JP4816920B2 - Authentication system and authentication method - Google Patents

Description

  The present invention relates to an authentication system and method when a network connection device connects to a network, and more particularly to a system and method for performing security authentication based on current incident information and vulnerability assessment of a network connection terminal.

  As a system for authenticating a user who uses a network, there are techniques disclosed in Patent Document 1 (Japanese Patent Laid-Open No. 2004-86880) and Patent Document 2 (Japanese Patent Laid-Open No. 2005-293088).

  A conventional network authentication system of this type is composed of a network connection device, a network authentication device, an ID / password registration database device, and a security authentication database device, and generally performs the following operations. is there.

  When a network connection device included in a terminal used by a user connects to the network, the ID / password and security status information input by the terminal user are transmitted to the network authentication device to request connection authentication.

  The network authentication device collates the ID / password registered in the ID / password registration database with the sent ID / password, and authenticates the network connection device if they match. Next, the network authentication device collates the security status information of the network connection device with the security authentication database device, and provides the regular network connection information if the security status information is appropriate.

The network connection device connects to the network based on the network connection information provided from the network authentication device. If the ID / password transmitted from the network connection terminal does not match any ID / password in the ID / password registration database, the network authentication device rejects the connection request and does not provide network connection information. Further, if the security status information is not appropriate, network connection information that can be connected only to a specific network is provided, and the security status information can be appropriately corrected in the specific network.
JP 2004-86880 A JP 2005-293088 A

  The conventional techniques described above have the following problems.

  The first problem is that it is difficult to keep the security information database up to date. The reason is that the security information database is constructed so as to be added to the network authentication device, and therefore the network must have a security information database for each network authentication system. This is also because the amount of distribution of security information has increased, the frequency has increased, and the types and number of corresponding network connection devices have increased.

  The second problem is that a threat that cannot be prevented even if the security status information is updated. The reason is that the threat enters faster than the security information database is up to date. This is related to the increase in the amount of work of the administrator mentioned in the first problem, but it is caused by the fact that the intrusion of threats is faster than that.

  The third problem is that the investment for constructing the security authentication system was enormous. The reason is that the security authentication system was built in addition to the network authentication system, so if the criteria for judging the consistency of security status information differ depending on the network authentication system, a separate security authentication system must be held. This is because it must not.

  The fourth problem is that the security information is handled in the same way as the management of ID / password information and is inefficient. The reason is that the user authentication by ID / password and the security authentication by security status information are realized at the same time, so the ID / password registration database and the security information database must be owned and operated. It is.

  The present invention has been made in view of the problems of the prior art as described above, and uses a security information database that utilizes incident information related to external threats in addition to security information related to network connection device vulnerabilities. It is an object to provide a security authentication system that can be operated independently and shared by a plurality of network authentication systems.

  Another object of the present invention is to provide a security authentication service in which a plurality of companies / organizations can share a security information database and receive security authentication.

An authentication system according to the present invention includes a network connection device , an authentication device, a vulnerability disclosed by a manufacturer of the network connection device or an application, and a security information providing site for publishing security information on a countermeasure method for the vulnerability. Because
The network connection device collects security information in its own device as security authentication information, performs data transmission / reception with the authentication device, gives a connection request by giving its own identifier when requesting connection to the network, Sending the security authentication information to the authentication device in response to a request from the authentication device;
The authentication device transmits / receives data to / from the network connection device, and requests to transmit the security authentication information to the network connection device according to an identifier assigned when receiving a connection request to the network, and then The security authentication information sent is compared with security information published by the security information providing site, and the network connection device is connected to the network according to the comparison result.

In this case, an incident information providing organization that provides incident information indicating a threat occurring in the current network via the network is provided.
The authentication device may compare the security authentication information with security information and the incident information published by the security information providing site, and connect the network connection device to the network according to the comparison result.

Network network connection device of the present invention, the authentication device, configuring the network connection device and applications both authentication system and security information providing site to publish security information countermeasures vulnerability and to it the manufacturer has published a A connecting device,
Security information is collected as security authentication information in its own device, data is transmitted to and received from the authentication device, and when a connection request to the network is made, a connection request is made by assigning its own identifier. In response, the security authentication information is sent to the authentication device.

Authentication apparatus of the present invention, network connection device, configuring the network connection device and applications both authentication system and security information providing site to publish security information countermeasures vulnerability and to it by the manufacturer exposes Authentication A device,
When sending / receiving data to / from the network connection device and receiving a connection request to the network, the network connection device is requested to send security authentication information to the network connection device in accordance with an assigned identifier, and the security sent thereafter The authentication information is compared with the security information published by the security information providing site, and the network connection device is connected to the network according to the comparison result.

In this case, it consists of a network authentication device and a security authentication device,
The network authentication device transmits / receives data to / from the network connection device, and requests to transmit the security authentication information to the network connection device according to an identifier given when receiving a connection request to the network, Then, send the security authentication information sent to the security authentication device,
The security authentication device may compare the security authentication information with security information published by the security information providing site, and connect the network connection device to the network according to the comparison result.

An authentication device according to another aspect of the present invention includes a network connection device, a security information providing site for disclosing security information on vulnerabilities disclosed by the manufacturer of the network connection device and the application, and a countermeasure against the vulnerability, and a current network the incident information indicating a threat occurring in the inner an authentication device constituting together an authentication system and incident information providers to provide through the network,
When sending / receiving data to / from the network connection device and receiving a connection request to the network, the network connection device is requested to send security authentication information to the network connection device in accordance with an assigned identifier, and the security sent thereafter The authentication information is compared with the security information published by the security information providing site and the incident information, and the network connection device is connected to the network according to the comparison result.

In this case, it consists of a network authentication device and a security authentication device,
The network authentication device transmits / receives data to / from the network connection device, and requests to transmit the security authentication information to the network connection device according to an identifier given when receiving a connection request to the network, Then, send the security authentication information sent to the security authentication device,
The security authentication device may compare the security authentication information with security information published by the security information providing site and the incident information, and connect the network connection device to the network according to the comparison result.

An authentication method according to the present invention includes a network connection device , an authentication device, a vulnerability disclosed by a manufacturer of the network connection device or an application, and a security information providing site for publishing security information of a countermeasure method for the vulnerability. The authentication method performed in
The network connection device collects security information in its own device as security authentication information, performs data transmission / reception with the authentication device, gives a connection request by giving its own identifier when requesting connection to the network, Sending the security authentication information to the authentication device in response to a request from the authentication device;
The authentication device transmits / receives data to / from the network connection device, and requests to transmit the security authentication information to the network connection device according to an identifier assigned when receiving a connection request to the network, and then The security authentication information sent is compared with security information published by the security information providing site, and the network connection device is connected to the network according to the comparison result.

An authentication method according to another embodiment of the present invention includes a network connection device , an authentication device, a security information providing site that discloses security information on a vulnerability disclosed by a manufacturer of the network connection device and the application, and a countermeasure for the vulnerability, An authentication method performed by an authentication system including an incident information provider that provides incident information indicating a threat occurring in the current network via the network,
The network connection device collects security information in its own device as security authentication information, performs data transmission / reception with the authentication device, gives a connection request by giving its own identifier when requesting connection to the network, Sending the security authentication information to the authentication device in response to a request from the authentication device;
The authentication device transmits / receives data to / from the network connection device, and requests to transmit the security authentication information to the network connection device according to an identifier assigned when receiving a connection request to the network, and then The security authentication information sent is compared with the security information and the incident information published by the security information providing site, and the network connection device is connected to the network according to the comparison result.

  In the security authentication system of the present invention, specifically, incident information related to external threats is registered in addition to security information related to the vulnerability of the network connection device, and the security authentication device individually checks the security status with respect to the network authentication device. The security authentication apparatus operates in such a manner that the security authentication apparatus determines the consistency and provides the result to the network authentication apparatus in accordance with the standard for each network authentication apparatus.

  Adopting such a configuration, the security authentication device determines the security status information of the network connection device transmitted from the network authentication device according to the standard of the network authentication device, and if it matches, the authentication permission information is displayed. In the case of a mismatch, the object of the present invention can be achieved by transmitting authentication disapproval information to the network authentication device.

  The first effect is that labor for updating the security authentication database can be saved.

  The reason is that, by operating the security authentication database independently, even in a plurality of network authentication systems, the work of updating the security information related to the vulnerability of the network connection device can be performed in an integrated manner. Moreover, by becoming an independent operation, it becomes possible to provide this to companies and organizations as a service by an external independent organization. In this case, since it is not necessary for each company or organization to individually update the security authentication database, the work can be saved greatly.

  The second effect is that it is possible to cope with a threat before the security information in the security authentication database becomes the latest.

  The reason is that the security authentication database contains not only security information related to vulnerabilities of network connection devices, but also incident information related to external threats, so measures can be taken before security information is provided. It is.

  The third effect is that the investment can be minimized.

  The reason is that the security authentication apparatus can have a standard for judging the consistency of security information for each network authentication apparatus, and it is not necessary to individually construct a security authentication system.

  The fourth effect is that the security authentication system can be easily serviced.

  This is because the ID / password registration database and the security information database can be managed independently, so that it is not necessary to hold personal information such as ID / password necessary for network authentication.

  Next, the best mode for carrying out the present invention will be described in detail with reference to the drawings.

  Referring to FIG. 1, the first embodiment of the present invention is a network (NW) connection device 100 that requests network connection, a network authentication device 200 that authenticates network connection, and a network authentication database that cooperates with the network authentication device. (DB) 300, security authentication device 400 for authenticating security status information, security authentication database (DB) 500 operating in cooperation with security authentication device 400, security information providing site 600, and incident information providing organization 700 , Is composed of.

  The network connection device 100, the network authentication device 200, the security authentication device 400, the security information providing site 600, and the incident information providing site 700 are connected via a network.

  The security information providing site 600 is an information providing site operated by an application manufacturer. The security information providing site 600 includes information on vulnerabilities disclosed by the network connection device 100 and the application manufacturer and countermeasures for the information. Information is accumulated and the accumulated information is made public via the network.

  Incident information providing organization 700 provides information on threats occurring in the current network via the network.

  The network connection apparatus 100 includes means 101 for transmitting / receiving data to / from the network authentication apparatus 200, means 102 for collecting security status information in the own apparatus, and means 103 for connecting to the network.

  Each of these means generally operates as follows.

  The means 101 for transmitting / receiving data to / from the network authentication device 200 transmits data specifying the destination of the network authentication device 200 from the network connection device 100 and requests to transmit / receive data. The network authentication device 200 side responds that transmission / reception is possible to the network connection device 100 that is the transmission source, and starts data transmission / reception.

  When the network connection device is activated, the means 102 for collecting the security status information in the own device confirms the files and setting information in the own device specified in advance and aggregates them as security status information.

  The means 103 for connecting to the network uses the network information obtained from the network authentication device 200 to transmit / receive data to / from any terminal connected via the network.

  The network authentication apparatus 200 includes means 201 for transmitting / receiving data to / from the network connection apparatus 100, means 202 for transmitting / receiving data to / from the network authentication database 300, and means 203 for creating a reference for each individual apparatus.

  Each of these means generally operates as follows.

  The means 201 for transmitting / receiving data to / from the network connection apparatus 100 allocates necessary resources to the data transmission / reception request from the network connection apparatus 100 and responds that transmission / reception to / from the network connection apparatus 100 is possible. .

  The means 202 for transmitting / receiving data to / from the network authentication database 300 transfers the ID / password received from the network connection apparatus 100 to the network authentication database 300 and receives verification result information from the network authentication database 300.

  The means 203 for creating a reference for the own apparatus creates an individual reference for the own apparatus by adding an ID unique to the own apparatus to the security reference information defined by the network authentication apparatus 200.

  The network authentication database 300 includes means 301 that holds ID / password information and means 302 that executes processing from the network authentication apparatus 200.

  Each of these means generally operates as follows.

  The means 301 for holding ID / password information holds a pair of ID and password information.

  The means 302 for executing the processing from the network authentication device 200 searches for the ID in its own database from the ID / password received from the network authentication device 200, and holds a pair if there is a matching ID. The password is verified to determine whether it is correct, and the result is transmitted to the network authentication apparatus 200.

  The security authentication device 400 includes means 401 for transmitting / receiving data to / from the network authentication device 200, means 402 for transmitting / receiving data to / from the security authentication database 500, means 403 for collecting security information, and means 404 for collecting incident information. And means 405 for holding a network authentication device specific reference together with an identification number of the network authentication device.

  Each of these means generally operates as follows.

  The means 401 for transmitting / receiving data to / from the network authentication device 200 receives the identification number of the network authentication device 200 and the security status information of the network connection device 100 from the network authentication device 200, and transmits the security authentication result to the network authentication device 200. .

  The means 402 for transmitting / receiving data to / from the security authentication database transmits the security status information of the network connection device, and receives the information of the location that does not match the location that matches the information registered in the security authentication database. To do.

  The means 403 for collecting security information periodically obtains information on the vulnerabilities disclosed by the network connection device 100 and application manufacturers and information on countermeasures against them from the manufacturer's security information providing site 600, Transfer to the security authentication database 500.

  The means 404 for collecting incident information periodically obtains incident information from the incident information providing organization 700 that provides information on threats occurring in the current Internet, and transfers the incident information to the security authentication database 500.

  The means 405 for holding the individual network authentication device standard together with the identification number of the network authentication device holds the identification number received from the network authentication device 200 and the security standard information as a pair.

  The security authentication database 500 includes means 501 for holding security information related to the vulnerability of the network connection device, means 502 for holding incident information related to external threats, and means 503 for executing processing from the security authentication device. .

  Each of these means generally operates as follows.

  The means 501 that holds security information related to the vulnerability of the network connection device always stores only the latest information on the security information received from the security authentication device 400 and deletes old information.

  The means 502 for storing incident information related to external threats always stores only the latest information on the incident information received from the security authentication device 400 and deletes old information.

  The means 503 for executing the processing from the security authentication device 400 compares the security status information of the network connection device 100 received from the security authentication device 400 with the security information held to determine whether it is the latest status, The result is transmitted to the security authentication device 400.

  Note that each of the network connection device 100, the network authentication device 200, the network authentication database 300, the security authentication device 400, and the security authentication database 500 according to the present embodiment is a general device including a control device, a storage device, an input device, and a display device. It is composed of a computer. These parts are not shown. Each means described above is constructed on a storage device such as a ROM and a RAM by a control device that operates according to a program stored in the storage device, and is controlled by the control device.

  The network authentication device 200 and the network authentication database 300 may be configured as one device. Similarly, the security authentication device 400 and the security authentication database 500 may be configured as one device. Further, the network authentication device 200, the network authentication database 300, the security authentication device 400, and the security authentication database 500 may be configured as one device that performs network and security authentication.

  FIG. 2 is a flowchart showing the operation of the present embodiment, FIG. 3 is a diagram showing an example of security status information generated by the network connection apparatus 100, and FIGS. 4A and 4B are security authentication databases. 5 is a diagram showing an example of security information and incident information held at 500. FIG.

  The overall operation of the present embodiment will be described in detail below with reference to FIGS.

  First, the security authentication device 400 obtains the security information having the contents shown in FIG. 4A from the security information providing site 600 and the incident information having the contents shown in FIG. 4B from the incident information providing organization 700, and performs security authentication. It is registered in the database 500, and the security authentication database 500 holds the latest security information and incident information.

  First, the network connection device 100 transmits ID / password information to the network authentication device 200 as a network connection request (step A1).

  Next, the ID / password information received by the network authentication device 200 is checked against information in the network authentication database 300 to determine whether or not they match (step A2). If they do not match, the network authentication device 200 transmits a message rejecting the network connection request of the network connection device 100 to the network connection device 100 (step A3). If they match, the network authentication device 200 requests the network connection device 100 to transmit security status information (step A4).

  The network connection apparatus 100 collects the security status information in its own apparatus with the contents shown in FIG. 3 and transmits it to the network authentication apparatus 200 (step A5).

  The network authentication device 200 transmits the received security status information together with the network authentication device identification number to the security authentication device 400, and requests security authentication (step A6).

  The security authentication device 400 compares the received security status information with the information in the security authentication database 500 based on the individual criteria corresponding to the received network authentication device identification number (step A7).

  If the received security status information does not match the security information in the security authentication database 500, or if the security status information corresponds to the incident information in the security authentication database 500, the security authentication device 400 The verification result and the information are transmitted to the authentication device 200, and the network authentication device 200 controls connection of the network connection device to a specific network and implements security state improvement control (step A8).

  When the received security status information matches the security information in the security authentication database 500, and the security status information does not correspond to the incident information in the security authentication database 500, the security authentication device 400 is a network authentication device. The verification result is transmitted to 200, and the network authentication device permits the network connection request of the network connection terminal, and transmits information necessary for network connection (step A9).

  Next, the effect of this embodiment will be described.

  In the present embodiment, the network authentication devices are distinguished by individual identification numbers, and the security authentication devices have individual standards corresponding to the identification numbers, so one security authentication device for a plurality of network authentication devices. Can provide security authentication services. As a result, the update work of the security authentication database is unified, and the load of the update work is minimized. In the present embodiment, since the network authentication device and the security authentication device are configured to operate independently, the operation of the security authentication device can be serviced. At that time, it is also an important point of service that the security authentication apparatus does not care about ID and password information.

  According to the present invention, when a terminal directly connected to an in-house network is brought home and connected via the Internet, security authentication is performed under conditions that are stricter than when the terminal is directly connected to the in-house network, and the same security is provided. It can be applied to applications such as protecting the internal network and increasing convenience while minimizing costs with the authentication system. Further, the present invention can also be applied to a case where a company providing a remote access service to a plurality of companies provides a security authentication service as a value-added service that can perform security authentication according to different standards for each company.

It is a block diagram which shows the structure of the best form for implementing this invention. It is a flowchart which shows operation | movement of the best form for implementing this invention. It is a figure which shows the specific example of the security status information for implementing this invention. It is a figure which shows the specific example of the security information for implementing this invention, and incident information.

Explanation of symbols

DESCRIPTION OF SYMBOLS 100 Network connection apparatus 200 Network authentication apparatus 300 Network authentication database 400 Security authentication apparatus 500 Security authentication database

Claims (9)

An authentication system comprising a network connection device , an authentication device, a security information providing site for publishing security information on a vulnerability disclosed by a manufacturer of the network connection device or an application and a countermeasure against the vulnerability,
The network connection device collects security information in its own device as security authentication information, performs data transmission / reception with the authentication device, gives a connection request by giving its own identifier when requesting connection to the network, Sending the security authentication information to the authentication device in response to a request from the authentication device;
The authentication device transmits / receives data to / from the network connection device, and requests to transmit the security authentication information to the network connection device according to an identifier assigned when receiving a connection request to the network, and then An authentication system that compares the received security authentication information with security information published by the security information providing site, and connects the network connection device to the network according to the comparison result. The authentication system according to claim 1,
An incident information provider that provides incident information indicating threats occurring in the current network via the network;
The authentication apparatus compares the security authentication information with security information published by the security information providing site and the incident information, and connects the network connection apparatus to a network according to the comparison result. Authentication device, a network connection device together constitute a certification system and security information providing site to publish security information of the network connection device and application countermeasures vulnerability and to it by the manufacturer is public,
Security information is collected as security authentication information in its own device, data is transmitted to and received from the authentication device, and when a connection request to the network is made, a connection request is made by assigning its own identifier. In response, a network connection device that sends the security authentication information to the authentication device. Network connection device, a authentication device constituting the network connection device and applications both authentication system and security information providing site to publish security information countermeasures vulnerability and to it by the manufacturer is public,
When sending / receiving data to / from the network connection device and receiving a connection request to the network, the network connection device is requested to send security authentication information to the network connection device in accordance with an assigned identifier, and the security sent thereafter An authentication device that compares authentication information with security information published by the security information providing site, and connects the network connection device to the network according to the comparison result. Network connection device, security information providing site that discloses security information on vulnerabilities published by the manufacturers of the network connection device and applications and countermeasures against them, incident information indicating threats occurring in the current network the an authentication device constituting together an authentication system and incident information providers to provide through the network,
When sending / receiving data to / from the network connection device and receiving a connection request to the network, the network connection device is requested to send security authentication information to the network connection device in accordance with an assigned identifier, and the security sent thereafter An authentication device that compares authentication information with security information published by the security information providing site and the incident information, and connects the network connection device to the network according to the comparison result. The authentication device according to claim 4, wherein
It consists of a network authentication device and a security authentication device,
The network authentication device transmits / receives data to / from the network connection device, and requests to transmit the security authentication information to the network connection device according to an identifier given when receiving a connection request to the network, Then, send the security authentication information sent to the security authentication device,
The security authentication device compares the security authentication information with security information published by the security information providing site, and connects the network connection device to the network according to the comparison result. The authentication device according to claim 5, wherein
It consists of a network authentication device and a security authentication device,
The network authentication device transmits / receives data to / from the network connection device, and requests to transmit the security authentication information to the network connection device according to an identifier given when receiving a connection request to the network, Then, send the security authentication information sent to the security authentication device,
The security authentication device compares the security authentication information with security information published by the security information providing site and the incident information, and connects the network connection device to the network according to the comparison result. An authentication method performed by an authentication system comprising a network connection device , an authentication device, a vulnerability disclosed by a manufacturer of the network connection device or an application, and a security information providing site that discloses security information on a countermeasure for the vulnerability. And
The network connection device collects security information in its own device as security authentication information, performs data transmission / reception with the authentication device, gives a connection request by giving its own identifier when requesting connection to the network, Sending the security authentication information to the authentication device in response to a request from the authentication device;
The authentication device transmits / receives data to / from the network connection device, and requests to transmit the security authentication information to the network connection device according to an identifier assigned when receiving a connection request to the network, and then An authentication method in which the security authentication information sent is compared with security information published by the security information providing site, and the network connection device is connected to the network according to the comparison result. Network connection devices , authentication devices, security information providing sites that disclose security information on vulnerabilities published by the manufacturers of the network connection devices and applications, and countermeasures against them, threats occurring in the current network An authentication method performed by an authentication system including an incident information provider that provides incident information to be shown via a network,
The network connection device collects security information in its own device as security authentication information, performs data transmission / reception with the authentication device, gives a connection request by giving its own identifier when requesting connection to the network, Sending the security authentication information to the authentication device in response to a request from the authentication device;
The authentication device transmits / receives data to / from the network connection device, and requests to transmit the security authentication information to the network connection device according to an identifier assigned when receiving a connection request to the network, and then An authentication method for comparing the security authentication information sent to the security information and the incident information published by the security information providing site, and connecting the network connection device to the network according to the comparison result.

Images