the communication network 2 and executes communication processing for communicating with other devices.

[0042] The authentication unit 302 is realized, for example, by a program executed by the computer 200 included in the service platform 12 (hereinafter referred to as service PF12), and executes authentication processing to authenticate that the user using the information terminal 111 is a legitimate user.

[0043] The communication management unit 303 is realized, for example, by a program executed by the computer 200 included in the application server 11. The communication management unit 303 executes a communication management process for accepting a connection request to a web service provided by the server device 101 connected to the local network 100 from the information terminal 111 via the communication network (first network) 2. The communication management unit 303 includes, for example, a reception unit 305 and a session management unit 304 as shown in FIG. 3(A).

[0044] The reception unit 305 provides the information terminal 111 with a web page or the like for accessing (connecting to) a web service provided by the server device 101 in the local network 100, for example, by using the communication system 1. The reception unit 305 also provides the information terminal 111 with a web API (Application User Interface) for using various functions provided by the management server 10.

[0045] For example, when the reception unit 305 receives a connection request from the information terminal 111, the communication management unit 303 generates a session ID for identifying a session of communication between the information terminal 111 and the secure box 14 via the relay server 13. In addition, the communication management unit 303 notifies the secure box 14 and the information terminal 111 of the generated session ID, thereby requesting (instructing) the secure box 14 and the information terminal 111 to connect to the relay server 13.

[0046] Preferably, the communication management unit 303 authenticates the user using the authentication unit 302, and if the user using the information terminal 111 that sent the connection request is a legitimate user, requests the secure box 14 and the information terminal 111 to connect to the relay server 13.

[0047] The storage unit 306 is realized by a program executed by one or more computers 200 and a storage device such as the HD 204. The storage unit 306 stores various information such as user information including authentication information of users registered in the communication system 1 and setting information of the communication system 1.

[0048] (Functional configuration of relay server) 3B shows an example of the functional configuration of the relay server 13 according to the first embodiment. The relay server 13 realizes a communication unit 311, a connection management unit 312, a relay unit 313, and the like, by, for example, executing a predetermined program on one or more computers 200. Note that at least a part of the above functional configurations may be realized by hardware.

[0049] The communication unit 311, for example, uses the network I / F 208 to connect the relay server 13 to the communication network 2 and executes communication processing for communicating with other devices.

[0050] The connection management unit 312 executes a connection management process for managing the information terminal 111 requesting a connection to the relay server 13 and the connection of the secure box 14 to the relay server 13. Preferably, the connection management unit 312 performs user authentication using the authentication unit 302, and permits the information terminal 111 to connect to the relay server 13 if the user using the information terminal 111 that has sent the connection request is a valid user.

[0051] The relay unit 308 relays communication between the information terminal 111 connected to the relay server 13 and the secure box 14. For example, the relay unit 308 relays between the first communication 3 established with the secure box 14 and the second communication 4 established with the information terminal 111 by establishing a tunnel between the first communication 3 and the second communication 4 using the same session ID.

[0052] (Functional configuration of Secure Box) Fig. 4 is a diagram (1) showing an example of the functional configuration of a communication device according to the first embodiment. The functions of the secure box 14 are not limited to the secure box 14, and may be possessed by an information processing device such as the server device 101, for example. In this embodiment, the secure box 14 and the information processing device having the functions of the secure box 14 are called communication devices. In Fig. 4, an example of the functional configuration when the communication device is the secure box 14 will be described.

[0053] In the example of Fig. 4, the local network 100 is connected to the communication network 2 via a router 421 and a firewall 422. However, this is just an example, and the functions of the router 421 and the firewall 422 may be provided in the secure box 14. Also, in the example of Fig. 4, a server device 101 is connected to the local network 100. The server device 101 has a web server unit 411 that functions as a web server that provides predetermined web services such as a business system, a time attendance management system, etc.

[0054] The secure box (communication device) 14 realizes a communication unit 401, a first communication control unit 402, a proxy server unit 403, a storage unit 404, etc., by executing a predetermined program on the computer 200 included in the secure box 14. Note that at least a part of the above functional configurations may be realized by hardware.

[0055] The communication unit 401 uses, for example, the network I / F 208 to connect the secure box 14 to the local network 100 or the like, and executes communication processing for communicating with other devices.

[0056] The first communication control unit 402 is communicatively connected to the management server 10, and in response to a request from the communication management unit 303 of the management server 10, connects to the relay server 13 from the local network (second network) 100 using encrypted first communication 3. For example, the first communication control unit 402 uses the session ID notified from the management server 10 to request a WebSocket connection to the relay server 13.

[0057] The proxy server unit 403 functions as a proxy server within the local network 100 that is available from the information terminal 111, utilizing a communication path (wws tunnel) established between the first communication control unit 402 and the information terminal 111 via the relay server 13.

[0058] The storage unit 406 is realized by, for example, a program executed by the computer 200 included in the secure box and a storage device such as the HD 204, and stores various information such as setting information for the secure box .

[0059] Fig. 5 is a diagram (2) showing an example of the functional configuration of the communication device according to the first embodiment. In Fig. 5, an example of the functional configuration in the case where the communication device is a server device 101 will be described.

[0060] The server device (communication device) 101 realizes a communication unit 401, a first communication control unit 402, a proxy server unit 403, a storage unit 404, a web server unit, and the like, by executing a predetermined program on one or more computers 200. Note that at least a part of the above-mentioned functional configurations may be realized by hardware.

[0061] Note that the communication unit 401, the first communication control unit 402, the proxy server unit 403, and the memory unit 404 are similar to the communication unit 401, the first communication control unit 402, the proxy server unit 403, and the memory unit 404 described in FIG. 4, and therefore their description will be omitted here.

[0062] The web server unit 411 functions as a web server that provides predetermined web services such as a business system, a time attendance management system, etc. In this way, the functions of the secure box 14 can be realized by various computers 200 connected to the local network 100.

[0063] (Functional configuration of information terminal) 6 is a diagram showing an example of the functional configuration of the information terminal according to the first embodiment. For example, the information terminal 111 realizes a communication unit 501, an element acquisition unit 602, a request analysis unit 603, a second communication control unit 604, a data conversion unit 605, a data accumulation unit 606, a drawing unit 607, an operation reception unit 608, and the like by executing a predetermined program in the CPU 201.

[0064] Of these, the element acquisition unit 602 and the drawing unit 607 are realized by a renderer 611 or the like of the web browser executed by the CPU 201. The renderer 611 is a program that interprets HTML (Hyper Text Markup Language) or the like of a web page and generates a DOM (Document Object Model) that represents the layout of characters, images, etc. to be displayed on the screen. The renderer 611 is also called, for example, an HTML rendering engine or the like.

[0065] Furthermore, the request analysis unit 603, the second communication control unit 604, the data conversion unit 605, and the data storage unit 606 are realized by a Worker 612 of the web browser executed by the CPU 201. The Worker 612 is a mechanism that transfers the processing of a script in a web application to a thread other than the main thread, enabling execution in the background, and is also called a Web Worker or a Service Worker. By using the Worker 612, the request contents can be analyzed and processed before the request is sent from the web browser to the web server.

[0066] A communication unit 601 uses, for example, the network I / F 208 to connect the information terminal 111 to the remote network 110 and the communication network 2, etc., and executes communication processing for communicating with other devices.

[0067] The element acquisition unit 602 acquires elements such as an HTML request from the HTML of a web page. The element acquisition unit 602 also requests the worker 612 to acquire data necessary for generating a DOM, such as a CSS (Cascading Style Sheets) or JavaScript (registered trademark) file. The request analysis unit 603 analyzes the request received from the element acquisition unit 602.

[0068] The second communication control unit 604 requests a connection to the relay server 13 using the session ID notified by the management server 10, and connects to the relay server 13 by the encrypted second communication 4. The second communication control unit 604 also transmits the request analyzed by the request analysis unit 603 to the secure box 14 via the relay server 13, and outputs the data received as a response to the transmitted request to the data conversion unit 605.

[0069] The data conversion unit 605 converts the data received from the second communication control unit 604 into a format usable by the renderer 611 as necessary, and outputs the data to the renderer 611 and the data storage unit 606. The data storage unit 606 stores the data output by the data conversion unit 605.

[0070] The drawing unit 607 draws the display screen using data received from the worker 612. The drawing unit 607 constructs a DOM during this drawing, and if further necessary data occurs, it requests the worker 612 to obtain the data. The operation receiving unit 608 receives operations on the display screen displayed by the drawing unit 607.

[0071] <Processing flow> Next, a process flow of the communication method according to the first embodiment will be described.

[0072] (Login process) 7 is a sequence diagram showing an example of login processing according to the first embodiment. This processing shows an example of login processing executed by the communication system 1 when a user who has been registered in the communication system 1 logs in to the management server 10 using the information terminal 111.

[0073] In step S701, it is assumed that a user performs a connection operation to connect to the reception unit 305 of the management server 10 using the web browser of the information terminal 111. For example, the user inputs a URL (Uniform Resource Locator) or the like for accessing the reception unit 305 of the communication management unit 303 into the web browser of the information terminal 111.

[0074] In steps S 702 and S 703 , when the web browser of the information terminal 111 accepts a connection operation by the user, it accesses the specified URL and obtains a web UI from the acceptance unit 305 of the communication management unit 303 .

[0075] In steps S704 and S705, the web browser of the information terminal 111 generates authorization request parameters and stores the generated authorization request parameters in the session storage. In addition, in step S706, the web browser transmits an authorization request including the generated authorization request parameters to the authentication unit 302 of the management server 10.

[0076] In step S707, in response to the authorization request from the information terminal 111, the authentication unit 302 of the management server 10 notifies the information terminal 111 of the URL of the login redirect destination.

[0077] In step 708, the web browser of the information terminal 111 uses the redirect destination URL notified by the management server 10 to request the reception unit 305 of the communication management unit 303 to display a login screen.

[0078] In step S709, the reception unit 305 of the communication management unit 303 transmits a login screen to the information terminal 111, and in step S710, the web browser of the information terminal 111 displays, for example, a login screen 1000 as shown in FIG.

[0079] In step S711, when the user performs a login operation to input login information such as an email address and a password on the login screen 1000, the communication system 1 executes the process from step S712 onwards. Note that the email address and password are an example of login information (authentication information) for authenticating the user. The login information for authenticating the user may be, for example, an electronic certificate, biometric information, or identification information obtained from the user's possession.

[0080] In step S712, when the web browser of the information terminal 111 accepts the login operation by the user, it transmits a login request including the input login information to the authentication unit 302 of the management server 10.

[0081] In step S713, when the authentication unit 302 of the management server 10 accepts the login request from the information terminal 111, it notifies the information terminal 111 that has made the request of the callback destination, the temporary code, and the like.

[0082] In step S714, the web browser of the information terminal 111 transmits a token acquisition request including the temporary code notified by the management server 10 to the authentication unit 302 of the management server 10.

[0083] In step S715, the authentication unit 302 of the management server 10 authenticates the user in response to the token acquisition request from the information terminal 111. As described above, the user is a user who has already been registered in the communication system 1, so the authentication is successful (the authentication result is OK).

[0084] In step S716, the authentication unit 302 of the management server 10 notifies the information terminal 111 of information such as the access token, the refresh token, and the expiration date.

[0085] In steps S718 and S719, the web browser of the information terminal 111 obtains user information from the authentication unit 302 of the management server using the user's user ID and the notified access token, etc., and displays a service list screen, etc., using the obtained user information.

[0086] The login process shown in FIG. 7 is just an example, and the communication system 1 may authenticate the user through other procedures and notify the information terminal 111 of the user who has been permitted to log in of an access token.

[0087] (Communication System Processing) 8 and 9 are sequence diagrams showing an example of processing of the communication system according to the first embodiment. This processing shows an example of processing executed by the communication system 1 when a user who uses the information terminal 111 uses a business portal, which is an example of a web service provided by the server device 101 in the local network 100.

[0088] At the start of the process shown in Fig. 8, the information terminal 111 executes the login process described in Fig. 7 and displays a service list screen 1100 as shown in Fig. 11. The session management unit 304 of the communication management unit 303 and the first communication control unit 402 of the secure box 14 are connected to each other so as to be able to communicate with each other, for example, by the MQTT protocol or the like.

[0089] In step S801, the user selects a business portal on a service list screen 1100 as shown in Fig. 11. For example, on the service list screen 1100, the user moves a cursor 1101 to the destination field of the service name "Business Portal" and selects the displayed "Connect" button 1102.

[0090] In step S802, when the renderer 611 of the information terminal 111 accepts the selection operation by the user, it transmits a connection request including the access token acquired in the login process of FIG.

[0091] In step S803, when the communication management unit 303 of the management server 10 accepts a connection request from the information terminal 111, it uses the authentication unit 302 to verify the access token included in the connection request. If the verification result of the access token is "OK" (if the user is a valid user), in step S804, the communication management unit 303 generates a session ID that identifies the session. On the other hand, if the verification result of the access token is not "OK", the communication management unit 303 notifies the information terminal 111 of an error, for example, and stops executing the process of step S804.

[0092] In step S805, the communication management unit 303 of the management server 10 transmits to the secure box 14 a connection request to the relay server 13 including the issued session ID.

[0093] In step S806, the first communication control unit 402 of the secure box 14 transmits a WebSocket connection request including the session ID notified by the management server 10 to the relay server 13.

[0094] In step S807, when the connection management unit 312 of the relay server 13 accepts the connection request from the secure box 14, it establishes a session of the first communication 3 encrypted by, for example, wws with the secure box 14 that is the request source.

[0095] In step S808, the communications management unit 303 of the management server 10 transmits a connection instruction including the session ID generated in step S804 to the information terminal 111 that has made the request.

[0096] In step S 809 , the renderer 611 of the information terminal 111 requests the worker 612 to connect to the relay server 13 .

[0097] In step S810, the second communication control unit 604 of the worker 612 transmits a WebSocket connection request to the relay server 13. This WebSocket connection request includes, for example, the access token acquired in the login process of FIG. 7 and the session ID notified from the management server 10.

[0098] In step S811, when the connection management unit 312 of the relay server 13 accepts a WebSocket connection request from the information terminal 111, the connection management unit 312 of the relay server 13 verifies the access token included in the WebSocket connection request using the authentication unit 302 of the management server 10. If the verification result of the access token is "OK" (if the user is a valid user), in step S812, the connection management unit 312 of the relay server 13 establishes a session of the second communication 4 encrypted by, for example, wws with the information terminal 111. As a result, the information terminal 111 and the secure box 14 participate in the same session provided by the relay server 13, and a tunnel is established that allows them to send and receive data to and from each other by encrypted communication (for example, wss) (step S813).

[0099] On the other hand, if the verification result of the access token is not "OK", the connection management unit 312 of the relay server 13 stops the execution of the process of step S812 and rejects the connection to the relay server 13 (or discards the WebSocket connection request).

[0100] Through the above processing, the web browser of the information terminal 111 can use the proxy server unit 403 of the secure box 14 to access web services such as a business portal provided by the server device 101 connected to the local network 100. For example, by repeatedly executing the processing of steps S821 to S833 in Fig. 8, the web browser of the information terminal 111 can display a business portal screen 1201 provided by the server device 101 on an operation page screen 1200 as shown in Fig. 12.

[0101] For example, the renderer 611 of the information terminal 111 generates an HTTPS request to display the business portal screen 1201 provided by the server device 101, and requests the worker 612 to acquire data (step S821).

[0102] The worker 612 analyzes the request received from the renderer 611 (step S822), and if it determines that it is necessary to communicate with the server device 101, it transmits a data acquisition request to the proxy server unit 403 of the secure box 14. Note that, if the requested data is stored in the data storage unit 606, the worker 612 may return the data stored in the data storage unit 606 to the renderer 611.

[0103] When the proxy server unit 403 of the secure box 14 receives the data acquisition request from the information terminal 111, it transfers the data acquisition request to the server device 101 in the same manner as when the data acquisition request is received from a terminal within the local network 100 (step S825).

[0104] When the server device 101 accepts the data acquisition request, it transmits data such as HTML to the secure box 14 as a response (steps S826 and S827).

[0105] When the proxy server unit 403 of the secure box 14 receives the response from the server device 101, it converts the response into a format that can be interpreted by the worker 612 as necessary and transmits it to the information terminal 111 (steps S828, S829). For example, if there is a possibility that the function cannot be provided by the absolute URL, the proxy server unit 403 may convert the absolute URL into a relative URL.

[0106] The worker 612 of the information terminal 111 converts the data received from the secure box 14 into a format that can be interpreted by the renderer 611, as necessary, and accumulates the converted data (steps S830 and S831). The worker 612 also notifies the renderer 611 of the data.

[0107] The renderer 611 uses the data notified from the worker 612 to display, for example, a business portal screen 1201 provided by the server device 101 on an operation page screen 1200 as shown in FIG.

[0108] Fig. 13 is a diagram showing an example of a page configuration of an operation page according to the first embodiment. A page configuration 1300 shown in Fig. 13 is, for example, HTML data for displaying an operation page screen 1200 as shown in Fig. 12.

[0109] In the example of FIG. 13, the data acquired by the worker 612 is inserted into the element portion of "id="target"" in the drawing area 1301. The inserted data is integrated as one DOM, and is not subject to restrictions due to the security protection mechanism of the web browser. Note that while the example of FIG. 13 shows a page configuration 1300 using simple HTML, the page configuration 1300 may be more complex and may be expressed in a form other than HTML.

[0110] Note that the transmission and reception of requests and responses between the worker 612 and the server device 101 shown in steps S821 to S833 in FIG. 8 continues until the communication ends.

[0111] Now, with reference to FIG. 9, an example of a communication termination process will be described.

[0112] In step S901, when the user performs an end operation on the web browser of the information terminal 111, the communication system 1 executes the processes in and after step S902.

[0113] In step S902, when the renderer 611 of the information terminal 111 accepts a termination operation by the user, it requests a disconnection to the worker 612. In response to this, in step S903, the worker 612 transmits a disconnection request to the relay server 13.

[0114] In steps S904 and S905, the connection management unit 312 of the relay server 13 disconnects the session with the secure box 14. As a result, in step S906, the tunnel established in step S813 of FIG.

[0115] In step S907, the connection management unit 312 of the relay server 13 disconnects the session with the information terminal 111. In response to this, in step S908, the worker 612 notifies the renderer 611 that the disconnection of the session with the relay server 13 has been completed.

[0116] (Data flow) Fig. 14 is a diagram showing the flow of data after a tunnel is established according to the first embodiment. This diagram shows the state of the communication system 1 in a state where a tunnel 1403 is established by WWS communication between the worker 612 and the secure box 14 in step S813 in Fig. 8. Note that the tunnel 1403 is an example of a first communication path between the first communication control unit 402 and the second communication control unit 604, and includes a communication path by WebSocket.

[0117] The worker 612 can use the tunnel 1403 to transmit and receive data in various formats, such as HTML, PNG (Portable Network Graphics), JSON (JavaScript Object Notation), and XML (Extensible Markup Language). This allows the information terminal 111 to use the proxy server unit 403 included in the secure box 14 in the same way as a terminal connected to the local network 100.

[0118] For example, the worker 612 can use the proxy server unit 403 to access a web service provided by the web server unit 411 of the server device 101. The worker 612 can also use the proxy server unit 403 to access a web server 1401 on the Internet 1400.

[0119] As described above, according to the first embodiment, it becomes possible to easily use web services provided by a web server (server device 101) connected to a local network from a web browser of an access source terminal (information terminal 111) that can connect to the Internet.

[0120] [Second embodiment] In the second embodiment, an example of a communication system 1 in which the Proxy-PAC technology is used instead of the worker 612 of the web browser of the information terminal 111 will be described.

[0121] <Functional configuration> (Management Server Functionality Configuration) Fig. 15(A) shows an example of a functional configuration of the management server 10 according to the second embodiment. The management server 10 according to the second embodiment has, for example, a setting management unit 1501 in addition to the functional configuration of the management server 10 according to the first embodiment described in Fig. 3(A).

[0122] The setting management unit 1501 is realized by, for example, a program executed by the computer 200 included in the management server 10, and manages, for example, setting information of a Proxy-PAC 1900, which will be described later with reference to Fig. 19. The setting management unit 1501 also provides information for acquiring a file of the Proxy-PAC 1900 to the information terminal 111, etc.

[0123] (Functional configuration of relay server) Fig. 15(B) shows an example of the functional configuration of the relay server 13 according to the second embodiment. The relay server 13 according to the second embodiment includes, for example, a proxy server unit 403 in addition to the functional configuration of the relay server 13 according to the first embodiment described in Fig. 3(B).

[0124] The proxy server unit 403 is realized, for example, by a program executed by the computer 200 included in the relay server 13. Note that the proxy server unit 403 has the same functions as the proxy server unit 403 included in the secure box 14 according to the first embodiment.

[0125] (Functional configuration of Secure Box) Fig. 16 is a diagram showing an example of the functional configuration of a secure box according to the second embodiment. The secure box 14 according to the second embodiment has a transfer unit 1601 instead of the proxy server unit 403 included in the secure box 14 according to the first embodiment described in Fig. 4.

[0126] The forwarding unit 1601 is realized, for example, by a program executed by the computer 200 included in the secure box 14. The forwarding unit 1601 functions as a TCP relay that forwards data transmitted and received between the relay server 13 and the server device 101 in both directions.

[0127] (Functional configuration of information terminal) 17 is a diagram showing an example of a functional configuration of an information terminal 111 according to the second embodiment. The information terminal 111 according to the second embodiment includes, for example, a communication unit 601, an element acquisition unit 602, a request analysis unit 603, a second communication control unit 604, a drawing unit 607, an operation reception unit 608, a setting unit 1701, and a third communication control unit 1702. At least a part of the above functional configurations may be realized by hardware.

[0128] The communication unit 601 is realized, for example, by a program (such as an OS) executed by the CPU 201, and uses the network I / F 208 to connect the information terminal 111 to the remote network 110 and the communication network 2, etc., and executes communication processing to communicate with other devices.

[0129] The setting unit 1701 is realized by, for example, a web browser 1700 executed by the CPU 201, and obtains, for example, a Proxy-PAC 1900 file as shown in Fig. 19 from the management server 10 and applies it to the web browser 1700. The setting unit 1701 also displays, for example, a setting screen 1800 as shown in Fig. 18 to accept the setting of the acquisition destination of the Proxy-PAC 1900 file.

[0130] Fig. 18 is a diagram for explaining the settings of a web browser according to the second embodiment. A user who uses an information terminal 111 can set the acquisition destination of a file of a Proxy-PAC 1900 by using, for example, a setting screen 1800 of a web browser 1700 as shown in Fig. 18(A).

[0131] However, when acquiring the file of Proxy-PAC 1900, the web browser 1700 cannot use the authentication information used when the information terminal 111 logged in to the management server 10. Therefore, in this embodiment, a value (hereinafter, referred to as a secret) that cannot be guessed by a third party is used to set the acquisition destination of the file of Proxy-PAC 1900.

[0132] This secret can be calculated, for example, by the following formula (1). secret = sha512sum(tenant ID + user ID + fixed secret string) (1) In addition, in the setting screen 1800 of FIG. 18(A), the secret value is shown as secret=7d099e3, but this is because it is not possible to display all the digits in the figure. In reality, the value will be, for example, as follows: secret = 7d099e3976e2be937cbe6d749e09737149cec03d67d1427a94ff3764cfbccfe69737a8f772e1efabafa3d53d09041782d76b8e0b36be19902aae65835af2f9c2 Here, the tenant ID is identification information that identifies a contract unit such as a company, organization, or group, and the user ID is identification information that identifies a user.

[0133] For example, the setting management unit 1501 of the management server 10 may provide a web page that displays a different secret for each user. In this case, the user can easily set the acquisition destination of the Proxy-PAC 1900 file by copying the displayed secret and pasting it into the URL input field 1801 of the setting screen as shown in FIG.

[0134] FIG. 19 is a diagram showing an example of a Proxy-PAC according to the second embodiment. In the example of FIG. 19, the setting of "https_proxy" of the Proxy-PAC 1900 is "tenant ID+secret".proxy.srws.example.ricoh.com:443", which is set to a value that is difficult for a third party to guess. The setting 1901 of this Proxy-PAC 1900 is set to access the proxy server indicated by the above "https_proxy" if the URL starts with "https:" or "wss:" and the destination is "internal.example.com". Note that the proxy server may request the user to input, for example, a user name, a password, etc., when it accepts an access from the information terminal 111 or the like.

[0135] Returning now to FIG. 17, the explanation of the functional configuration of the information terminal 111 will be continued.

[0136] The element acquisition unit 602 is realized by, for example, the web browser 1700 executed by the CPU 201, and acquires elements such as an HTML request from the HTML of a web page, etc. The element acquisition unit 602 also outputs a request for acquiring data necessary for generating a DOM, such as a CSS (Cascading Style Sheets) or JavaScript (registered trademark) file, to a request analysis unit 603.

[0137] The request analysis unit 603 analyzes the request received from the element acquisition unit 602 and determines whether to send the request to a proxy server or directly to a web server based on, for example, the settings of Proxy-PAC1900 as shown in FIG.

[0138] The second communication control unit 604 uses the session ID notified by the management server 10 to request a connection to the relay server 13, and connects to the relay server 13 using the encrypted second communication 4. The second communication control unit 604 also selectively transmits the request that the request analysis unit 603 has determined to be transmitted to the proxy server, to the proxy server unit 403 included in the relay server 13, and receives a response to the transmitted request.

[0139] The third communication control unit 1702 directly transmits a request that the request analysis unit 603 has determined to be directly transmitted to a web server to the web server that is the destination of the request, and receives a response to the transmitted request.

[0140] The drawing unit 607 draws the display screen using data received by the second communication control unit 604 or the third communication control unit 1702. The operation receiving unit 608 receives operations on the display screen displayed by the drawing unit 607.

[0141] <Processing flow> (Communication System Processing) 20 and 21 are sequence diagrams showing an example of processing of the communication system according to the second embodiment. This processing shows another example of processing executed by the communication system 1 when a user using the information terminal 111 uses a business portal, which is an example of a web service provided by the server device 101 in the local network 100. At the start of the processing shown in FIG. 20, the session management unit 304 of the communication management unit 303 and the first communication control unit 402 of the secure box 14 are connected to each other so as to be able to communicate with each other, for example, by the MQTT protocol. Also, it is assumed that the file acquisition destination of the Proxy-PAC 1900 has been set in the web browser 1700 of the information terminal 111, for example, by using a setting screen 1800 as shown in FIG. 18.

[0142] It is assumed that in step S2001, the user performs an operation to start up the web browser 1700 provided in the information terminal 111.

[0143] In steps S2002 and S2003, when web browser 1700 is started, setting unit 1701 acquires a Proxy-PAC file from a preset Proxy-PAC file acquisition destination. Note that the Proxy-PAC file acquired here is preset so that URL requests related to server device 101 and relay server 13 are sent to the proxy server, and URL requests related to management server 10 are sent directly to management server 10.

[0144] In steps S2004 and S2005, the communication system 1 executes a login process as shown in FIG. 7, for example, and the web browser 1700 of the information terminal 111 displays a service list screen 1100 as shown in FIG.

[0145] In step S 2006 , it is assumed that the user selects a business portal on the service list screen 1100 .

[0146] In step S2007, the request analysis unit 603 of the information terminal 111 analyzes the request to be sent next, and determines whether to send the request to the proxy server or directly to the destination based on the acquired Proxy-PAC file. In this case, since the destination of the request (connection request) to be sent next is the management server 10, the request analysis unit 603 determines to send the request directly to the management server 10.

[0147] In step S2007, the third communications control unit 1702 of the information terminal 111 transmits a connection request including the access token acquired in the login process in step S2004 to the communications management unit 303 of the management server 10.

[0148] In step S2008, when the communication management unit 303 of the management server 10 accepts a connection request from the information terminal 111, it uses the authentication unit 302 to verify the access token included in the connection request. If the verification result of the access token is "OK" (if the user is a valid user), in step S2009, the communication management unit 303 generates a session ID that identifies the session. On the other hand, if the verification result of the access token is not "OK", the communication management unit 303 notifies the information terminal 111 of an error, for example, and stops executing the process of step S2009.

[0149] In step S2010, the communication management unit 303 of the management server 10 transmits to the secure box 14 a connection request to the relay server 13 including the issued session ID.

[0150] In step S2011, the first communication control unit 402 of the secure box 14 transmits a WebSocket connection request including the session ID notified by the management server 10 to the relay server 13.

[0151] In step S2012, when the connection management unit 312 of the relay server 13 accepts the connection request from the secure box 14, it establishes a session of the first communication 3 encrypted by, for example, wws with the secure box 14 that is the request source.

[0152] In step S2013, the communications management unit 303 of the management server 10 transmits a connection instruction including the session ID generated in step S2009 to the information terminal 111 that has made the request.

[0153] In step S2014, the request analysis unit 603 of the information terminal 111 analyzes the request to be sent next, and determines whether to send the request to the proxy server or directly to the destination based on the acquired Proxy-PAC file. In this case, since the destination of the request to be sent next (WebSocket connection request) is the relay server 13, the request analysis unit 603 determines to send the request to the proxy server (relay server 13).

[0154] In step S2015, the second communication control unit 604 of the information terminal 111 transmits a WebSocket connection request to the relay server 13. This WebSocket connection request includes, for example, the access token acquired in step S2004 and the session ID notified from the management server 10.

[0155] In step S2016, when the connection management unit 312 of the relay server 13 accepts a WebSocket connection request from the information terminal 111, the connection management unit 312 verifies the access token included in the WebSocket connection request using the authentication unit 302 of the management server 10. If the access token verification result is "OK" (if the user is a valid user), in step S2016, the connection management unit 312 of the relay server 13 establishes a session with the information terminal 111 for, for example, encrypted second communication 4 using wws.

[0156] On the other hand, if the verification result of the access token is not "OK", the connection management unit 312 of the relay server 13 stops the execution of the process of step S2017 and rejects the connection to the relay server 13 (or discards the WebSocket connection request).

[0157] Through the above process, the web browser 1700 of the information terminal 111 becomes able to use the proxy server unit 403 of the relay server 13 as a proxy server. Also, a tunnel is established between the relay server 13 and the secure box 14 (step S2018). Therefore, the proxy server unit 403 of the relay server 13 becomes able to communicate with the server device 101 via the established tunnel and the transfer unit 1601 functioning as a TCP relay in the secure box 14.

[0158] Therefore, by repeatedly executing the processes of steps S2101 to S2108 in FIG. 21, the web browser 1700 of the information terminal 111 can display, for example, a business portal screen 2200 as shown in FIG.

[0159] For example, in step S2101, the drawing unit 607 of the information terminal 111 generates an HTTPS request (data acquisition request) to display the business portal screen 2200 provided by the server device 101. In addition, the request analysis unit 603 decides to transmit the generated data acquisition request to the proxy server, and the second communication control unit 604 transmits the generated data acquisition request to the proxy server unit 403 of the relay server 13.

[0160] In steps S2102 and S2103, upon receiving a data acquisition request from information terminal 111, proxy server section 403 of relay server 13 transmits the received data acquisition request to server apparatus 101 via transfer section 1601 of secure box .

[0161] In steps S2104 to S2106, upon receiving the data acquisition request, web server section 411 of server apparatus 101 transmits data such as HTML to relay server 13 via transfer section 1601 of secure box 14 as a response.

[0162] In step S2107, upon receiving the data (response) from server device 101, proxy server section 403 of relay server 13 transmits the received data to information terminal 111.

[0163] In step S2108, the drawing unit 607 of the information terminal 111 uses the data received from the relay server 13 to display, for example, a business portal screen 2200 as shown in FIG.

[0164] Note that the transmission and reception of requests and responses between information terminal 111 and server device 101 shown in steps S2101 to S2108 in FIG. 21 continues until the communication ends.

[0165] Next, an example of a communication termination process will be described with reference to FIG.

[0166] In step S2111, when the user performs an end operation on the web browser of the information terminal 111, the communication system 1 executes the processes in and after step S2112.

[0167] In step S2112, when web browser 1700 of information terminal 111 accepts an end operation by the user, second communication control unit 604 transmits a disconnection request to relay server 13.

[0168] In steps S2113 and S2114, the connection management section 312 of the relay server 13 disconnects the session with the secure box 14. As a result, in step S2115, the tunnel between the relay server 13 and the secure box 14 is disconnected.

[0169] In step S2116, connection management section 312 of relay server 13 disconnects the session with information terminal 111.

[0170] (Data flow) Fig. 23 is a diagram showing a data flow after a tunnel is established according to the second embodiment. This diagram shows an example of the communication system 1 in a state where a tunnel 2301 is established by the wws communication between the relay server 13 and the secure box 14 in step S2018 in Fig. 20. Note that the tunnel 1403 is an example of the second communication path between the relay server 13 and the first communication control unit 402, and includes a communication path by WebSocket.

[0171] The proxy server unit 403 of the relay server 13 can use this tunnel 2301 and the transfer unit 1601 provided in the secure box 14 to transmit and receive data in various formats, such as HTML, PNG, JSON, and XML, to and from the server device 101. This allows the web browser 1700 of the information terminal 111 to transmit and receive requests and responses to and from the web server unit 411 provided in the server device 101, using the proxy server unit 403 provided in the relay server 13.

[0172] As described above, according to the second embodiment, it is possible to easily use web services provided by a web server (server device 101) connected to a local network from a web browser of an access source terminal (information terminal 111) that can connect to the Internet.

[0173] <Supplementary Information> Each function of each embodiment described above can be realized by one or more processing circuits. Here, the term "processing circuit" in this specification includes a processor programmed to execute each function by software, such as a processor implemented by an electronic circuit, and a device such as an ASIC (Application Specific Integrated Circuit), a DSP (digital signal processor), an FPGA (field programmable gate array), or a conventional circuit module designed to execute each function described above.

[0174] Moreover, the group of devices described in the examples merely illustrates one of a plurality of computing environments for implementing the embodiments disclosed herein. In an embodiment, the management server 10, the relay server 13, or the server device 101 includes a plurality of computing devices, such as a server cluster. The plurality of computing devices are configured to communicate with each other via any type of communication link, including a network, a shared memory, or the like, and perform the processes disclosed herein. Furthermore, each functional configuration of the management server 10, the relay server 13, or the server device 101 may be integrated into one server device or may be divided into multiple devices. [Explanation of symbols]

[0175] 1. Communication Systems 2. Communication network (an example of the first network) 13 Relay Server 14 Secure Box (an example of a communication device) 100 Local Network (Secondary Network) 101 Server device (an example of a communication device) 110 Remote network (an example of the first network) 111 Information terminal 302 Authentication section 303 Communications Management Department 402 First communication control unit 403 Proxy Server 411 Web Server Department (Web Server) 604 Second communication control section 1403 Tunnel (first communication path) 2301 Tunnel (second communication path) [Prior art documents] [Patent documents]

[0176] [Patent Document 1] JP 2001-5714 A

Claims

1. A communication system for remotely accessing a web server connected to a second network different from a first network from an information terminal connected to the first network, comprising: a communication management unit that receives a connection request from the information terminal to a web service provided by the web server via the first network; a first communication control unit that connects from the second network to a relay server that is connected to the first network in response to a request from the communication management unit in response to the connection request accepted by the communication management unit; a second communication control unit for connecting from the information terminal to the relay server; having transmitting and receiving requests and responses between a web browser included in the information terminal and the web service provided by the web server via the relay server and the first communication control unit; Communication systems.

2. the communication system includes the relay server; The communication system according to claim 1 , wherein the relay server establishes a first communication path between the first communication control unit and the second communication control unit.

3. The communication system according to claim 2 , wherein the first communication path includes a communication path based on WebSocket.

4. the communication system includes a communication device having the first communication control unit, 4. The communication system according to claim 2, wherein the communication device comprises a proxy server unit capable of communicating with a web browser provided in the information terminal via the first communication path.

5. the communication system includes the relay server; The relay server establishes a second communication path between the first communication control unit and the relay server.

2. The communication system according to claim 1, wherein the relay server includes a proxy server unit capable of communicating with a web browser provided in the information terminal via the first network.

6. The communication system according to claim 5 , wherein the second communication control unit selectively transmits a request regarding the web service to the relay server.

7. an authentication unit for authenticating that a user who uses the information terminal is a legitimate user; the communication management unit requests the first communication control unit to connect to the relay server when the user of the information terminal that has transmitted the connection request is a valid user. A communication system according to any one of claims 1 to 6.

8. the communication system includes the relay server; the relay server permits a connection from the second communication control unit to the relay server if the user of the information terminal is a valid user.

8. The communication system according to claim 7.

9. 1. A communication system for remotely accessing a web server connected to a second network different from a first network from an information terminal connected to the first network, comprising: A computer connected to the second network, a process of connecting to a relay server connected to the first network in response to a request from a communication management unit that accepts a connection request from the information terminal to the web server via the first network; a process of receiving, from the relay server, a request for a web service provided by the web server from a web browser included in the information terminal connected to the relay server, and transferring the request to the web service; receiving a response to the request from the web service and forwarding the response to the relay server; A communication method.

10. 1. A communication system for remotely accessing a web server connected to a second network different from a first network from an information terminal connected to the first network, comprising: A computer connected to the second network, a process of connecting to a relay server connected to the first network in response to a request from a communication management unit that accepts a connection request from the information terminal to the web server via the first network; a process of receiving, from the relay server, a request for a web service provided by the web server from a web browser included in the information terminal connected to the relay server, and transferring the request to the web service; receiving a response to the request from the web service and forwarding the response to the relay server; A program to execute.

Images