JP4797685B2 - Cooperation control apparatus and network management system - Google Patents

Description

  The present invention relates to entry / exit management in an advanced security level area and information management in an advanced security level area, and more particularly, a linkage control apparatus and network management in which an entry / exit management system responsible for entry / exit management and a network authentication system responsible for information management are linked. About the system.

  In companies that frequently handle confidential information or specific departments within the company, leakage of confidential information can be prevented in advance by applying an entry / exit management system that manages entry / exit of workers who handle confidential information. I am doing so.

  Generally, an entrance / exit management system uses information that uniquely identifies a user, such as a user ID (IDentification) incorporated in an IC (Integrated Circuit) card given to the user, or biometric information (fingerprint, iris, voiceprint, etc.). Advanced authentication that handles confidential information by unlocking the locked door for entry / exit when personal authentication is performed by the host computer for entrance / exit management and it is authenticated that the user is a registered valid user. Management such as permitting entry into the security level area.

  By the way, the above-mentioned confidential information is managed by a network authentication system constructed on a network different from the entrance / exit management system, and is confidential from an information terminal device installed in an area where entrance / exit management is performed. It can be used in response to access to a host computer for information management. When accessing the host computer for managing confidential information, an authentication process similar to the personal authentication in the above-described entry / exit management system is required.

Therefore, cooperation between such an entrance / exit management system and a network authentication system is required, and authentication processing at the time of entering / exiting into an area that handles confidential information, and use of the information terminal device after entering the room are started. A technique for associating with authentication processing has been devised (for example, see Patent Document 1).
JP 2002-41469 A

  By the way, recently, as represented by the legal system of the Personal Information Protection Law, interest in security is increasing more and more. In response to such a background, the entrance / exit management system is starting to cooperate with the above-described network authentication system and the like, and its scale is becoming larger.

  When a network is constructed by linking an entrance / exit management system and a network authentication system, especially when the network is scaled up as described above, the settings of the existing system must be significantly changed. There is a problem that a great amount of labor and cost are required for constructing the network system.

  In view of this, the present applicant has devised a cooperative control device that links an access management system that manages access between areas with different security levels and a network authentication system. This cooperation control device is set to pass authentication packets exchanged during authentication processing between the authentication device of the network authentication system and the authentication server, and controls the access control system and the network authentication system in a coordinated manner. Can do.

  In addition, the cooperation control device uses information transmitted from the access control system to grasp changes in user access information in the access control system, such as movement into the high security level area, and changes the user access status. Depending on whether the network authentication request, which is an authentication packet transmitted as an access request from the terminal device of the network authentication system to the authentication server via the authentication device, is passed or not passed, It is possible to determine whether to refuse in advance.

  As a result, the linkage control device can easily link the access control system and the network authentication system, so that the network management system that eliminates the connection to the network of the user who has illegally entered the high security level can be reduced. It can be constructed at low cost without spending. Further, by providing the cooperation control device, unnecessary authentication processing for a suspicious access request can be avoided, so that the processing load on the authentication server can be greatly reduced.

  However, even if such a linkage control device that realizes linkage control between the entry / exit management system and the network authentication system is set correctly, if the entry / exit management system or the network authentication system is defective, the system as a whole There is a problem that it doesn't work. Furthermore, since the cooperation control device always controls the entry / exit management system and the network authentication system to cooperate with each other, it is difficult to identify whether the entry / exit management system or the network authentication system is causing a problem. End up.

  When such a problem occurs, the system administrator intentionally disconnects the connection between the cooperative control device, the access control system, and the network authentication system, changes the system configuration, and individually connects the access control system and the network authentication system. However, there is a problem that it is forced to perform very troublesome work such as verification.

  In this way, the cooperation control device always controls the entry / exit management system and the network authentication system to cooperate with each other. For example, the newly constructed entry / exit management system and the network authentication system are constructed to cooperate with the cooperation control device. Even when identifying the cause of a malfunction in the operation check, the connection between the once-connected cooperative control device, the access control system, and the network authentication system as described above is bothered. This causes a problem that the system configuration is changed and a very troublesome work such as individually verifying the access control system and the network authentication system is forced.

  Therefore, the present invention has been proposed to solve the above-described problems, and the system configuration is changed in a network management system using a cooperation control device that controls the access management system and the network authentication system in cooperation. It is an object of the present invention to provide a cooperative control apparatus and a network management system that can quickly identify a failure that has occurred in an access control system or a network authentication system.

  The cooperation control apparatus according to the present invention includes an access management system that manages the access to and from the advanced security level area according to the authentication processing result based on the first authenticated information that uniquely identifies the user, and the advanced security level area. A linkage control device that mutually links a network that has been constructed with a network authentication system that restricts access according to an authentication processing result by an authentication server based on second authenticated information that uniquely identifies the user. A storage for associating and storing the current entry / exit state of the user in the high security level area according to the authentication processing result based on the first authentication information by the entry / exit management system and the second authentication information And a request for access to the network made by the user using the second authenticated information Accordingly, an authentication processing means for performing an authentication process based on a current access state with respect to the high security level area of the user associated with the second authenticated information stored in the storage means, and depending on a user operation When the authentication processing unit authenticates in response to the operation switching unit instructing to switch the operation mode of the cooperation control device and the operation switching unit, the second authenticated information The network access request by the network authentication system is transmitted to the authentication server of the network authentication system, and when it is not authenticated by the authentication processing means, the network access request by the second authenticated information is authenticated by the network authentication system. Normal operation mode to reject without sending to server or before made by the user A control means for controlling to operate in the first maintenance mode that unconditionally transmits an access request to the network by the second authenticated information to the authentication server of the network authentication system, thereby solving the above-mentioned problem To do.

  In addition, the network management system of the present invention includes an access management system that manages access to and from the advanced security level area according to the authentication processing result based on the first authenticated information that uniquely identifies the user, and the advanced security level. A network authentication system that restricts access to the network constructed in the area according to an authentication processing result by an authentication server based on second authenticated information that uniquely identifies the user; and the access management system; A cooperation control device that links the network authentication system to each other, and the cooperation control device is configured to at least a user's high security level area corresponding to an authentication processing result based on first authentication information by the access management system. Store the current access state in association with the second authenticated information Using the storage means and the second authenticated information, in response to a request for access to the network made by the user, the user associated with the second authenticated information stored in the storage means An authentication processing means for performing an authentication process based on a current access state with respect to the high security level area, an operation switching means for instructing to switch an operation mode of the cooperation control device according to a user operation, and the operation switching means. In response to the operation, when authenticated by the authentication processing means, a request for access to the network by the second authenticated information is transmitted to the authentication server of the network authentication system, and authentication is performed by the authentication processing means. If not, a request for access to the network based on the second authenticated information is received. A normal operation mode for rejecting without transmitting to the authentication server of the system or a network access request by the second authenticated information made by the user is unconditionally transmitted to the authentication server of the network authentication system. Having the control means for controlling to operate in the first maintenance mode solves the above-mentioned problem.

  According to the present invention, by setting the operation mode of the cooperative control device to the first maintenance mode, an access request to the network can be unconditionally sent to the authentication server without linking the access control system and the network authentication system. Can be sent.

  As a result, since the access control system and the network authentication system can be operated independently, it is possible to easily identify a problem occurring in either the access control system or the network authentication system.

  In addition, when a newly built access control system or network authentication system is constructed so that it can be linked by the linkage control device, the system configuration can be checked by switching to the first maintenance mode. It is possible to carry out independently without changing.

  Further, by setting the operation mode of the cooperation control device to the second maintenance mode, all access requests to the network by the second authenticated information made by the user are discarded, so whether the failure has occurred in the cooperation control device. Can be created artificially.

  As a result, assuming that a failure occurs in the cooperative control device, when taking a redundant configuration so that at least operation with network authentication can be secured, by switching to the second maintenance mode, It is possible to confirm in advance whether this redundant configuration functions reliably.

  First, a network management system shown as an embodiment of the present invention will be described with reference to FIG. As shown in FIG. 1, the network management system 1 is configured by connecting an equipment system 10 and a network authentication system 20 to each other by an information breaker 30.

  The facility system 10 manages entry / exit from a low security level area (low security level area) to a high security level area (high security level area) that handles confidential information.

  The network authentication system 20 is a network constructed in a high security level area managed by the facility system 10. In the network authentication system 20, for example, confidential information is managed, and only an authenticated user is permitted to log on from the information terminal device connected to the network and is allowed to access the confidential information.

  The facility system 10 may be of any form as long as it manages the entry and exit from the low security level area to the high security level area. For example, as shown in FIG. The advanced security level area is separated from the low security level area by a door, etc., and there is no equipment system 10A that allows movement to each area in accordance with the authentication process, and there is no physical barrier such as a door. A facility system 10B for recognizing a user in a region or a low security level region can be applied.

  The facility system 10A performs an authentication process on all users who wish to enter the advanced security level area, authenticates only legitimate users registered in advance, and permits entry into the advanced security level area. Further, the facility system 10A performs an authentication process on a user who wishes to leave the high security level area as necessary, and permits the user to leave the high security level area. The low security level area and the high security level area are separated from each other by a door provided with an electric lock that can be locked and unlocked by an electric action.

  Specifically, the facility system 10A is stored in a semiconductor memory of a non-contact IC card (Integrated Circuit) 2 owned by the user, for example, by an entry card reader 11 provided outside the high security level area. When the user is authenticated as a valid user based on the card ID, which is the information to be authenticated, of the read information, the electric lock that has been locked under the control of the entrance / exit control unit 13 is unlocked. To allow entry into the advanced security level area.

  Further, when the facility system 10A leaves the advanced security level area, the facility system 10A reads the above-described information of the IC card 2 by the exit card reader 12 provided in the advanced security level area, and authenticates that the user is a valid user. In such a case, the user can leave the high security level area by unlocking the electric lock that has been locked under the control of the entry / exit control unit 13.

  When the unlocked electric lock is unlocked by such an authentication process, the facility system 10A uniquely identifies the IC card 2 among the information stored in the IC card 2 owned by the user. The ID, the door ID specific to the unlocked door, and information indicating whether the room is entered or exited are transmitted from the entrance / exit control unit 13 to the information breaker 30 described later. The information indicating whether to enter or leave the room may be indicated by, for example, a device ID that uniquely identifies the entry card reader 11 or the exit card reader 12.

  On the other hand, as shown in FIG. 1, the equipment system 10B is owned by the user and the zone monitoring sensor 15 installed in the common zone Z1 that is the low security level area or the specific zone Z2 that is the high security level area. By wirelessly communicating with the non-contact IC card 2, the card ID is acquired from the IC card 2 owned by the user, and the authentication control unit 16 performs authentication processing to recognize the user existing in each zone. The IC card 2 used in the facility system 10B has a function equivalent to, for example, an active RFID (Radio Frequency IDentification) tag.

  Of the information stored in the IC card 2 owned by the user, the equipment system 10B uniquely identifies the card ID, which is authentication information for uniquely identifying the IC card 2, and the zone monitoring sensor 15 that has acquired the card ID. The device ID to be specified is transmitted from the authentication control unit 16 to the information breaker 30 described later.

The network authentication system 20 is constructed in the high security level area, and permits the connection from the terminal device 21 _n (n is a natural number) to the network according to the authentication process by the authentication device 22 and the authentication server 23.

Specifically, the network authentication system 20 uses a technology for authenticating a user connected to a LAN (Local Area Network) switch or a wireless LAN access point established by IEEE (American Institute of Electrical and Electronics Engineers) 802.1X. Thus, an authentication process is performed in response to a network authentication request that is an access request from the terminal device 21 _n . IEEE 802.1X is a protocol on Ethernet (registered trademark) that controls whether or not a LAN can be used. In addition, a RADIUS server that can centrally manage users to be authenticated by communication using RADIUS (Remote Authentication Dial-In-User-Service) as an authentication protocol is used for user authentication.

The terminal device 21 _n is a so-called PC (Personal Computer) that can be used by a user who has entered the high security level area, and exchanges information with the authentication device 22 and the authentication server 23 to request connection to the network. It holds authentication client software called Supplicant.

The authentication device 22 is connected to a plurality of terminal devices 21 _n by wire or wireless, and functions as a relay device that relays authentication processing between the authentication server 23 and the terminal device 21 _n . The authentication device 22 functions as a RADIUS client for the RADIUS server, and performs communication using RADIUS as an authentication protocol for communication with the RADIUS server.

Authentication device 22, the authentication device 22a, 22b such as, IEEE802.1X, and the like LAN switch or a wireless LAN access point corresponding to the RADIUS, the network terminal device 21 _n for each port in cooperation with the authentication server 23 Connect to.

The authentication server 23 is a RADIUS server in the RADIUS authentication, and includes a user information storage unit (not shown) that holds information about a user who requests connection to the network via the terminal device 21 _n , and is an authentication device 22 that is a RADIUS client. The terminal device _21n is authenticated via the network, and the network connection is notified according to the authentication result.

  A user information storage unit (not shown) provided in the authentication server 23 holds an account ID, which is information to be authenticated for uniquely identifying a user in the network, and a password corresponding to the account ID.

  The actual authentication procedure by the network authentication system 20 is defined by EAP (Extensible Authentication Protocol). In the network authentication system 20, a user ID (account ID) and a password are input to various EAP that can be used in IEEE802.1X, for example, EAP-MD5 (EAP-Message Digest alogorithm5) and PEAP (Protected-EAP). EAP that is required to be performed, EAP-TLS (EAP-Transport Layer Security) that authenticates using a digital electronic certificate, or the like can be used.

  Then, the structure of the information breaker 30 is demonstrated using FIG. As shown in FIG. 2, the information breaker 30 includes an external system I / F (interface) 31, an information conversion unit 32, an internal database 33, a network I / F (interface) 34, a RADIUS authentication unit 35, An authentication processing unit 36, an authentication state control unit 37, an information management unit 38, an authentication log storage unit 39, and an operation switching unit 40 are provided.

  The information breaker 30 is provided so as to pass through an authentication packet exchanged during authentication processing between the authentication device 22 of the network authentication system 20 and the authentication server 23, and the facility system 10 and the network authentication system 20 It functions as a cooperative control device that performs cooperative control.

The information breaker 30 uses the information transmitted from the facility system 10 to grasp changes in the user's access status in the facility system 10 such as movement from the low security level region to the high security level region. The network authentication request, which is an authentication packet transmitted as an access request from the terminal device 21 _n to the authentication server 23 via the authentication device 22 according to the change in the access state of the terminal device, is passed or not. It can be determined whether the authentication server 23 rejects the authentication in advance.

  In addition, the information breaker 30 uses information transmitted from the facility system 10 in a state where the user has already been authenticated to connect to the network, and moves from the high security level area to the low security level area. Ascertain the change in the user's entry / exit status in the facility system 10, and forcibly request re-authentication according to the change in the user's entry / exit status, and reject the authentication or disconnect the connected network according to the authentication result. Can be controlled.

  Further, the information breaker 30 is configured to operate the facility system without changing the normal operation mode in which the facility system 10 and the network authentication system 20 are cooperatively controlled according to the instruction of the operation switching unit 40 and the configuration of the network management system 1. 10 and the maintenance mode for disconnecting the cooperation between the network authentication system 20 can be switched.

  The external system I / F 31 is a communication interface for connecting the facility system 10 and the information breaker 30. Communication between the facility system 10 and the information breaker 30 via the external system I / F 31 can use a communication standard such as Ethernet (registered trademark), for example. Communication between the equipment system 10 and the information breaker 30 via the external system I / F 31 is not limited to TCP / IP-based communication, and a non-IP field bus or the like can also be used.

  The information conversion unit 32 converts the information input to the information breaker 30 into a predetermined data format via the external system I / F 31 and stores it in the internal database 33.

  The internal database 33 is a database that stores various types of information used by the information breaker 30, and includes a user information storage unit 33A that stores static information defined for each user, and a dynamic information that indicates the current state of the user. An authentication state storage unit 33B that stores information and a system information storage unit 33C that stores static information defined in relation to the facility system 10 and the network authentication system 20 are provided.

  The user information storage unit 33A, for each account ID, which is information to be authenticated for uniquely identifying the user in the network, the card ID of the IC card 2 held by the user registered in advance, and the user authenticating the network When this is done, the stayable time information indicating the time during which the authentication can be maintained is stored in association with each other. The information stored in the user information storage unit 33A is static information, and once set, it is held without being changed until a new user registration or system change occurs. The information update process of the user information storage unit 33A is executed by the information management unit 38 to be described later.

  FIG. 3 shows an example of information stored and held in the user information storage unit 33A and its contents. The card ID is the card ID of the IC card 2 that is used when the facility system 10 enters and exits. When the information conversion unit 32 is notified of the card ID from the facility system 10, the information conversion unit 32 refers to the user information storage unit 33A to acquire the account ID, and updates the authentication status storage unit 33B based on the account ID. Execute. In addition, since one user may have a plurality of IC cards 2, a plurality of card IDs may be registered for one account ID.

  The stayable time information is information indicating a time given to the user specified by the account ID and permitted to maintain the network authentication. This stayable time information is compared with the time information indicating how long the user has used the network at the time of re-authentication of the network, and if the network usage time exceeds the stayable time, The re-authentication request is invalidated. The time information indicating how much network the user has used up to now is obtained by the authentication processing unit 36 from the authentication time information, which will be described later, indicating the time when the network authentication is permitted, which is stored in the authentication state storage unit 33B.

  The authentication status storage unit 33B includes, for each account ID, which is information to be authenticated for uniquely identifying the user in the network, staying area number information, entry time information, authentication time information, authentication device ID, and authentication Device port number information is stored in association with each other. The information stored in the authentication status storage unit 33B is dynamic information, depending on the user access status managed by the facility system 10, the network authentication status of the user managed by the network authentication system 20, and the like. It is updated by the information conversion unit 32 and the authentication processing unit 36 as needed.

  FIG. 4 shows an example of information stored in the authentication status storage unit 33B and its contents. The staying area number information is number information for specifying the security level area where the user is currently staying, for example, the high security level area and the low security level area. Each security level area of the facility system 10 is assigned an identification number that uniquely identifies each security level area. The information conversion unit 32 identifies which security level area the user is currently in from information notified when there is a state change in the facility system 10, and stays area number information indicating the security level area As the middle area number information, it is stored in the authentication state storage unit 33B.

  For example, in the equipment system 10A, when there is a change in state, the entrance / exit door ID or exit door ID is transmitted from the entrance / exit control unit 13, but the information conversion unit 32 uses this entrance door ID or exit door ID. Using this, area number information for specifying the security level area stored in association with the entrance door ID and the exit door ID is acquired in the system information storage unit 33C described later, and this area number information is used as the stay area number information. And written in the authentication state storage unit 33B.

  The entry time information is the time when the signal transmitted when the state change from the facility system 10 is received, and indicates the time when the stay in the security level area indicated as the stay area number information is started. Yes. This entry time information is used for comparison with the stayable time information and the available time information in the security level area at the time of network authentication and re-authentication.

  The authentication time information indicates the time when the network authentication of the user is permitted. At the time of network re-authentication, the authentication processing unit 36 obtains the user's network usage time from the authentication time information, and is specified for each network usage time and the stayable time information or security level area defined for each user. Used for comparison with available time information.

The authentication device ID indicates the IP address of the authentication device 22 to which the user who transmitted the network authentication request is connected via the terminal device 21 _n . This authentication device ID is used at the time of forced disconnection processing by SNMP.

The authentication device port number information indicates the port number of the authentication device 22 to which the user who transmitted the network authentication request is connected via the terminal device 21 _n . This authentication device port number information is used during forced disconnection processing by SNMP.

  The system information storage unit 33C includes, for each area number information that is an identification number for uniquely identifying each security level area of the facility system 10, an entrance door ID, an exit door ID, available time information, The stayable time information and the authentication device ID are stored in association with each other. The information stored in the system information storage unit 33C is static information, and once set, it is held without being changed until there is a system change or the like. The information update process of the system information storage unit 33C is executed by the information management unit 38 described later.

  FIG. 5 shows an example of information stored and held in the system information storage unit 33C and its contents. The entrance door ID and the exit door ID are prepared to correspond to the facility system 10 in which the security level region is separated by the door as in the facility system 10A.

  The entrance door ID is an ID of an entrance door provided in the equipment system 10, and uses the ID of the entrance card reader 11 of the equipment system 10A corresponding one-to-one with the entrance door. The exit door ID is an ID of an exit door provided in the facility system 10, and uses the ID of the exit card reader 12 of the facility system 10A corresponding one-to-one with the exit door. A plurality of entrance door IDs and exit door IDs can be set according to the number of doors provided in the security level area.

  The available time information is information indicating a time zone in which use of the network is permitted in this security level area. Specifically, the available time information is time information obtained by pairing start time information permitted to use the network and end time information. This available time information is used at the time of network authentication and re-authentication.

  The stayable time information is information indicating a time during which network authentication is permitted in this security level area. The stayable time information is compared with the time information indicating how long the user has used the network at the time of re-authentication of the network, and if the network usage time exceeds the stayable time, The authentication request is invalidated. At this time, the shorter one of the stayable time information stored in the system information storage unit 33C and the stayable time information stored in the user information storage unit 33A is preferentially used. become.

  The authentication device ID indicates the IP address of the authentication device 22 installed in this security level area. A plurality of authentication device IDs can be set according to the number of authentication devices 22 set in the security level area.

  The network I / F 34 is a communication interface for performing communication between the information breaker 30, the authentication device 22, and the authentication server 23. The network I / F 34 corresponds to Ethernet (registered trademark) or a TCP / IP stack.

  The RADIUS authentication unit 35 includes an authentication request relay unit 35A, a request relay determination unit 35B, and a device setting storage unit 35C, and executes processing related to RADIUS authentication.

  The authentication request relay unit 35A relays a RADIUS packet transmitted / received between the authentication device 22 and the authentication server 23 in the RADIUS authentication. At this time, the authentication request relay unit 35A acquires information necessary for the authentication processing in the authentication processing unit 36, such as an account ID included in the RADIUS packet of the network authentication request. It also has a function of recalculating the authentication code defined in the RADIUS standard.

  The request relay determination unit 35B makes a final determination on whether to transmit a network authentication request to the authentication server 23 or to reject the network authentication request based on the authentication determination made by the authentication processing unit 36. The request relay determination unit 35 </ b> B generates a rejection response packet and transmits it to the authentication device 22 when a rejection response is made.

  The device setting storage unit 35C manages all the secret shared keys held by the authentication device 22 and the authentication server 23, which are necessary for confirming the validity of the RADIUS communication, in association with the IP address of the communication partner. .

  The authentication processing unit 36 performs an authentication process using the account ID included in the RADIUS packet of the network authentication request transmitted from the authentication device 22 and the information stored in the user information storage unit 33A of the internal database 33. It is determined whether a network authentication request is transmitted to the authentication server 23.

  When the authentication device 22 supports authentication state control from the outside, the authentication state control unit 37 immediately transmits a request for resetting the authentication state in response to a change in the user's action state.

  The authentication state control unit 37 is a functional unit that operates when the authentication device 22 holds a management information database called MIB (Management Information Base). Specifically, by exchanging the MIB, which is the management information, in SNMP (Simple Network Management Protocol), which is a management protocol in a TCP / IP network environment standardized by IETF (Internet Engineering Task Force), The authentication state control unit 37 can manage the authentication device 22. That is, when an SNMP agent is given to the authentication device 22, the authentication state control unit 37 functions as an SNMP manager. For example, a MIB defined by IEEE 802.1x can be used.

  The information management unit 38 stores static information stored in the user information storage unit 33A and the system information storage unit 33C, setting information stored in the device setting storage unit 35C, and the like with an HTTP (S) server, Telnet, etc. Can be managed from the outside using.

  The authentication log storage unit 39 stores an authentication processing result by the authentication processing unit 36 and a log of device operation status. The authentication log storage unit 39 has a Syslog output function.

  The operation switching unit 40 instructs to switch the operation mode of the information breaker 30 according to a user operation.

  Specifically, the operation switching unit 40 includes a normal operation mode in which the facility system 10 and the network authentication system 20 are cooperatively controlled by the functional units described above, and the facility system without changing the configuration of the network management system 1. 10 and the network authentication system 20 are disconnected inside the information breaker 30, and an instruction is given to switch between the maintenance mode in which the facility system 10 and the network authentication system are operated separately.

  The operation switching unit 40 includes, for example, a dip switch, and can instruct to switch between the normal operation mode and the maintenance mode in accordance with the operation of the dip switch by the user.

  The maintenance mode is for identifying the malfunctioning part that has occurred in the network management system 1 and for confirming the operation when the newly constructed equipment system 10 and the network authentication system 20 are linked with the information breaker 30. It is an operation mode. When the operation switching unit 40 instructs to switch the operation mode of the information breaker 30 to the maintenance mode, the cooperation between the facility system 10 and the network authentication system 20 can be disconnected without changing the system configuration.

  In the maintenance mode, by causing the authentication request relay unit 35A to function as a RADIUS proxy server, the first maintenance mode (Mode 1) for disconnecting the cooperation between the facility system 10 and the network authentication system 20 and the authentication request relay unit 35A On the other hand, there is a second maintenance mode (Mode 2) in which the facility system 10 and the network authentication system 20 are disconnected from each other by discarding all RADIUS packets for network authentication requests. The first maintenance mode and the second maintenance mode can also be switched by operating the operation switching unit 40.

  FIG. 6 shows a state transition diagram of the information breaker 30 in which the mode is switched according to the operation of the operation switching unit 40. The normal operation mode is Mode 3 for the first maintenance mode which is Mode 1 and the second maintenance mode which is Mode 2.

  As shown in FIG. 6, when the information breaker 30 is activated in a state where various settings essential to the information breaker 30 have already been made, the first maintenance mode and the second maintenance mode are performed according to the state of the operation switching unit 40. Will start in one of the normal operating modes. In addition, when the operation switching unit 40 is operated while the information breaker 30 is activated, the operation can be freely switched to the first maintenance mode, the second maintenance mode, and the normal operation mode according to the operation state.

  When switched to the first maintenance mode, the authentication request relay unit 35A of the RADIUS authentication unit 35 functions as a RADIUS proxy server. Specifically, when switched to the first maintenance mode, the authentication request relay unit 35A acquires information necessary for the authentication processing in the authentication processing unit 36, such as an account ID included in the RADIUS packet of the network authentication request. Is executed, only the recalculation of the authentication code defined in the RADIUS standard is executed, and a network authentication request is transmitted to the authentication server 23.

  As described above, when the authentication request relay unit 35A functions as a RADIUS proxy server, the authentication processing unit 36 does not perform authentication processing, and thus cooperates with the user entering and leaving the high security level area managed by the facility system 10. Instead, the network authentication system 20 performs network authentication.

  As described above, in the first maintenance mode, the authentication request relay unit 35A functions as a RADIUS proxy server, and the authentication processing in the authentication processing unit 36 is not executed, so that the facility system 10 and the network authentication system 20 Link control is disconnected.

  Instead, when the operation switching unit 40 instructs to switch to the first maintenance mode, the authentication processing unit 36 does not execute the authentication process, but uses the account ID included in the network authentication request as a key. Information acquired from the authentication status storage unit 33B of the database 33 and information acquired from the system information storage unit 33C of the internal database 33 using the IP address of the authentication device 22 as a key, that is, a user managed by the facility system 10 It is also possible to change the information relating to the state of entry / exit to the advanced security level area so that the authentication judgment is always made and execute the authentication process.

  In this case, the authentication processing unit 36 always determines that the network authentication request transmitted from the authentication device 22 may be transferred to the authentication server 23. Accordingly, in the same manner as when the authentication request relay unit 35A functions as a RADIUS proxy server without executing the authentication process in the authentication processing unit 36, the user entering and exiting the advanced security level area managed by the facility system 10 The network authentication system 20 executes network authentication without cooperating with the above.

  That is, in the first maintenance mode, the facility system 10 and the network authentication system 20 can be operated independently, so that when the network management system 1 malfunctions, the operation switching unit 40 is set to the first maintenance mode. By switching to the maintenance mode, it is possible to easily identify a problem that has occurred in either the facility system 10 or the network authentication system 20 without changing the system configuration.

  In addition, when the newly constructed equipment system 10 or network authentication system 20 is constructed so as to be linked by the information breaker 30 that is the linkage control device, the contractor or the system administrator sets the operation switching unit 40 to the first maintenance mode. By switching, the operation check of the facility system 10 and the network authentication system 20 can be performed independently without changing the system configuration.

On the other hand, when switched to a second maintenance mode, the authentication request relay unit 35A of the RADIUS authentication unit 35, a packet for authentication transmitted as an access request from the terminal device 21 _n to the authentication server 23 via the authentication device 22 Discard all RADIUS packets for a network authentication request.

  As described above, when the authentication request relay unit 35A discards all the RADIUS packets of the network authentication request, a state as if a failure has occurred in the information breaker 30 can be created intentionally.

  By the way, the network management system 1 can take a redundant configuration so that even if a failure occurs in the information breaker 30, at least operation by network authentication by RADIUS can be secured.

  For example, as shown in FIG. 7, information breakers 30A and 30B having the same configuration are provided, and in the authentication device 22, the information breaker 30A is set as a primary server, and the information breaker 30B is set as a secondary server. Thereby, when information breaker 30A which is a primary server breaks down, authentication device 22 can realize cooperation control with equipment system 10 via information breaker 30B which is a secondary server.

  Further, as shown in FIG. 8, the information breaker 30 can be set as a primary server and the authentication server 23 can be set as a secondary server in the authentication device 22. In this case, when the information breaker 30 serving as the primary server fails, the cooperation control with the facility system 10 cannot be executed, but at least the network authentication can be executed.

  As described above, when the network management system 1 has a redundant configuration, it is desired that the secondary server functions reliably when the primary server fails. In particular, when there is a change in the system configuration, such as building a facility system 10 or a network authentication system, it is necessary to confirm the operation in advance so that the switching operation from the primary server to the secondary server is performed reliably. There is.

  Therefore, in such a case, the operation switching unit 40 is switched to the second maintenance mode, and the authentication request relay unit 35A discards all the RADIUS packets for the network authentication request, so that the information breaker 30 has failed. To create a unique state. In response to this, when the authentication device 22 determines that the primary server has failed and transmits a network authentication request to the secondary server, it determines that the redundant configuration of the network management system 1 functions reliably. be able to.

  9, 10, and 11, the processing operation of the network management system 1 when the information breaker 30 is set to the normal operation mode, and the network management system 1 when the information breaker 30 is set to the first maintenance mode. The processing operation will be described.

[Processing in normal operation mode]
First, the processing operation of the network management system 1 when the information breaker 30 is set to the normal operation mode will be described using the timing chart shown in FIG. In order to avoid redundant description, only the case where the equipment system 10A is used will be described, but the same processing operation is performed in the case of the equipment system 10B.

  In step S <b> 1, it is assumed that the user enters the room from the door managed by the entrance / exit control unit 13 from the low security level area to the high security level area where the network is constructed.

  Specifically, the user puts the IC card 2 in the room card reader 11. In response to this, the entrance / exit control unit 13 reads the information stored in the semiconductor memory of the IC card 2, authenticates the card ID, and unlocks the locked electric lock.

  The entrance / exit control unit 13 transmits the card ID read from the IC card 2 to the information breaker 30. In addition, the entrance / exit control unit 13 transmits an entrance door ID that uniquely identifies the door that has unlocked the electric lock, and information indicating entrance.

  The information conversion unit 32 of the information breaker 30 converts the information transmitted from the facility system 10 via the external system I / F 31 so that it can be used in the authentication process, and stores it in the authentication state storage unit 33B of the internal database 33. The current entry / exit state of the user in the high security level area of the facility system 10 is stored.

  Specifically, the information conversion unit 32 refers to the user information storage unit 33A using the card ID of the IC card 2 transmitted from the entrance / exit control unit 13, and is stored in association with this card ID. Get an account ID. In addition, the information conversion unit 32 refers to the system information storage unit 33C using the entrance door ID transmitted from the entrance / exit control unit 13, and determines the advanced security level area stored in association with the entrance door ID. Get area number information to be identified.

  Then, the information conversion unit 32 uses the area number information acquired from the system information storage unit 33C as the staying area number information indicating that the user is currently staying in the high security level area from the user information storage unit 33A. In association with the acquired account ID, it is stored in the authentication status storage unit 33B.

  Further, the information conversion unit 32 stores the time when the card ID and the entrance door ID are received from the entrance / exit control unit 13 as the entry time information when the user enters the high security level area in the authentication state storage unit 33B. .

In step S2, the user who has entered the high security level region, via the authentication device 22 from the terminal device 21 _n, in accordance with the procedure of IEEE802.1X, try to connect to the network by sending a network authentication request as an access request .

In the initial state, since the line between the terminal device 21 _n and the network is disconnected by the authentication device 22, the terminal device 21 _n can only communicate with the authentication device 22.

First, in order to connect to the network, the user inputs an account ID and a password from the terminal device 21 _n and transmits a network authentication request, which is an authentication packet, to the authentication device 22.

The terminal device 21 _n transmits a network authentication request to the authentication device 22 as a MAC (Media Access Control) frame containing an EAP message. At this time, the account ID is transmitted in plain text, and the password is transmitted in a hashed state.

  The authentication device 22 extracts the EAP message from the MAC frame, transfers it to the IP packet, and transmits it to the information breaker 30. Specifically, the authentication device 22 stores the EAP message extracted from the authentication device 22 in the data portion of the RADIUS packet and transmits it to the information breaker 30 using UDP of the upper layer of IP.

In the authentication sequence in the RADIUS authentication process between the authentication device 22 and the authentication server 23, only the EAP message of the first RADIUS packet transmitted as a network authentication request from the authentication device 22 is EAP-Type = Identity data that is a plaintext account ID. Exists. The RADIUS packets, this addition to the account ID, IP address of the authentication device 22, such as the port number of the authentication device 22 the terminal device 21 _n is connected is described as the RADIUS attribute information as information of the authentication device 22.

  In step S <b> 3, the authentication request relay unit 35 </ b> A of the RADIUS authentication unit 35 acquires the Identity data attached to the EAP message of the RADIUS packet of the network authentication request received via the network I / F 34 and outputs it to the authentication processing unit 36. To do. Further, the authentication request relay unit 35A acquires the IP address of the authentication device 22 from the received RADIUS packet of the network authentication request and outputs it to the authentication processing unit 36.

  In step S4, the authentication processing unit 36 is information indicating the current access state in the high security level area of the user stored in the authentication state storage unit 33B of the internal database 33 using the account ID of the acquired Identity data as a key. Request certain area number information and entry time information. Further, the authentication processing unit 36 uses the acquired IP address of the authentication device 22 as a key to specify a high security level region where the authentication device 22 is installed, which is stored in the system information storage unit 33C of the internal database 33. Request number information and available time information. This area number information indicates the high security level area in which the authentication device 22 that has transmitted the network authentication request is installed.

  In step S5, the authentication processing unit 36 receives the stay area number information, the entry time information, and the system information storage unit 33C, which are information indicating the current access state in the high security level area of the user acquired from the authentication state storage unit 33B. Based on the acquired area number information and available time information, it is determined whether the network authentication request transmitted from the authentication device 22 can be transferred to the authentication server 23.

  In addition, if the information acquired from the authentication status storage unit 33B indicates that the corresponding user exists in the high security level area and has already been authenticated on the network, a network authentication request is made. Since it is known that the user is an unauthorized user, the authentication state of the authentication state storage unit 33B may be rewritten from being authenticated to being disconnected.

  In step S6, the authentication processing unit 36 includes the staying region number information that is information indicating the current access state in the high security level region of the user acquired from the user information storage unit 33A and the region number acquired from the system information storage unit 33C. It is possible to confirm that the user exists at the high security level by comparing the information and the network authentication request has been canceled from this high security level area, and the available time information acquired from the system information storage unit 33C and the current time And the authentication judgment is notified to the request relay judgment unit 35B of the RADIUS authentication unit 35 in accordance with the fact that it is confirmed that it is time to use the network in the high security level area.

  In step S7, the request relay determination unit 35B makes a final determination to transmit a network authentication request to the authentication server 23 in accordance with the authentication determination from the authentication processing unit 36, and performs network authentication via the network I / F 34. The request is transmitted to the authentication server 23.

  In step S8, the authentication processing unit 36 includes the staying region number information that is information indicating the current access state in the high security level region of the user acquired from the authentication state storage unit 33B and the region number acquired from the system information storage unit 33C. Compared with information, it cannot be confirmed that the user exists in the high security level area, or the network authentication request is not transmitted from the high security level area where the user exists, or the system Deny when it is confirmed that the use time information acquired from the information storage unit 33C and the current time are compared, and it is confirmed that the time is not allowed to use the network in the high security level area. The determination is notified to the request relay determination unit 35B of the RADIUS authentication unit 35.

In step S9, the request relay determination unit 35B rejects transmission of the network authentication request to the authentication server 23 in response to the rejection determination from the authentication processing unit 36, generates a rejection response packet, and sets the network I / F 34 to To the authentication device 22. The authentication device 22 notifies the terminal device 21 _n of a rejection response indicating that the network authentication request has been rejected based on the transmitted rejection response packet.

In step S10, in response to the network authentication request to the authentication server 23 has been transmitted, the response packet sent from the authentication server 23 the EAP message is attached, by exchanging request packet transmitted from the terminal device 21 _n Thus, authentication processing on the user's network is executed.

  Specifically, the authentication server 23 performs collation processing with information stored in a user information storage unit (not shown) using the account ID attached to the network authentication request as a key.

  The authentication server 23 hashes the password of the target user associated with the transmitted account ID and stored in the user information storage unit with a predetermined hash function, and is hashed attached to the network authentication request. Compare with the password and check if the hashed passwords match.

In this case, the authentication request relay unit 35A of the information breaker 30, the request packet of the terminal device 21 _n and the authentication server 23, and through without performing anything to the response packet. The authentication device 22 functions as a relay device that performs only EAP message transfer as described above.

  In step S11, the authentication server 23 sends either an authentication permission notification indicating that the authentication by the authentication server 23 has been performed or an authentication disapproval notification indicating that the authentication has not been performed to the RADIUS authentication unit 35 of the information breaker 30. To the authentication device 22.

When receiving the authentication permission notification from the authentication server 23, the authentication device 22 opens the line between the terminal device _21n and the network. Thus, the user can access the network via the terminal device 21 _n and can communicate with other terminal devices on the network.

The authentication device 22, when the authentication server 23 has received the authentication denial notice, the terminal device 21 without opening the line between the _n and the network, a message notifying the authentication unauthorized terminal device 21 _n Send to.

In step S12, when an authentication permission notification is received from the authentication server 23, the authentication request relay unit 35A of the RADIUS authentication unit 35 stores the network authentication result in the authentication state storage unit 33B of the internal database 33. Information stored in the authentication status storage unit 33B includes, for example, an account ID, a device ID that uniquely identifies the authentication device 22 to which the terminal device _21n is connected, a port number that is open to the network, and authentication. Is the authorized authentication time.

In this way, in the network management system 1 in which the facility system 10 and the network authentication system 20 are mutually connected and linked by the information breaker 30, the current level of the user in the high security level area of the user detected in the facility system 10 The information breaker 30 makes a determination in the previous stage of notifying the authentication server 23 of the validity of the network authentication request made from the terminal device 21 _n .

  As a result, the facility system 10 and the network authentication system 20 can be easily linked simply by adding (add-on) the information breaker 30 to the existing system. A network management system that can eliminate the connection of a user who has illegally entered a high security level to the network can be constructed at low cost.

In addition, since the information breaker 30 is provided, it is not necessary for the authentication server 23 to execute useless authentication processing for a suspicious network authentication request requested from the terminal device 21 _n . The load can be greatly reduced.

[Processing operation in the first maintenance mode]
Next, processing operations of the network management system 1 when the information breaker 30 is set to the first maintenance mode will be described using timing charts shown in FIGS. 10 and 11. As described above, in the first maintenance mode, the authentication request relay unit 35A is used as a RADIUS proxy server, and the authentication processing in the authentication processing unit 36 is not executed. There is a configuration in which the information regarding the entry / exit state is always changed so that the authentication processing unit 36 makes an authentication judgment.

(In the case of a configuration in which authentication processing in the authentication processing unit 36 is not executed)
In the case where the authentication processing in the authentication processing unit 36 is not executed, as shown in FIG. 10, the processing operation when the information breaker 30 is set to the first maintenance mode is the processing operation in the normal operation mode shown in FIG. Steps S1 and S12 are no longer necessary, and step S21 is executed instead of steps S3 to S9. Therefore, in the timing chart shown in FIG. 10, the same processes as those in the timing chart shown in FIG.

  First, when performing maintenance processing such as operation confirmation of the network management system 1 and identification of a defective part, the user sets the information breaker 30 to the first maintenance mode.

  Then, when confirming the operation of the network authentication system 20 or identifying a defective part, the user enters the advanced security level area, executes the process of step S2 described with reference to FIG. Make it work. When the process of step S2 ends, the process proceeds to step S21.

  When confirming the operation of the facility system 10 or identifying a defective part, the user uses, for example, the card ID, which is authentication information stored in the IC card 2, to enter the card reader 11 or leave the card reader 12. The entry / exit control unit 13 verifies whether or not the authentication process is correctly executed.

  In step 21, the authentication request relay unit 35A performs processing for acquiring information necessary for authentication processing in the authentication processing unit 36, such as an account ID included in a RADIUS packet of the network authentication request received via the network I / F 34. Only the recalculation of the authentication code defined in the RADIUS standard is executed without executing it, and a network authentication request is transmitted to the authentication server 23 via the network I / F 34. When step S21 ends, the process proceeds to step S10.

  Then, from the result obtained in step S11, the user determines whether the network authentication system 20 is functioning normally or whether there is a problem with the network authentication system 20, and if there is a problem, a predetermined maintenance is performed. Execute the process.

For example, despite the user is an authorized user, and if the line of the terminal device 21 _n and the network is not open, though not an authorized user, such as when the line between the terminal unit 21 _n and the network from being opened It can be determined that a problem has occurred in the network authentication system 20.

(In the case of a configuration for executing authentication processing in the authentication processing unit 36)
In the case of a configuration for executing the authentication process in the authentication processing unit 36, as shown in FIG. 11, the processing operation when the information breaker 30 is set to the first maintenance mode is the processing operation in the normal operation mode shown in FIG. Steps S1 and S12 are no longer necessary, and step S31 is executed instead of step S4. Therefore, in the timing chart shown in FIG. 11, the same processing as that in the timing chart shown in FIG.

  First, when performing maintenance processing such as operation confirmation of the network management system 1 and identification of a defective part, the user sets the information breaker 30 to the first maintenance mode.

  Then, when confirming the operation of the network authentication system 20 or identifying a defective part, the user enters the advanced security level area, executes the process of step S2 described with reference to FIG. Make it work. When the process of step S2 ends, the process proceeds to step S3 and step S31.

  When confirming the operation of the facility system 10 or identifying a defective part, the user uses, for example, the card ID, which is authentication information stored in the IC card 2, to enter the card reader 11 or leave the card reader 12. The entry / exit control unit 13 verifies whether or not the authentication process is correctly executed.

  In step S31, the authentication processing unit 36 is information indicating the current access state in the high security level area of the user stored in the authentication state storage unit 33B of the internal database 33, using the account ID of the acquired Identity data as a key. Request certain area number information and entry time information. Further, the authentication processing unit 36 uses the acquired IP address of the authentication device 22 as a key to specify a high security level region where the authentication device 22 is installed, which is stored in the system information storage unit 33C of the internal database 33. Request number information and available time information. This area number information indicates the high security level area in which the authentication device 22 that has transmitted the network authentication request is installed.

  At this time, the authentication processing unit 36 obtains the staying area number information, which is information indicating the current access state in the high security level area of the user stored in the authentication state storage unit 33B, and the entry time information from the authentication. The processing unit 36 is changed so that the authentication judgment can be made.

  As a result, the authentication processing unit 36 always makes an authentication determination in steps S5 and S6. Therefore, in step S7, the request relay determination unit 35B makes a final determination to transmit a network authentication request to the authentication server 23 in response to the authentication determination from the authentication processing unit 36, and via the network I / F 34, A network authentication request is transmitted to the authentication server 23.

  Then, from the result obtained in step S11 after step S10, the user determines whether the network authentication system 20 is functioning normally or is defective, and if there is a defect, A predetermined maintenance process is executed.

For example, despite the user is an authorized user, and if the line of the terminal device 21 _n and the network is not open, though not an authorized user, such as when the line between the terminal unit 21 _n and the network from being opened It can be determined that a problem has occurred in the network authentication system 20.

  As described with reference to FIGS. 10 and 11, in the first maintenance mode, the authentication request relay unit 35 </ b> A is a RADIUS proxy server, or the authentication processing unit 36 always makes an authentication decision so that the user's advanced security level is set. By changing the information indicating the current access state in the area, the network authentication request is transmitted unconditionally to the authentication server 23. Thereby, since the installation system 10 and the network authentication system 20 are not linked, the installation system 10 and the network authentication system 20 can be operated independently.

  Therefore, when a problem occurs in the network management system 1, the operation switching unit 40 is switched to the first maintenance mode without changing the system configuration, so that either the equipment system 10 or the network authentication system 20 The trouble that has occurred can be easily identified.

  In addition, when the newly constructed equipment system 10 or network authentication system 20 is constructed so as to be linked by the information breaker 30 that is the linkage control device, the contractor or the system administrator sets the operation switching unit 40 to the first maintenance mode. By switching to, the operation confirmation of the facility system 10 and the network authentication system 20 can be performed independently without changing the system configuration.

  Further, as shown in FIG. 10, when the authentication processing in the authentication processing unit 36 is not executed, the number of processing steps is greatly reduced as compared with the case where the authentication processing unit 36 shown in FIG. Therefore, the processing load on the information breaker 30 can be reduced.

  In the embodiment of the present invention, the user uses the card ID stored in the IC card owned by the user as the authentication target information, and performs the authentication process in the facility system 10. It is not limited, and the user only needs to be uniquely specified in the facility system 10. For example, the facility system can be obtained by performing biometric authentication processing using biometric information such as fingerprint information and iris information as authentication target information. Authentication processing in the system 10 may be performed.

Also, when the terminal device 21 _n accesses the network, the biometric authentication process using this biometric information may be executed.

  The above-described embodiment is an example of the present invention. For this reason, the present invention is not limited to the above-described embodiment, and various modifications can be made depending on the design and the like as long as the technical idea according to the present invention is not deviated from this embodiment. Of course, it is possible to change.

It is a figure for demonstrating the structure of the network management system shown as embodiment of this invention. It is a figure for demonstrating the structure of the information breaker of the said network management system. It is a figure for demonstrating the various information memorize | stored in the user information storage part of an internal database. It is a figure for demonstrating the various information memorize | stored in the authentication state memory | storage part of an internal database. It is a figure for demonstrating the various information memorize | stored in the system information storage part of an internal database. It is the state transition diagram which showed the transition of the operation mode of an information breaker. It is the figure which showed an example of the said network management system made into the redundancy structure. It is the figure which showed another example of the said network management system made into the redundancy structure. It is a timing chart for demonstrating the processing operation at the time of making the operation mode of the said information breaker into normal operation mode. It is a timing chart for demonstrating the processing operation at the time of making the operation mode of the said information breaker into the 1st maintenance mode which does not perform an authentication process in an authentication process part. It is a timing chart for demonstrating the processing operation at the time of making the operation mode of the said information breaker into the 1st maintenance mode which performs an authentication process in an authentication process part.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 Network management system 2 IC card 10 Equipment system 11 Entrance card reader 12 Exit card reader 13 Entrance / exit control unit 15 Zone monitoring sensor 16 Authentication control unit 20 Network authentication system 21 _n terminal device 22 Authentication device 23 Authentication server 30 Information breaker 33 Internal database 33A User information storage unit 33B Authentication status storage unit 33C System information storage unit 35 RADIUS authentication unit 35A Authentication request relay unit 35B Request relay determination unit 36 Authentication processing unit 37 Authentication state control unit 40 Operation switching unit

Claims (8)

In accordance with an authentication processing result based on first authenticated information for uniquely identifying a user, an access management system for managing access to and from the high security level area, and a network constructed in the high security level area, In accordance with the authentication processing result by the authentication server based on the second authentication information that uniquely identifies the user, a cooperation control device that cooperates with a network authentication system that restricts access,
Storage means for storing a current entry / exit state for a user's advanced security level area according to an authentication processing result based on at least the first authentication information by the entry / exit management system, and the second authentication information in association with each other;
Using the second authenticated information, the user's advanced security level area associated with the second authenticated information stored in the storage means in response to a network access request made by the user An authentication processing means for performing an authentication process based on the current access status of
An operation switching means for instructing to switch the operation mode of the cooperation control device according to a user operation;
In response to the operation of the operation switching means, when authenticated by the authentication processing means, a request for access to the network by the second authenticated information is transmitted to an authentication server of the network authentication system, A normal operation mode for rejecting a request for access to the network based on the second authenticated information without sending it to the authentication server of the network authentication system when the authentication processing means does not authenticate,
Or control means for controlling to operate in a first maintenance mode in which a request for access to the network by the second authenticated information made by the user is unconditionally transmitted to the authentication server of the network authentication system. The cooperative control device characterized by this. In response to being instructed to switch to the first maintenance mode by the operation switching means,
The control unit transmits an access request to the network by the second authenticated information made by the user to the authentication server without executing the authentication process by the authentication processing unit. The linkage control device described. In response to being instructed to switch to the first maintenance mode by the operation switching means,
The control means changes the current access state for the user's high security level area associated with the second authenticated information stored in the storage means so that the authentication processing means is always authenticated. The cooperation control apparatus according to claim 1, wherein In response to the operation switching means being operated,
The control means controls to operate in the normal operation mode, the first maintenance mode, or the second maintenance mode in which all access requests to the network by the second authenticated information made by the user are discarded. The cooperation control device according to any one of claims 1 to 3, wherein An entry / exit management system for managing entry / exit of the high security level area according to the authentication processing result based on the first authenticated information for uniquely identifying the user;
A network authentication system that restricts access to a network constructed in the high security level area according to an authentication processing result by an authentication server based on second authenticated information that uniquely identifies the user;
A linkage control device that mutually links the access control system and the network authentication system;
The cooperation control apparatus associates at least the current access state with respect to the user's advanced security level area according to the authentication processing result based on the first authenticated information by the access management system, and the second authenticated information. Storage means for storing;
Using the second authenticated information, the user's advanced security level area associated with the second authenticated information stored in the storage means in response to a network access request made by the user An authentication processing means for performing an authentication process based on the current access status of
An operation switching means for instructing to switch the operation mode of the cooperation control device according to a user operation;
In response to the operation of the operation switching means, when authenticated by the authentication processing means, a request for access to the network by the second authenticated information is transmitted to an authentication server of the network authentication system, A normal operation mode for rejecting a request for access to the network based on the second authenticated information without sending it to the authentication server of the network authentication system when the authentication processing means does not authenticate,
Or a control means for controlling to operate in a first maintenance mode in which a request for access to the network by the second authenticated information made by the user is unconditionally transmitted to the authentication server of the network authentication system. A network management system characterized by this. In response to being instructed to switch to the first maintenance mode by the operation switching means,
The control unit of the cooperation control device transmits an access request to the network by the second authenticated information made by the user to the authentication server without executing the authentication process by the authentication processing unit. The network management system according to claim 5. In response to being instructed to switch to the first maintenance mode by the operation switching means,
The control means of the cooperation control apparatus always authenticates the current access state with respect to the high security level area of the user associated with the second authenticated information stored in the storage means by the authentication processing means. The network management system according to claim 5, wherein the network management system is changed as follows. In response to the operation switching means being operated,
The control unit of the cooperative control device operates in the normal operation mode, the first maintenance mode, or the second maintenance mode that discards all access requests to the network by the second authenticated information made by the user. The network management system according to any one of claims 5 to 7, wherein the network management system is controlled to perform.

Images