Information terminal remote operation system, remote access terminal, gateway server, information terminal control apparatus, information terminal apparatus, and remote operation method therefor

• US 20060126603A1
• Filed: 08/12/2005
• Published: 06/15/2006
• Est. Priority Date: 11/22/2004
• Status: Abandoned Application

• Current Assignee: Kabushiki Kaisha Toshiba (Toshiba Corporation)
• Original Assignee: Kabushiki Kaisha Toshiba (Toshiba Corporation)
• Inventors: Kawano, Tomohide, Shimizu, Nobuo
• Application Number:
  US11/202,154
• Publication Number:
  US 20060126603A1
• Time in Patent Office: Days
• US Class Current: 370/356
• CPC Class Codes: H04L 12/12 Arrangements for remote connection or disconnection of substations or of equipment thereof
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: Y02D 30/50 in wire-line communication networks, e.g. low power modes or reduced link rate

Abstract

An information-terminal remote-operation system includes at least one remote access terminal connected to a public network, a local network connected to the public network, at least one information terminal apparatus that is connected to the local network and that is remotely operated by the remote access terminal, an information-terminal control apparatus connected to the local network, and a gateway server that controls bidirectional communication between the remote access terminal and the information terminal apparatus and bidirectional communication between the remote access terminal and the information-terminal control apparatus. When the information terminal apparatus is not booted the information-terminal control apparatus boots the information terminal apparatus.

Claims

1. An information-terminal remote-operation system, comprising:

at least one remote access terminal connected to a public network;

a local network connected to the public network via a firewall;

at least one information terminal apparatus that is connected to the local network and that is remotely operated by the remote access terminal;

an information-terminal control apparatus that is connected to the local network to control the information terminal apparatus; and

a gateway server provided in the public network to control bidirectional communication between the remote access terminal and the information terminal apparatus and bidirectional communication between the remote access terminal and the information-terminal control apparatus;

wherein, when the remote access terminal attempts to remotely operate the information terminal apparatus and the information terminal apparatus is not booted, the information-terminal control apparatus boots the information terminal apparatus.

2. A gateway server that is provided in a public network to control bidirectional communication between at least one remote access terminal and at least one information terminal apparatus and bidirectional communication between the remote access terminal and an information-terminal control apparatus, the remote access terminal being connected to the public network and the information terminal apparatus and the information-terminal control apparatus being provided in a local network connected to the public network via a firewall, the gateway server comprising:

a ciphering unit configured to encrypt and to decrypt the bidirectional communication;

a first connecting unit configured to perform communication with the information-terminal control apparatus;

a second connecting unit configured to perform communication with the remote access terminal;

a third connecting unit configured to perform communication with the information terminal apparatus;

an authenticating unit configured to authenticate connections with the remote access terminal, the information terminal apparatus, and the information-terminal control apparatus;

a management-information storing unit configured to pre-store authentication information required for the authentication and storing states of the connections in relation to the authentication information;

an electronic-mail sending unit configured to send electronic mail to the remote access terminal; and

a relaying unit configured to relay the bidirectional communication between the remote access terminal and the information terminal apparatus;

wherein, when the remote access terminal attempts to remotely operate the information terminal apparatus and the information terminal apparatus is not booted, the first connecting unit issues an instruction to the information-terminal control apparatus so as to boot the information terminal apparatus.

3. The gateway server according to claim 2, wherein the ciphering unit comprises encryption and decryption functionality based on an SSL/TLS protocol.

4. The gateway server according to claim 2, wherein, upon receiving connection establishment requests from the remote access terminal, the information terminal apparatus, and the information-terminal control apparatus, the first, second, and third connecting units establish secure connections based on the ciphering unit.

5. The gateway server according to claim 2, wherein the authenticating unit comprises a first authenticating unit and a second authenticating unit:

the first authenticating unit comprising;

a first determining unit configured to determine authentication in accordance with apparatus authentication information received from the information terminal apparatus and the information-terminal control apparatus and in accordance with the authentication information stored by the management-information storing unit;

a first authenticating acceptance unit configured, when the first determining unit determines that the authentication succeeds, to maintain established connections with the information terminal apparatus and the information-terminal control apparatus, to issue a notification indicating a result of the determination to the remote access terminal and, to update the states of the connections with the information terminal apparatus and the information-terminal control apparatus, the states being stored by the management-information storing unit; and

a first authenticating rejection unit configured, when the first determining unit determines that the authentication fails, to disconnect connections with the information terminal apparatus and the information-terminal control apparatus, to issue a notification indicating a result of the determination to the remote access terminal, and to update the states of the connections with the information terminal apparatus and the information-terminal control apparatus, the states being stored by the management-information storing unit; and

the second authenticating unit comprising;

a second determining unit configured to determine authentication in accordance with login authentication information received from the remote access terminal or login authentication information and apparatus authentication information received from the remote access terminal and in accordance with the authentication information stored by the management-information storing unit;

a second authenticating acceptance unit configured, when the second determining unit determines that the authentication succeeds, to maintain an established connection with the remote access apparatus, to issue a notification indicating a result of the determination to the remote access terminal, and to update the state of the connection with the remote access terminal, the state being stored by the management-information storing unit; and

a second authenticating rejection unit configured, when the second determining unit determines that the authentication fails, to issue a notification indicating a result of the determination to the remote access terminal, to disconnect a connection with the remote access terminal, and to update the state of the connection with the remote access terminal, the state being stored by the management-information storing unit.

6. The gateway server according to claim 2, wherein the second authenticating unit comprises a transferring unit configured, when a authentication target of login authentication information received from the remote access terminal is the authentication apparatus in the local network, to transfer the login authentication information to an authentication apparatus in the local network via the information-terminal control apparatus and to receive a result of authentication performed by the authentication apparatus;

and the second determining unit performs determination that includes the result of the authentication performed by the authentication apparatus.

7. The gateway server according to claim 2, wherein the second authenticating unit comprises a transferring unit configured, when a authentication target of login authentication information received from the remote access terminal is an authentication apparatus in the local network, to transfer the login authentication information to the authentication apparatus in the local network via the information terminal apparatus and to receive a result of authentication performed by the authentication apparatus;

and the second determining unit performs determination that includes the result of the authentication performed by the authentication apparatus.

8. The gateway server according to claim 2, wherein the second connecting unit further comprises a referring unit configured, upon receiving a query for an information terminal apparatus to be remotely operated from the remote access terminal, to refer to the management-information storing unit and to return apparatus identification information of the information terminal apparatus to be remotely operated to the remote access terminal.

9. The gateway server according to claim 2, wherein, upon receiving a request for communication with the information terminal apparatus from the remote access terminal, the second connecting unit refers to the management-information storing unit to determine whether or not a connection between the information terminal apparatus and the gateway sever is established, wherein when the connection between the information terminal apparatus and the gateway server is established, the second connecting unit issues a notification indicating the established connection to the remote access terminal;

and when the connection between the information terminal apparatus and the gateway server is not established, the first connecting unit issues an instruction to the information-terminal control apparatus, stored in the management-information storing unit in relation to the information terminal apparatus, so as to send a booting instruction to the information terminal apparatus.

10. The gateway server according to claim 2, wherein after receiving a request for communication with the information terminal from the remote access terminal, when a connection between the information terminal apparatus and the gateway server is established within a predetermined amount of time, the second connecting unit issues an notification indicating a state of the connection to the remote access terminal, and when a connection between the information terminal apparatus and the gateway server is not established after a predetermined amount time elapses, the second connecting unit issues a notification indicating a state of the connection to the remote access terminal.

11. The gateway server according to claim 10, wherein, when a connection between the remote access terminal and the gateway server is established, the connection is used to issue the notification to the remote access terminal, and when a connection between the remote access terminal and the gateway server is not established, the electronic-mail sending unit is used to issue the notification.

12. The gateway server according to claim 2, wherein after a connection between the remote access terminal and the gateway server and a connection between the information terminal apparatus and the gateway server are established, the third connecting unit issues, to the information terminal apparatus, a request for communication from the remote access terminal to the information terminal apparatus;

when the information terminal apparatus accepts the communication request, the third connecting unit issues a notification indicating the acceptance to the remote access terminal via the second connecting unit; and

when the information terminal apparatus rejects the communication request, the third connecting unit issues a notification indicating the rejection to the remote access terminal via the second connecting unit and maintains the established connection between the information terminal apparatus and the gateway server.

13. The gateway server according to claim 2, wherein the relaying unit relays bidirectional communication between the remote access terminal and the information terminal apparatus, after a connection between the remote access terminal and the gateway server and a connection between the information terminal apparatus and the gateway server are established, the information terminal apparatus accepts a request for communication from the remote access terminal to the information terminal apparatus, and a notification indicating the acceptance is issued to the remote access terminal.

14. The gateway server according to claim 2, wherein, when a connection between the remote access terminal and the gateway server is disconnected, the third connecting unit issues a notification indicating the disconnection to the information terminal apparatus that has performed bidirectional communication with the remote access terminal, and temporarily stops the bidirectional communication.

15. The gateway server according to claim 2, wherein, when the remote access terminal issues a shutdown instruction to the information terminal apparatus, the second connecting unit issues a notification indicating a state of the disconnected connection between the information terminal apparatus and the gateway server to the remote access terminal.

16. The gateway server according to claim 15, wherein, when a connection between the remote access terminal and the gateway server is established, the connection is used to issue the notification to the remote access terminal, and when a connection between the remote access terminal and the gateway server is disconnected, the electronic-mail sending unit is used to issue the notification.

17. The gateway server according to claim 2, wherein the third connecting unit performs communication between the information terminal apparatus and the gateway server via the information-terminal control apparatus and the relaying unit performs communication between the information terminal apparatus and the remote access terminal via the information-terminal control apparatus.

18. A remote access terminal that is provided in a public network and that performs bidirectional communication with at least one information terminal apparatuses and an information-terminal control apparatus, provided in a local network connected to the public network via a firewall, via a gateway server, the remote access terminal comprising:

a ciphering unit configured to encrypt and to decrypt the bidirectional communication;

a connecting unit configured to perform communication with the gateway server;

an authentication-information sending unit configured to send authentication information to the gateway server;

a remote operating unit configured to remotely operate the information terminal apparatuses; and

an electronic-mail receiving unit configured to receive electronic mail from the gateway server;

wherein the information terminal apparatuses to be remotely operated comprise an information terminal apparatus to be booted by the information-terminal control apparatus.

19. The remote access terminal according to claim 18, wherein the authentication information contains login authentication information for uniquely identifying a user or the login authentication information and apparatus authentication information.

20. The remote access terminal according to claim 18, wherein the remote operating unit comprises a issuing unit configured to issue a request to the gateway server so as to return apparatus identification information of an information terminal apparatus to be remotely operated to the remote access terminal.

21. The remote access terminal according to claim 18, wherein the remote operating unit issues a communication request to the information terminal apparatus, and receives a notification regarding a state of a connection between the information terminal apparatus to which the communication request is issued and the gateway server and a notification regarding a result of communication acceptance/rejection determination performed by the information terminal apparatus.

22. The remote access terminal according to claim 21, wherein, when a connection between the remote access terminal and the gateway server is established, the connection is used to receive the notification regarding the state of the connection and the notification regarding the result of the communication acceptance/rejection determination, and when a connection between the remote access terminal and the gateway server is disconnected, the electronic-mail receiving unit is used to receive the notifications.

23. The remote access terminal according to claim 18, wherein the connecting unit disconnects the connection with the gateway server in accordance with an operation performed by a user of the remote access terminal.

24. The remote access terminal according to claim 18, wherein the remote operating unit sends an instruction for shutting down and powering off the information terminal apparatus to the information terminal apparatus.

25. An information terminal apparatus in a local network connected to a public network via a firewall, the information terminal apparatus comprising:

a connecting unit configured to perform bidirectional communication with a gateway server connected to the public network;

a ciphering unit configured to encrypt and to decrypt the bidirectional communication;

an authentication-information sending unit configured to send authentication information to the gateway server;

a remote operating unit configured to perform bidirectional communication with s remote access terminal connected to the gateway server through the public network and for being remotely operated by the remote access terminal;

a communication-request acceptance/rejection determining/returning unit configured, upon receiving a request for communication with the remote access terminal from the gateway server, to determine whether or not to approve the communication request, and to return a result of the determination to the gateway server;

a local connecting unit configured to receive a booting instruction sent from an information-terminal control apparatus to the information terminal apparatus when the remote access terminal attempts to remotely operate the information terminal apparatus and the information terminal apparatus is not booted; and

a booting unit configured to boot the information terminal apparatus after receiving the booting instruction;

wherein the connecting unit establishes a connection with the gateway server after the information terminal apparatus is booted.

26. The information terminal apparatus according to claim 25, wherein, upon receiving authentication information for authenticating a connection between the remote access terminal and the gateway server from the gateway server, the information terminal apparatus issues a request for authentication to an authentication apparatus connected to the local network and returns a result of the authentication to the gateway server.

27. The information terminal apparatus according to claim 25, wherein the ciphering unit comprises encryption and decryption functionality based on an SSL/TLS protocol.

28. The information terminal apparatus according to claim 25, wherein bidirectional communication with the gateway server is performed via a proxy server comprising an HTTP proxy server and a SOCKS proxy server.

29. The information terminal apparatus according to claim 25, wherein all bidirectional communications with the gateway server are performed via the information-terminal control apparatus connected to the local network.

30. An information-terminal control apparatus in a local network connected to a public network via a firewall, the information-terminal control apparatus comprising:

a local connecting unit capable of communicating with a plurality of information terminal apparatuses connected to the local network;

a gateway-server connecting unit configured to establish secure bidirectional connection with the gateway server connected to the public network;

a ciphering unit configured to encrypt and to decrypt the bidirectional communication;

an authentication-information sending unit configured to send authentication information to the gateway server;

a receiving unit configured to receive, from the gateway server via the established bidirectional communication, an identifier for identifying one of the information terminal apparatuses and a remote connection request sent from a remote access terminal connected to the public network;

a booting-instruction generating/sending unit configured to generate a booting instruction for booting the information terminal apparatus in accordance with the received remote connection request; and

a sending unit configured to send the generated booting instruction to the information terminal apparatus corresponding to the identifier via the local connection unit.

31. The information-terminal control apparatus according to claim 30, wherein, upon receiving authentication information for authenticating a connection between the remote access terminal and the gateway server from the gateway server, the information-terminal control apparatus issues a request for authentication to an authentication apparatus connected to the local network and returns a result of the authentication to the gateway server.

32. The information-terminal control apparatus according to claim 30, wherein the ciphering unit comprises encryption and decryption functionality based on an SSL/TLS protocol.

33. The information-terminal control apparatus according to claim 30, wherein the bidirectional communication with the gateway server is performed via a proxy server comprising an HTTP proxy server and a SOCKS proxy server.

34. The information-terminal control apparatus according to claim 30, wherein the booting instruction is based on Magic Packet™

.

35. A remote operation method for an information-terminal remote-operation system including at least one remote access terminal connected to a public network, a local network connected to the public network via a firewall, at least one information terminal apparatus connected to the local network, an information-terminal control apparatus that is connected to the local network and that controls the information terminal apparatus, and a gateway server that controls encrypted bidirectional communication between the remote access terminal and the information terminal apparatus and encrypted bidirectional communication between the remote access terminal and the information-terminal control apparatus, the method comprising the steps of:

establishing a first connection between the information-terminal control apparatus and the gateway server;

sending information, required for first authentication, from the information-terminal control apparatus to the gateway server;

maintaining the first connection when the gateway server succeeds in the first authentication and disconnecting the first connection when the gateway server fails in the first authentication;

establishing a second connection between the remote access terminal and the gateway server;

sending information, required for second authentication, from the remote access terminal to the gateway server;

maintaining the second connection when the gateway server succeeds in the second authentication and disconnecting the second connection when the gateway server fails in the second authentication;

sending a request, from the remote access terminal to the gateway server, for communication with a specific one of the at least one information terminal apparatus connected to the local network; and

issuing an instruction from the gateway server to the information-terminal control apparatus so as to boot the specific information terminal apparatus, when the specific information terminal apparatus is not booted;

wherein, upon receiving the instruction, the information-terminal control apparatus boots the specific information terminal apparatus and establishes a third connection between the specific information terminal apparatus and the gateway server;

the specific information terminal apparatus sends information required for third authentication to the gateway server;

when the gateway server succeeds in the third authentication, the third connection is maintained, and when the gateway server fails in the third authentication, the third connection is disconnected;

the gateway server issues the communication request, received from the remote access terminal, to the information terminal apparatus via the third connection;

the information terminal apparatus determines whether or not to approve the communication request, issues a notification indicating a result of the determination to the gateway server, and maintains the third connection regardless of the determination result;

when the second connection is maintained, the gateway server uses the second connection to issue a notification indicating a state of the third connection and a notification indicating the determination result to the remote access terminal, and when the second connection is disconnected, the gateway server uses electronic mail to issue the notifications to the remote access terminal; and

the remote access terminal remotely operates the information terminal apparatus through bidirectional communication with the information terminal apparatus, the bidirectional communication using the second connection and the third connection.