Terminal authentication and registration system, method for authenticating and registering terminal, and storage medium

A terminal authentication and registration method executed in a terminal authentication and registration system including a destination computer capable of authenticating a remote desktop connection by a terminal of a user, and a terminal registration apparatus configured to register the remote desktop connection between the terminal and the destination computer,

• the method comprising the steps of, performed by the destination computer:
• a user information acquisition step of acquiring user information identifying the user;
• a user authentication step of determining whether or not to permit the user indicated by the user information to log in to the destination computer, with reference to authentication information indicating a user permitted to log in to the destination computer;
• a terminal information acquisition step of acquiring terminal information identifying the terminal, from the terminal;
• a connection permission determination step of determining, when it is determined in the user authentication step that the user indicated by the user information is permitted to log in to the destination computer, whether or not to permit a remote desktop connection between the terminal indicated by the terminal information and the destination computer by the user indicated by the user information, with reference to a white list in which a list of a combination of the user, the terminal, and the destination computer, a remote desktop connection being permitted in the combination, is registered;
• a request information generation step of generating, when it is determined in the connection permission determination step that the remote desktop connection is not permitted, request information to be used for requesting to register the combination of the user, the terminal, and the destination computer to the white list, on the basis of the user information, the terminal information, and computer information identifying the destination computer;
• and
• a request information transmission step of transmitting the request information generated in the request information generation step, to the terminal registration apparatus,
• the method comprising the steps of, performed by the terminal registration apparatus:
• a request information reception step of receiving the request information from the destination computer;
• a registration step of determining whether or not to register the combination of the user, the terminal, and the destination computer to the white list, with reference to condition information indicating a condition for determining whether or not to register the combination of the user, the terminal, and the destination computer to the white list, on the basis of the request information received in the request information reception step, and updating, when it is determined to register the combination, the white list by registering the combination of the user, the terminal, and the destination computer to the white list;
• and
• a permission information transmission step of transmitting, when it is determined in the registration step to register the combination, the updated white list to the destination computer, and transmitting, when it is determined not to register the combination, error information indicating that the registration is not permitted, to the destination computer, and
• the method further comprising the steps of, performed by the destination computer:
• a permission information reception step of receiving the error information and the updated white list from the terminal registration apparatus and storing the updated white list;
• and
• an error information output step of outputting the error information received in the permission information reception step.

A computer-readable storage medium recorded with a program, the program causing a computer to function as:

• a user information acquisition unit configured to acquire user information identifying a user;
• a user authentication unit configured to determine whether or not to permit the user indicated by the user information to log in a destination computer, with reference to authentication information indicating a user permitted to log in to the destination computer;
• a terminal information acquisition unit configured to acquire, from a terminal of the user, terminal information identifying the terminal;
• a white-list storage unit configured to store a white list in which a list of a combination of the user, the terminal, and the destination computer, a remote desktop connection being permitted in the combination, is registered;
• a connection permission determination configured to determine, when the user authentication unit determines to permit the user indicated by the user information to log in to the destination computer, whether or not to permit a remote desktop connection between the terminal indicated by the terminal information and the destination computer by the user indicated by the user information, with reference to the white list;
• a request information generation unit configured to generate, when the connection permission determination unit determines not to permit the remote desktop connection, request information to be used for requesting to register the combination of the user, the terminal, and the destination computer to the white list, on the basis of the user information, the terminal information, and computer information identifying the destination computer not permitting the remote desktop connection;
• a condition information storage unit to store condition information indicating a condition for determining whether or not to register the combination of the user, the terminal, and the destination computer to the white list;
• a registration unit configured to determine whether or not to register the combination of the user, the terminal, and the destination computer to the white list, with reference to the condition information on the basis of the request information, and to update, when determining to register the combination, the white list by registering the combination of the user, the terminal, and the destination computer to the white list;
• an error information generation unit configured to generate, when the registration unit determines not to register the combination, error information indicating that the registration is not permitted;
• and
• an error information output unit configured to output the error information.

A terminal authentication apparatus comprising:

• a user authentication unit configured to acquire user information identifying a user, and to determine whether or not to permit the user indicated by the user information to log in to the own apparatus, with reference to authentication information indicating a user permitted to log in to the own apparatus:
• a terminal information acquisition configured to acquire, from a terminal executing a remote desktop connection to the own apparatus, terminal information identifying the terminal;
• a first storage unit configured to store a white list in which a list of a combination of the user, the terminal, and a destination computer to which the terminal executes a remote desktop connection, the remote desktop connection being permitted in the combination, is registered;
• a connection permission determination unit configured to determine, when the user authentication unit determines to permit the user indicated by the user information to log in to the destination computer, whether or not to permit a remote desktop connection between the terminal indicated by the terminal information and the own apparatus by the user indicated by the user information, with reference to the white list;
• and
• a request information generation unit configured to generate, when the connection permission determination unit determines not to permit the remote desktop connection, request information to be used for requesting to register the combination of the user, the terminal, and the own apparatus to the white list, on the basis of the user information, the terminal information, and computer information identifying the own apparatus, and to transmit the generated request information to a terminal registration apparatus configured to register the remote desktop connection between the terminal and the own apparatus.

A terminal authentication method that is performed by an information processing apparatus, comprising:

• acquiring user information identifying a user, and executing user authentication for determining whether or not to permit the user identified by the user information to log in to the own apparatus, on the basis of authentication information indicating a user permitted to log in to the own apparatus;
• acquiring, from a terminal executes a remote desktop connection to the own apparatus, terminal information identifying the terminal;
• determining, when it is determined in the user authentication that the user indicated by the user information is permitted to log in to the own apparatus, whether or not to permit a remote desktop connection between the terminal indicated by the terminal information and the own apparatus by the user indicated by the user information, with reference to a white list corresponding to a list of a combination of the user, the terminal, and a destination computer with which the terminal executes a remote desktop connection, a remote desktop connection being permitted in the combination;
• generating, when it is determined in the determination that the remote desktop connection is not permitted, request information to be used for requesting to register the combination of the user, the terminal, and the own apparatus to the white list, on the basis of the user information, the terminal information, and computer information identifying the own apparatus;
• and
• transmitting the generated request information to a terminal registration apparatus configured to register the remote desktop connection between the terminal and the own apparatus.

A non-transitory computer-readable storage medium recorded with a computer program, the computer program causing a computer functioning as a terminal authentication apparatus to execute:

• a user authentication process of acquiring user information identifying a user, and determining whether or not to permit the user identified by the user information to log in to the own apparatus, on the basis of authentication information indicating a user permitted to log in to the own apparatus;
• a terminal information acquisition process of acquiring, from a terminal executing a remote desktop connection to the own apparatus, terminal information identifying the terminal;
• a connection permission determination process of determining, when it is determined in the user authentication process that the user indicated by the user information is permitted to log in to the own apparatus, whether or not to permit a remote desktop connection between the terminal indicated by the terminal information and the own apparatus by the user indicated by the user information, with reference to a white list corresponding to a list of a combination of the user, the terminal, and a destination computer with which the terminal execute a remote desktop connection, a remote desktop connection being permitted in the combination;
• and
• a request information generation process of generating, when it is determined in the connection permission determination process that the remote desktop connection is not permitted, request information to be used for requesting to register the combination of the user, the terminal, and the own apparatus to the white list, on the basis of the user information, the terminal information, and computer information identifying the own apparatus, and transmitting the generated request information to a terminal registration apparatus configured to register the remote desktop connection between the terminal and the own apparatus.