Ubiquitous Thin Client and Teleworking Takaaki Ozeki The implementation of thin clients is Image of displayed screen on thin client Thin clients for external use accelerating as they are considered to be the Home “trump card of strategies against information leaks” in the IT environment of business Thin client enterprises. Thin client systems have as their Location-free environment: Destination of business call basic architecture “Server Based Computing” When the terminal used and location changes, (SBC), which offers a mechanism for managing whether in the office, a satellite office, the destination of a business call or at home, the Thin client (laptop) data at data centers, also the data cannot be same screen display and environment as on one's retrieved from the terminals of individuals. This own personal computer, are available for use. Satellite office is an important aspect that prevents the leaking Internet of information in teleworking operations. Corporate internal Thin client Another feature of thin clients, “the availability Data center Thin client of one's own personal computer environment Thin client Servers: File server, etc. from any terminal” (location-free) is also a LAN Thin client major advantage for realizing an easy to use teleworking environment. Fig. 1 Location-free A thin client USB-type is introduced as a “ubiquitous thin client” in this paper. Using this USB-type thin client enables users to utilize their own desktop A user simply inserts the Safario into the USB port of personal computer or any laptop personal computer, an existing personal computer and starts using the available anywhere, as a thin client in a simple manner, personal computer as a thin client terminal. This making it possible for teleworking in a secure manner. combination of “personal computer plus Safario” can replace the category of “thin clients for external use” depicted in Fig. 1. Ubiquitous thin client Features of the Safario relevant to providing thin client A feature of thin clients is “the availability of one's own environments suitable for teleworking are described in personal computer environment at any terminal”, which the next chapter. means that when thin client terminals are arranged in the manner shown in Fig. 1, a user can log onto his or her Features of ubiquitous thin client Safario “own personal computer environment” from any of these thin client terminals. This demonstrates that the Safario is a “ubiquitous thin client solution” developed configuration depicted in Fig. 1 is an environment that with the intention of achieving remote access in a secure presents a “location-free” setup, so to speak, which yet simple manner. Safario is comprised of the following enables users to do their work using different thin client three components (Fig. 2): terminals at different locations as if they were always a. Safario token (USB memory-type device) using their own personal computers. This USB-type thin client device internally The method involving the placement of dedicated thin incorporates the operating system and applications. This clients at all locations, including homes, in order to device enables the instant use of a personal computer as actually carry out teleworking is not very realistic a thin client terminal simply by connecting it to the USB however, when the transition from existing personal port of an existing personal computer. Furthermore, this computer environments to new environments, as well as device functions as a “token” for certifying that it is an the implementation costs involved, are taken into authorized thin client device through an internally consideration. In view of the consequences of such a incorporated certificate authenticated through a situation we developed a USB-type of ubiquitous thin coordinated linkup with the Safario Gateway and Safario client, “Safario,” which is a tool for using the existing Manager, which are described in the following section. personal computers as thin client terminals in a secure b. Safario Gateway (software) yet simple manner. The Safario Gateway is installed at the entrance to 60 Oki Technical Review October 2008 / Issue 213 Vol.75 No.2 Special Issue on Teleworking in Ubiquitous Society PC considerations, lower cost systems have been made available for USB-type thin clients of other companies. The functional features of Safario, which will be necessary for teleworking, are described in the following segment. a. Safario token (1) Security as a thin client • A thin client connected to a personal computer The Safario token operates as an independent thin client with the necessary operating system as well as b. Safario Gateway • Token authentication and VPN applications all built in. It is also able to operate without Internet connection the use of any hard disk in the personal computer. For c. Safario Manager this reason the operating environment of Safario will • User management database never be impacted by any virus that infects personal computers. Furthermore, the leaking of information can be prevented, since the loading of data onto an external Thin client server File server storage device is prohibited when Safario is in use. In this manner, it is possible to utilize existing personal computers as thin client terminals and to realize secure teleworking through the use of Safario (Fig. 3). Fig. 2 Three components of Safario (2) Security of communication path the corporate internal network. The personal computer of When a thin client terminal is used externally, it is a user is able to gain access to the corporate internal usually connected to the corporate internal network via network from the internet via a Safario token that links it the internet. The connection via the internet has been to the Safario Gateway. In this process, when a identified as an issue, since the data can potentially be connection request is received from a Safario token, the tapped into through the communication path. Therefore, Safario Gateway authenticates the authorized user by the VPN is most commonly used for the encryption of accessing the database managed by the Safario communications through a connection between a Manager, which is described in the next section. terminal at an external location and a corporate internal Furthermore, a virtual private network (VPN) connection network. with encrypted data is configured on the communication Since Safario already provides the VPN connectivity path between the Safario token and the Safario Gateway. as a basic function, there is no need to arrange for c. Safario Manager (software) equipment to use VPN (lower cost) to realize teleworking This tool is used for managing the users of Safario securely and simply. This is an aspect that is considered tokens. It prepares a database that correlates the Safario to be a feature of Safario (Fig. 3). tokens with users. This database is used for authenticating Safario tokens and users, as described (3) Two methods available for startup earlier. If a user loses a Safario token, the lost token can Two methods, “Boot mode” and “Virtual mode,” are be registered for “prohibited use” with the Safario available for starting up Safario. This feature of Safario is Manager to prevent unauthorized use by others. not available with other USB-type thin clients. The “Boot Safario provides a ubiquitous thin client environment mode” method of starting up Safario is executed by securely and simply through the functions of the three inserting it into the USB port of a personal computer components described above. In terms of further outlay Internet Thin client serverSafario PC Safario token Gateway/Manager USB Applications Gateway software Monitor Keyboard Mouse performs: interface RDP client User User User User Token VPN client, etc. AP AP AP AP authentication SSH-VPN CPU Memory VPN connection Drivers Manager software Internet Wireless Communi- NIC Windows Server OS Linux LAN cation card Linux Servers (data center) Gateway maintains Network is Hard disk on PC is not used. perform: strict restrictions on connected by VPN Once power is turned OFF • Operation of connected terminals. connection. nothing is left behind on PC. applications • Storage of data Fig. 3 Security of Safario Oki Technical Review 61 October 2008 / Issue 213 Vol.75 No.2 (1) Boot mode PC power Safario inserted PC power Thin client started up turned OFF turned ON (2) Virtual mode PC operating Safario inserted Icon clicked Thin client started up Safario token (Windows) Fig. 4 Two startup modes (Boot mode and Virtual mode) Thin client area Confidential data area before turning on the power of the personal computer. Applications The “Virtual mode,” on the other hand, is a method for starting up Safario automatically by simply inserting it into RDP client a personal computer that is already running on a VPN client, etc. Windows operating system. The characteristics of these PDF data two methods are described below (Fig. 4). a. Boot mode Drivers This is an operating mode in which Safario starts up without the use of any portion of the hard disk on the Linux personal computer. In this mode Safario is theoretically equivalent to a “dedicated thin client terminal.” Fig. 5 Confidential data area Furthermore, the features of this mode include the speed at which Safario starts up and terminates operations, appropriate antivirus software is not installed on the which is overwhelmingly faster than the Windows Windows operating system. operating system. By selecting one of these two startup modes in an This booting mode for starting up Safario, however, appropriate manner it is possible to attain the benefits of may not be available in some personal computer models, a more convenient thin client environment suitable for depending on the particular model in use, due to the particular conditions of teleworking. difference in basic specifications. In such cases, utilization of the “Supplementary CD-ROM” supplied with (4) Confidential data area (Fig. 5) Safario will render most personal computers usable for The third feature within the Safario token is a memory starting up Safario.