JP2009206579A - Thin client network, thin client, unauthorized connection preventing device, method for operating them and recording medium - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To build a network which does not permit connection of a fat client, but permits connection of a thin client in a thin client network. <P>SOLUTION: The thin client network has a thin client connected to a LAN and performing communications with a thin client server via a router, and an unauthorized connection preventing device connected to the LAN. The thin client does not transmit an ARP request onto the LAN, but statically holds the combination of the IP address of the router and the MAC address thereof in the ARP table, and performs communications with the thin client server via the router by using the IP address of the router and the MAC address thereof. Upon receiving the ARP request broadcasted on the LAN, the unauthorized connection preventing device transmits on the LAN the ARP response including a predetermined MAC address different from the MAC address of a transmission source terminal so that the transmission source terminal of the corresponding ARP request is disconnected from the LAN. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

  The present invention relates to a thin client network, a thin client, an unauthorized connection prevention device, an operation method thereof, and a recording medium, and more particularly to a thin client in a quarantine network.

  Conventionally, a network is operated by a so-called “thin client” in which an OS (Operating System) is operated on a server and information is not held in a terminal. According to this, the risk of information leakage and the like can be reduced by not holding information in the terminal. Non-Patent Document 1 describes an example of a related-art thin client network system.

  As described above, in a thin client network using a thin client as a user terminal, the minimum necessary processing is performed on the terminal, and most processing is concentrated on the server side. In recent years, a thin client has attracted particular attention for the purpose of reducing the risk of information leakage due to theft of a PC (personal computer) and reducing the management cost of a terminal. Since the thin client does not hold data in the terminal, there is a low possibility that important data such as personal information is leaked even if the terminal is stolen. Further, since the OS and applications are centrally managed by the server, there is an advantage that the overall management cost can be reduced as compared with the case of managing individual terminals. In a client-server network, a terminal that holds these resources is also called a “fat client” for a “thin client” that is a terminal that does not hold resources such as a hard disk (this term is also used in the following description). use).

On the other hand, as a security measure against virus infection and unauthorized intrusion in the corporate network, allow the connection to the terminal trying to connect to the corporate network after checking its safety and confirming that there is no problem with the terminal. A system using a so-called “quarantine network” is also known. In this regard, Patent Document 1 proposes a network technology for the purpose of improving security by simply introducing an inexpensive quarantine network and realizing the quarantine network. Patent Document 2 proposes an access control device in which access control between terminals in a quarantine network is devised.
JP 2006-262019 A JP 2007-104058 A NEC web page "Virtual PC Thin Client System Virtual PC Center Base Software", [online], [Search February 18, 2008], Internet <http://www.nec.co.jp/vpcc_sw/

  However, in the related technology thin client network, even if an attempt is made to construct a network with only the thin client, there is a risk that a fat client brought in from the outside is connected to the network. Further, in the normal method, since the thin client and the fat client cannot be identified, there is a problem that the quarantine that the thin client permits the connection and the fat client does not permit the connection cannot be performed.

  Further, Patent Documents 1 and 2 relate to a quarantine network technology, and are not particularly intended for a network using a thin client, and thus the above-described problems unique to the thin client are not recognized. Therefore, even in Patent Documents 1 and 2, the above-described problems are not solved.

  An object of the present invention is to make it possible to construct a network that allows connection of a thin client without allowing connection of a fat client in a thin client network.

  In order to achieve the above object, a thin client network according to the present invention includes a thin client connected to a network and communicating with a thin client server via a router, and an unauthorized connection prevention device connected to the network. The thin client does not transmit an ARP (Address Resolution Protocol) request on the network, and statically holds a pair of IP (Internet Protocol) address and MAC (Media Access Control) address of the router in the ARP table. ARP table setting means for setting to the network, and communication means for communicating with the thin client server via the router using the IP address and MAC address of the router set in the ARP table. The device broadcasts on the network When the received ARP request is received, an ARP response including a predetermined MAC address different from the MAC address of the source terminal is transmitted on the network so as to block the source terminal of the ARP request from the network. It has the means.

  The thin client network operating method according to the present invention includes a thin client that is connected to a network and communicates with a thin client server via a router, and an unauthorized connection prevention device connected to the network. An ARP table setting step in which the thin client is set to statically hold a pair of the IP address and MAC address of the router in the ARP table without transmitting an ARP request on the network; A communication step in which the thin client communicates with the thin client server via the router using the IP address and MAC address of the router set in the ARP table, and the unauthorized connection prevention device is connected to the network. To bro Upon receiving the cast ARP request, an ARP response including a predetermined MAC address different from the MAC address of the source terminal is transmitted on the network so as to block the source terminal of the ARP request from the network. An ARP response step.

  According to the present invention, in a thin client network, it is possible to construct a network that does not permit connection of a fat client that transmits an ARP request and permits connection of a thin client that does not transmit an ARP request.

  Next, the best mode for carrying out the thin client network, the thin client, the unauthorized connection preventing apparatus, the operation method thereof, and the recording medium according to the present invention will be described in detail with reference to the drawings.

  Next, the structure of the Example of this invention is demonstrated in detail with reference to drawings.

  Referring to FIG. 1, a thin client network according to an embodiment of the present invention includes a thin client 1, a fat client 2, an unauthorized connection prevention device 3, a router 4, a business network 5, and a thin client server 6. Have.

  The network of the present embodiment includes a LAN (Local Area Network) 8 on the subnet side and a business network 5 outside the subnet. The LAN 8 and the business network 5 are connected to each other via the router 4 so that they can communicate with each other. On the LAN 8, a thin client 1, a fat client 2, and an unauthorized connection prevention device 3 are arranged. A thin client server 6 is disposed on the business network 5. The thin client 1 communicates with the thin client server 6 on the business network 5 outside the subnet via the router 4.

  The thin client system according to the present embodiment performs communication between an ARP request source terminal and another terminal on the same network as an ARP response to an ARP (Address Resolution Protocol) request broadcast on the network (LAN 8). A quarantine method using a so-called “spoofed ARP” that performs a spoofed ARP response using a predetermined MAC address that is different from the MAC address of the source terminal of the ARP request so as to prevent . Then, by introducing the thin client 1 that does not use the ARP, the connection of the fat client 2 that is the transmission source terminal that transmits the ARP request is not permitted, and the connection of the thin client 1 that does not transmit the ARP request is permitted. This makes it possible to construct a network (quarantine network).

  In other words, in this embodiment, the thin client 1 statically holds a pair of IP (Internet Protocol) address and MAC (Media Access Control) address of the router 4 in the ARP table 12 without transmitting an ARP request. Further, when receiving the ARP request broadcast, the unauthorized connection prevention device 3 transmits a “spoofed ARP” that blocks the ARP request source terminal (corresponding to the fat client 2 of this embodiment) from the network. . The “spoofed ARP” here is a predetermined MAC address set in advance different from the MAC address of the transmission source terminal of the ARP request as described above (corresponding to a dummy MAC address described later in this embodiment). It means that the ARP response impersonated using is performed. The details will be described below.

  In the present embodiment, the thin client 1 includes a communication device (communication means) 11, an ARP table 12, a communication control device 13, and a connection destination storage unit 14. Among these, the communication device 11 transmits / receives a packet to / from the network, and unlike an ordinary communication device, does not transmit an ARP request. The communication control device 13 adds an entry to the ARP table 12 and controls the communication device 13. The connection destination storage unit 14 stores a set of the IP address and MAC address of the router 4. The set of the IP address and MAC address of the router 4 stored in the connection destination storage unit 14 is manually input and stored by the user of the thin client 1. The communication control device 13 and the connection destination storage unit 14 correspond to the ARP table setting step used in the ARP table setting means and the operation method of the thin client of the present invention.

  The fat client 2 is a normal client holding resources such as a hard disk. Reference numeral 21 in the figure is the ARP table of the fat client 2.

  Upon receiving the ARP request, the unauthorized connection prevention device 3 includes a communication control unit 31 that transmits a fake ARP that blocks the terminal that has transmitted the ARP request from the network. The communication control unit 31 corresponds to the ARP response means included in the unauthorized connection prevention apparatus of the present invention.

  The business network 5 is a network including resources such as a file server and a Web server. In the example of FIG. 1, a thin client server 6 is connected to the business network 5 and can communicate with the LAN 8 via the router 4.

  The thin client server 6 is a server to which the thin client 1 is connected.

  First, the operation when the thin client 1 connects to the thin client server 6 will be described with reference to FIG.

  Referring to the sequence diagram of FIG. 2, when the thin client 1 tries to connect to the thin client server 6 and there is no entry in its own ARP table 12, the communication control unit 13 displays the connection destination storage unit. 14, a set of the IP address and MAC address of the router 4 is acquired (step 1). Here, the pair of the IP address and the MAC address of the router 4 stored in the connection destination storage unit 14 is manually input and stored in advance by the user of the thin client 1 as described above.

  Next, the communication control unit 13 statically stores the acquired pair of the IP address and the MAC address in the ARP table 12 (Step 2). When an entry exists in the ARP table 12 when the thin client 1 tries to connect to the thin client server 6, step 1 and step 2 are skipped.

  Next, in the thin client 1, the communication control device 13 requests the communication device 11 to connect to the thin client server 6 outside the subnet (LAN 8) (step 3). Upon receiving a connection request outside the subnet, the communication device 11 acquires the set of the IP address and MAC address of the router 4 stored as described above from the entry in the ARP table 12 (step 4). A request for connection to the thin client server 1 is transmitted to the router 4 using the set of the IP address and MAC address of the router 4 (step 5).

  Next, when receiving the connection request from the thin client 1, the router 4 routes the connection request to the thin client server 6 on the business network 5 (step 6). When receiving the connection request from the thin client 1 routed from the router 4, the thin client server 6 transmits a response to the thin client 1 to the router 4 (step 7).

  When the router 4 receives the response from the thin client server 6 to the thin client 1, if the combination of the IP address and MAC address of the thin client 1 is not registered in its ARP table 41, the router 4 sends an ARP request to the thin client 1. Perform (broadcast), receive an ARP response from the thin client 1, and store the set of the IP address and MAC address of the thin client 1 in the ARP table 41 of the router 4 (step 8).

  On the other hand, when the router 4 receives a response from the thin client server 6 to the thin client 1, if the IP address / MAC address pair of the thin client 1 is not registered in its own ARP table 41, step 8 skip.

  Next, the router 4 transmits a response from the thin client server 6 to the thin client 1 using the combination of the IP address and MAC address of the thin client 1 registered in the entry of the ARP table 41 (step 9). .

  With the above operation, the thin client 1 that does not issue an ARP request can communicate with the thin client server 6.

  Next, the operation when the fat client 1 is disconnected from the network will be described with reference to FIGS. In the example of the figure, the IP address and MAC address are exemplified when the router 4 is “IP_A” and “MAC_A”, the fat client 1 is “IP_B” and “MAC_B”, and the thin client 1 is “IP_C” and “MAC_C”. is doing.

  Referring to the sequence diagram of FIG. 3, when the fat client 2 performs communication, it is necessary to make an ARP request in order to acquire the MAC address of the communication destination. That is, the fat client 2 becomes a transmission source terminal of the ARP request.

  First, in order for the fat client 2 to communicate with the router 4 having the IP address “IP_A”, <source IP: IP_B (own IP address), source MAC: IP_B (own MAC address) ARP request such as: Destination IP: IP_A (IP address of router 4), Destination MAC: Undefined> is broadcast (step 11).

  When the router 4 receives the ARP request (step 11) from the fat client 2, the router 4 in the own ARP table 41 based on the source IP address “IP_B” and the MAC address “MAX_B” of the ARP request. Is updated with the IP address “IP_B” and the MAC address “MAX_B” of the fat client 2 (step 12). Subsequently, the router 4 sends <source IP: IP_A (own IP address), source MAC: IP_A (own MAC address), destination IP: IP_B (IP address of the fat client 2), destination MAC: An ARP response such as MAC_B (the MAC address of the fat client 2)> is unicast to the fat client 2 (step 13).

  Thus, when the fat client 2 receives the ARP response (step 13) from the router 4, the fat client 2 stores the ARP response in its own ARP table 21 based on the destination IP address “IP_A” and the MAC address “MAX_A” of the ARP response. The entry of the router 4 is updated with the IP address “IP_A” and the MAC address “MAX_A” of the router 4 (step 14).

  On the other hand, when the communication control unit 31 detects the ARP request (step 11) from the fat client 2, the unauthorized connection prevention device 3 thereafter becomes a certain time later (after the ARP response (step 13) of the router 4). (D) at the operation timing delayed, as a spoofed ARP, <source IP: IP_A (IP address of router 4), source MAC: IP_X (dummy MAC address), destination IP: IP_B (IP of fat client 2) ARP response (first ARP response) such as (address), destination MAC: MAC_B (MAC address of fat client 2)> is unicast to the fat client 2 (step 15). Here, “MAC_X” is a dummy MAC address (a predetermined MAC address set in advance) prepared in advance as a camouflaged ARP.

  As a result, when the fat client 2 receives the ARP response (step 15) from the unauthorized connection prevention device 3, the fat client 2 again determines its own based on the destination IP address “IP_A” and the MAC address “MAX_X” of the ARP response. The entry of the router 4 in the ARP table 21 is updated with the IP address “IP_A” of the router 4 and the dummy MAC address (MAX_X) (step 16).

  Next, the unauthorized connection prevention device 3 performs the following operations: <source IP: IP_B (IP address of fat client 2), source MAC: IP_X (dummy MAC address), destination IP: broadcast address, destination MAC: broadcast address ARP response (second ARP response) such as> is broadcast (step 17).

  Accordingly, when the thin client 1 receives the ARP response (step 17) from the unauthorized connection prevention device 3, the thin client 1 based on the destination IP address “IP_B” and the MAC address “MAX_X” of the ARP response has its own ARP table. 12 is updated with the IP address “IP_B” and the dummy MAC address “MAX_X” of the fat client 2 (step 18).

  Similarly, when the router 4 receives the ARP response (step 17) from the unauthorized connection prevention device 3, the router 4 also has its own ARP table 41 based on the destination IP address “IP_B” and the MAC address “MAX_X” of the ARP response. The entry of the fat client 2 is updated with the IP address “IP_B” of the fat client 2 and the dummy MAC address “MAX_X” (step 18).

  The fat client 2 also receives the ARP response (step 17) from the unauthorized connection prevention device 3, but since the ARP response is “IP_B” and the same as its own IP address, the entry in its own ARP table 41 Do not update.

  When steps 11 to 18 are executed, the entries in the ARP tables 12, 21, and 41 of the terminals (thin client 1, fat client 2, router 4) are as shown in FIG.

  Among them, in the ARP table 21 of the fat client 2, as shown in FIG. 4B, the entry to the router 4 has a dummy MAC address “MAX_X” associated with the IP address (IP_A) of the router 4. It is registered dynamically. As a result, communication from the fat client 2 to the router 4 can be prevented. Further, if communication from the fat client 2 to a terminal other than the router 4, for example, the thin client 1 is attempted, steps 11 to 18 in FIG. 3 are executed again, and communication with the thin client 1 can be prevented.

  Further, in the ARP tables 12 and 41 of the thin client 1 and the router 4, as shown in FIGS. 4A and 4C, the entry of the fat client 2 corresponds to the IP address “IP_B” of the fat client 2. The dummy MAC address “MAX_X” is dynamically registered. As a result, communication from the thin client 1 and the router 4 to the fat client 2 can be prevented.

  Therefore, according to the present embodiment, the following effects can be obtained.

  The first effect is that the fat client 2 can be blocked from the network. The reason is that when the fat client 2 tries to communicate, the unauthorized connection prevention device 3 detects the ARP request and sends a fake ARP, thereby allowing the entry of the ARP table 21 of the fat client 2 and the terminal in the network. This is to destroy the entry of the fat client 2 in the entry of the ARP table.

  The second effect is that the thin client 1 can connect to the thin client server 6 outside the subnet. The reason is that since the thin client 1 does not transmit an ARP request, it is not detected and blocked by the unauthorized connection prevention device 3, and the combination of the IP address and MAC address to the router 4 is stored in the connection destination storage unit 14. This is because it is possible to communicate with the router 4 without making an ARP request.

  Next, a second embodiment of the present invention will be described.

  Referring to FIG. 5, the thin client network according to the present embodiment is different in that the thin client 1 does not hold the connection destination storage unit 14 and has a USB (Universal Serial Bus) memory 7.

  The USB memory 7 includes a connection destination storage unit 71 and an ARP table setting program 72. The connection destination storage unit 71 stores a set of the IP address and MAC address of the router 4. The stored IP address and MAC address are set by the network administrator. The USB memory 7 is distributed from the network administrator to the user of the thin client 1. The ARP table setting program 72 is automatically started when the USB memory 7 is connected to the thin client 1, and the IP address and MAC address stored in the connection destination storage unit 71 are statically stored in the ARP table 12 of the thin client 1. Register with.

  Next, the operation of this embodiment will be described with reference to the sequence diagram of FIG.

  The user connects the USB memory 7 to the thin client 1 before connecting the thin client 1 to the thin client server 6. When the USB memory 7 is connected to the thin client 1, the thin client 1 automatically starts the ARP table setting program 72 in the USB memory 7 and executes the ARP table setting program 72, thereby connecting in the USB memory 7. A set of the IP address and MAC address of the router 4 is acquired from the destination storage unit 71 (step 21).

  Next, the thin client 1 executes the ARP table setting program 72 to statically register the IP address and MAC address of the router 4 acquired in step 1 in its own ARP table 12 (step 22). Since the subsequent operations are the same as steps 3 to 9 shown in FIG. 2 and steps 11 to 18 shown in FIG. 3 of the first embodiment, description thereof will be omitted.

  Therefore, in this embodiment, the same effect as in the first embodiment can be obtained, and the setting of the ARP table 12 of the thin client 1 is automatically performed by the connection of the USB memory 7. There is a new effect that it is not necessary to directly set the IP address and MAC address of the router 4. As a result, the burden on the user of the thin client 1 can be reduced, and the IP address and MAC address unintended by the network administrator can be prevented from being registered by the user of the thin client 1.

  In the second embodiment, the case where the USB memory 7 is used has been described. However, other external memories and other portable recording media that can be carried are detachably connected to the thin client. It is also possible to use a recording medium to be used.

  The thin client 1 of each of the above embodiments can be applied to any mounting system. For example, OS, application, and data files are aggregated on a server, these are read from the server and executed on the terminal side, and a screen transfer type that executes the application on the server side and transfers screen information to the terminal In addition, any method such as a virtual PC type in which a client virtual machine is executed on the server side, an application is executed on the virtual machine, and screen information is transferred to a terminal can be applied.

  In addition, the thin client network according to each of the above embodiments includes the above-described components of the thin client 1 (communication device 11, communication control device 13, connection destination storage unit 14), and components of the unauthorized connection prevention device 3 (communication control unit). 31) As long as each process (function) of the constituent elements (the connection destination storage unit 71 and the ARP table setting program 72) of the USB memory 7 can be realized, the physical configuration of the device and the hardware inside the device The (circuit) and software (program) configurations are not particularly limited. For example, any form, such as independently configuring individual circuits, units, or program parts (program modules, etc.), or integrally configured in one circuit or unit, can be applied. These forms can be appropriately selected according to circumstances such as network operation. For example, the unauthorized connection prevention device 3 may be integrally mounted on the router 4.

  In addition, a method of operating a thin client network having steps for performing the same processing corresponding to each function of the constituent elements of the thin client 1 and the unauthorized connection prevention device 3 described above is also included in the scope of the present invention. .

  Further, at least a part of the functions of the constituent elements of the thin client 1 and the unauthorized connection prevention device 3 described above may be realized by software processing by a computer such as a processor having a CPU (Central Processing Unit). . In this case, an operation program for causing the computer to function is included in the category of the present invention. This program is not limited to a program in a format that can be directly executed by the CPU, but includes a program in various forms such as a source format program, a compressed program, and an encrypted program. In addition, this program operates in cooperation with a control program such as an OS (Operating System) and firmware that controls the entire apparatus, or is incorporated into a part thereof and constitutes an application program that operates integrally. Any form such as a software component (software module) can be applied. Further, this program can be downloaded from a server on the network, installed on a recording medium in the own device, and used. These forms can be appropriately selected according to circumstances such as network operation.

  A computer-readable recording medium that records the above computer program is also included in the scope of the present invention. In this case, the recording medium can be applied in any form such as a memory such as a ROM (Read Only Memory) that is used in a fixed manner in the apparatus or a portable type that can be carried by the user. is there.

  As described above, according to the present invention, the present invention can be applied to uses such as a thin client network, a thin client, an unauthorized connection prevention device, an operation method and an operation program thereof, and a recording medium such as a USB memory.

It is a schematic block diagram which shows the whole structure of the thin client network which concerns on 1st Example of this invention. FIG. 6 is a sequence diagram for explaining an operation when the thin client 1 connects to the thin client server 6 in the first embodiment. FIG. 6 is a sequence diagram illustrating an operation when the fat client 1 is disconnected from the network in the first embodiment. (A) is a diagram showing an entry in the ARP table of the thin client, (b) is a diagram showing an entry in the ARP table of the fat client, and (c) is a diagram showing an entry in the ARP table of the router. It is a schematic block diagram which shows the whole structure of the thin client network based on 2nd Example of this invention. It is a sequence diagram explaining operation | movement of a 2nd Example.

Explanation of symbols

1 Thin Client 2 Fat Client 3 Unauthorized Connection Prevention Device 4 Router 5 Business Network 6 Thin Client Server 7 USB Memory 8 LAN
11 Communication device (thin client)
12 ARP table (thin client)
13 Communication control device (thin client)
14 Connection destination storage (thin client)
21 ARP table (Fat client)
41 ARP table (router)
71 Connection destination storage (thin client)
72 ARP table setting program

Claims (20)

A thin client connected to the network and communicating with the thin client server via a router;
An unauthorized connection prevention device connected to the network;
The thin client
An ARP table for setting a set of IP (Internet Protocol) address and MAC (Media Access Control) address of the router to be statically held in the ARP table without transmitting an ARP (Address Resolution Protocol) request on the network. Setting means;
Communication means for communicating with the thin client server via the router using the IP address and MAC address of the router set in the ARP table;
The unauthorized connection prevention device includes:
Upon receiving an ARP request broadcast on the network, an ARP response including a predetermined MAC address different from the MAC address of the source terminal is sent on the network so as to block the source terminal of the ARP request from the network. A thin client network comprising ARP response means for transmitting to the network. The ARP response means includes
After the ARP response from the router is transmitted to the source terminal in response to the ARP request from the source terminal, the destination IP address and the destination MAC address are set to the IP address and MAC address of the source terminal. And sending a first ARP response with the source IP address as the IP address of the router and the source MAC address as the predetermined MAC address to the source terminal,
2. The second ARP response having the transmission source IP address as the IP address of the transmission source terminal and the transmission source MAC address as the predetermined MAC address is then broadcast on the network. Thin client network. The ARP table setting means includes:
A storage unit for storing data of a set of the IP address and MAC address of the router that is input in advance;
When the set of IP address and MAC address of the router is not registered in the ARP table during communication with the thin client server, the data is acquired from the storage unit, and the acquired data is set in the ARP table. The thin client network according to claim 1 or 2, characterized in that: A recording medium removably connected to the thin client;
The recording medium is
A storage unit for storing data of a set of an IP address and a MAC address of the router;
An ARP table setting program for setting the data of the storage unit in the ARP table of the thin client;
The ARP table setting unit sets data in the storage unit in the ARP table by starting and executing the ARP table setting program when the recording medium is connected to the thin client. The thin client network according to claim 1 or 2.   The thin client network according to claim 4, wherein the recording medium is a USB (Universal Serial Bus) memory. A thin client connected to the network and communicating with the thin client server via a router;
An operation method of a thin client network having an unauthorized connection prevention device connected to the network,
An ARP table setting step in which the thin client sets an IP address and a MAC address of the router to be statically held in an ARP table without transmitting an ARP request on the network;
A communication step in which the thin client communicates with the thin client server via the router using the IP address and MAC address of the router set in the ARP table;
When the unauthorized connection prevention apparatus receives an ARP request broadcast on the network, a predetermined MAC address different from the MAC address of the source terminal is set so as to block the source terminal of the ARP request from the network. And an ARP response step of transmitting an ARP response including the ARP response on the network. In the ARP response step, after an ARP response from the router is transmitted to the source terminal in response to an ARP request from the source terminal, a destination IP address and a destination MAC address are set to the source terminal. Transmitting a first ARP response with the IP address and MAC address as the source IP address of the router and the source MAC address as the predetermined MAC address to the source terminal;
7. The method further comprises: broadcasting a second ARP response having the source IP address as the IP address of the source terminal and the source MAC address as the predetermined MAC address on the network. The operation method of the thin client network described in 1. The ARP table setting step includes:
Storing in the storage unit data of a set of the IP address and MAC address of the router inputted in advance;
When the set of IP address and MAC address of the router is not registered in the ARP table during communication with the thin client server, the data is acquired from the storage unit, and the acquired data is set in the ARP table. The method for operating a thin client network according to claim 6 or 7, further comprising the step of: The thin client network further includes a recording medium detachably connected to the thin client,
The recording medium includes a storage unit that stores data of a set of an IP address and a MAC address of the router, and an ARP table setting program for setting data of the storage unit in the ARP table of the thin client,
The ARP table setting step sets data in the storage unit in the ARP table by starting and executing the ARP table setting program when the recording medium is connected to the thin client. The operation method of the thin client network according to claim 6 or 7.   The method of operating a thin client network according to claim 9, wherein the recording medium is a USB memory. A thin client connected to a network and communicating with a thin client server via a router,
ARP table setting means for setting a set of the IP address and MAC address of the router to be statically held in the ARP table without transmitting an ARP request on the network;
A thin client comprising communication means for communicating with the thin client server via the router using the IP address and MAC address of the router set in the ARP table. The ARP table setting means includes:
A storage unit for storing data of a set of the IP address and MAC address of the router that is input in advance;
When the set of IP address and MAC address of the router is not registered in the ARP table during communication with the thin client server, the data is acquired from the storage unit, and the acquired data is set in the ARP table. The thin client according to claim 11, wherein: A recording medium detachably connected to the thin client according to claim 11,
The recording medium is
A storage unit for storing data of a set of an IP address and a MAC address of the router;
An ARP table setting program for setting the data of the storage unit in the ARP table of the thin client;
A recording medium that sets data in the storage unit in the ARP table by starting and executing the ARP table setting program when connected to the thin client.   A USB memory comprising the recording medium according to claim 13. An unauthorized connection prevention device connected to the network and used in a thin client network having a thin client that communicates with a thin client server via a router,
Upon receiving an ARP request broadcast on the network, an ARP response including a predetermined MAC address different from the MAC address of the source terminal is sent on the network so as to block the source terminal of the ARP request from the network. An unauthorized connection preventing apparatus, comprising: an ARP response means for transmitting to the network.   The ARP response means sends a destination IP address and a destination MAC address of the source terminal after an ARP response from the router is transmitted to the source terminal in response to an ARP request from the source terminal. A first ARP response with the IP address and MAC address as the source IP address of the router and the source MAC address as the predetermined MAC address is transmitted to the source terminal, and the source IP 16. The unauthorized connection prevention apparatus according to claim 15, wherein a second ARP response having an address as an IP address of the source terminal and a source MAC address as the predetermined MAC address is broadcast on the network. . A thin client operating method connected to a network and communicating with a thin client server via a router,
An ARP table setting step for setting a set of the IP address and MAC address of the router to be statically held in an ARP table without transmitting an ARP request on the network;
A method of operating a thin client, comprising: a communication step of communicating with the thin client server via the router using the IP address and MAC address of the router set in the ARP table. An operation method of an unauthorized connection prevention device connected to a network and used in a thin client network having a thin client that communicates with a thin client server via a router,
Upon receiving an ARP request broadcast on the network, an ARP response including a predetermined MAC address different from the MAC address of the source terminal is sent on the network so as to block the source terminal of the ARP request from the network. The operation method of the unauthorized connection prevention device characterized by comprising an ARP response step for transmitting to the network. A thin client operation program connected to a network and communicating with a thin client server via a router,
On the computer,
A process of setting a set of the IP address and MAC address of the router to be statically held in an ARP table without transmitting an ARP request on the network;
An operation program for a thin client that executes processing for communicating with the thin client server via the router using the IP address and MAC address of the router set in the ARP table. An operation program for an unauthorized connection prevention device connected to a network and used in a thin client network having a thin client that communicates with a thin client server via a router,
On the computer,
Upon receiving an ARP request broadcast on the network, an ARP response including a predetermined MAC address different from the MAC address of the source terminal is sent on the network so as to block the source terminal of the ARP request from the network. An operation program for an unauthorized connection prevention device, characterized by causing a process to be transmitted to a server to be executed.

Images