Remote access management device, virtual server management device, remote access management method, virtual server management method, program, and recording medium

Abstract

To provide a remote access management apparatus configured to enhance security.SOLUTION: In a remote access management apparatus 10, a database management unit 11 manages a database on association between a user, a facility server, and a virtual machine. An acquisition unit 12 acquires identification information on a user who requests accessing the facility server and identification information of a terminal of the user. An inquiry unit 13 queries the database for each of the identification information to specify a facility server for which the user has a right to access and a virtual machine associated with the facility server. An execution unit 14 executes connection between the terminal of the user and the virtual machine to start remote access between the terminal of the user and the facility server via the virtual machine.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to a remote access management device, a virtual server management device, a remote access management method, a virtual server management method, a program, and a recording medium. [Background technology]

[0002] Remote access is becoming widespread. Remote access refers to connecting to a remote computer or a network such as a LAN (Local Area Network) from an external terminal. Patent Document 1 discloses a technology for authenticating a terminal that accesses via a VPN (Virtual Private Network). [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2011-164837 A Summary of the Invention [Problem to be solved by the invention]

[0004] However, there is a demand for ensuring higher security.

[0005] Therefore, an object of the present invention is to provide a remote access management device, a virtual server management device, a remote access management method, a virtual server management method, a program, and a recording medium that are capable of improving security. [Means for solving the problem]

[0006] In order to achieve the above object, a remote access management device of the present invention comprises: The system includes a database management unit, an acquisition unit, a query unit, and an execution unit; the database management unit manages a database relating to associations between users, facility servers, and virtual machines; The facility server is associated with one or more of the virtual machines, The virtual machine is constructed on a virtual server, the acquiring unit acquires identification information regarding a user requesting access to the facility server and identification information of a terminal of the user; the query unit queries the database for each of the identification information to identify a facility server for which the user has access authority and a virtual machine associated with the facility server; The execution unit is a device that executes a connection between the user's terminal and the virtual machine, and initiates remote access between the user's terminal and the facility server via the virtual machine.

[0007] The virtual server management device of the present invention comprises: A construction processing unit is included, The construction processing unit is a device that constructs one or more virtual machines on a virtual server in association with a facility server, and also constructs a database on the virtual server. The database is a database relating to associations between users, facility servers, and virtual machines.

[0008] The remote access management method of the present invention includes the steps of: The method includes a database management step, an acquisition step, a query step, and an execution step; The database management step includes managing a database relating to associations between users, facility servers, and virtual machines; The facility server is associated with one or more of the virtual machines, The virtual machine is constructed on a virtual server, The acquiring step acquires identification information regarding a user requesting access to the facility server and identification information of a terminal of the user, The query step queries the database for each of the identification information to identify a facility server to which the user has access authority and a virtual machine associated with the facility server; The executing step is a method of executing a connection between the user's terminal and the virtual machine, and initiating remote access between the user's terminal and the facility server via the virtual machine.

[0009] The virtual server management method of the present invention includes: A construction process is included. The construction processing step is a method of constructing one or more virtual machines on a virtual server in association with a facility server, and constructing a database on the virtual server. The database is a database relating to associations between users, facility servers, and virtual machines. Effect of the Invention

[0010] According to the present invention, higher security can be ensured. [Brief description of the drawings]

[0011] [Figure 1] FIG. 1 is a block diagram illustrating a configuration of an example of a remote access management device according to the first embodiment. [Diagram 2] FIG. 2 is a block diagram illustrating an example of a hardware configuration of the remote access management apparatus according to the first embodiment. [Diagram 3] FIG. 3 is a flowchart illustrating an example of processing in the remote access management device of the first embodiment. [Figure 4] FIG. 4 is a schematic diagram showing an example of each database in the remote access management device of the third embodiment. [Diagram 5] FIG. 5 is a schematic diagram showing an example of a case where a user terminal newly connects to a facility server in the remote access management device of the third embodiment. [Figure 6] FIG. 6 is a schematic diagram showing an example of a case where a user terminal makes a reservation for remote access in the remote access management device of the third embodiment. [Figure 7]FIG. 7 is a schematic diagram showing an example of a case where a reservation has been made for a time slot when a new connection is to be made in the remote access management device of the third embodiment. [Figure 8] FIG. 8 is a schematic diagram showing an example of a case where the remote access management device of the third embodiment logs off and ends the remote access. [Figure 9] FIG. 9 is a schematic diagram illustrating an example of a configuration of a remote access environment construction system apparatus according to the second embodiment. [Figure 10] FIG. 10 is a block diagram illustrating a configuration of an example of a virtual server management device according to the second embodiment. [Figure 11] FIG. 11 is a block diagram illustrating an example of a hardware configuration of a virtual server management apparatus according to the second embodiment. [Figure 12] FIG. 12 is a flowchart illustrating an example of processing in the virtual server management device of the second embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0012] In the remote access management device of the present invention, for example, the database management unit manages a user database, a facility database, an access authority database, an identification information database, and a virtual machine database; the user database is a database in which identification information of the user is associated with attribute information of the user; the facility database is a database in which identification information of the facility server is associated with attribute information of the facility server, the access authority database is a database in which identification information of the user is associated with identification information of the facility server, the identification information database is a database in which the identification information of the user is associated with the identification information of the user's terminal, the virtual machine database is a database in which identification information of the facility server is associated with identification information of the virtual machine; the query unit queries the user database and the identification information database for the user's identification information to confirm whether the user is a user registered in each database; If the user is a registered user, the query unit queries the access authority database to identify the facility server identification information associated with the user identification information, and queries the virtual machine database to identify the virtual machine identification information associated with the facility server identification information; The execution unit may be configured to execute a connection between the user's terminal and the virtual machine having the specified identification information, and initiate remote access between the user's terminal and the facility server via the virtual machine.

[0013] In the remote access management device of the present invention, for example, The database management unit further manages a lock database; the lock database is a database in which identification information of the facility server, identification information of the virtual machine, and a connection status are associated with each other; the query unit, after identifying the identification information of the virtual machine associated with the identification information of the facility server, queries the lock database to confirm a connection status corresponding to the identification information of the facility server and the identification information of the virtual machine; When the connection status indicates that the terminal is not connected to another user's terminal, the execution unit executes a connection between the user's terminal and the virtual machine having the specified identification information, and initiates remote access between the user's terminal and the facility server via the virtual machine; The database management unit may be configured to record in the lock database a connection status corresponding to the identification information of the facility server and the identification information of the virtual machine as a status indicating that the facility server is connected to the user's terminal. In the above aspect, for example, When the connection status indicates that the terminal is connected to another user's terminal, The execution unit may not execute a connection between the user terminal and the virtual machine having the specified identification information.

[0014] In the remote access management device of the present invention, for example, The user database further includes a contact list for the user. The facility database further includes a contact information for an administrator of the facility server. When a connection between the user's terminal and the virtual machine is established, The inquiry unit may be configured to inquire the user database and the facility database, and send a message to the user's contact point and the administrator's contact point indicating that the connection has been established.

[0015] In the remote access management device of the present invention, for example, The database management unit further manages a log database, The log database may be a database that records a log relating to a connection between the virtual machine corresponding to the facility server and the user's terminal.

[0016] In the remote access management device of the present invention, for example, The database management unit further manages a reservation database; the reservation database is a database for recording reservations regarding connections to the virtual machines; The acquisition unit acquires reservation information of the virtual machine corresponding to the user, The database management unit may register a reservation for connection to the virtual machine in the reservation database based on the reservation information.

[0017] The remote access management device of the present invention includes, for example: Further, the system includes a monitoring unit, The monitoring unit monitors the behavior of the user's terminal, the execution unit, when the monitoring unit cannot confirm the access request for a certain period of time after the user logs in to the remote access management device, logs off the terminal of the user who logged in from the remote access management device; and Another aspect is that if the monitoring unit is unable to confirm the behavior due to the user's operation for a certain period of time after connecting to the virtual machine, the monitoring unit terminates the connection between the user's terminal and the virtual machine having the specified identification information.

[0018] The remote access management device of the present invention includes, for example: The virtual server may be on a cloud, and the virtual machine may be constructed on the virtual server.

[0019] The remote access environment construction system of the present invention includes, for example, A system including a remote access management device of the present invention and a virtual server management device of the present invention, The virtual server management device is a device that constructs the virtual machines and the database on the remote access management device, which is a virtual server.

[0020] In the remote access management method of the present invention, for example, The database management step includes managing a user database, a facility database, an access authority database, an identification information database, and a virtual machine database; the user database is a database in which identification information of the user is associated with attribute information of the user; the facility database is a database in which identification information of the facility server is associated with attribute information of the facility server, the access authority database is a database in which identification information of the user is associated with identification information of the facility server, the identification information database is a database in which the identification information of the user is associated with the identification information of the user's terminal, the virtual machine database is a database in which identification information of the facility server is associated with identification information of the virtual machine; the query step queries the user database and the identification information database for the user's identification information to confirm whether the user is a user registered in each database; If the user is a registered user, the query step queries the access authority database to identify the facility server identification information associated with the user identification information, and queries the virtual machine database to identify the virtual machine identification information associated with the facility server identification information; The execution step may include executing a connection between the user's terminal and the virtual machine having the specified identification information, and initiating remote access between the user's terminal and the facility server via the virtual machine.

[0021] In the remote access management method of the present invention, for example, The database management step further includes managing a lock database; the lock database is a database in which identification information of the facility server, identification information of the virtual machine, and a connection status are associated with each other; the query step includes identifying the identification information of the virtual machine associated with the identification information of the facility server, and then querying the lock database to confirm a connection status corresponding to the identification information of the facility server and the identification information of the virtual machine; When the connection status indicates that the terminal is not connected to another user's terminal, the executing step includes executing a connection between the user's terminal and the virtual machine having the specified identification information, and starting remote access between the user's terminal and the facility server via the virtual machine; The database management process may be configured to record in the lock database a connection status corresponding to the identification information of the facility server and the identification information of the virtual machine as a status indicating that the facility server is connected to the user's terminal. In the above aspect, for example, When the connection status indicates that the terminal is connected to another user's terminal, The executing step may be implemented in a manner that does not execute a connection between the user terminal and the virtual machine having the specified identification information.

[0022] In the remote access management method of the present invention, for example, The user database further includes a contact list for the user. The facility database further includes a contact information for an administrator of the facility server. When a connection between the user's terminal and the virtual machine is established, The query step may include querying the user database and the facility database, and sending a message to the user contact and the administrator contact indicating that the connection has been made.

[0023] In the remote access management method of the present invention, for example, The database management step further includes managing a log database; The log database may be a database that records logs relating to connections between the virtual machine corresponding to the facility server and the terminals of the users.

[0024] In the remote access management method of the present invention, for example, The database management step further includes managing a reservation database; the reservation database is a database for recording reservations regarding connections to the virtual machines; The acquiring step acquires reservation information of the virtual machine corresponding to the user, The database management step may be implemented in a manner that registers a reservation for connection to the virtual machine in the reservation database based on the reservation information.

[0025] The remote access management method of the present invention includes, for example, Further, a monitoring step is included, The monitoring step monitors the behavior of the user's terminal; The execution step includes, when the access request cannot be confirmed for a certain period of time after logging in to the remote access management device by the monitoring step, logging off the terminal of the logged-in user from the remote access management device; and Another aspect is that if the behavior due to the user's operation cannot be confirmed for a certain period of time after connection to the virtual machine through the monitoring process, the connection between the user's terminal and the virtual machine having the specified identification information is terminated.

[0026] In the remote access management method of the present invention, for example, In one embodiment, the device that executes the remote access management method is the virtual server on a cloud, and the virtual machine is constructed on the virtual server.

[0027] The remote access environment construction method of the present invention includes, for example, The present invention includes a remote access management method and a virtual server management method, The virtual machine and the database are constructed on a virtual server by the virtual server management method.

[0028] The program of the present invention is a program for causing a computer to execute each step of the method of the present invention as a procedure.

[0029] The recording medium of the present invention is a computer-readable recording medium having the program of the present invention recorded thereon.

[0030] Next, an embodiment of the present invention will be described with reference to the drawings. The present invention is not limited to the following embodiment. In each of the drawings, the same parts are given the same reference numerals. In addition, the explanations of each embodiment can be mutually incorporated unless otherwise specified, and the configurations of each embodiment can be combined unless otherwise specified.

[0031] [Embodiment 1] Fig. 1 is a block diagram showing an example of the configuration of a remote access management device 10 according to the present embodiment. As shown in Fig. 1, the device 10 includes a database management unit 11, an acquisition unit 12, a query unit 13, and an execution unit 14. The device 10 may further include a monitoring unit 15, a virtual machine construction unit 16, etc. as optional components.

[0032] The device 10 may be, for example, a single device including each of the above-mentioned units, or a device to which each of the above-mentioned units can be connected via a communication line network. The device 10 may be connected to an external device described later via the communication line network. The communication line network is not particularly limited, and a known network may be used, for example, wired or wireless. Examples of the communication line network include an Internet line, a World Wide Web (WWW), a telephone line, a Local Area Network (LAN), a Storage Area Network (SAN), a Delay Tolerant Networking (DTN), a Low Power Wide Area (LPWA), and a Local 5G (L5G). Examples of wireless communication include Wi-Fi (registered trademark), Bluetooth (registered trademark), a Local 5G, and a LPWA. Examples of the wireless communication may include a form in which each device directly communicates with each other (Ad Hoc communication), an infrastructure (infrastructure communication), and an indirect communication via an access point. The device 10 may be incorporated into a system as, for example, a physical server or a virtual server. The device 10 may be, for example, a personal computer (PC, for example, desktop type or notebook type) in which the program of the present invention is installed. Furthermore, the device 10 may be in the form of cloud computing or edge computing, for example, in which at least one of the units is on a server and the other units are on a terminal.

[0033] 2 illustrates a block diagram of the hardware configuration of the device 10. The device 10 includes, for example, a central processing unit (CPU, GPU, etc.) 101, a memory 102, a bus 103, a storage device 104, a communication device 107, etc. Each part of the device 10 is connected to each other via the bus 103 by each interface (I / F).

[0034] 2, the virtual machine 100 is constructed on the hardware of the present device 10. Although an OS (Operating System) and the like are not shown, the virtual machine 100 may be of a host OS type or a hypervisor type.

[0035] The central processing unit 101 is responsible for the overall control of the device 10. In the device 10, the central processing unit 101 executes, for example, the program of the present invention and other programs, and also reads and writes various information. Specifically, for example, the central processing unit 101 functions as a database management unit 11, an acquisition unit 12, a query unit 13, an execution unit 14, a monitoring unit 15, a virtual machine construction unit 16, and the like.

[0036] The bus 103 can also be connected to, for example, an external device. Examples of the external device include an external storage device (external database, etc.), a printer, an external input device, an external display device, an external imaging device, etc. The present device 10 can be connected to an external network (the above-mentioned communication line network) by, for example, a communication device 107 connected to the bus 103, and can also be connected to other devices via the external network.

[0037] An example of the memory 102 is a main memory (primary storage device). When the central processing unit 101 performs processing, the memory 102 reads various operation programs, such as the program of the present invention, stored in the storage device 104 described below, and the central processing unit 101 receives data from the memory 102 and executes the program. The main memory is, for example, a RAM (random access memory). The memory 102 may also be, for example, a ROM (read only memory).

[0038] The storage device 104 is also called an auxiliary storage device, for example, in contrast to the main memory (primary storage device). As described above, the storage device 104 stores an operation program including the program of the present invention. The storage device 104 may be, for example, a combination of a recording medium and a drive for reading and writing from and to the recording medium. The recording medium is not particularly limited, and may be, for example, an internal or external type, such as a hard disk (HD), CD-ROM, CD-R, CD-RW, MO, DVD, flash memory, or memory card. The storage device 104 may be, for example, a hard disk drive (HDD) in which a recording medium and a drive are integrated, or a solid state drive (SSD).

[0039] In the present device 10, the memory 102 and the storage device 104 can store various information such as log information, information acquired from an external database (not shown) or an external device, information generated by the present device 10, and information used when the present device 10 executes processing. At least a part of the information may be stored, for example, in an external server other than the memory 102 and the storage device 104, or may be stored in a distributed manner in multiple terminals using block chain technology or the like. The memory 102 and the storage device 104 may store, for example, each database managed by the database management unit 11.

[0040] Next, an example of the remote access management method of this embodiment will be described with reference to the flowchart of Fig. 3. The remote access management method of this embodiment is implemented as follows, for example, using the remote access management device 10 of Fig. 1. Note that the remote access management method of this embodiment is not limited to the use of the remote access management device 10 of Fig. 1. Also, the steps in parentheses in Fig. 3 are optional steps.

[0041] First, in the case where the virtual machine construction unit 16 is included, the virtual machine construction unit 16 may construct one or more virtual machines 100 on a virtual server in association with a facility server, and may also construct a database on the virtual server (S10). The construction method is not particularly limited, and a known technique may be used. The facility server, the virtual machine 100, and the database will be described later. Meanwhile, the virtual machine 100 and the database may be constructed, for example, by a virtual server management device 20 described later. Specifically, for example, the virtual server management device 20 may construct the virtual machine 100 in response to a request from an arbitrary physical machine (which may be a physical machine in the cloud or a physical machine outside the cloud).

[0042] Here, the device 10 may be, for example, a virtual server on a cloud on which a virtual machine 100 runs. On the other hand, the device 10 may be, for example, a physical machine capable of realizing a virtual server environment. The physical machine capable of realizing the virtual server environment and the physical machine requesting the construction of the virtual machine 100 may be the same physical machine or different physical machines. Here, "cloud" refers to, for example, a system form in which resources are used remotely via the communication line network.

[0043] Next, the database management unit 11 manages a database relating to the association between users, facility servers, and virtual machines 100 (S11). The user is, for example, a user who has remote access authority to the facility server. The database may be constructed from a plurality of databases, and will be specifically described later. As described above, the facility server is linked to one or a plurality of virtual machines 100. The facility server is a server of a facility that accepts remote access, and the facility is not particularly limited. The facility may be, for example, a company, a school, a hospital, etc. The virtual machine 100 is constructed on a virtual server (for example, the present device 10, which is a virtual server) as described above. The virtual machine 100 may be of a host OS type or a hypervisor type. The facility server and the virtual machine 100 can be connected via the communication line network, and the connection method is not particularly limited.

[0044] Next, for example, the monitoring unit 15 may monitor the behavior of the terminal of the user who has logged in to the device 10 (S12). The behavior of the terminal of the user to be monitored is not particularly limited. The terminal of the user is, for example, a PC, a smartphone, a tablet terminal, etc. The user logs in to the device 10 using the terminal of the user, and then requests access to the facility server.

[0045] Next, when the access request is confirmed, the acquisition unit 12 acquires identification information regarding the user requesting access to the facility server and identification information of the user's terminal (S13). The user's identification information is not particularly limited as long as it is information that can identify the user, and is, for example, a user ID (identifier), a password, or a combination of these. The terminal's identification information is not particularly limited as long as it is information that can identify the terminal, and is, for example, an address (MAC address, IP address) that can identify a communication subject on a communication technology or network. An IP address does not depend on the terminal and can be assigned by the user. Therefore, from the viewpoint of security and identification, it is preferable to use a MAC address, which is an identification number unique to a terminal, as the identification information. The user's identification information and the terminal's identification information are acquired, for example, from the user's terminal via the communication line network. Then, when the request is confirmed, for example, the acquisition unit 12 acquires the identification information used at the time of the login.

[0046] Next, the query unit 13 queries the database for the user's identification information and the terminal's identification information to identify facility servers for which the user has access authority and virtual machines 100 linked to the facility servers (S14).

[0047] Then, the execution unit 14 executes a connection between the user's terminal and the virtual machine 100, and starts remote access between the user's terminal and the facility server via the virtual machine 100 (S15), and ends (END). The method of connection is not particularly limited, and may be, for example, a VPN method using a Virtual Private Network (VPN), an RDP (Remote Desktop Protocol) method for transferring a screen of the facility server to the user's terminal, a secure browser method using a secure browser, an API (Application Programming Interface) method for connecting via an application, or a combination of these. The method of connection between the user's terminal and the virtual machine 100 and the method of connection between the virtual machine 100 and the facility server may be the same or different.

[0048] The execution unit 14 may, for example, perform authentication processing using a one-time password, biometric information, or the like, prior to starting the remote access. The authentication processing is, for example, processing related to personal authentication that the user requesting the access is the same as the user registered in the database. Information required for the authentication processing can be acquired, for example, by the acquisition unit 12. The authentication processing can use a known technique. Specifically, for example, a known technique can be used for authentication using the one-time password, and may be a challenge-response method or a time synchronization method (time stamp method). The one-time password may, for example, be generated by the execution unit 14. Then, the execution unit 14 starts the remote access when the personal authentication is successful by the authentication processing.

[0049] On the other hand, for example, if the monitoring unit 15 cannot confirm the access request for a certain period of time after logging in to the device 10, that is, if the step (S13) is not executed, the execution unit 14 may log off the terminal of the logged-in user from the device 10 (S16). If the step (S16) is executed, for example, the process ends directly (END).

[0050] Also, for example, if the monitoring unit 15 cannot confirm the behavior due to the user's operation for a certain period of time after the connection with the virtual machine 100 is established, the execution unit 14 may terminate the connection between the user's terminal and the virtual machine 100 having the specified identification information (S17). When the step (S17) is executed, for example, the process ends immediately (END). The user's operation may be, for example, a key operation, a mouse operation, etc. Note that when the connection with the virtual machine 100 is terminated, for example, the logoff may also be executed automatically.

[0051] Furthermore, for example, when the execution unit 14 confirms a request to terminate the remote access from the user's terminal, the execution unit 14 may terminate the connection between the user's terminal and the virtual machine 100 having the specified identification information (S17).

[0052] According to this embodiment, a higher level of security can be ensured by performing remote access via the virtual machine 100. Specifically, even if the user's terminal uses an inappropriate application or a patch is not applied, the adverse effect on the facility server can be suppressed by using the virtual machine 100 according to this embodiment. Furthermore, by using the virtual machine 100, a higher level of security can be ensured by an administrator. Specifically, the administrator can update the virtual machine 100 to keep it up to date, and can control file transfer to the virtual machine 100, that is, control the take-out of data to the user's terminal. Furthermore, the administrator can control the virtual machine environment to suppress fraudulent access to the facility server from the user's terminal.

[0053] [Embodiment 2] FIG. 9 shows an example of the configuration of a remote access environment construction system device 1000. As shown in FIG. 9, the device 1000 includes the remote access management device 10 described in the first embodiment and a virtual server management device 20. The remote access management device 10 and the virtual server management device 20 can be connected to each other via the communication line network. The remote access management device 10 can be connected to, for example, the user's terminal 1 (user terminal 1), the administrator's terminal 2 (administrator terminal 2) that manages the remote access, a facility server 3 (server 3a of facility A, server 3b of facility B), and the like via the communication line network. Note that there may be a plurality of user terminals 1, administrator terminals 2, and facility servers 3.

[0054] In this device 1000, the virtual server management device 20 constructs one or more virtual machines 100 and the database on the remote access management device 10, which is a virtual server, as will be described later.

[0055] 10 is a block diagram showing an example of a configuration of the virtual server management device 20 of this embodiment. As shown in FIG.

[0056] The virtual server management device 20 can be connected to an external device described later via the communication line network. The communication line network is not particularly limited and may be, for example, the same as described above. The virtual server management device 20 may be incorporated into a system as a physical server, for example. The virtual server management device 20 may be, for example, a personal computer (PC, for example, desktop type or notebook type) in which the program of the present invention is installed. Furthermore, the virtual server management device 20 may be in the form of, for example, cloud computing or edge computing.

[0057] 11 illustrates a block diagram of a hardware configuration of the virtual server management device 20. The virtual server management device 20 includes, for example, a central processing unit (CPU, GPU, etc.) 101, a memory 102, a bus 103, a storage device 104, an input device 105, a display device 106, a communication device 107, an imaging device 108, and an audio input / output device 109. Each part of the virtual server management device 20 is connected to each other via the bus 103 by its respective interface (I / F).

[0058] The central processing unit 101 can be similar to the central processing unit 101 described in the first embodiment, except that the central processing unit 101 functions as the construction processing unit 21, for example.

[0059] Examples of the input device 105 include a touch panel, a keyboard, and a mouse. Examples of the display device 106 include an LED display and a liquid crystal display. Examples of the imaging device 108 include a 2D camera, a 3D camera, and an infrared camera. Examples of the sound input / output device 109 include a microphone and a speaker.

[0060] The memory 102, the bus 103, the storage device 104, and the communication device 107 can be configured as described in the first embodiment.

[0061] Next, an example of the virtual server management method of this embodiment will be described with reference to the flowchart of Fig. 12. The virtual server management method of this embodiment is implemented as follows, for example, using the virtual server management device 20 of Fig. 10. Note that the virtual server management method of this embodiment is not limited to the use of the virtual server management device 20 of Fig. 10.

[0062] In the virtual server management method of this embodiment, the construction processing unit 21 constructs one or more virtual machines on a virtual server by linking them with a facility server, and also constructs a database on the virtual server (S21), and then ends (END). The virtual server is, for example, a remote access management device 10, but is not limited to this. The facility server, the virtual machine, and the database can be described above.

[0063] The construction processing unit 21 may execute the construction after receiving a request from another physical machine, for example. The other physical machine is not particularly limited and may be, for example, the administrator terminal 2 or the like.

[0064] The remote access environment construction method of the present embodiment is a method including the remote access management method shown in Fig. 3 and the virtual server management method shown in Fig. 12. The virtual server management method is processed, for example, prior to the remote access management method.

[0065] According to this embodiment, it is possible to construct a virtual machine and a database on the remote access management device 10, which is a virtual server. Therefore, similar to the first embodiment, higher security can be ensured.

[0066] [Embodiment 3] A description will be given of an example of processing in each of the following cases using the remote access management device 10 described in the first and second embodiments. Note that the remote access management method in each of the following cases can also be implemented, for example, using the remote access management device 10 as follows, but is not limited to the use of the remote access management device 10.

[0067] The database management unit 11 manages a user database, a facility database, an access authority database, an identification information database, a virtual machine database, a lock database, a log database, a reservation database, and the like in advance. An example of each database is shown in FIG. 4. Note that the structure of each database shown in FIG. 4 is an example and is not limited to this. Also, in FIG. 4, items that are the same between the databases (e.g., user ID, etc.) are linked to each other.

[0068] The user database is a database in which the user's identification information and the user's attribute information are associated with each other. The user's identification information is, for example, the same as described above. The user's attribute information includes, for example, the user's contact information (e.g., email address, etc.), the start date of use, the end date of use, the name of the user terminal 1, etc.

[0069] The facility database is a database that associates identification information of the facility server 3 with attribute information of the facility server 3. The identification information of the facility server 3 is, for example, an ID. The attribute information of the facility server 3 is, for example, a facility name, a facility manager's name, a manager's ID, and a contact address (e.g., an email address) of the manager.

[0070] The access authority database is a database in which the identification information of the user and the identification information of the facility server 3 are associated with each other.

[0071] The identification information database is a database that associates the identification information of the user with the identification information of the user terminal 1. The identification information includes, for example, a MAC address and an IP address.

[0072] The virtual machine database is a database that associates identification information of the facility server 3 with identification information of the virtual machine 100. The identification information of the virtual machine 100 is, for example, an ID, a name of the virtual machine 100, etc. The virtual machine database may also associate attribute information of the virtual machine 100, for example. The attribute information of the virtual machine 100 is, for example, an ID (connected user ID) that is assigned to a user when connected to the virtual machine 100, etc.

[0073] The lock database is a database in which identification information of the facility server 3, identification information of the virtual machine 100, and connection status are associated with each other. The connection status indicates whether or not a user terminal 1 is connected to the virtual machine 100. For example, when the virtual machine 100 and the user terminal 1 are connected, identification information of the user terminal 1 may be recorded as the connection status. However, this is not limited to this, and for example, a word such as "connected" may be recorded as the connection status. In the lock database, for example, a record as shown in FIG. 4 may be generated when the virtual machine 100 and the user terminal 1 are connected. When the connection is cut off, the record may be deleted from the lock database. Also, in this case, for example, when there is no user terminal 1 connected to the virtual machine 100, the record is not generated in the lock database. On the other hand, for example, a record may exist for each virtual machine 100 regardless of whether or not a user terminal 1 is connected to the virtual machine 100. In this case, for example, when the virtual machine 100 and the user terminal 1 are connected, identification information of the user terminal 1 or a word such as "connected" may be recorded in the "connection status" of the record. Furthermore, for example, if there is no user terminal 1 connected to the virtual machine 100 or if the connection is cut off, the "connection status" of the record may be left blank.

[0074] The log database is a database that records logs related to connections between the virtual machine 100 corresponding to the facility server 3 and the user terminal 1. Specifically, for example, as shown in the figure, the log database records a log ID, a facility ID, a connection start date and time, a connection end date and time, identification information of the user terminal 1, a name of the user terminal 1, a name of the virtual machine 100, a user ID, and the like in association with each other.

[0075] The reservation database is a database that records reservations related to connections with the virtual machine 100. Specifically, as shown in the figure, the reservation database records, in association with each other, for example, identification information of the user terminal 1 that is the subject of the reservation, the facility name, the virtual machine name, the name of the user who made the reservation, the scheduled date of use, the scheduled start time of use, the scheduled end time of use, and the like.

[0076] When attempting remote access, the user terminal 1 may display, for example, the virtual machine names corresponding to the facility servers 3 for which the user has access authority by the database management unit 11. In addition, the user terminal 1 may display, for example, the names of connectable virtual machines (i.e., the names of virtual machines not connected to other user terminals) and the names of virtual machines that cannot be connected (i.e., the names of virtual machines connected to other user terminals) by the database management unit 11.

[0077] (For new connections) FIG. 5 shows an example of a case where the user terminal 1 newly connects to the facility server 3. First, when there is a request from the user terminal 1 to access the facility server 3, the acquisition unit 12 acquires the user ID (AAA) and password used by the user terminal 1 at the time of login. Next, the inquiry unit 13 inquires the user database and the identification information database about the user ID "AAA" and the password, and confirms that the user is a registered user ((1) in FIG. 5). Then, if the user is a registered user, the inquiry unit 13 inquires the access authority database linked by the user ID (AAA) to confirm to which facility server 3 the user is granted access authority, and identifies the ID of the facility server 3 associated with the user ID "AAA" (facility ID; 001) ((2) in FIG. 5). In addition, the inquiry unit 13 inquires the virtual machine database to identify the name of the virtual machine 100 associated with the ID "001" of the facility server 3 (virtual machine name; VM1, VM2) ((3) in FIG. 5). Then, the execution unit 14 executes a connection between the user terminal 1 and one of the virtual machines whose names are VM1 and VM2, and starts remote access between the user terminal 1 and the facility server 3 via the virtual machine 100 ((7a) in FIG. 5). The selection of either VM1 or VM2 may be made at the discretion of the user, for example, or may be automatically selected in the order of registration in the database.

[0078] As shown in FIG. 5, the query unit 13, for example, identifies the names "VM1 and VM2" of the virtual machines 100 associated with the ID "001" of the facility server 3 (after (3) of FIG. 5), and then queries the lock database to confirm the connection status corresponding to the ID "001" of the facility server 3 and the names "VM1 and VM2" of the virtual machines 100 ((4) of FIG. 5). In the lock database of this example, a record exists indicating that "VM1" is connected to a user terminal with a user ID "BBB". However, since there is no record related to "VM2", this means that there is no user terminal connected to the name "VM2" of the virtual machine 100. In this way, when the connection status indicates that there is no connection to a terminal of another user (connectable status), the execution unit 14 executes a connection between the user terminal 1 and the virtual machine 100 "VM2" having the identified name in the same manner as described above, and starts remote access between the user terminal 1 and the facility server 3 via the virtual machine 100 ((7b) of FIG. 5). That is, a virtual machine 100 that is not connected to a terminal of another user becomes a connectable virtual machine 100. Although not shown, the database management unit 11 records the connection status corresponding to the ID "001" of the facility server 3 and the name "VM2" of the virtual machine 100 in the lock database as a status indicating a connection with the user terminal 1 of the user ID "AAA". Specifically, for example, a record is generated indicating that the virtual machine 100 "VM2" associated with the ID "001" of the facility server 3 and the user terminal 1 of the user ID "AAA" are connected. Note that FIG. 5 shows a form of the lock database in which the record is generated or deleted depending on the connection status, but as described above, the present invention is not limited to this.

[0079] Furthermore, after identifying the names "VM1" and "VM2" of the virtual machines 100 associated with the facility server 3 ID "001" (after (3) in FIG. 5), the inquiry unit 13 may inquire the reservation database to check the reservation status corresponding to the facility server 3 ID "001" and the virtual machine 100 names "VM1" and "VM2." An example of checking the reservation status will be described later.

[0080] Furthermore, when a connection between the user terminal 1 and the virtual machine 100 is established, the inquiry unit 13 may, for example, inquire about the user database and the facility database, and send a message indicating that the connection has been established to the user's contact information and the administrator's contact information ((5) in FIG. 5). Furthermore, when a connection between the user terminal 1 and the virtual machine 100 is terminated, the inquiry unit 13 may, for example, as described below, send a message indicating that the connection has been terminated to the user's contact information and the administrator's contact information.

[0081] Furthermore, when a connection between the user terminal 1 and the virtual machine 100 is established, the database management unit 11 may record a log relating to the connection in the log database, for example. FIG. 5 (6) shows an example of a record (a record with a log ID of "aaa") relating to a connection between the virtual machine 100 "VM1" and the user terminal of user ID "BBB" as the log. Although not shown, the database management unit 11 generates a record (a record with a log ID other than "aaa") relating to a connection between the virtual machine 100 "VM2" and the user terminal 1 of user ID "AAA" after this log ID "aaa", for example, and records the log.

[0082] (If already connected) On the other hand, in (4) of Fig. 5, when the connection status indicates a connection to another user's terminal (connection impossible status), that is, when a record related to the name of the identified virtual machine 100 exists, the execution unit 14 does not execute the connection between the user terminal 1 and the virtual machine 100 having the identified identification information. As shown in Fig. 5, when there are multiple names of the virtual machines 100 ("VM1" and "VM2") associated with the ID "001" of the facility server 3, for example, even if the connection status for the virtual machine "VM1" is the connection impossible status, if the connection status for the virtual machine "VM2" is the connection possible status, the execution unit 14 executes the connection with the virtual machine "VM2".

[0083] (When making a reservation for remote access) FIG. 6 shows an example of a case where the user terminal 1 makes a reservation for remote access. First, as described in FIG. 5, the device 10 confirms that the user is a registered user, confirms which facility server 3 the user has been granted access to, identifies the ID of the facility server 3 associated with the user ID, and identifies the name of the virtual machine 100. Then, the database management unit 11 may, for example, display a reservation status calendar of the virtual machine 100 corresponding to the ID of the facility server 3 on the user terminal 1 based on the reservation database (FIG. 6(1)). The reservation status calendar is information indicating a reserved date and time and a reservation available date and time. The reserved date and time is a date and time when the virtual machine 100 is in a connection unavailable state due to the user himself or other users at the time of display. On the other hand, the reservation available date and time is a date and time when the virtual machine 100 is in a connection available state at the time of display. The acquisition unit 12 acquires reservation information of the virtual machine 100 corresponding to the user from the user terminal 1 on which the reservation status calendar is displayed, for example. Specifically, the acquisition unit 12 acquires reservation information including, for example, the date and time selected by the user terminal 1. Next, the database management unit 11 registers a reservation for connection to the virtual machine 100 in the reservation database based on, for example, the reservation information ( FIG. 6(2)). Specifically, for example, as shown in the figure, the reservation database registers identification information of the user who made the reservation, identification information of the user terminal 1, identification information of the facility, identification information of the virtual machine 100, and the reservation date and time in association with each other.

[0084] When the reservation information is registered in the reservation database, for example, as shown in Fig. 6, the database management unit 11 may display the reservation status based on the reservation database on the user terminal 1 (Fig. 6(3)). The reservation status is the reservation information registered in the reservation database.

[0085] 7 shows an example of a case where a reservation has been made for the time period when the new connection is made. For example, as described above, the names "VM1" and "VM2" of the virtual machines 100 associated with the facility server 3 ID "001" are identified (FIG. 5 (3)). After that, the inquiry unit 13 may, for example, inquire into the reservation database to confirm the reservation status corresponding to the facility server 3 ID "001" and the virtual machine 100 names "VM1" and "VM2" (FIG. 7 (1)). In this example, as shown in the figure, it is assumed that a user ID "BBB" has reserved a connection to a virtual machine named "VM1" at a facility named "Facility 1". In this way, when there is a reservation and the user ID "BBB" is not connected to the virtual machine name "VM1" of the facility name "Facility 1" during the reserved time period, the inquiry unit 13 may, for example, inquire the user database linked by the user ID "BBB" to confirm the contact information of the user with the user ID "BBB" and send a message to the contact information indicating that the user terminal 1 with the user ID "AAA" has connected to the virtual machine name "VM1" of the facility name "Facility 1" during the reserved time period ((3) in FIG. 7). In addition, the execution unit 14 executes the connection between the user terminal 1 with the user ID "AAA" and the virtual machine 100, for example, in the same manner as described above ((4) in FIG. 7). In this way, the reservation database clearly indicates the reservation and does not give priority to the reserved connection (the connection between the user ID (reservation person) and the corresponding virtual machine 100).

[0086] (When logging off or terminating remote access) Fig. 8 shows an example of a case where the remote access is terminated and a case where the logoff is performed. For example, as described above, the logoff is performed when the access request from the user terminal 1 is not confirmed for a certain period of time after logging in to the device 10 (Fig. 8(1)). On the other hand, for example, the logoff may be processed when a logoff request is made from the user terminal 1.

[0087] The remote access is terminated, for example, as described above, when the behavior due to the user's operation cannot be confirmed for a certain period of time. On the other hand, the remote access may be terminated, for example, when a request for termination is received from the user terminal 1. When the execution unit 14 terminates the remote access, the database management unit 11, for example, queries the lock database and changes the connection status of the virtual machine 100 connected to the user terminal 1 to a connectable status (FIG. 8(2)). Note that FIG. 8 illustrates a form of the lock database in which a record exists for each virtual machine 100, unlike the example illustrated in FIG. 5, but as described above, this is not limiting. Furthermore, the database management unit 11, for example, queries the log database and updates the usage end date and time related to the connection (FIG. 8(3)). In addition, the query unit 13, for example, queries the facility database and may send a message indicating that the connection has been terminated or that the administrator has logged off to the administrator's contact point (FIG. 8(4)).

[0088] Although an example of the process in each case has been described above, in each case, as in the first and second embodiments, higher security can be ensured. Furthermore, according to this embodiment, a lock database, a reservation database, etc. are utilized to prevent multiple users from accessing the same connection destination. This prevents a situation in which a previous connection is disconnected without logging out, and high security can be ensured. Furthermore, according to this embodiment, the administrator can be assisted in grasping the connection status and logs, etc., by utilizing a lock database, a log database, etc., and by sending various messages. In this way, according to this embodiment, it is possible to assist the administrator in managing and monitoring remote access. Furthermore, according to this embodiment, the messages are also sent to the user, so that it is possible to assist the administrator in grasping the connection status, etc.

[0089] [Embodiment 4] The program of this embodiment is a program for causing a computer to execute each step of the method of the present invention as a procedure. In the present invention, the "procedure" may be read as "processing." The program of this embodiment may be recorded, for example, in a computer-readable recording medium. The recording medium is, for example, a non-transitory computer-readable storage medium. The recording medium is not particularly limited, and examples thereof include a read-only memory (ROM), a hard disk (HD), and an optical disk.

[0090] The composite program of the present embodiment includes two or more of the programs of the present invention. The composite program of the present embodiment may be recorded on one or more of the recording media.

[0091] Although the present invention has been described above with reference to the embodiment, the present invention is not limited to the above embodiment. Various modifications that can be understood by those skilled in the art can be made to the configuration and details of the present invention within the scope of the present invention.

[0092] <Additional Notes> Some or all of the above embodiments may be described as follows, but are not limited to the following supplementary notes. (Appendix 1) The system includes a database management unit, an acquisition unit, a query unit, and an execution unit; the database management unit manages a database relating to associations between users, facility servers, and virtual machines; The facility server is associated with one or more of the virtual machines, The virtual machine is constructed on a virtual server, the acquiring unit acquires identification information regarding a user requesting access to the facility server and identification information of a terminal of the user; the query unit queries the database for each of the identification information to identify a facility server for which the user has access authority and a virtual machine associated with the facility server; The execution unit executes a connection between the user's terminal and the virtual machine, and initiates remote access between the user's terminal and the facility server via the virtual machine. (Appendix 2) the database management unit manages a user database, a facility database, an access authority database, an identification information database, and a virtual machine database; the user database is a database in which identification information of the user is associated with attribute information of the user; the facility database is a database in which identification information of the facility server is associated with attribute information of the facility server, the access authority database is a database in which identification information of the user is associated with identification information of the facility server, the identification information database is a database in which the identification information of the user is associated with the identification information of the user's terminal, the virtual machine database is a database in which identification information of the facility server is associated with identification information of the virtual machine; the query unit queries the user database and the identification information database for the user's identification information to confirm whether the user is a user registered in each database; If the user is a registered user, the query unit queries the access authority database to identify the facility server identification information associated with the user identification information, and queries the virtual machine database to identify the virtual machine identification information associated with the facility server identification information; The remote access management device of claim 1, wherein the execution unit executes a connection between the user's terminal and the virtual machine having the specified identification information, and initiates remote access between the user's terminal and the facility server via the virtual machine. (Appendix 3) The database management unit further manages a lock database; the lock database is a database in which identification information of the facility server, identification information of the virtual machine, and a connection status are associated with each other; the query unit, after identifying the identification information of the virtual machine associated with the identification information of the facility server, queries the lock database to confirm a connection status corresponding to the identification information of the facility server and the identification information of the virtual machine; When the connection status indicates that the terminal is not connected to another user's terminal, the execution unit executes a connection between the user's terminal and the virtual machine having the specified identification information, and initiates remote access between the user's terminal and the facility server via the virtual machine; The remote access management device according to claim 2, wherein the database management unit records in the lock database a connection status corresponding to the identification information of the facility server and the identification information of the virtual machine as a status indicating that the facility server is connected to the user's terminal. (Appendix 4) When the connection status indicates that the terminal is connected to another user's terminal, 4. The remote access management device according to claim 3, wherein the execution unit does not execute a connection between the user's terminal and the virtual machine having the specified identification information. (Appendix 5) The user database further includes a contact list for the user. The facility database further includes a contact information for an administrator of the facility server. When a connection between the user's terminal and the virtual machine is established, 5. The remote access management device according to claim 2, wherein the query unit queries the user database and the facility database, and sends a message to the user's contact and the administrator's contact indicating that the connection has been made. (Appendix 6) The database management unit further manages a log database, 6. The remote access management device according to any one of appendixes 1 to 5, wherein the log database is a database that records logs relating to connections between the virtual machine corresponding to the facility server and the user's terminal. (Appendix 7) The database management unit further manages a reservation database; the reservation database is a database for recording reservations regarding connections to the virtual machines; The acquisition unit acquires reservation information of the virtual machine corresponding to the user, 7. The remote access management device according to claim 1, wherein the database management unit registers a reservation for connection to the virtual machine in the reservation database based on the reservation information. (Appendix 8) Further, the system includes a monitoring unit, The monitoring unit monitors the behavior of the user's terminal, the execution unit, when the monitoring unit cannot confirm the access request for a certain period of time after the user logs in to the remote access management device, logs off the terminal of the user who logged in from the remote access management device; and 8. The remote access management device according to claim 1, wherein if the monitoring unit is unable to confirm the behavior due to the user's operation for a certain period of time after connection to the virtual machine, the monitoring unit terminates the connection between the user's terminal and the virtual machine having the specified identification information. (Appendix 9) 9. The remote access management device according to any one of appendixes 1 to 8, wherein the remote access management device is the virtual server on a cloud, and the virtual machine is constructed on the virtual server. (Appendix 10) A construction processing unit is included, the construction processing unit constructs one or more virtual machines on a virtual server in association with a facility server, and constructs a database on the virtual server; The virtual server management device, wherein the database is a database relating to associations between users, facility servers, and virtual machines. (Appendix 11) A remote access management device according to any one of appendixes 1 to 9 and a virtual server management device according to appendix 10, The virtual server management device is a remote access environment construction system device that constructs the virtual machine and the database on the remote access management device, which is a virtual server. (Appendix 12) The method includes a database management step, an acquisition step, a query step, and an execution step; The database management step includes managing a database relating to associations between users, facility servers, and virtual machines; The facility server is associated with one or more of the virtual machines, The virtual machine is constructed on a virtual server, The acquiring step acquires identification information regarding a user requesting access to the facility server and identification information of a terminal of the user, The query step queries the database for each of the identification information to identify a facility server to which the user has access authority and a virtual machine associated with the facility server; A remote access management method, wherein the executing step executes a connection between the user's terminal and the virtual machine, and initiates remote access between the user's terminal and the facility server via the virtual machine. (Appendix 13) The database management step includes managing a user database, a facility database, an access authority database, an identification information database, and a virtual machine database; the user database is a database in which identification information of the user is associated with attribute information of the user; the facility database is a database in which identification information of the facility server is associated with attribute information of the facility server, the access authority database is a database in which identification information of the user is associated with identification information of the facility server, the identification information database is a database in which the identification information of the user is associated with the identification information of the user's terminal, the virtual machine database is a database in which identification information of the facility server is associated with identification information of the virtual machine; the query step queries the user database and the identification information database for the user's identification information to confirm whether the user is a user registered in each database; If the user is a registered user, the query step queries the access authority database to identify the facility server identification information associated with the user identification information, and queries the virtual machine database to identify the virtual machine identification information associated with the facility server identification information; The remote access management method of claim 12, wherein the execution step executes a connection between the user's terminal and the virtual machine having the specified identification information, and initiates remote access between the user's terminal and the facility server via the virtual machine. (Appendix 14) The database management step further includes managing a lock database; the lock database is a database in which identification information of the facility server, identification information of the virtual machine, and a connection status are associated with each other; the query step includes identifying the identification information of the virtual machine associated with the identification information of the facility server, and then querying the lock database to confirm a connection status corresponding to the identification information of the facility server and the identification information of the virtual machine; When the connection status indicates that the terminal is not connected to another user's terminal, the executing step includes executing a connection between the user's terminal and the virtual machine having the specified identification information, and starting remote access between the user's terminal and the facility server via the virtual machine; The remote access management method of claim 13, wherein the database management step records in the lock database a connection status corresponding to the identification information of the facility server and the identification information of the virtual machine as a status indicating that the connection is made to the user's terminal. (Appendix 15) When the connection status indicates that the terminal is connected to another user's terminal, 15. The remote access management method according to claim 14, wherein the executing step does not execute a connection between the user's terminal and the virtual machine having the specified identification information. (Appendix 16) The user database further includes a contact list for the user. The facility database further includes a contact information for an administrator of the facility server. When a connection between the user's terminal and the virtual machine is established, 16. The remote access management method of any one of appendices 13 to 15, wherein the query step queries the user database and the facility database, and sends a message to the user's contact and the administrator's contact indicating that the connection has been performed. (Appendix 17) The database management step further includes managing a log database; 17. The remote access management method according to any one of appendices 12 to 16, wherein the log database is a database that records logs relating to connections between the virtual machine corresponding to the facility server and the user's terminal. (Appendix 18) The database management step further includes managing a reservation database; the reservation database is a database for recording reservations regarding connections to the virtual machines; The acquiring step acquires reservation information of the virtual machine corresponding to the user, 18. The remote access management method according to any one of appendices 12 to 17, wherein the database management step registers a reservation for connection to the virtual machine in the reservation database based on the reservation information. (Appendix 19) Further, a monitoring step is included, The monitoring step monitors the behavior of the user's terminal; The execution step includes, when the access request cannot be confirmed for a certain period of time after logging in to the remote access management device by the monitoring step, logging off the terminal of the logged-in user from the remote access management device; and 19. The remote access management method according to any one of Appendices 12 to 18, wherein if the behavior due to the user's operation cannot be confirmed for a certain period of time after connection to the virtual machine by the monitoring step, the connection between the user's terminal and the virtual machine having the specified identification information is terminated. (Appendix 20) 20. The remote access management method according to any one of appendices 12 to 19, wherein an apparatus for executing the remote access management method is the virtual server on a cloud, and the virtual machine is constructed on the virtual server. (Appendix 21) A construction process is included. The construction process includes constructing one or more virtual machines on a virtual server in association with a facility server, and constructing a database on the virtual server; A virtual server management method, wherein the database is a database relating to associations between users, facility servers, and virtual machines. (Appendix 22) A remote access management method according to any one of claims 12 to 20 and a virtual server management method according to claim 21, A remote access environment construction method, comprising constructing the virtual machine and the database on a virtual server by the virtual server management method. (Appendix 23) a program for causing a computer to carry out procedures including database management procedures, retrieval procedures, query procedures and execution procedures; The database management step includes managing a database relating to associations between users, the facility servers, and the virtual machines; The facility server is associated with one or more of the virtual machines, The virtual machine is constructed on a virtual server, the obtaining step obtains identification information regarding a user requesting access to the facility server and identification information of a terminal of the user; The query step queries the database for each of the identification information to identify a facility server to which the user has access authority and a virtual machine associated with the facility server; The execution procedure executes a connection between the user's terminal and the virtual machine, and initiates remote access between the user's terminal and the facility server via the virtual machine. (Appendix 24) The database management procedure manages a user database, a facility database, an access authority database, an identity information database, and a virtual machine database; the user database is a database in which identification information of the user is associated with attribute information of the user; the facility database is a database in which identification information of the facility server is associated with attribute information of the facility server, the access authority database is a database in which identification information of the user is associated with identification information of the facility server, the identification information database is a database in which the identification information of the user is associated with the identification information of the user's terminal, the virtual machine database is a database in which identification information of the facility server is associated with identification information of the virtual machine; the inquiry step inquires about the user's identification information in the user database and the identification information database, respectively, to confirm whether the user is a user registered in each database; If the user is a registered user, the query step queries the access authority database to identify the facility server identification information associated with the user identification information, and queries the virtual machine database to identify the virtual machine identification information associated with the facility server identification information; The program described in Appendix 23, wherein the execution procedure executes a connection between the user's terminal and the virtual machine having the specified identification information, and initiates remote access between the user's terminal and the facility server via the virtual machine. (Appendix 25) The database management procedure further comprises managing a lock database; the lock database is a database in which identification information of the facility server, identification information of the virtual machine, and a connection status are associated with each other; the inquiry step includes identifying the identification information of the facility server and the identification information of the virtual machine associated with the identification information of the facility server, and then inquiring the lock database to confirm a connection status corresponding to the identification information of the facility server and the identification information of the virtual machine; When the connection status indicates that the terminal is not connected to another user's terminal, the execution step includes executing a connection between the user's terminal and the virtual machine having the specified identification information, and starting remote access between the user's terminal and the facility server via the virtual machine; The program described in Appendix 24, wherein the database management procedure records in the lock database a connection status corresponding to the identification information of the facility server and the identification information of the virtual machine to a state indicating that the connection is made to the user's terminal. (Appendix 26) When the connection status indicates that the terminal is connected to another user's terminal, The program described in Appendix 25, wherein the execution procedure does not execute a connection between the user's terminal and the virtual machine having the specified identification information. (Appendix 27) The user database further includes a contact list for the user. The facility database further includes a contact information for an administrator of the facility server. When a connection between the user's terminal and the virtual machine is established, 27. The program of any one of claims 24 to 26, wherein the query procedure queries the user database and the facility database and sends a message to the user's contact and the administrator's contact indicating that the connection has been made. (Appendix 28) The database management procedure further comprises managing a log database; 28. The program described in any one of appendices 23 to 27, wherein the log database is a database that records logs regarding connections between the virtual machine corresponding to the facility server and the user's terminal. (Appendix 29) The database management procedure further comprises managing a reservation database; the reservation database is a database for recording reservations regarding connections to the virtual machines; The obtaining step obtains reservation information of the virtual machine corresponding to the user; The program according to any one of appendices 23 to 28, wherein the database management procedure registers a reservation for connection to the virtual machine in the reservation database based on the reservation information. (Appendix 30) In addition, it includes monitoring procedures, The monitoring step monitors the behavior of the user's terminal; The execution step includes, when the access request cannot be confirmed for a certain period of time after logging in to the remote access management device by the monitoring step, logging off the terminal of the logged-in user from the remote access management device; A program described in any one of Appendices 23 to 29, which terminates the connection between the user's terminal and the virtual machine having the identified identification information if the behavior due to the user's operation cannot be confirmed for a certain period of time after connection to the virtual machine through the monitoring procedure. (Appendix 31) The program described in any one of Appendices 23 to 30, wherein the device that executes the program is the virtual server on a cloud, and the virtual machine is constructed on the virtual server. (Appendix 32) a program for causing a computer to carry out steps including construction process steps; The construction process includes constructing one or more virtual machines on a virtual server in association with a facility server, and constructing a database on the virtual server; The database is a database relating to associations between users, facility servers, and virtual machines. (Appendix 33) A first program according to any one of appendices 23 to 31 and a second program according to appendices 32, A composite program that constructs the virtual machine and the database on a virtual server by the second program. (Appendix 34) A computer-readable recording medium having recorded thereon a program according to any one of appendices 23 to 33. [Industrial Applicability]

[0093] According to the present invention, it is possible to improve security, and therefore the present invention is useful, for example, in cases where remote access is performed. [Explanation of symbols]

[0094] 1 User terminal 2. Administrator terminal 3 Facility Server 10. Remote access management device 11 Database Management Department 12 Acquisition Department 13 Enquiry Section 14 Executive Department 15 Monitoring Department 16 Virtual Machine Construction Department 20 Virtual Server Management Device 21 Construction Processing Section 100 Virtual Machines 101 Central Processing Unit 102 Memory 103 Bus 104 Storage device 105 Communication Devices 1000 Remote access environment construction system device

Claims

1. The system includes a database management unit, an acquisition unit, a query unit, and an execution unit; the database management unit manages a database relating to associations between users, facility servers, and virtual machines; The facility server is associated with one or more of the virtual machines, The virtual machine is constructed on a virtual server, the acquiring unit acquires identification information regarding a user requesting access to the facility server and identification information of a terminal of the user; the database management unit manages a user database, a facility database, an access authority database, an identification information database, and a virtual machine database; the user database is a database in which identification information of the user is associated with attribute information of the user; the facility database is a database in which identification information of the facility server is associated with attribute information of the facility server, the access authority database is a database in which identification information of the user is associated with identification information of the facility server, the identification information database is a database in which the identification information of the user is associated with the identification information of the user's terminal, the virtual machine database is a database in which identification information of the facility server is associated with identification information of the virtual machine; the query unit queries the user database and the identification information database for the user's identification information to confirm whether the user is a user registered in each database; If the user is a registered user, the query unit queries the access authority database to identify the facility server identification information associated with the user identification information, and queries the virtual machine database to identify the virtual machine identification information associated with the facility server identification information; The execution unit is a remote access management device that executes a connection between the user's terminal and the virtual machine having the specified identification information, and initiates remote access between the user's terminal and the facility server via the virtual machine.

2. A system including the remote access management device according to claim 1 and a virtual server management device, The virtual server management device includes a construction processing unit, the construction processing unit constructs one or more virtual machines on a virtual server in association with a facility server, and constructs a database on the virtual server; the database is a database relating to associations between users, facility servers, and virtual machines; The virtual server is the remote access management device.

3. The method includes a database management step, an acquisition step, a query step, and an execution step; The database management step includes managing a database relating to associations between users, facility servers, and virtual machines; The facility server is associated with one or more of the virtual machines, The virtual machine is constructed on a virtual server, The acquiring step acquires identification information regarding a user requesting access to the facility server and identification information of a terminal of the user, The database management step includes managing a user database, a facility database, an access authority database, an identification information database, and a virtual machine database; the user database is a database in which identification information of the user is associated with attribute information of the user; the facility database is a database in which identification information of the facility server is associated with attribute information of the facility server, the access authority database is a database in which identification information of the user is associated with identification information of the facility server, the identification information database is a database in which the identification information of the user is associated with the identification information of the user's terminal, the virtual machine database is a database in which identification information of the facility server is associated with identification information of the virtual machine; the query step queries the user database and the identification information database for the user's identification information to confirm whether the user is a user registered in each database; If the user is a registered user, the query step queries the access authority database to identify the facility server identification information associated with the user identification information, and queries the virtual machine database to identify the virtual machine identification information associated with the facility server identification information; The execution step includes executing a connection between the user's terminal and the virtual machine having the specified identification information, and starting remote access between the user's terminal and the facility server via the virtual machine. A remote access management method, in which each of the steps is executed by a computer.

4. The remote access management method according to claim 3 and a virtual server management method, The virtual server management method includes a construction process, The construction process includes constructing one or more virtual machines on a virtual server in association with a facility server, and constructing a database on the virtual server; the database is a database relating to associations between users, facility servers, and virtual machines; The virtual server is a remote access management device that implements the remote access management method. A remote access environment construction method, in which each of the steps is executed by a computer.

5. a program for causing a computer to carry out procedures including database management procedures, retrieval procedures, query procedures, and execution procedures; The database management procedure includes managing a database relating to associations between users, facility servers, and virtual machines; The facility server is associated with one or more of the virtual machines, The virtual machine is constructed on a virtual server, the obtaining step obtains identification information regarding a user requesting access to the facility server and identification information of a terminal of the user; The database management procedure manages a user database, a facility database, an access authority database, an identity information database, and a virtual machine database; the user database is a database in which identification information of the user is associated with attribute information of the user; the facility database is a database in which identification information of the facility server is associated with attribute information of the facility server, the access authority database is a database in which identification information of the user is associated with identification information of the facility server, the identification information database is a database in which the identification information of the user is associated with the identification information of the user's terminal, the virtual machine database is a database in which identification information of the facility server is associated with identification information of the virtual machine; the inquiry step inquires about the user's identification information in the user database and the identification information database, respectively, to confirm whether the user is a user registered in each database; If the user is a registered user, the query step queries the access authority database to identify the facility server identification information associated with the user identification information, and queries the virtual machine database to identify the virtual machine identification information associated with the facility server identification information; The execution procedure executes a connection between the user's terminal and the virtual machine having the specified identification information, and initiates remote access between the user's terminal and the facility server via the virtual machine.

6. A program including the first program according to claim 5 and a second program, the second program is a program for causing a computer to execute a procedure including a construction processing procedure, The construction process includes constructing one or more virtual machines on a virtual server in association with a facility server, and constructing a database on the virtual server; the database is a database relating to associations between users, facility servers, and virtual machines; The virtual server is a remote access management device that executes the first program.

Images