JP2003242109A - Certification access control server device, gateway device, certification access control method, gateway control method, certification access control program and recording medium with the program recorded thereon, and gateway control program and recording medium with the program recorded thereon - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a single sign-on achieving high security strength, independence of the kind of a server, and difficulty of generation of throughput reduction. <P>SOLUTION: A gateway function is separated from a conventional reverse proxy type certification access control server device to set a dedicated gateway device capable of conducting hardware processes of packet filtering based on IP addresses, port numbers, etc., and a certification access control server device. A request for access without setting for entry to permit passing the gateway device is only transferred to the certification access control server device. For preventing an uncertified request for access from reaching the server due to direct communication of a user terminal with the server, a program for recognizing a terminal is sent to the user terminal for monitoring. End of communication is detected to nullify certification, and communication permitting entry of the gateway device is deleted. <P>COPYRIGHT: (C)2003,JPO

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention is used in a system that is composed of an authentication access control server device and a gateway device and authenticates an access request to a server group issued from a user terminal connected to a communication network. Authentication access control server device, gateway device used in the system, authentication access control method used in the authentication access control server device, gateway control method used in the gateway device, and realization of the authentication access control method The present invention relates to an authentication access control program used in the above, a recording medium recording the program, a gateway control program used for realizing the gateway control method, and a recording medium recording the program.

A server that wants to permit access only to a specific user needs to require the user to authenticate at the time of access. When the user has the access authority to a plurality of servers, it is desirable from the viewpoint of security and convenience that authentication can be performed collectively instead of performing authentication for each server.

The present invention relates to an authentication access control system which collectively authenticates users who have the authority to access one or a plurality of servers.

[0004]

2. Description of the Related Art As a method of enabling access to a plurality of servers (hereinafter, content servers in particular) with a single authentication (hereinafter referred to as single sign-on), there is a method of installing an authentication access control server in a network. Known,
Depending on the processing form, "reverse proxy type",
It is classified as “agent module type”.

Reverse proxy type single sign-on is realized by installing an authentication access control server between a user terminal and a content server, as shown in FIG.

In this reverse proxy type single sign-on, all access requests to the content server are transmitted by relaying the authentication access control server, and the authentication access control server has an internal access list for each user when relaying. Access control is performed by referring to.

On the other hand, the agent module type single sign-on is realized by an authentication access control server installed in the network and an agent module incorporated in the content server, as shown in FIG.

In this agent module type single sign-on, the user first logs in to the authentication access control server. When the authentication is successful, the authentication access control server embeds a list of content servers accessible by the user in a cookie and sends the cookie to the user terminal.

After that, when the user accesses the content server, the agent module in the content server determines whether the access is possible based on the information in the cookie. If the content server is accessed by a user terminal that is not authenticated by the authentication access control server, the agent module in the content server forwards the access request to the authentication access control server for authentication. Let me do it.

[0010]

In the reverse proxy type, since single sign-on is possible without modifying the content server, single sign-on can be performed regardless of the type of the content server.

However, since all access requests are relayed, the security strength is strong, but on the other hand, in a large-scale environment in which a large number of content servers are distributed, due to concentrated access to the authentication access control server, In particular, there is a possibility that throughput may be reduced due to server processing performance and network resource limitations.

On the other hand, in the agent module type,
Since only unauthenticated access requests go through the authenticated access control server, it is unlikely that the throughput will be reduced as in the case of the reverse proxy type.

However, since the unauthenticated packet reaches the content server directly, the security strength is slightly weaker than that of the reverse proxy type, and it is necessary to install a dedicated agent module in each content server, which is possible. There was a possibility that the number of content servers would be limited.

According to the present invention, in single sign-on,
This was done to solve the drawbacks of the reverse proxy type and the agent module type described above. While inheriting the advantages of the reverse proxy type that the agent module type does not have, the authentication access control server By avoiding the concentration of load, the security strength is strong and it does not depend on the type of content server.
Further, it is an object of the present invention to realize a communication system in which a decrease in throughput does not easily occur.

[0015]

In order to achieve this object, an authenticated access control server device of the present invention is composed of an authenticated access control server device and a gateway device, and is a user terminal connected to a communication network. When it is used in a system that authenticates an access request to a server group issued from, and the access request is transferred because the path is not set in the gateway device,
Using the method for receiving the access request, the method for acquiring the information required for authentication from the user terminal only in the case of the first access request, and the information required for the authentication for the server that does not have the authentication function. Means for executing authentication, means for requesting a server having an authentication function by designating the information necessary for the acquired authentication, and means for setting a path to the authenticated server in the gateway device. , And means for invalidating the path set in the gateway device when the specified state is reached.

The authentication access control method realized by the operation of the authentication access control server device of the present invention can be concretely realized by a computer program, and this computer program is a semiconductor memory or the like. It can be provided by recording it on any suitable recording medium.

On the other hand, in order to achieve this object, the gateway device of the present invention is composed of an authentication access control server device and a gateway device and is connected to a server group issued from a user terminal connected to a communication network. When it is used in a system that authenticates the access request of, when the means for managing the path set from the authentication access control server device and the path corresponding to the access request from the user terminal are not set, A means for transferring the access request to the authentication access control server device; a means for setting the path when the authentication access control server device gives a path setting instruction in response to the transfer of the access request; and an authentication access control In response to the invalidation instruction from the server device, means for invalidating all the setting paths for the specified user terminal, and If the path is not referenced predetermined time, configured to and means for invalidating the path.

The gateway control method realized by the operation of the gateway device of the present invention can be realized concretely by a computer program, and this computer program is recorded in an appropriate memory such as a semiconductor memory. It can be recorded on a medium and provided.

Next, an example of the processing flow of the authentication system of the present invention configured as above will be described.

In the authentication system of the present invention having such a configuration, when the first access request is issued from the user terminal, the path is not set in the gateway device, so that the access request is sent to the authentication access control server. After being transferred to the device, the authenticated access control server device receives the information and acquires the information necessary for authentication from the user terminal.

If this initial access request is an access request to a server that does not have an authentication function, the authentication access control server device uses the information necessary for authentication to acquire all the authentication functions that do not have an authentication function. Authenticate the server at once and set the path to the gateway device. After that, since the path is set, the access request to the server having no authentication function will not be transferred from the gateway device.

On the other hand, if the first access request is an access request to a server having an authentication function, the authentication access control server device responds to the request from the server and acquires the necessary information for the authentication. Authenticate to that server by requesting authentication to that server, and then use the information required for authentication to authenticate once for all servers that do not have the authentication function. To set the path in the gateway device. After that, since the path is set, the access request to the server having the authentication function and the access request to the server not having the authentication function will not be transferred from the gateway device.

When the access request to the server having the authentication function is transferred in the access request subsequent to the first access request, the information necessary for the authentication has already been acquired, and therefore, from that server. In response to the request, the information required for the acquired authentication is designated, and the server is authenticated by making an authentication request to the server, and the path is set in the gateway device. After that, since the path is set, the access request to the server having the authentication function will not be transferred from the gateway device.

By setting the path in the gateway device in this way, the access request is not transferred to the authentication access control server device, but the connection relationship between the user terminal and the server is left as it is. It is not preferable for security to set it.

Therefore, the authentication access control server device
By sending the program to the user terminal, if there is no response from the program for a certain period of time, disable all the paths set for the user terminal set in the gateway device, and authenticate from the program. When the invalidation instruction is issued, all the paths set to the user terminal set in the gateway device are invalidated, and the authentication of the set path in response to the access request from the user terminal is performed. When a certain time has elapsed from (authentication and setting of a path), processing is performed to invalidate all paths set for the user terminal set in the gateway device.

On the other hand, the gateway device invalidates the path in response to the invalidation instruction from the authentication access control server device, and also performs processing to invalidate the path when the path is not referenced for a certain period of time. .

As described above, according to the present invention, the conventional reverse
The gateway function is cut out from the proxy-type authentication access control server device, and is separated into a dedicated gateway device and an authentication access control server device that can perform packet filtering hardware processing based on the IP address, port number, etc., and passes through the gateway device. It is characterized in that only an access request for which no entry permitting is set is transferred to the authentication access control server device.

Then, in order to prevent an unauthenticated access request from reaching the server, which is caused by direct communication between the user terminal and the server, a terminal confirmation program is transmitted to the user terminal for monitoring. It is characterized by detecting the end of communication, invalidating the authentication, and deleting (invalidating) the communication permission entry of the gateway device.

As described above, according to the present invention, only the access request for which the entry permitting passage of the gateway device is not set is transferred to the authentication access control server device, which is a problem of the conventional reverse proxy type. Further, it becomes possible to avoid concentration of load on the authentication access control server device.

Then, in the direct communication that does not pass through the authentication access control server device, a program for terminal confirmation is transmitted to the user terminal for monitoring, the end of communication is detected, and the communication permission entry of the gateway device is deleted ( By disabling), without changing the server,
It is possible to prevent an unauthenticated access request from directly reaching the server as in the conventional agent module type.

Next, the structural features of the present invention will be summarized.

(1) In the present invention, the authentication access control server device and the gateway device are used, and when the user terminal connected to the connectionless communication network accesses a plurality of servers, the user has access authority. Manages a group of servers with each user, accepts access requests to the server group to which the user has access authority by the authentication access control server device, and revoke authentication to the server group to which the user has access authority Only when accessing for the first time afterwards, request the user to input the information required for authentication, and during the valid period of authentication, the user can access the information required for authentication for all servers belonging to the relevant server group. When it succeeds in the authentication, the gateway device placed in the communication network is controlled,
The feature is that it enables direct communication between the user terminal and the server.

(2) As a function of the gateway device, security is ensured by not allowing communication between the user terminal and the server until the user is successfully authenticated and addressed to the server, and An access request which is not permitted to pass is transferred to the authentication access control server device to request authentication.

(3) Then, in the access to the server having the authentication function, the access request accepted by the authentication access control server device as a proxy is directly transferred to the access request destination server and the authentication request from the server is received. However, only when the access to the server is the first access to the server group to which the user has access authority after the authentication has expired, the user is requested to input the information necessary for authentication, Authentication is performed based on the information received from the user, the information required for authentication at the server is transmitted on behalf of the user, and the gateway device in the network is used to connect the user terminal and the server. For the access requests for other servers in the server group that are accepted by the authentication access control server device during the validity period of authentication, Remains transferred to the server,
In response to the authentication request from the server, the information required for authentication at the server is sent on behalf of the user, and the gateway device in the network allows direct communication between the user terminal and the server. It is characterized by doing.

(4) Then, in accessing the server having the authentication function, the first access request to the server group to which the user has the access authority after the authentication expires,
When the authentication access control server accepts it by proxy, it requests the user to input the information required for authentication,
After successful authentication, the access request is transferred to the server, and in response to the authentication request from the server, the information necessary for authentication at the server is sent on behalf of the user, and the user at the gateway device in the network. Direct communication between the terminal and the server is permitted, and the access request for other servers in the server group accepted by the authentication access control server device within the valid period of the authentication is directly transferred to the server,
In response to the authentication request from the server, the information required for authentication at the server is sent on behalf of the user, and the gateway device in the network allows direct communication between the user terminal and the server. It is characterized by doing.

(5) When accessing a server that does not have an authentication function, the authentication access control server apparatus accepts the first access request for the server group to which the user has access authority after the authentication has expired, Request that the user input the information required for authentication,
After successful authentication, the gateway device in the communication network permits direct communication between the user terminal and all the servers belonging to the server group.

(6) Then, the program has a program that runs on the user terminal, and the state of the user terminal is monitored by periodically communicating between the authentication access control server device and the program, It is characterized in that the end of the session is detected when the communication from the program is lost, the authentication of the user is invalidated, and the setting of the gateway device is changed so as to accept the access request to the server group again by proxy. .

(7) After the authentication by the authentication access control server device, the program is transmitted to the browser of the user terminal that has been successfully authenticated, and a button or the like for instructing the forced expiration of the authentication is displayed on the browser. When the user clicks the button etc., the authentication access control server device is made to send the information indicating the invalidation of the authentication,
When the information is received, the setting of the gateway device is changed so as to accept the access request to the server group again by proxy.

(8) If the communication permission entry between the user terminal and the server, which is set in the gateway device after the authentication by the authentication access control server device, is not referred to for a certain period of time, the entry is automatically set. It is characterized in that the authentication of the user is invalidated by deleting (invalidating), and by making the access request to the server again transferred to the authentication access control server device.

(9) Then, after the authentication by the authentication access control server device, the communication permission entry between the user terminal and the server which is automatically set in the gateway device after a lapse of a certain time is deleted (invalidated). However, the authentication of the user is invalidated by again transferring the access request to the server to the authentication access control server device.

[0041]

BEST MODE FOR CARRYING OUT THE INVENTION Hereinafter, the present invention will be described in detail according to embodiments.

FIG. 1 shows an embodiment of a system configuration for realizing the present invention.

As shown in this figure, an authentication access control system 1 for realizing the present invention is composed of an authentication access control server 2 and a gateway device 3, and the gateway device 3 is a high speed based on an IP address and a port number. It has various packet filtering functions.

When adopting this configuration, it is assumed that the user 4 accesses the content servers 7 to 12 belonging to the content server group 6 having the access right from the user terminal 5 via the authentication access control system 1. .

Here, it is assumed that the content server group 6 is composed of content servers 7 to 9 having an authentication function and content servers 10 to 12 having no authentication function.

(A) Processing when first accessing the content servers 7 to 9 having the authentication function (pattern to relay first) FIGS. 2 and 3 show the flow of processing at this time.

When the user 4 sends an access request packet addressed to any of the content servers 7 to 9 from the user terminal 5 to the content server group 6 in an unauthenticated state, the gateway device 3 User terminal 5
The packet from the user terminal 5 is transferred to the authentication access control server 2 because there is no entry permitting the passage of the packet having the source as the source and the destination as the content server (here, the content server 7 is assumed). Is
A communication connection is established with the content server 7 via the authentication access control server 2 (step 101).

When the user terminal 5 accesses the content that requires authentication in the content server 7 (steps 102 and 103), the content server 7 sends information necessary for authentication (password in this embodiment). Is transmitted (step 104).

In response to this, the authentication access control server 2 transmits to the user terminal 5 a request for transmitting the password required for the user 4 to authenticate the content server group 6 (step 105).

When the authentication access control server 2 receives the password returned in response to this transmission request,
After the user 4 is authenticated to the content server group 6 (step 106), the information necessary for the authentication of the user 4 inside the content server 7 is transmitted to the content server 7 on behalf of the user (step 107). Authenticates in the content server 7, and sends a resident program (in this embodiment, a Java (registered trademark) applet in the present embodiment) to the user terminal 5 on the browser of the user terminal 5 (step 108). .

Subsequently, the authentication access control server 2 sets a firewall entry to the gateway device 3 so as to pass a packet having the user terminal 5 as a transmission source and the content server 7 as a transmission destination. Registration) (step 109).

Further, the authentication access control server 2 allows the gateway device 3 to pass a packet having the user terminal 5 as the transmission source and the content servers 10 to 12 having no authentication function as the transmission destination. And set (register) a firewall entry (step 11)
0).

The response to the access request transmitted in steps 102 and 103 is transmitted to the user terminal 5 (step 11
1, 112) and subsequent access requests from the content server 7 and the user terminal 5 addressed to the content servers 10 to 12, the authentication access control server 2
It directly reaches the content server without going through (steps 113 and 114).

Next, when the user 4 attempts an access from the user terminal 5 to the content server 8or9, the gateway device 3 transmits a packet having the user terminal 5 as the source and the content server 8or9 as the destination. Since the entry that allows passage is not set, the packet is transferred to the authentication access control server 2 and passes through the authentication access control server 2 to the content server 8or.
9 and a communication connection is established (step 115).

When there is access to a content that requires authentication in the content server 8 or 9 (step 1)
16, 117) is requested to transmit a password from the content server 8 or 9 (step 118).

In this case, the authentication access control server 2
The password transmission request is not issued to the user terminal 5, but the password for the content server 8or9 of the user 4 inside the authentication access control server 2 is transmitted to the content server 8or9 on behalf of the content server. Authentication is performed within 8 or 9 (step 119).

Subsequently, the authentication access control server 2 sets a firewall entry for the gateway device 3 so that the packet having the user terminal 5 as the transmission source and the content server 8 or 9 as the transmission destination is passed. (Register) (step 120).

The response to the access request transmitted in steps 116 and 117 is transmitted to the user terminal 5 (step 12
1, 122) and then the content server 8or
An access request from the user terminal 5 addressed to 9 does not go through the authentication access control server 2 and is directly sent to the content server 8
or9 will be reached (steps 123 and 12)
4).

Next, when the user 4 attempts access from the user terminal 5 to any of the content servers 10 to 12, the entry allowing packet passage is already set in the gateway device 3. It is possible to access the content (steps 126 and 127) by directly establishing a communication connection with the content servers 10 to 12 without going through the authentication access control server 2 (step 125).

(B) Processing when first accessing the content servers 7 to 9 having an authentication function (pattern to be authenticated first) FIGS. 4 and 5 show the flow of processing at this time.

When the user 4 transmits an access request packet addressed to any of the content servers 7 to 9 from the user terminal 5 to the content server group 6 in an unauthenticated state, the gateway device 3 User terminal 5
The packet from the user terminal 5 is transferred to the authentication access control server 2 because there is no entry permitting the passage of the packet having the source as the source and the destination as the content server (here, the content server 7 is assumed). Is
A communication connection is established with the content server 7 via the authentication access control server 2 (step 201).

After that, the authentication access control server 2 receives the content access request from the user terminal 5 (step 202), and the content server group 6 of the user 4 is received.
A request for transmitting a password required for authentication is transmitted to the user terminal 5 (step 203).

When the authentication access control server 2 receives the password returned in response to this transmission request,
After the user 4 authenticates the content server group 6 (step 204), the original access request addressed to the content server 7 is transmitted to the content server 7 on behalf of the user terminal 5 (step 205), and the content server is sent. In addition to authenticating within 7, the user terminal 5
Send the Java applet (step 206).

Then, the response to the access request transmitted in steps 202 and 205 is transmitted to the user terminal 5 (steps 207 and 208).

After that, when there is access to a content that requires authentication in the content server 7 (step 2)
09, 210), the content server 7 requests the transmission of the password (step 211).

In this case, the authentication access control server 2
The password for the content server 7 of the user 4 held inside is transmitted to the content server 7 on behalf of the user to be authenticated in the content server 7 (step 212).

Subsequently, the authentication access control server 2 sets the firewall entry to the gateway device 3 so that the packet having the user terminal 5 as the transmission source and the content server 7 as the transmission destination is passed. Registration) (step 213).

Further, the authentication access control server 2 allows the gateway device 3 to pass the packet having the user terminal 5 as the transmission source and the content servers 10 to 12 having no authentication function as the transmission destination. And set (register) a firewall entry (step 21)
4).

The response to the access request transmitted in steps 209 and 210 is transmitted to the user terminal 5 (step 21
5, 216) and subsequent access requests from the content server 7 and the user terminal 5 addressed to the content servers 10 to 12, the authentication access control server 2
It directly reaches the content server without going through (steps 217 and 218).

The access request in step 202 is
If the request is an access to a content that requires authentication in the content server 7, steps 207 to 210
The steps up to are omitted, and the response to the access request in steps 215 and 216 is the response to the access request transmitted in steps 202 and 205.

Next, when the user 4 attempts an access from the user terminal 5 to the content server 8or9, the gateway device 3 transmits a packet whose source is the user terminal 5 and whose destination is the content server 8or9. Since the entry permitting passage is not set, the packet is transferred to the authentication access control server 2, and the content server 8 or 9 passes through the authentication access control server 2.
And a communication connection is established (step 219).

When there is access to a content that requires authentication in the content server 8 or 9 (step 2)
20, 221) is requested to transmit a password from the content server 8 or 9 (step 222).

In this case, the authentication access control server 2
The password transmission request is not issued to the user terminal 5, but the password for the content server 8or9 of the user 4 inside the authentication access control server 2 is transmitted to the content server 8or9 on behalf of the content server. Authentication is performed within 8 or 9 (step 223).

Subsequently, the authentication access control server 2 sets a firewall entry for the gateway device 3 so as to pass a packet having the user terminal 5 as a transmission source and the content server 8 or 9 as a transmission destination. (Register) (step 224).

The response to the access request transmitted in steps 220 and 221 is transmitted to the user terminal 5 (step 22
5, 226), the content server 8or
Regarding the access request from the user terminal 5 addressed to 9,
The content server 8 or 9 is directly reached without passing through the authentication access control server 2 (step 227,
228).

Next, when the user 4 attempts an access from the user terminal 5 to any of the content servers 10 to 12, the entry for permitting the passage of packets has already been set in the gateway device 3. Therefore, it is possible to directly establish a communication connection with the content servers 10 to 12 without going through the authentication access control server 2 (step 229) and access the content (steps 230 and 231).

(C) Processing when first accessing the content servers 10 to 12 that do not have the authentication function FIGS. 6 and 7 show the flow of processing at this time.

When the user 4 sends to the content server group 6 an access request packet addressed to any of the content servers 10 to 12 that does not have the authentication function from the user terminal 5 in the unauthenticated state. , Gateway device 3
In the above, since there is no entry permitting passage of a packet having the user terminal 5 as the transmission source and the transmission destination as the content server (here, temporarily the content server 10), the packet from the user terminal 5 is authenticated. It is transferred to the access control server 2 and establishes a communication connection with the content server 10 via the authentication access control server 2 (step 301).

After that, the authentication access control server 2 receives the content access request from the user terminal 5 (step 302), and the content server group 6 of the user 4 is received.
A request for transmitting a password required for authentication is transmitted to the user terminal 5 (step 303).

When the authentication access control server 2 receives the password returned in response to this transmission request,
After the user 4 is authenticated to the content server group 6 (step 304), the original content server 10
An access request addressed to the user terminal 5 is transmitted to the content server 10 on behalf of the user terminal 5 (step 305), and a Java applet is transmitted to the user terminal 5 (step 3).
06).

Subsequently, the authentication access control server 2 sets the firewall entry to the gateway device 3 so that the packet having the user terminal 5 as the transmission source and the content servers 10 to 12 as the transmission destination is passed. It is set (registered) (step 307).

Then, the response to the access request transmitted in steps 302 and 305 is transmitted to the user terminal 5 (steps 308 and 309).

Access requests from the user terminal 5 addressed to the content servers 10 to 12 on and after the next time directly reach the content servers 10 to 12 without passing through the authentication access control server 2 (step 310,
311).

Next, when the user 4 attempts an access from the user terminal 5 to any of the content servers 7 to 9, the gateway device 3 uses the user terminal 5 as the transmission source and the content servers 7 to 9 are transmitted. Since there is no entry that allows the passage of packets destined to
The packet is transferred to the authentication access control server 2,
A communication connection is established with the content server via the authentication access control server 2 (step 31).
2).

When there is access to a content that requires authentication in the content server 7-9 (step 3)
13, 314) is requested to transmit the password from the content server 7-9 (step 315).

In this case, the authentication access control server 2
A password transmission request is not issued to the user terminal 5, but the password for the content server 7-9 of the user 4 held inside the authentication access control server 2 is transmitted to the content server 7-9 by proxy. , Authentication is performed in the content servers 7 to 9 (step 316).

Then, the authentication access control server 2 causes the gateway device 3 to pass the packet having the user terminal 5 as the transmission source and the content servers 7 to 9 as the transmission destination. Is set (registered) (step 317).

The response to the access request transmitted in steps 313 and 314 is transmitted to the user terminal 5 (step 31
8, 319), and the content server 7 from the next time onward.
An access request from the user terminal 5 destined for 9 does not go through the authentication access control server 2 but directly to the content server 7
~ 9 is reached (steps 320, 32)
1).

Next, when the user 4 attempts an access from the user terminal 5 to the content server 11 or 12, the gateway device 3 has already set the entry for permitting the passage of the packet, so that the authentication access control is performed. The content server 11 directly without going through the server 2.
Establish communication connection with or12 (Step 3
22) and access to the content is possible (steps 323, 324).

(D) Invalidation process of authentication due to termination of user's browser The authentication access control server 2 authenticates the content server group 6 of the user 4 and then sends the resident program (here) to the user terminal 5. Then, it is called Java applet) and communicates at regular intervals.

When the response from the Java applet of the user terminal 5 is lost, the authentication access control server 2 determines that the browsing of the content server by the user 4 has ended, and sets the gateway device 3 first. All the passage permission entries having the user terminal 5 as the transmission source and the content server belonging to the content server group 6 as the transmission destination are deleted.

As a result, the authentication is invalidated, and the access request from the user terminal 5 to the content server belonging to the content server group 6 is requested again through the authentication access control server 2.

(E) Invalidation process of authentication by user logout process Using the resident program (here, Java applet) transmitted to the user terminal 5 after the user 4 is authenticated to the content server group 6, As shown in FIG. 8, the logout button 20 for instructing the forced expiration of the authentication is displayed on the browser on the user terminal 5.

In response to the display of the logout button 20, the user terminal 5 displays the logout button 20 by the user 4.
When the button is clicked, a packet instructing the forced expiration of the authentication is transmitted to the authentication access control server 2.

When the authentication access control server 2 receives the packet, the content server group 6 whose source is the user terminal 5 previously set for the gateway device 3 is set.
Delete all pass-through entries destined for the content server belonging to.

As a result, the authentication is invalidated, and the access request from the user terminal 5 to the content server belonging to the content server group 6 is requested again through the authentication access control server 2.

(F) Invalidation processing of authentication due to communication timeout The gateway device 3 monitors the reference status of the packet passage permission entry set by the authentication access control server 2.

If there is no communication from the user terminal 5 to the content servers belonging to the content server group 6 for a certain period of time continuously, the gateway device 3 sends the user terminal 5
Delete the passage permission entry having the source as the source and the content server as the destination.

As a result, when the entries for all the content servers belonging to the content server group 6 are deleted, the authentication is invalidated, and the access request from the user terminal 5 to the content server belonging to the content server group 6 is made. With respect to, the authentication will be requested again via the authentication access control server 2.

(G) Invalidation processing of authentication after a lapse of a certain time after authentication The authentication access control server 2 records the time when the user 4 has authenticated the content server group 6,
When a certain period of time has elapsed, all the passage permission entries that are set in advance for the gateway device 3 and have the user terminal 5 as the transmission source and the content server belonging to the content server group 6 as the transmission destination are deleted.

As a result, the authentication is invalidated, and an access request from the user terminal 5 to the content server belonging to the content server group 6 is requested again through the authentication access control server 2.

Although the present invention has been described according to the illustrated embodiment, the present invention is not limited to this. For example, in the embodiment, the present invention has been described by taking the authentication of the content server as a specific example, but the present invention can be directly applied to the authentication of servers other than the content server.

[0103]

As described above, according to the present invention, in the authentication access control system for realizing the single sign-on to the content server, by avoiding the concentration of the load on the authentication access control server, the authentication access control server It is possible to avoid a decrease in throughput due to the limitation of processing performance and network resources, and it is possible to realize a system with high security strength by preventing unauthenticated access requests from directly reaching the content server.
The effect is obtained.

[Brief description of drawings]

FIG. 1 is an embodiment of a system configuration for implementing the present invention.

FIG. 2 is a flow of processing in the embodiment.

FIG. 3 is a flow of processing in the embodiment.

FIG. 4 is a flow of processing in the embodiment.

FIG. 5 is a flow of processing in the embodiment.

FIG. 6 is a flow of processing in the embodiment.

FIG. 7 is a flow of processing in the embodiment.

FIG. 8 is an explanatory diagram of a browser.

FIG. 9 is an explanatory diagram of a reverse proxy type single sign-on.

FIG. 10 is an explanatory diagram of agent module type single sign-on.

[Explanation of symbols]

1 Authentication access control system 2 Authentication access control server 3 Gateway device 4 users 5 user terminals 6 Content server group 7-12 Content Server

─────────────────────────────────────────────────── ───

[Procedure amendment]

[Submission date] March 27, 2002 (2002.3.2)
7)

[Procedure Amendment 1]

[Document name to be amended] Statement

[Name of item to be amended] Claims

[Correction method] Change

[Correction content]

[Claims]

[Procedure Amendment 2]

[Document name to be amended] Statement

[Name of item to be corrected] 0015

[Correction method] Change

[Correction content]

[0015]

In order to achieve this object, the authentication access control server device of the present invention comprises an authentication access control server device and a gateway device.
Te, In the case used in a system for authenticating an access request to the server that is issued from a Subscriber terminal, that access permission request to the server is not set to the gateway device, the access request When a request is transferred, the method of receiving it and the access request destination server
The information required for authentication of the server group consisting of Ba, and a means for obtaining only in the case of the first round of a request for access to a Subscriber terminal or server from a group, attached to the server group, necessary for the acquired authentication by running the authentication by using the information, Do not have the authentication function
And hand position attainable About have server authentication, and to the server with an authentication function, and the hand position attainable authentication by requesting authentication by specifying the information required for authentication of the server, the server to obtain a certificate Information indicating permission of access request to
To the gateway device and the entry information set in the gateway device when the specified state is reached
And a means for invalidating.

[Procedure 3]

[Document name to be amended] Statement

[Correction target item name] 0017

[Correction method] Change

[Correction content]

Meanwhile, in order to achieve this object, the gateway apparatus of the present invention, is composed of an authentication access control server and the gateway device, authenticating access requests to the server that issued from a Subscriber terminal in the case for use in a system for, allowing access request to the authentication access control server Ru is set from the server
And means for managing entry information indicating the user ends the end of the
Entry information that corresponds to the access request to the server to be issued
If the broadcast is not set, means for transferring the access request to the authentication access control server, in response to a transfer of the access request, whether the authentication access control server
If there is a setting instruction of Luo entry information, its entry
Means for setting the information to the management unit, in response to the invalidation instruction from the authentication access control server, is designated
And means for disabling the setting entry information that, a picture that you set
If the entry information is not referenced a certain period of time, its the entry
And a means for invalidating the information .

[Procedure amendment 4]

[Document name to be amended] Statement

[Correction target item name] 0020

[Correction method] Change

[Correction content]

[0020] In the authentication system of the present invention thus constituted, when the uppermost first access request to the user terminal or server from is issued, entry information (that according to that server
(Information indicating permission of access request to server) is not set in the gateway device, the access request is transferred to the authentication access control server device, and in response to this, the authentication access control server device Acquires the information necessary for authenticating the server group from the user terminal.

[Procedure Amendment 5]

[Document name to be amended] Statement

[Correction target item name] 0021

[Correction method] Change

[Correction content]

[0021] Subsequently, the authentication access control server device,
Use the information required for authentication to acquire the servers
Te perform authentication, by this, to obtain the authentication for all of the server that does not have the authentication function, to the gateway device
All showing access permission to those servers
Set the entry information for . This and later, when the entry information is <br/> set, authentication does not have the access request to the server (user authentication was performed on servers
Access request) from the gateway device will not be transferred. Authentication access control service
The server device has the authentication function for this first access request.
If the request is for a server that does not
By setting the bird information, in this initial access request
Finished setting the entry information for the gateway device
To do.

[Procedure correction 6]

[Document name to be amended] Statement

[Name of item to be corrected] 0022

[Correction method] Change

[Correction content]

On the other hand, when the first access request is an access request to a server having an authentication function, the authentication access control server device obtains the authentication for the server group.
And it is, in response to a request from the server of its, the server
Information required for authentication of the server (authentication access control server device
Specify held internally are), to obtain authentication for the server by performing the authentication request to the server,
Setting the entry information to the gateway device. After this
Descending, that entry information is set, certified for access requests (server to server with the authentication function
Access request) information about from the user performing the testimony, that is not transferred from the gateway device.

[Procedure Amendment 7]

[Document name to be amended] Statement

[Name of item to be corrected] 0023

[Correction method] Change

[Correction content]

[0023] And, the authentication access control server,
The first times of the slave to the access request to be issued after access request
The access request to another server that has an authentication function.
If it is sent, the authentication for the servers is already
Since it has finished, in response to the request from that server,
Information required to authenticate the server (authentication access control server
(Hold inside the device) and specify that server
Authentication for the server by requesting authentication to
It was obtained, and sets the entry information to the gateway device.
This and later, the entry information that is set, information on the access request (the server to the server with the authentication function
The access request from the authenticated user) will not be transferred from the gateway device.

[Procedure Amendment 8]

[Document name to be amended] Statement

[Name of item to be corrected] 0024

[Correction method] Change

[Correction content]

In this way, the gateway device is
Although the access request is not transferred to the authentication access control server device by setting the re-information, it is not preferable for security to leave the connection relationship between the user terminal and the server as it is.

[Procedure Amendment 9]

[Document name to be amended] Statement

[Name of item to be corrected] 0025

[Correction method] Change

[Correction content]

Therefore, the authentication access control server device
By sending the program to the user terminal,
If there is no response from the program for a certain period of time,
Everything that happens to the user terminal set on the toway deviceof
Entry informationTo disable it,User terminal
To send the program toProgram of
If a certificate invalidation instruction is issued from the gateway,
Everything that happens to the user terminal set in the deviceEntry
informationTo disable it, From the user terminal
Access request and setTo the entry informationAbout
Certification (certifiedThe entry informationFrom setting) for a certain time
When the time elapses, its use set in the gateway device
All over the device terminalThe entry information ofTo disable
To process.

[Procedure Amendment 10]

[Document name to be amended] Statement

[Correction target item name] 0026

[Correction method] Change

[Correction content]

On the other hand, the gateway device, an access request to the server to be set authenticated access control server or al
The user manages the entry information indicating that the
Encoding corresponding to the access request to the server issued by the terminal
Access request if the bird information is not set
Is adopted to transfer to the authentication access control server device.
The Rutoki, authenticated access Disabling the entry information in response to invalidation command from the control server to Rutotomoni, set
If the entry information is not referenced a certain period of time, its of
Process to invalidate the entry information .

Continued front page    (72) Inventor Takao Kawada             2-3-1, Otemachi, Chiyoda-ku, Tokyo             Inside Telegraph and Telephone Corporation (72) Inventor Hiroyuki Ishii             2-3-1, Otemachi, Chiyoda-ku, Tokyo             Inside Telegraph and Telephone Corporation (72) Inventor Koichi Suto             2-3-1, Otemachi, Chiyoda-ku, Tokyo             Inside Telegraph and Telephone Corporation F term (reference) 5B085 AA08 AE02 AE23 BA07 BC01                       BG02 BG07                 5K030 GA11 HA08 HB29 HC13 HD03                       LB05                 5K033 AA08 CB01 DA05 DB16    (54) [Title of Invention] Authentication access control server device, gateway device, authentication access control method, and gateway                     Control method, authentication access control program, recording medium recording the program, and gateway                     Control program and recording medium recording the program

Claims (19)

[Claims] 1. An authentication access control server device for use in a system configured by an authentication access control server device and a gateway device for authenticating an access request to a server group issued from a user terminal connected to a communication network. However, when the access request is transferred because the path is not set in the gateway device, the information required for authentication is provided from the means for receiving the access request and the user terminal for the first time. In the case of the above, for the server that does not have the authentication function, specify the information required for the above authentication for the server that does not have the authentication function and the method that performs the authentication by using the information required for the above authentication. And means for requesting authentication, and means for setting a path to the server that has been authenticated in the gateway device. Authentication access control server device. 2. The authentication access control server device according to claim 1, wherein the means for executing the authentication executes authentication for all servers having no authentication function in the case of an initial access request, A characteristic authentication access control server device. 3. The authentication access control server device according to claim 1, wherein the means for requesting authentication authenticates the server having the authentication function when receiving an access request to the server having the authentication function. An authentication access control server device characterized by making a request. 4. The authentication access control server device according to any one of claims 1 to 3, further comprising means for invalidating a path set in the gateway device when a prescribed state is reached, A characteristic authentication access control server device. 5. The authentication access control server device according to claim 4, wherein the invalidating unit sets the user set in the gateway device when the response from the program sent to the user terminal is lost for a certain period of time. An authentication access control server device characterized by invalidating all paths applied to a terminal. 6. The authentication access control server device according to claim 4, wherein the invalidation unit is set in the gateway device when an authentication invalidation instruction is issued from a program transmitted to a user terminal. An authentication access control server device characterized by invalidating all paths applied to the user terminal. 7. The authentication access control server device according to claim 4, wherein the invalidating unit lapses a certain time after authentication of a path set to the gateway device in response to an access request from a user terminal. In this case, the authentication access control server device is characterized in that all the paths related to the user terminal set in the gateway device are invalidated. 8. A gateway device used in a system, which comprises an authentication access control server device and a gateway device, and which authenticates an access request to a server group issued from a user terminal connected to a communication network. , Means for managing a path set from the authentication access control server device, and when the path corresponding to the access request from the user terminal is not set, the access request is transferred to the authentication access control server device A gateway device comprising: a means and a means for setting a path in response to the transfer when there is a path setting instruction from the authentication access control server device. 9. The gateway device according to claim 8, further comprising means for invalidating all the setting paths related to the designated user terminal in response to the invalidation instruction from the authentication access control server device. A gateway device characterized by: 10. The gateway device according to claim 8, further comprising means for invalidating a set path when the set path is not referred to for a certain period of time. 11. An authentication access control server device used in a system configured by an authentication access control server device and a gateway device for authenticating an access request to a server group issued from a user terminal connected to a communication network. Authentication access control method to be executed by the above, when the access request is transferred because the path is not set in the gateway device, the process of receiving the access request and the authentication from the user terminal are required. The process of obtaining such information only in the case of the first access request, the process of performing the authentication using the information required for the above authentication for the server that does not have the authentication function, and the above process for the server having the authentication function. Specify the information required for authentication and request authentication, and set the path to the server that has obtained the above authentication in the above gateway device. Further comprising a step, the authentication access control method according to claim. 12. The authentication access control method according to claim 11, wherein in the process of executing the authentication, authentication is executed for all servers having no authentication function in the case of an initial access request. Authentication access control method. 13. The authentication access control method according to claim 11, wherein in the process of requesting authentication, when an access request to a server having an authentication function is received, the server having the authentication function is requested to perform authentication. An authentication access control method characterized by: 14. The authentication access control method according to claim 11, further comprising a step of invalidating a path set in the gateway device when a prescribed state is reached. Authentication access control method. 15. An authentication access control server device and a gateway device, which are executed by a gateway device used in a system for authenticating an access request to a server group issued from a user terminal connected to a communication network. In the gateway control method, when the path corresponding to the access request from the user terminal is not set, the process of transferring the access request to the authentication access control server device, and the step of responding to the transfer, When there is a path setting instruction from the authentication access control server device, means for managing the path set from the authentication access control server device is provided with a step of setting the path of the setting instruction. Gateway control method. 16. An authentication access control program for causing a computer to execute a process used for realizing the authentication access control method according to claim 11. Description: 17. A recording medium of an authentication access control program, which records a program for causing a computer to execute the process used for realizing the authentication access control method according to claim 11. 18. A gateway control program for causing a computer to execute the process used to implement the gateway control method according to claim 15. 19. A recording medium of a gateway control program, which records a program for causing a computer to execute the process used to implement the gateway control method according to claim 15.