VPN access control system, operating method thereof, program, VPN router, and server

Patent metadata

Field	Value
Publication number	US-10637830-B2
Application number	US-201514843954-A
Country	US
Kind code	B2
Filing date	Sep 2, 2015
Priority date	Sep 18, 2014
Publication date	Apr 28, 2020
Grant date	Apr 28, 2020

Abstract

To provide a VPN access control system, an operating method thereof, a non-transitory computer-readable recording medium having a program recorded thereon, a VPN router, and a server capable of reducing the effort of work of an administrator and quickly permitting remote access. A VPN access control system includes a VPN router and an image server. The VPN router executes a router authentication process based on router authentication information, and the image server executes a server authentication process based on server authentication information. The image server receives an access right granting request from a portable terminal of a registered user to which the access right has been granted and executes a first user registration process. The VPN router executes a second user registration process based on a command from the image server, and transmits an authentication information notification to a user who is an access right granting target.

First claim

What is claimed is:

1. A VPN access control system including a VPN router having an authentication function of providing access permission based on router authentication information in case where receiving an access request from a terminal of a registered user to which an access right has been granted, and a server having an authentication function of providing access permission based on server authentication information separate from the router authentication information in case where receiving the access request from the terminal of the registered user via the VPN router, the VPN access control system controlling remote access to an internal communication network to which the server is connected, from an external communication network of the VPN router,
wherein the server includes:
a hardware processor configured at least to:
receive, from the terminal of the registered user which is stored in a first user registration table within the server as a permanent user, an access right granting request for automatically granting the access right to a terminal of an unregistered user who is not a same user as the registered user and is stored in the first user registration table as a temporary user and to which the access right to the VPN router and the server has not been granted, wherein the access right has been granted for the terminal of the registered user;
execute issuing of the server authentication information and first user registration for granting an access right to access the server for the unregistered user for a validity duration based on the access right granting request in response to receiving the access right request, wherein the server authentication including first temporary identification data and first temporary password for the unregistered user to access the server are registered to the first user registration table when the first user registration is executed; and
issue automatically, to the VPN router through an intranet without going through an external network or an internet, a command including the server authentication information and instructing the VPN router to issue the router authentication information different from the server authentication information to perform second user registration for the terminal for the unregistered user, and

the VPN router includes:
a hardware processor configured at least to:
issue automatically the router authentication information based on the command and execute the second user registration for granting an access to access the VPN router for the terminal of the unregistered user in response to receiving the command, wherein the router authentication including second temporary identification data and a second temporary password for the unregistered user to access the VPN router are registered to a second user registration table within the VPN router when the second user registration is executed; and

transmit authentication information including the router authentication information and the server authentication information to the terminal of the unregistered user.

2. The VPN access control system according to claim 1 ,
wherein a destination of the unregistered user is included in the access right granting request, and
the hardware processor of the VPN router transmits the authentication information to the destination.

3. The VPN access control system according to claim 1 ,
wherein the hardware processor of the server transmits the server authentication information and the command in an e-mail format to the VPN router.

4. The VPN access control system according to claim 2 ,
wherein the hardware processor of the server transmits the server authentication information and the command in an e-mail format to the VPN router.

5. The VPN access control system according to claim 1 ,
wherein VPN client software for performing the remote access is installed in the terminal of the registered user, and
the VPN router receives the router authentication information through the VPN client software.

6. The VPN access control system according to claim 2 ,
wherein VPN client software for performing the remote access is installed in the terminal of the registered user, and
the VPN router receives the router authentication information through the VPN client software.

7. The VPN access control system according to claim 3 ,
wherein VPN client software for performing the remote access is installed in the terminal of the registered user, and
the VPN router receives the router authentication information through the VPN client software.

8. The VPN access control system according to claim 5 ,
wherein the hardware processor of the VPN router encrypts the server authentication information and the router authentication information into information that is decrypted by the VPN client software, and transmits the encrypted information.

9. The VPN access control system according to claim 6 ,
wherein the hardware processor of the VPN router encrypts the server authentication information and the router authentication information into information that can be decrypted by the VPN client software, and transmits the encrypted information.

10. The VPN access control system according to claim 8 ,
wherein the hardware processor of the VPN router also encrypts an address of the server.

11. The VPN access control system according to claim 1 ,
wherein the hardware processor of the server or the hardware processor of the VPN router has a validity period setting function of setting a validity period of the router authentication information or the server authentication information.

12. The VPN access control system according to claim 11 ,
wherein the validity period of the access right is designated in the access right granting request, and
the hardware processor of the server or the hardware processor of the VPN router sets the validity period of the server authentication information or the router authentication information based on the designation.

13. The VPN access control system according to claim 12 ,
wherein the hardware processor of the server or the hardware processor of the VPN router sets an initial value of the validity period set in advance in case where there is no designation.

14. The VPN access control system according to claim 1 ,
wherein the VPN router determines that the command is included in the IP packet in case where the source address is the server and the destination address is the VPN router by referring to address information of the received IP packet.

15. The VPN access control system according to claim 1 ,
wherein the server is a medical information server that distributes medical information.

16. The VPN access control system according to claim 15 ,
wherein the medical information server is installed in a medical facility.

17. A method of operating a VPN access control system including a VPN router having an authentication function of providing access permission based on router authentication information in case where receiving an access request from a terminal of a registered user to which an access right has been granted, and a server having an authentication function of providing access permission based on server authentication information separate from the router authentication information in case where receiving the access request from the terminal of the registered user via the VPN router, the VPN access control system controlling remote access to an internal communication network to which the server is connected, from an external communication network of the VPN router,
wherein the s

Assignees

• Fujifilm Corp

Inventors

• Yaguchi Takamasa
• Ohta Yasunori
• Ueda Satoshi
• Kudo Yuya
• Usami Ryosuke
• Matsumasa Hironori

Classifications

• H04L63/102

  Entity profiles · CPC title

• H04L63/0272 Primary

  Virtual private networks · CPC title

• H04L63/08

  for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32) · CPC title