JP6744030B2 - Home gateway device, connection terminal access management method, and connection terminal access management program - Google Patents

Description

The present invention relates to a home gateway device, a connection terminal access management method, and a connection terminal access management program, and more particularly to a home gateway device and connection terminal access management capable of easily managing access of a connecting terminal to an Internet network or a server. A method and a connection terminal access control program.

In recent years, with the spread of the Internet network and the improvement of infrastructure, information collection using the Internet network and exchange of information by mail have become common environments. Even in office work, the Internet network is indispensable for developing information and accumulating information in a server on the network. In a small office, a home gateway device (Home Gateway device: hereinafter abbreviated as “HGW device”) and a router are installed, and terminals such as personal computers are connected under the router to use the Internet network. There is.

Here, in the office, in response to the recent heightened awareness of security and information leakage, Japanese Patent Publication No. 2013-512633 “Power saving by management of session between home gateway and broadband access node”. In many cases, information about terminals that are permitted to access the Internet network or the in-house network is registered in advance as a whitelist in the HGW device and is used. Then, for example, when a terminal not registered in the whitelist is connected to the HGW device, the HGW device can prevent unauthorized access by denying access to the Internet network or the company network. I have to.

Japanese Patent Publication No. 2013-512633

However, the current technology related to the present invention has the following problems.

The first problem is that the security settings for making the Internet network and the company network available are complicated. The reason is that it is necessary to grasp the information necessary for identifying the terminal and reflect the setting in the HGW device, and it is necessary to change the setting by a person each time.

The second problem is that even if the terminal can be trusted, the HGW device cannot easily connect to the Internet network or the company network due to the security function. The reason is that, exceptionally, there is no means in the HGW device that can connect the terminal to the in-house network.

In other words, in the current technology, it is difficult to flexibly change the information registered as a terminal that can be connected to the whitelist, because the whitelist is strictly managed from the viewpoint of security. It is assumed that the reason for this is that in the office, the whitelisted terminals correspond to the PCs used by employees for their work, and are often terminals that are permanently installed in the office. Because it is.

However, the personal computers brought by employees or customers who have visited other offices visiting the office are not registered in the white list, so the visited office cannot use the Internet network or the company network. In order to use it at the visited office, the administrator of the in-house network confirms information such as the MAC address in order to uniquely identify each terminal of the visitor, and changes the whitelist setting of the HGW device. As a result, the Internet network and company network can be used for the first time. As described above, the procedure for registering the whitelist is complicated and time-consuming.

(Purpose of the present invention)
The present invention has been made in view of the above circumstances, and a home gateway device, a connection terminal access management method, and a connection terminal capable of easily managing access of a connecting terminal to an Internet network or a server. Its purpose is to provide an access control program.

In order to solve the above problems, the home gateway device, the connection terminal access management method, and the connection terminal access management program according to the present invention mainly employ the following characteristic configurations.

(1) The home gateway device according to the present invention is
In the home gateway device that controls the connection between the terminal and the Internet network,
A temporarily permitted terminal whitelist for registering terminal information of the terminal for temporarily permitting access to the Internet network;
When it is detected that a removable medium storing the key information for registration in the white list for temporary permitted terminals or a removable auxiliary storage device is connected, is the key information appropriate key information? If it is determined whether the key information is appropriate, a key information control unit that outputs a determination result indicating that the removable medium or the removable auxiliary storage device is connected,
When the terminal is connected within a period from the acquisition of the determination result output by the key information control unit to the elapse of a predetermined allowable time, the terminal including the MAC address of the terminal The terminal information is registered in the temporary permitted terminal white list, and thereafter, access control means for permitting access from the terminal to the Internet network is provided.

(2) The connection terminal access management method according to the present invention is
A connection terminal access management method in a home gateway device for controlling a connection between a terminal and an internet network, comprising:
A temporarily permitted terminal whitelist for registering terminal information of the terminal for temporarily permitting access to the Internet network;
When it is detected that a removable medium storing the key information for registration in the white list for temporary permitted terminals or a removable auxiliary storage device is connected, is the key information appropriate key information? A key information control step of outputting a determination result indicating that the removable medium or the removable auxiliary storage device is connected, if the key information is appropriate.
In the case where the terminal is connected before the predetermined allowable time elapses after the determination result output by the key information control step is acquired, the terminal including the MAC address of the terminal An access control step of registering the terminal information in the temporarily permitted terminal white list and permitting the terminal to access the Internet network thereafter.

(3) The connection terminal access management program according to the present invention is
A connection terminal access management program for causing a computer to execute an operation of managing access of a connection terminal in a home gateway device that controls a connection between a terminal and an Internet network,
A temporarily permitted terminal whitelist for registering terminal information of the terminal for temporarily permitting access to the Internet network;
When it is detected that a removable medium storing the key information for registration in the white list for temporary permitted terminals or a removable auxiliary storage device is connected, is the key information appropriate key information? If it is determined whether the key information is appropriate, a key information control process for outputting a determination result indicating that the removable medium or the removable auxiliary storage device is connected,
When the terminal is connected before the predetermined allowable time elapses after the determination result output by the key information control process is acquired, the terminal including the MAC address of the terminal The terminal information is registered in the temporary permitted terminal white list, and thereafter, access control processing for permitting the terminal to access the Internet network is performed.

According to the home gateway device, the connection terminal access management method, and the connection terminal access management program of the present invention, the following effects can be achieved.

According to the present invention, even if the terminal information (MAC address or the like) regarding the terminal that is permitted to access the Internet network is not registered in advance in the white list of the HGW device, the terminal is temporarily permitted to access the Internet network. It can be given easily and the registration work time can be shortened. The reason is that the removable media or removable auxiliary storage device that is prepared in advance as a key necessary for registering the terminal on the temporarily permitted terminal white list that allows temporary access is connected to the HGW device. After that, the HGW device is provided with a function of automatically registering the terminal information about the connected terminals until the predetermined allowable time elapses in the temporarily permitted terminal white list.

Furthermore, the existing HGW device and the network environment can be used as they are, and there is no need to prepare or purchase a dedicated device again. The reason is that by expanding the program (firmware) of the HGW device, it becomes possible to execute the mechanism related to the registration operation to the white list of the temporarily permitted terminals.

It is a connection block diagram which shows an example of the connection structure of the HGW apparatus which concerns on this invention. FIG. 2 is a block configuration diagram showing in detail an example of an internal configuration of the HGW device shown in FIG. 1. It is a schematic diagram which shows an example of the whitelist with which the HGW apparatus shown in FIG. 1 is equipped. It is a connection block diagram which shows another example different from FIG. 1 of the connection structure of the HGW apparatus which concerns on this invention. It is a schematic diagram which shows an example of the white list with which the inside of the HGW apparatus shown in FIG. 4 is equipped.

Hereinafter, preferred embodiments of a home gateway device, a connection terminal access management method, and a connection terminal access management program according to the present invention will be described with reference to the accompanying drawings. In the following description, the home gateway device and the connection terminal access management method according to the present invention will be described, but the connection terminal access management method may be implemented as a connection terminal access management program executable by a computer. It goes without saying that the connection terminal access management program may be recorded in a computer-readable recording medium. In addition, the drawing reference numerals attached to the following drawings are added for convenience to each element as an example for helping understanding, and it goes without saying that the present invention is not intended to be limited to the illustrated embodiments. Yes.

(Characteristics of the present invention)
Prior to the description of the embodiments of the present invention, the features of the present invention will be first outlined. INDUSTRIAL APPLICABILITY The present invention is more effective in the function of the HGW device by providing a mechanism for temporarily giving the access right to the Internet network and the server to the connection terminal connected to the home gateway device (hereinafter, abbreviated as “HGW device”). Its main feature is that it can be used for.

The features of the present invention will be described in more detail below. The HGW apparatus according to the present invention has a function of allowing the connected terminal to access the Internet network by a white list, a function of recognizing a connected terminal that has been connected or removed, a function of temporarily registering terminal information of the connected terminal in a white list, It is assumed to have a function of deleting the terminal information of the connection terminal temporarily added from the white list. Then, when the user wants to temporarily connect the terminal to the HGW device and use the Internet network, the user borrows a key necessary for registering the terminal on the white list from the network administrator. Here, the borrowed key is, for example, a USB memory.

In the USB memory, a program is stored in addition to the key information for admitting the registration to the white list, and when the USB memory is connected to the HGW device, the program stored in the USB memory is automatically executed. It is also possible to support the operation of notifying that the terminal will be connected to the access control unit that manages the access to the Internet network in the HGW device. After that, when the user connects the terminal that tries to connect to the Internet network to the HGW device before the predetermined allowable time elapses, the HGW device detects the terminal and the terminal information regarding the terminal. Temporarily additionally register (MAC address, etc.) to the white list.

Thus, a user or network administrator can temporarily connect to a server on the Internet network or company network by using a terminal such as a guest PC (Personal Computer) without performing complicated operations. become.

(Example of configuration of the embodiment of the present invention)
Next, a configuration example of the HGW device according to the present invention will be described with reference to the drawings. FIG. 1 is a connection configuration diagram showing an example of the connection configuration of the HGW device according to the present invention.

The HGW device 20 shown in FIG. 1 is installed in the office 10 and is connected to the Internet network 30. For example, three terminals A40, B41, and C42 are connected under the HGW device 20 as connection terminals, and each of the three connection terminals A40, B41, and C42 is connected to the HGW device 20. It is possible to access the Internet network 30 via the. Each of the three connection terminals, that is, the terminal A40, the terminal B41, and the terminal C42, is an information communication terminal such as a personal computer.

FIG. 2 is a block configuration diagram showing in detail an example of the internal configuration of the HGW device 20 shown in FIG. As shown in FIG. 2, the HGW apparatus 20 can connect the connection terminals such as the terminal A40 and the terminal B41 connected under the HGW apparatus 20 to the Internet network 30 by the Internet connection unit 21. Further, the access control unit 22 refers to the registered content of the white list 23, and whether or not to hand over the connection request to the Internet network 30 received from the connection terminal connected under the control of the HGW device 20 to the Internet connection unit 21. It has a function of determining whether or not the connection terminal accesses the Internet network 30.

Further, the network control unit 24 determines that the terminal A40, the terminal B41, etc. under the HGW device 20 are connected to the LAN port of the HGW device 20 as connection terminals, or conversely, to the LAN port of the HGW device 20. It has a function of determining that the terminal A40, the terminal B41, or the like, which has been connected as a connection terminal, has been removed and disconnected. Further, it also has a function of acquiring the MAC address of the terminal A40, the terminal B41, or the like, which is connected or disconnected. Then, the network control unit 24 has a function of notifying the access control unit 22 of the determination result of connection or disconnection of the terminal A40 or the terminal B41 and the MAC address of the terminal A40 or the terminal B41 that has connected or disconnected. have.

Further, the key information control unit 25 uses the USB memory 27 (temporary terminal to the whitelist 23 lent to the user of the terminal as a key required for temporary terminal registration to the whitelist 23 from the network administrator of the office 10. (Key information required for registration and a program for supporting the registration operation are stored) are attached to the USB port 26 and connected to the HGW device 20, or are removed and disconnected from the HGW device 20. When it is determined that the key information stored in the USB memory 27 is appropriate, when the connection is detected, the obtained determination result is used as the access control unit 22. It has a function to notify.

FIG. 3 is a schematic diagram showing an example of the white list 23 provided inside the HGW device 20 shown in FIG. As shown in FIG. 3, the white list 23 is a permanently permitted terminal white list 231 that constantly registers connected terminals that are permitted to access the Internet network 30, and a connected terminal that is temporarily permitted to access the Internet network 30. And a temporary permitted terminal white list 232 for registering the. Then, in both the permanently permitted terminal white list 231 and the temporarily permitted terminal white list 232, as the terminal information, the MAC address of the connected terminal connected to the HGW device 20 (each connected terminal can be uniquely identified). Unique information), IP address (information assigned for access to each connection terminal), etc. are registered as terminal information.

(Description of Operation of Embodiment of Present Invention)
Next, as an example of the present invention, the operation of the HGW device 20 shown in FIGS. 1, 2 and 3 will be described in detail.

First, the operation of registering a terminal (permanently permitted terminal) that permanently permits access to the Internet network 30 in the HGW device 20 will be described. The administrator who manages the in-house network in the office 10 has terminal information (a MAC address, an IP address, etc.) regarding a permanently permitted terminal that constantly permits access to the Internet network 30 in the white list 23 in the HGW device 20. Is registered in advance in the constant permission terminal white list 231. Here, the administrator's means for registering in the constant permission terminal whitelist 231 is prepared in advance in the HGW device 20 in order to set or change various parameters of the HGW device 20. An input/output screen such as a Web setting screen is used.

Thereafter, when a terminal registered in the constant permission terminal whitelist 231 as the constant permission terminal is connected to the LAN port of the HGW device 20, the terminal is connected in the network control unit 24 of the HGW device 20. This is detected and the MAC address of the connected terminal, for example, the terminal A40 is acquired. Then, the network control unit 24 notifies the access control unit 22 of the determination result that the terminal is connected and the MAC address of the connected terminal, for example, the terminal A40.

Upon receiving the notification that the terminal is connected from the network control unit 24, the access control unit 22 refers to the white list 23, and the MAC address of the terminal, such as the terminal A 40, received from the network control unit 24 is added to the white list 23. Check whether it is registered. When it is confirmed that the MAC address of the terminal, for example, the terminal A40, is registered in the whitelist 231, which is the permanently permitted terminal of the whitelist 23, the access control unit 22 accesses the Internet network 30 of the terminal, for example, the terminal A40. Allow Therefore, the access control unit 22 operates to transmit the communication packet for the Internet network 30 transmitted from the terminal, for example, the terminal A 40, to the Internet connection unit 21 via the network control unit 24.

Here, since the Internet connection unit 21 has a function of connecting to the Internet network 30 as described above, it transmits the communication packet received from the access control unit 22 toward the Internet network 30. Thus, the user of the terminal, for example, the terminal A40 can access the Internet network 30 by using the terminal, for example, the terminal A40.

Note that, unlike the above-described operation, when the notification that the terminal is connected is received from the network control unit 24, the MAC address of the terminal received from the network control unit 24 is the whitelist 23 of the permanently permitted terminal. If it is not registered in either the H. 231 or the temporarily permitted terminal whitelist 232, the access control unit 22 prohibits the terminal from accessing the Internet network 30.

Therefore, in such a case, the access control unit 22 does not thereafter transmit the communication packet for the Internet network 30 transmitted from the terminal via the network control unit 24 to the Internet connection unit 21. Works to discard. Thus, the user of the terminal cannot access the Internet network 30 using the terminal.

Next, an operation when registering a terminal (temporary permission terminal) temporarily permitting access to the Internet network 30 in the HGW device 20 will be described. When the user in the office 10 temporarily connects an arbitrary terminal to the HGW device 20 to access the Internet network 30, first, the terminal is registered in the temporarily permitted terminal whitelist 232 of the whitelist 23. The USB memory 27 prepared in advance as a necessary key is borrowed from the administrator who manages the company network in the office 10. Then, the user connects the borrowed USB memory 27 to the USB port 26 of the HGW device 20.

As a result, the USB port 26 detects that the USB memory 27 is connected and notifies the key information control unit 25 of that fact. The key information control unit 25 reads the key information stored in the USB memory 27 connected to the USB port 26, and the key information is used as key information for permitting temporary access to the Internet network 30. Check if the information is appropriate. Upon confirming that the key information is appropriate key information, the key information control unit 25 allows the terminal connected to the HGW device 20 to temporarily access the Internet network 30 by using the HGW device 20. Recognize that the terminal is

As a result, the key information control unit 25 is connected to the LAN port of the HGW device 20 to the effect that the USB memory 27, which is a key required for temporary terminal registration in the temporary permitted terminal whitelist 232, has been connected. The terminal is output to the access control unit 22 as information indicating that the connection to the Internet network 30 is temporarily accepted. When the connection notification indicating that the USB memory 27 is connected is received from the key information control unit 25, the access control unit 22 acquires the connection notification from the key information control unit 25, and then the predetermined allowable time elapses. Until then, the network control unit 24 waits for notification of the determination that the terminal has been connected and the MAC address of the connected terminal.

It should be noted that, in addition to the key information, the USB memory 27 confirms the key information, and a predetermined permissible time elapses that a terminal to be registered in the temporary permitted terminal whitelist 232 of the whitelist 23 is connected. A program that supports the operation of the key information control unit 25 that notifies the access control unit 22 that it will wait until this is stored. When the USB memory 27 is connected to the USB port 26 of the HGW device 20, the program is automatically activated to execute the above-described operation as an operation that supports the operation of the key information control unit 25. For example, when the USB memory 27 is connected to the USB port 26 of the HGW device 20, a function of automatically starting the program in the USB memory 27 may be provided in advance, or The function described above may be realized by utilizing the function of automatically updating the firmware when the USB memory 27 is connected to the USB port 26 of the HGW device 20.

When the user who connects the USB memory 27 to the USB port 26 of the HGW device 20 and tries to access the Internet network 30 next connects an arbitrary terminal such as the terminal B41 to the LAN port of the HGW device 20, the network control unit 24 detects the connection of the terminal, for example, the terminal B41, acquires the MAC address of the terminal, for example, the terminal B41, and determines that the terminal, for example, the terminal B41 has been connected, and the connected terminal For example, the MAC address of the terminal B41 is notified to the access control unit 22.

When the access control unit 22 receives a notification from the network control unit 24 that a terminal, for example, the terminal B41 is connected, the access control unit 22 sets the MAC address of the terminal, for example, the terminal B41 received from the network control unit 24 to the temporarily permitted terminal whitelist of the whitelist 23. Register in 232. Then, the access control unit 22 operates to transmit the communication packet for the Internet network 30 transmitted from the terminal, for example, the terminal B41, to the Internet connection unit 21 via the network control unit 24.

As described above, the Internet connection unit 21 has the function of connecting to the Internet network 30, and therefore transmits the communication packet received from the access control unit 22 toward the Internet network 30. Thus, the user of the terminal, for example, the terminal B41, can use the terminal, for example, the terminal B41, to access the Internet network 30 until the connection between the terminal, for example, the terminal B41 and the HGW device 20 is disconnected. It will be possible.

In addition, even if the determination result that the terminal has been connected is detected from the network control unit 24 and the MAC address of the connected terminal is not notified even after the predetermined allowable time has elapsed, The access control unit 22 determines that the connection of the USB memory 27 to the USB port 26 is an erroneous connection, and cancels the registration operation of the white list 23 to the temporarily permitted terminal white list 232.

Further, when the connected terminal is removed from the LAN port of the HGW device 20 and the connection with the HGW device 20 is disconnected, the network control unit 24 detects that the terminal has been removed and that it has been removed. The access control unit 22 is notified of the determination result and the MAC address of the terminal. Upon receiving the notification of the removal of the terminal, the access control unit 22 deletes the terminal information such as the MAC address of the terminal from the white list 232 of the temporarily permitted terminals of the white list 23.

Then, the access control unit 22 thereafter connects the terminal to the HGW device 20 again, and the communication packet for the Internet network 30 is transmitted from the terminal via the network control unit 24. Even in this case, the communication packet is discarded without being transmitted to the Internet connection unit 21. In other words, when the user connects the once removed terminal to the HGW device 20 and tries to access the Internet network 30 again, the USB memory 27 is connected again to the USB port 26, and thereafter, It is necessary to repeat the procedure of reconnecting the terminal to the LAN port of the HGW device 20 and reregistering the terminal information such as the MAC address of the terminal in the temporarily permitted terminal whitelist 232 of the whitelist 23.

(Explanation of the effect of the embodiment)
As described in detail above, the following effects can be achieved in this embodiment.

The first effect is that even if terminal information (MAC address or the like) regarding a terminal that is permitted to access the Internet network 30 is not registered in the white list 23 of the HGW device 20 in advance, the temporary Internet network 30 is stored in the terminal. Access permission can be easily given, and the registration work time can be shortened.

The reason is that the HGW device 20 triggers that the USB memory 27, which is prepared in advance as a key necessary for terminal registration in the temporarily permitted terminal whitelist 232 that permits temporary access, is connected to the HGW device 20. Then, after that, it has a function of automatically registering the terminal information about the connected terminals until the predetermined allowable time elapses in the temporarily permitted terminal whitelist 232 of the whitelist 23. ..

The second effect is that the existing HGW device 20 and the network environment can be used as they are, and there is no need to prepare or purchase a dedicated device again.

The reason is that by expanding the program (firmware) of the HGW device 20, it is possible to execute the mechanism related to the operation of registering the whitelist 23 in the temporarily permitted terminal whitelist 232 described in the present embodiment.

(Other embodiment of the present invention)
Next, another embodiment of the present invention will be described. In the other embodiment, a case will be described in which, when a server 50 dedicated to the office 10 is installed in the office 10, access control to the server 50 is performed. FIG. 4 is a connection configuration diagram showing another example of the connection configuration of the HGW device according to the present invention, which is different from FIG. 1. As shown in FIG. 4, a dedicated server 50 is installed in the office 10 in which various data and the like are stored on the company network in the office 10. The server 50 is connected to the HGW device 20A. ing. The office-dedicated server 50, such as the terminal A 40, the terminal B 41, and the terminal C 42, exists in the office 10 and can be accessed only from the terminals connected to the HGW apparatus 20A. ..

Further, the server 50 is pre-assigned with an IP address to which information about the server-dedicated subnet unique to the server 50 is assigned, and the port setting of the HGW device 20A to which the server 50 is connected is changed so that the server 50 The HGW device 20A is configured to exist in another subnet (network) different from the HGW device 20A. Therefore, even a terminal connected to the HGW device 20A can access the server 50 for the first time by changing the port setting of the HGW device 20A and connecting to a port of another subnet in which the server 50 exists. it can.

The internal configuration of the HGW device 20A is the same as that of the whitelist 23 shown in FIG. 5, except that the configuration of the whitelist 23 shown in FIG. It has exactly the same structure as. The terminal connected to the LAN port of the HGW device 20A is configured to be able to access the server 50 from the network control unit 24 of the HGW device 20A via the access control unit 22.

FIG. 5 is a schematic diagram showing an example of the white list 23A provided inside the HGW device 20A shown in FIG. The white list 23A shown in FIG. 5 has a configuration in which a registration field for the access permission address 232A3 is newly added as a component of the temporarily permitted terminal white list 232A, as compared with the case of FIG. Note that the other registration fields of the temporary permitted terminal white list 232A, that is, the registration fields of the MAC address 232A1 and the IP address 232A2, and the registration fields of the permanent permitted terminal white list 231, are exactly the same as in the case of FIG.

The access permission address 232A3 is a registration field for registering an IP address used when accessing the server 50 in the office 10, and is not a normal IP address registered in the IP address 232A2 field, for example, “192.168.zz”, This indicates that the access control unit 22 permits access to the server 50 only when the IP address of the same different subnet as the server 50, for example, “192.168.vv” or “192.168.ww” is registered.

Note that, here, regarding the USB memory 27 lent to the user in order to permit the access to the server 50 from the terminal, as the key information necessary for the terminal registration in the temporarily permitted terminal whitelist 232 of the whitelist 23, FIG. It is assumed that an IP address registered in the access permission address 232A3 of No. 5 is additionally set in advance. In other words, the information to which the IP address having the information of the server-dedicated subnet allocated to the server 50 is added as the key information for registration in the temporary permitted terminal whitelist 232A is an access that permits access to the server 50. It is further stored in the USB memory 27 as a permission address. That is, for the terminal connected to the HGW device 20A after the USB memory 27 is connected, the subnet information of the IP address added as the access permission address to the key information of the USB memory 27 is assigned as the subnet unique to the server 50. Access is permitted only to the same server 50 as the stored information.

When the USB memory 27 storing the IP address indicating the access permission address as the key information is connected to the USB port 26, the key information control unit 25 acquires the information on the access permission address and notifies the access control unit 22 of the information. To be done. Then, as described in the above embodiment, when the fact that the terminal is connected and the MAC address of the terminal are notified from the network control unit 24, the access control unit 22 notifies the MAC address of the terminal. The address is registered in the MAC address 232A1 column of the temporary permission terminal white list 232A shown in FIG. 5, and the access permission address notified from the key information control unit 25 is stored in the access permission address 232A3 column of the temporary permission terminal white list 232A. Register with.

Then, when the terminal attempts to access the server 50 via the HGW device 20A, the access control unit 22 sets the IP address registered in the access-permitted address 232A3 column of the temporarily permitted terminal whitelist 232A. If it is confirmed that an IP address having the same subnet as the server 50 to be accessed is registered, any of the corresponding IP addresses registered in the access permission address 232A3 column as the IP address of the terminal. Assign and set. Thus, the terminal can access the server 50.

If an IP address having the same subnet as the server 50 to be accessed is not registered in the access permission address 232A3 column of the temporarily permitted terminal whitelist 232A, access to the server 50 is prohibited. .. That is, in the access control unit 22, when the terminal tries to access the server 50 in the office 10, only the server 50 in which the key information of the USB memory 27 includes the same subnet as the access permission address is accessed. Is allowed.

Operations other than those described above in the other embodiments are exactly the same as those in the above-described embodiments, and therefore, duplicated description here will be omitted.

As described in detail above, in any of the embodiments of the present invention and other embodiments, it is possible to connect any terminal to the in-house network while maintaining the security in the office 10. Further, since it is not necessary for a person to change the security settings and the user of the terminal does not have to perform a complicated procedure, it is possible to easily use the in-house network without taking time.

It is also possible to use a non-contact type card such as Felica instead of the USB memory 27 as described above as the key information for registering the terminal information and the access permission address of the terminal in the white list 23, 23A. is there. In this way, by using a non-contact type memory card, it becomes possible to include the key information for whitelist registration in the admission permit to the office. Further, it is not limited to a USB memory or a non-contact type memory card, but a removable medium or a removable auxiliary storage device may be used. Further, in the above description of the embodiments, the home gateway device dedicated to the office, the connection terminal access management method, and the connection terminal access management program have been described, but the present invention can be handled in the same way even in a place other than the office. Needless to say.

The configuration of the preferred embodiment of the present invention has been described above. However, it should be noted that such an embodiment is merely an example of the present invention and does not limit the present invention in any way. Those skilled in the art can easily understand that various modifications and changes can be made according to the specific application without departing from the gist of the present invention.

10 office 20 HGW device 20A HGW device 21 Internet connection unit 22 access control unit 23 white list 23A white list 24 network control unit 25 key information control unit 26 USB port 27 USB memory 30 Internet network 40 terminal A
41 Terminal B
42 Terminal C
50 Server 231 Permanently Permitted Terminal White List 232 Temporary Permitted Terminal White List 232A Temporary Permitted Terminal White List 232A1 MAC Address 232A2 IP Address 232A3 Access Permitted Address

Claims (10)

In the home gateway device that controls the connection between the terminal and the Internet network,
A temporarily permitted terminal whitelist for registering terminal information of the terminal for temporarily permitting access to the Internet network;
When it is detected that a removable medium storing the key information for registration in the white list for temporary permitted terminals or a removable auxiliary storage device is connected, is the key information appropriate key information? If it is determined whether the key information is appropriate, a key information control unit that outputs a determination result indicating that the removable medium or the removable auxiliary storage device is connected,
When the terminal is connected within a period from the acquisition of the determination result output by the key information control unit to the elapse of a predetermined allowable time, the terminal including the MAC address of the terminal A home gateway device, comprising: access control means for registering terminal information in the temporarily permitted terminal whitelist, and thereafter permitting the terminal to access the Internet network. If the server is connected,
An IP address to which information about the server-specific subnet dedicated to the server is assigned in advance to the server,
And, as the key information for registration in the temporarily permitted terminal whitelist, information to which an IP address having information on the server dedicated subnet is attached is used as an access permitted address for permitting access to the server, and the removable medium. And a configuration for further storing in the removable auxiliary storage device,
And the key information control means,
When it is detected that the removable medium or the removable auxiliary storage device is connected, the key information is suitable for registration in the temporary permission terminal whitelist, and If the access-permitted address is further added to the key information, the information indicating the access-permitted address is displayed together with the determination result indicating that the removable medium or the removable auxiliary storage device is connected. Output to access control means,
And, the access control means,
When the terminal is connected before the allowable time elapses after the determination result output by the key information control unit is acquired, the terminal information of the terminal including the MAC address of the terminal And the access-permitted address output by the key information control means are registered in the temporary-permitted-terminal whitelist, and the temporary-permitted terminal is subsequently requested when the terminal makes an access request to the server. If an IP address having the same subnet information as the subnet information of the access request target server exists among the access permission addresses of the terminal registered in the white list, The home gateway device according to claim 1, wherein the home gateway device is assigned to a terminal to permit access to the server. The access control means,
If the terminal is not connected until the allowable time elapses after the determination result output by the key information control unit is acquired, a registration operation to the temporary permitted terminal white list is performed. Even if the terminal is connected after that, the access to the Internet network or the server is prohibited unless the operation of reconnecting the removable medium or the removable auxiliary storage device is repeated. The home gateway device according to claim 1, wherein the home gateway device is a device. The access control means,
When the connection of the terminal registered in the temporarily permitted terminal white list is disconnected, the registration information regarding the terminal is deleted from the temporarily permitted terminal white list, and thereafter, to the Internet network or the server of the terminal. 4. The home gateway device according to claim 1, wherein the access is prohibited. The removable medium or the removable auxiliary storage device stores a program for supporting the operation of the key information control means together with the key information,
The program is automatically started when the removable medium or the removable auxiliary storage device is connected to support the operation of the key information control means. The home gateway device according to any of the above. A connection terminal access management method in a home gateway device for controlling a connection between a terminal and an internet network, comprising:
A temporarily permitted terminal whitelist for registering terminal information of the terminal for temporarily permitting access to the Internet network;
When it is detected that a removable medium storing the key information for registration in the white list for temporary permitted terminals or a removable auxiliary storage device is connected, is the key information appropriate key information? A key information control step of outputting a determination result indicating that the removable medium or the removable auxiliary storage device is connected, if the key information is appropriate.
In the case where the terminal is connected before the predetermined allowable time elapses after the determination result output by the key information control step is acquired, the terminal including the MAC address of the terminal An access control step of registering the terminal information in the temporary permitted terminal white list and permitting the terminal to access the Internet network thereafter. When the server is connected to the home gateway device,
An IP address to which information about the server-specific subnet dedicated to the server is assigned in advance to the server,
And, as the key information for registration in the temporarily permitted terminal whitelist, information to which an IP address having information on the server dedicated subnet is attached is used as an access permitted address for permitting access to the server, and the removable medium. And a configuration for further storing in the removable auxiliary storage device,
And, the key information control step,
When it is detected that the removable medium or the removable auxiliary storage device is connected, the key information is suitable for registration in the temporary permission terminal whitelist, and If the access permission address is further added to the key information, the information indicating the access permission address is output together with the determination result indicating that the removable medium or the removable auxiliary storage device is connected. ,
And, the access control step,
When the terminal is connected before the allowable time elapses after the determination result output by the key information control step is acquired, the terminal information of the terminal including the MAC address of the terminal And the access-permitted address output by the key information control step are registered in the temporary-permitted-terminal whitelist, and when the access request to the server is made from the terminal thereafter, the temporary-permitted terminal is displayed. If an IP address having the same subnet information as the subnet information of the access request target server exists among the access permission addresses of the terminal registered in the white list, The connection terminal access management method according to claim 6, wherein the access terminal is assigned to a terminal to permit access to the server. The access control step,
If the terminal is not connected until the allowable time elapses after the determination result output by the key information control step is acquired, a registration operation to the temporarily permitted terminal white list is performed. Even if the terminal is connected after that, the access to the Internet network or the server is prohibited unless the operation of reconnecting the removable medium or the removable auxiliary storage device is repeated. 8. The connection terminal access management method according to claim 6 or 7. The access control step,
When the connection of the terminal registered in the temporarily permitted terminal white list is disconnected, the registration information regarding the terminal is deleted from the temporarily permitted terminal white list, and thereafter, to the Internet network or the server of the terminal. The access management method according to claim 6, wherein the access is prohibited. A connection terminal access management program for causing a computer to execute an operation of managing access of a connection terminal in a home gateway device that controls a connection between a terminal and an Internet network,
A temporarily permitted terminal whitelist for registering terminal information of the terminal for temporarily permitting access to the Internet network;
When it is detected that a removable medium storing the key information for registration in the white list for temporary permitted terminals or a removable auxiliary storage device is connected, is the key information appropriate key information? If it is determined whether the key information is appropriate, a key information control process for outputting a determination result indicating that the removable medium or the removable auxiliary storage device is connected,
When the terminal is connected before the predetermined allowable time elapses after the determination result output by the key information control process is acquired, the terminal including the MAC address of the terminal A connection terminal access management program, comprising: access control processing for registering terminal information in the temporarily permitted terminal whitelist and permitting the terminal to access the Internet network thereafter.

Images