JP2000151677A - Access authentication device for mobile ip system and storage medium - Google Patents

Abstract

PROBLEM TO BE SOLVED: To confirm a user of a mobile client simply and periodically, to enhance the security and an illegal connection prevention effect for mobile registration communication and to reduce communication traffic in a home network. SOLUTION: The access authentication device is used on a home network side of a mobile IP system and is provided with a communication start time access authentication processing means that allows an access authentication serer 7 on the home network to authenticate the user based on the received user authentication information and stores tentatively the user authentication information to a user authentication information database and with a communication state access authentication processing means that compares and collates the user authentication information of a confirmation packet received periodically and the user authentication information stored before to confirm the user and terminates mobile registration communication when the mobile client 4 is an illegal user.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an access authentication device for a mobile IP system, and more particularly, to an access authentication device and a storage device for a mobile IP system characterized in an access authentication portion of a mobile client moved from a home network to an external network. It is about media.

[0002]

2. Description of the Related Art In recent years, batteries (computers, PCs, WSs) are driven by batteries that are smaller and lighter, and communication infrastructures are being developed with the development of the Internet. This makes it possible, for example, to move a computer (terminal or client) used in a certain network (home network) to another network and use it by connecting to the home network via the Internet or the like.

Here, even if the connection location of the client is changed, it is as if the client after the movement (in this case, referred to as a mobile client) is connected to the home network, that is, the same computer as before the movement. Mobile IP protocols have been developed to make them accessible in the environment. Under the environment where the mobile IP protocol is realized, within the range where access is permitted,
Access from another computer and access to another computer can be performed in the same manner as before moving.

[0004] The mobile IP protocol conforms to the IETF, and a system that implements the mobile IP protocol is called a mobile IP system. In the mobile IP system,
For example, a transfer agent server (also referred to as a home agent) receives a packet addressed to a mobile client from a communication partner flowing to a home network when the mobile client moves, by proxy. Then, the environment is realized by transferring the packet from the transfer agent to the destination of the mobile client.

However, before proceeding to the processing in the transfer agent server, at the entrance (router) between the mobile client and the home network, user authentication of the mobile client and access authority to the processing requested by the mobile client are performed. You need to check if you have one. This authentication and confirmation is generally performed by an access server provided in the router computer.

FIG. 4 is a block diagram showing a configuration of a general home network.

As shown in FIG. 1, an in-house LAN 9 in which each client 91 and a transfer agent server 92 are provided.
3 is generally connected to a public network 96 via a firewall 94 and a router. For example, in-house LAN 9
The mobile client 97 that has moved from 3 to an external LAN (not shown) attempts to register the transfer with the transfer agent server 92 in order to realize the IP mobile function.

At this time, first, user authentication of the mobile client 97 is performed by the access server 95 provided in the router. The user authentication is performed from the access server 95 to the access authentication server 9 on the barrier segment LAN 98.
9 is executed when an inquiry is made to 9.

On the other hand, in order for the mobile client to execute the IP mobile function, the transfer agent server 92
In some cases, a file transfer or a log-in request to a computer in the in-house LAN 93 is made. However, also in this case, the processing request from the mobile client 97 to the transfer agent server 92 cannot be made directly. First, the access authority of the user is confirmed from the access server 95 to the access authentication server 99, and only when the user is authorized. The process moves to the transfer agent server 92.

In the conventional processing, the user authentication between the mobile client 97 and the access server 95 is performed by confirming a user name and a password conforming to the format of the access authentication server 99 only once at the time of connection. Have been done.

On the other hand, in a certain method, the access authority confirmation at the time of file transfer or the like is performed by checking the access server 95 against access permission information held by the access authentication server 99 every time a packet is received from the mobile client 97. I have. In another method, the access server 95 permits access to the process confirmed once.

[0012]

However, the conventional access authentication processing has the following problems to be solved.

First, the user authentication process is executed only at the time of the first mobile registration request from the mobile client. Therefore, if a malicious third party obtains a copy of the information at the time of this initial registration for some reason and the initial user authentication is cleared, it is necessary to prevent the third party from performing illegal acts after that point Can not be done. This inconvenience also occurs when the access right is confirmed only once for the access permission.

On the other hand, if the access server 95 checks the access authority one by one with the access authentication server 99 each time a packet is received from the mobile client 97, communication traffic between the access server 95 and the access authentication server 99 is large. Become.

Further, in the conventional mobile IP system, in order to maintain the mobile communication processing during the mobile registration communication, a mobile registration request without user authentication and its response are transmitted between the mobile client 97 and the transfer agent server 92. It is performed regularly. Therefore, for example, it is conceivable that the access server 95 checks the user with the access authentication server 99 every time there is a transfer registration request. However, this still increases traffic. In addition, the user name and password included in the packet of the first move registration request are encrypted. However, if this encrypted information is used as it is, even if user authentication is performed every time a move registration request is made, it is illegal. Action cannot be prevented.

Further, when the mobile client 97 executes the mobile client processing, the software activation also requires user authentication. Since the user authentication for activation and the user authentication for registration with the transfer agent server 92 are separately required, the user needs to input a password or the like one by one, which is complicated.

The present invention has been made in view of such circumstances, and it is possible to easily and regularly confirm a user of a mobile client, and to enhance the security of mobile registration communication and the effect of preventing unauthorized connection. It is an object of the present invention to provide an access authentication device and a storage medium for a mobile IP system capable of reducing communication traffic in a home network.

[0018]

SUMMARY OF THE INVENTION In order to solve the above-mentioned problems, the invention corresponding to claim 1 has been made for an access authentication device on a home network side in a mobile IP system realizing a mobile function of a mobile IP protocol. It is.

In this access authentication apparatus, the communication start-time access authentication processing means uses the user authentication information received from the mobile client at the start of the mobile registration communication to the access authentication server provided in another computer on the home network. Have the user authenticate.

As a result, when the user is confirmed, while the mobile registration communication with the mobile client is being performed, the user authentication information confirmed by the user by the communication start access authentication processing means is stored in the user authentication information database. Stored temporarily.

When a periodic confirmation packet for maintaining the mobile registration communication is received from the mobile client, the user authentication information is extracted from the confirmation packet by the access authentication processing means during communication, and the user authentication information is obtained. Is compared with the user authentication information held in the user authentication information database, and the user is confirmed.
Here, when the result that the mobile client is an unauthorized user is obtained, the mobile registration communication is terminated.

Therefore, the user of the mobile client can be easily and regularly checked, the security of the mobile registration communication and the effect of preventing unauthorized connection can be improved, and the communication traffic in the home network can be reduced. it can.

Next, a second aspect of the present invention is the mobile terminal according to the first aspect, wherein the user confirmation information in the packet transmitted by the mobile client is encrypted differently for each packet transmission. It is an access authentication device of the IP system.

According to the present invention, such means are provided, so that the security of mobile registration communication can be further improved.

Next, a third aspect of the present invention is the invention according to the first or second aspect, wherein the communication start-time access authentication processing means receives a request from another computer provided on the home network at the time of user confirmation. The access permission information for the user is acquired, and the access permission information is temporarily stored in the access permission information database, that is, during the mobile registration communication with the mobile client.

When the processing request packet is received by proxy from the mobile client, the access authentication processing means extracts the access permission information from the access information database and executes the requested processing based on the access permission information. Is determined.

Therefore, communication traffic in the home network can be further reduced.

Next, according to a fourth aspect of the present invention, the moving I
This is an access authentication device on the mobile client side in a mobile IP system that realizes the mobile function of the P protocol.

In this access authentication apparatus, the user authentication information for starting the mobile registration communication is sent to the home network by the access authentication processing means at the start of communication, and when the permission of the mobile registration communication is received from the home network. The user authentication information is temporarily stored in the user authentication information database, that is, during the mobile registration communication with the mobile client.

When a periodic confirmation packet for maintaining the mobile registration communication is transmitted from the mobile client, the user authentication information stored in the user authentication information database is converted into the confirmation packet by the access authentication processing means during communication. Included.

Therefore, the present invention can exhibit the effects of the inventions according to claims 1 to 3 by forming a pair with the access authentication device on the home network side according to any one of claims 1 to 3.

According to a fifth aspect of the present invention, in the invention according to the fourth aspect, the user authentication information database stores the access authentication processing means at the start of communication and / or the access authentication processing means during communication. The user authentication information is held in association with the user authentication information for obtaining permission of the mobile registration communication, and the access authentication processing means at the start of communication and / or the access authentication processing means during communication provide the user authentication information for activation or the communication permission. When one of the user authentication information is input, the other authentication information is also taken out from the user authentication information database and used.

Therefore, the same operation and effect as the invention according to claim 4 can be obtained, and the operation for user authentication can be facilitated.

Next, the invention corresponding to claim 6 is a storage medium storing a program for causing a computer to realize the invention corresponding to claim 1.

The computer controlled by the program read from the storage medium is a mobile IP according to claim 1.
Functions as an access authentication device for the system.

Next, the invention corresponding to claim 7 is a storage medium storing a program for causing a computer to realize the invention corresponding to claim 3.

The computer controlled by the program read from the storage medium is preferably a mobile IP.
Functions as an access authentication device for the system.

[0038]

Embodiments of the present invention will be described below.

FIG. 1 shows a mobile IP according to an embodiment of the present invention.
1 is a block diagram illustrating a configuration example of a network system to which a system access authentication device is applied.

This network system comprises a LAN serving as a home network 2 of a client 1 and a LAN (not shown) to which the client 1 moves via a public network 3 such as the Internet. ing. Although this network system is shown in a somewhat simplified form, it may be configured such that an in-house LAN or the like to which the client 1 is to be connected via a firewall is provided as shown in FIG. .

The home network 2 has a public network 3
, A router computer 5 serving as an entrance to the home network 2, an access authentication server 6, and the client 1 belonging to the home network 2 are connected via a data transmission path. Here, the client 1 is disconnected from the LAN of the home network 2 in some cases,
The mobile client 4 is connected to another network (such as a LAN). Note that the mobile client 4 may be directly connected to the public network 3.

Here, first, the router computer 5 functions as a general router, and is provided with a transfer agent server 7.

The transfer agent server 7 accepts the movement registration from the moved client 4 and realizes the processing of transferring the packet of the home network 2 of the movement source to the mobile client 4 and the access authentication processing linked to this processing. .

For this purpose, the transfer agent server 7 is provided with a transfer agent server processing unit 11, an access authentication processing unit 12, an access authentication agent 13, an access permission information database 14, and a user account information database 15. ing.

The transfer agent server processing unit 11 implements a general transfer agent function.
(1) a function of receiving a move registration request from a mobile client; (2) a function of authenticating and identifying a packet from the mobile client and flowing the packet to a home network; and (3) a proxy receiving and moving a packet of a client before the home network moves. It has a function to transfer to the client that is doing it.

The access authentication processing unit 12 links the user authentication information from the mobile client 4 with the access authentication information obtained from the access authentication server 6,
With this cooperation, an access authentication process is performed on a packet transmitted from the mobile client 4. This access authentication process is realized by a user authentication process based on user account information and an access right confirmation process based on access permission information.

The access authentication process performed by the access authentication processing unit 12 includes an authentication process for the first mobile registration request from the mobile client 4 and a reception of a mobile registration request packet periodically issued from the mobile client 4 during communication continuation. And a process of confirming whether the user has the right when receiving a processing request packet such as a file transfer (also referred to as a packet filtering process). These specific operations will be described later.

The access authentication agent 13 sends the access authentication server 6 at the request of the access authentication processing unit 12.
This is a communication process for realizing the exchange with the user. The access authentication server 6 is inquired of the user authentication information from the mobile client 4 as the access authentication information to perform the user authentication, and obtains the access permission information for the user from the access authentication server 6. The user authentication result and the obtained access permission information are transferred to the access authentication processing unit 12.

Note that the access permission information is information indicating an access right for a process permitted to the user. For example, the user A is information indicating that file transfer is permitted, but login to the database server is not permitted.

The access permission information database 13 temporarily stores the access permission information from the access authentication server 6 until the communication with the mobile client 4 is completed (from the start of the mobile registration to the end of the mobile registration). This information storage and deletion is performed by the access authentication processing unit 12.

User account information database 14
Is a database for temporarily storing user authentication information from the mobile client 4 until the end of communication. Specifically, the user account information (user name and password) is temporarily stored in an encrypted state during the communication processing from the start of the mobile registration to the end of the mobile registration of the mobile client 4. The storage and deletion of information in the database 14 are also performed by the access authentication processing unit 12.

The access authentication server 6 is a server that holds user authentication information and access permission information for each client (user) and provides services such as user authentication and provision of permission information for remote access from a remote place. is there. That is, the server 6 authenticates the user name and password, provides access permission information for the user, and records access.

The mobile client 4 is a mobile computer, and the mobile client processing unit 21
And a user account information database 22. Further, an input device 8 is provided.

The mobile client processing unit 21 is a processing unit on the client side that realizes the IP mobile function, and executes various IP mobile processes such as transmitting a processing request packet. Further, an access authentication processing unit 23 is provided.

The access authentication processing section 23 is a main processing section for access authentication in the mobile client 4. That is, at the start of the transfer registration request, the first transfer registration request packet is generated and transmitted, and the user authentication information (user name and password) for access authentication at that time is stored in the user account information database. Also,
Thereafter, the mobile station also periodically transmits a movement registration request packet.
Further, the access authentication processing unit 23 encrypts the movement registration request packet using an encryption key created by combining time elements.

FIG. 2 is a diagram showing an example of the data structure of a move registration request packet sent by a mobile client.

This movement registration request packet has a header 3
1, authentication information 32 for mobile communication, an IP address 33 before movement, an IP address 34 after movement, and an access authentication field 35. The data 32, 33, 34, and 35 are encrypted. The user account information stored in the access authentication field 35 includes a user name 36 and a password 37.

The access authentication processing section 23 handles not only the authentication information for the access authentication but also the activation authentication information of the mobile client process, and performs a process of associating them. That is, activation of the mobile client process requires user authentication information for the client computer, and this authentication information is different from access authentication for the transfer agent.

More specifically, the confirmation information is associated with the user authenticated when the mobile client process is activated and the same user who requests access authentication to the transfer agent, and these are integrated into the user account information database 22. To be stored temporarily. Until the end of the communication, the authentication information is handled as a unit, so that it is not necessary to re-input or re-read the authentication information of each of the authentication information. If both pieces of authentication information are the same, for example, each consisting of a user name and the same password, the activation authentication information and the user account information are identified and encrypted, and the packet is transmitted to the transfer agent server.

User account information database 22
Is a database that cooperates with the user account information held by the transfer agent server 5 and temporarily holds the user account information of the mobile client 4 until the end of the communication (from the start of the transfer registration request to the end of the transfer registration). Also, as described above, the mobile client processing unit 2
The activation authentication user authentication information 1 is also temporarily stored in association with the access authentication user authentication information (user account information).

Next, the operation of the access authentication device of the mobile IP system configured as described above according to the present embodiment will be described.

First, the processing on the mobile client 4 side will be described.

Using the mobile client 4 taken out of the home network 2, the home network 2
Is accessed. At this time, the mobile client processing unit 21 is activated. When the program is started, the user is prompted to enter a user name and a password as start authentication information. The activation authentication information and the authentication information for access authentication to the home network 2 do not necessarily have to be the same, but here the same user name and password are used.

A packet called a transfer registration request (preparation) is created using the input user name and password as user account information and sent to the transfer agent server. The packet at this time is similar to the movement registration request packet shown in FIG. In the transfer registration packet, the user account information is encrypted with a key obtained by combining a time element with an encryption key determined in advance by both parties.

Further, the information is retained while the user account information of the mobile client 4 is temporarily encrypted. The mobile client 4 which has transmitted the transfer registration request (preparation) packet waits for a transfer registration permission response from the transfer agent server 7 in this holding state.

Here, when the transfer registration permission (preparation) packet is received from the transfer agent server 7, the mobile client 4 performs a process of permitting the user account information held first. Further, the information is stored in the user account information database 22.

Thereafter, the mobile client 21 periodically outputs a mobile registration request packet for registration confirmation until the mobile client process ends and the connection is disconnected. In this packet output, the access authentication processing unit 2
By the process of 3, the user account information recorded in the user account information database 22 is stored in the access authentication field 35 of the packet. Since this user account information is encrypted with a key having time as an element, the user account information in each transfer registration request packet is different data.

When the user authentication information for access authentication is stored in the user account information database 22, the user authentication information for software activation is also stored in the database 2.
2 is stored, and information that the two correspond to each other is also stored. In this case, since the authentication information is the same, only the association information is stored. Thus, it is possible to perform authentication as a user of the mobile client processing unit program and authentication as a user connected to the home network 2 with only one authentication thereafter.

After the mobile registration is established in this way,
The mobile client 4 outputs various processing request packets, such as file transfer, to the home network 2 in addition to the periodic movement registration request packet.

When the connection with the home network 2 is cut off due to the end of the transfer registration process, the user account information in the user account information database 22 is deleted.

Next, processing on the home network side will be described.

FIG. 3 is a flowchart showing processing in the access authentication device of the mobile IP system according to the present embodiment. FIG. 2 mainly shows the processing of the access authentication processing unit 12 of the transfer agent server 7.

First, the transfer agent request packet (preparation) received from the mobile client 4 (S 1) is decoded by the transfer agent server 7 which has received the packet. This decrypted access authentication information (user account information)
The access authentication processing unit 12 sends the data to the access authentication server 6 via the access authentication agent 13 and inquires whether there is any problem with the access permission with the mobile client 4 (S2).

As a result, when an access permission notification is received from the access authentication server 6 (S3), the access authentication processing unit 12 holds the user account information from the mobile client 4 in the user account database 15 (S4). The access permission information obtained from the access authentication server 6 is stored in the access permission information database 14 (S5).

On the other hand, when the access authentication server 6 receives the notification of the access denial (S3), a rejection packet is sent to the mobile client 4 (S13), and the process ends.

After each information is stored in the databases 14 and 15 (S4, S5), a movement registration permission (preparation) packet is sent to the mobile client as a response packet (S6).

After the permission output, the transfer agent server 7 waits for a packet from the mobile client 4 (S7).

Here, when a mobile registration request packet to be issued periodically from the mobile client 4 is received (S7), the packet is decrypted by the access authentication processing unit 12, the user account information is extracted, and the user account information is extracted. The stored user account information is retrieved from the account information database 15, decrypted and compared (S
8).

If the user is confirmed from the result of the comparison and collation in the access authentication processing section 12, the process returns to step S7. On the other hand, if the user cannot be authenticated (S9),
That is, when the user account information in the packet is determined to be invalid, the subsequent communication is stopped, and a reject packet is sent to the mobile client 4 (S14). At the same time, in conjunction with the access authentication server 6, a transition is made to a permanent access denied state.

As described above, the access authentication process is performed every time in response to the periodic movement registration request packet. As described above, the user account information in the packet is encrypted with the encryption key including the time element. Therefore, different data is received every time in appearance.

Next, in the standby state of step S7,
When the processing request packet is received, the access permission information is extracted from the access permission information database 14, and the access authentication processing unit 12 compares and confirms (packet filtering) with the contents of the processing request (S10).

As a result, if the process is permitted (eg, file transfer) for the user (S10),
The access authentication processing unit 12 notifies the transfer agent server processing unit 11 of the fact, and the agent server processing unit 11 executes the process (S12), and returns to step S7 again.

On the other hand, if the process is not permitted to the user (for example, login to the server computer) (S10), a rejection packet to that effect is sent to the mobile client 4, and the process returns to step S7.

Further, in the standby state of step S7, when a registration deletion request is received from the mobile client 4, the request corresponds to the mobile client 4 in the user account information database 15 and the access permission information database 14 of the transfer agent server 7. Each piece of information is deleted by the access authentication processing unit 12, and the transfer registration processing ends.

As described above, the access authentication apparatus of the mobile IP system according to the embodiment of the present invention temporarily holds the access authentication information of the user during the mobile registration communication in the transfer agent server 7 and also uses the mobile client. 4
The user authentication information is included in the periodic mobile registration request packet from the user, and the user authentication is performed by comparing the two authentication information, so that the user can be verified in a simple manner and every time the request packet is received. Thus, the security of mobile registration communication can be improved. As a result, unauthorized connection such as continuous connection by a malicious third party can be prevented. Also, by adopting this user authentication method, it is not necessary to request the user authentication to the access authentication server 6 one by one, and the traffic in the home network can be reduced.

The user account information in the packet transmitted between the mobile client 4 and the transfer agent server 7 has its encryption method (encryption key) periodically changed by a time element or the like. The security of the information inside can be improved. For example, if a third party simply copies the movement registration request packet, it cannot be exploited. In addition, various methods are conceivable for the change of the encryption method in addition to the use of the key of the time element.

The access authentication device of the present embodiment
An access permission information database 14 is provided to temporarily hold the user permission information acquired from the access authentication server 6 at the time of user authentication, and to permit or deny a processing request based on the information of the database 14 when a processing request packet is received from the mobile client 4. Is determined (packet filtering), the communication traffic of the home network 2 can be reduced, and the access permission information can be reflected in the communication processing in a timely manner.

Further, in the access authentication apparatus of the present embodiment, the activation authentication information when the mobile client is activated and the access authentication information are linked in the mobile client, thereby facilitating the operation for user authentication. be able to.

The present invention is not limited to the above embodiments, but can be variously modified without departing from the scope of the invention.

For example, it has been described that the user authentication information at the time of activation and access authentication in the mobile client 4 is input from the input device 8, but such information is stored in a storage device such as a hard disk in a confidential and secure state. In advance, it may be a format to be read from there.

For example, in the embodiment, the access authentication processing unit 12, the access permission information database 14, the user account information database 15, and the access authentication agent 13 are provided on the transfer agent server 7. Is not limited to this. For example, the transfer agent server itself is provided on another computer of the home network together with some functions of the access authentication processing unit 12, and each of the above functions 12-1
5 may be left in the router computer 5. In this case, after the router computer confirms the user and access right of the packet received from the mobile client 4, the router computer delivers the packet and / or a notification of improper user or notification of no access right to the transfer agent server.

The method described in the embodiment can be stored in a recording medium as a program (software means) or data which can be executed by a computer (computer).

The storage medium mentioned here can store programs such as a magnetic disk, floppy disk, hard disk, optical disk (CD-ROM, CD-R, DVD, etc.), magneto-optical disk (MO, etc.), semiconductor memory, etc. In addition, as long as the storage medium is readable by a computer, the storage form may be any form.

Also, an OS (Operating System) running on the computer based on instructions of a program installed in the computer from the storage medium,
MW for database management software, network software, etc.
(Middleware) or the like may execute a part of each process for realizing the present embodiment.

Further, the storage medium in the present invention is not limited to a medium independent of a computer, but also includes a storage medium in which a program transmitted via a LAN or the Internet is downloaded and stored or temporarily stored.

Further, the number of storage media is not limited to one, and the case where the processing in this embodiment is executed from a plurality of media is also included in the storage media of the present invention, and any media configuration may be used.

Note that the computer according to the present invention executes each processing in the present embodiment based on a program stored in a storage medium, and is executed by a computer such as a personal computer.
Any configuration such as a single device, a system in which a plurality of devices are connected to a network, or the like may be used.

The computer in the present invention is:
It is not limited to a personal computer, but also includes a processing device, a microcomputer, and the like included in an information processing device, and generically refers to a device and a device capable of realizing the functions of the present invention by a program.

[0099]

As described above in detail, according to the present invention, user confirmation of a mobile client can be performed easily and periodically, and the security of mobile registration communication and the effect of preventing unauthorized connection can be improved. Mobile IP that can reduce communication traffic in home network
An access authentication device and a storage medium for the system can be provided.

[Brief description of the drawings]

FIG. 1 is a block diagram showing a configuration example of a network system to which an access authentication device of a mobile IP system according to an embodiment of the present invention is applied.

FIG. 2 is a diagram showing an example of a data structure of a movement registration request packet transmitted by a mobile client.

FIG. 3 is a flowchart showing processing in the access authentication device of the mobile IP system according to the embodiment.

FIG. 4 is a block diagram showing a configuration of a general home network.

[Explanation of symbols]

 DESCRIPTION OF SYMBOLS 1 ... Client 2 ... Home network 3 ... Public network 4 ... Mobile client 5 ... Router computer 6 ... Access authentication server 7 ... Transfer agent server 8 ... Input device 11 ... Transfer agent server processing part 12 ... Access authentication processing part 13 ... Access authentication Agent 14 Access permission information database 15 User account information database 21 Mobile client processing unit 22 User account information database 23 Access authentication processing unit 31 Header 32 Mobile phone authentication information 33 IP address before transfer 34 Mobile After IP address 35 ... Access authentication field 36 ... User name 37 ... Password

 ──────────────────────────────────────────────────続 き Continuing on the front page F term (reference) 5J104 AA07 KA01 KA09 KA10 NA05 NA27 NA38 PA01 PA07 5K030 GA15 HB19 HC01 HC14 HD03 HD06 5K033 AA08 BA01 CB08 DA05 DA19 DB18 EC03 5K067 AA33 BB00 BB21 EE02 EE04 HH05H 001 LL03

Claims (7)

[Claims] 1. An access authentication device on a home network side in a mobile IP system for realizing a mobile function of a mobile IP protocol, wherein the access authentication device on the home network is provided by user authentication information received from a mobile client at the start of mobile registration communication. A communication start-time access authentication processing means for causing the access authentication server provided in another computer to perform user authentication, and temporarily storing the user authentication information when the user is confirmed as a result, While the mobile registration communication is being performed, the user authentication information database holding the user authentication information confirmed by the user by the storing process of the communication start access authentication processing means, and the mobile client to maintain the mobile registration communication from the mobile client. Receiving the regular confirmation packet of The user authentication information is extracted from the confirmation packet, and the user authentication information is compared with the user authentication information held in the user authentication information database to perform user confirmation. If the mobile client is an unauthorized user, An access authentication device for a mobile IP system, comprising: a communication access authentication processing means for terminating mobile registration communication. 2. The access authentication device for a mobile IP system according to claim 1, wherein the user confirmation information in the packet transmitted by the mobile client is encrypted differently for each packet transmission. 3. The communication start-time access authentication processing means acquires access permission information for the user from another computer provided on the home network at the time of user confirmation, and temporarily stores the access permission information. And while the mobile registration communication is being performed with the mobile client, an access permission information database holding access permission information acquired by the communication start-time access authentication processing means is provided. When the processing request packet is received by proxy from the mobile client,
3. The access authentication device for a mobile IP system according to claim 1, wherein access permission information is extracted from the access information database, and whether to execute a requested process is determined based on the access permission information. . 4. An access authentication device on a mobile client side in a mobile IP system for realizing a mobile function of a mobile IP protocol, wherein user authentication information for starting mobile registration communication is sent to a home network, and a home network is provided. A communication start-time access authentication processing means for temporarily storing the user authentication information when the mobile registration communication is permitted from the mobile client; and the communication start-time access authentication during the mobile registration communication with the mobile client. A user authentication information database that holds user authentication information confirmed by the user by the storage processing of the processing unit; and a user that transmits the user authentication information when a periodic confirmation packet for maintaining mobile registration communication is transmitted from the mobile client. The user authentication information stored in the database is added to the confirmation packet. And an access authentication processing means during communication. 5. The user authentication information database according to claim 1, wherein the user authentication information for activating the communication start access authentication processing means and / or the communication access authentication processing means is provided for the user for obtaining permission for the mobile registration communication. While holding in association with authentication information, the communication start-time access authentication processing means and / or the communication-in-progress access authentication processing means are configured to input either user authentication information for activation or user authentication information for communication permission. 5. The access authentication device for a mobile IP system according to claim 4, wherein the other authentication information is also taken out from the user authentication information database and used. 6. A program for controlling an access authentication device on a home network side in a mobile IP system for realizing a mobile function of a mobile IP protocol, comprising: a user authentication information received from a mobile client at the start of mobile registration communication; With this, a communication start is performed in which an access authentication server provided in another computer on the home network performs user authentication, and when the user is confirmed as a result, the user authentication information is temporarily stored in a user authentication information database. Access authentication processing means, when a periodic confirmation packet for maintaining mobile registration communication is received from the mobile client, user authentication information is extracted from the confirmation packet, and the user authentication information and the user Authentication information database A mobile access authentication processing means for making a user confirmation by comparing and collating with the user authentication information held in the mobile device, and terminating the mobile registration communication when the mobile client is an unauthorized user. Computer readable storage medium. 7. The communication start-time access authentication processing means obtains access permission information for the user from another computer provided on the home network at the time of user confirmation, and stores the access permission information in an access permission information database. When a packet of a processing request is received as a proxy from the mobile client, the communication access authentication processing means retrieves access permission information from the access information database, and makes a request based on the access permission information. 7. The computer-readable storage medium according to claim 6, wherein it is determined whether to execute the performed processing.