JP2003273897A - Network service use allowing system and method for allowing its use - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To interrupt a network by suitably using a mail of a provider toward a group only for a valid group user. <P>SOLUTION: A network service allowing system comprises a plurality of groups of user terminals 7, 8 for conducting network connection requests; a carrier 6 having group dealing NAS 6-1, 6-2 for allocating one of the global IP addresses to be managed by himself, when a network connection request is received from a certain group of the user terminal; and provider systems 2, 3 dealing with the group having VPN units 21, 32 for allocating the private IP address shared by a certain group to the user terminal by confirming a valid user, when a NAS connection request is received, based on identification data from the user terminal of the group aligned with the global IP address. <P>COPYRIGHT: (C)2003,JPO

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a network service use permission system and a use permission method for properly relaying mail belonging to a group.

[0002]

2. Description of the Related Art As an environment for using electronic mail, there are a case where it is used by dial-up connection and a case where it is used via the Internet.

For use by dial-up connection, the provider installs an access point such as a modem or a router,
This is a form in which, when sending a mail from a user terminal, a mail server operated by the provider is used by connecting to the access point.

Specifically, as shown in FIG. 5, prior to the use of electronic mail, the user uses the user terminal 51 with the user I.
D and a password are input and transmitted to the network service provider (hereinafter abbreviated as provider) 53 via the public line / ISDN network 52.

The provider 53 side receives the data through an access point 54 such as a modem or a router, and an authentication server 55.
While checking whether the user is a valid user based on the user ID and password, the user who has issued the authentication request is recorded as log information regardless of whether the authentication is correct or not.

When the authentication server 55 authenticates the legitimate user, the IP address managed by the provider 53 is assigned to the user terminal 51, and then the line connection is established. The billing server 56 operated by the provider 53, after starting the line connection,
When the user terminal 51 disconnects the line,
The log information of who used which line to use the line is recorded. The user terminal 51 is a provider 53
While the IP address is assigned, the mail server 57 can be used to send and receive mail. In the figure, 58 is a firewall that protects the system of the provider 53 from unauthorized access and data destruction, and 59 is the Internet.

In the case of the use by the dial-up connection as described above, since the billing server 56 records the network connection state of the provider 53 as log information, even if the mail server 57 is illegally used, the follow-up investigation can be easily performed. Is.

On the other hand, in the latter case of using via the Internet, two types of Internet service using systems are considered as described below.

As shown in FIG. 6, one of the Internet service utilizing systems is, for example, when a user terminal 51 having a mail account with a provider 53 in the suburbs of Tokyo uses e-mail from a business trip destination, for example, Hokkaido.
It connects to another provider 61 operated near Hokkaido and acquires an IP address from the provider 61.

The IP address assigned to the user terminal 51 is the provider 53 operating the mail server 57.
Since it is not assigned by the other provider 61 but assigned by another provider 61, it is necessary to confirm the user's legitimacy by some method when using the mail server 57.

As a method of confirming the validity, the mail server 57 prompts the user to enter a user ID and a password when receiving an electronic mail, and determines the validity when the user ID and the password are entered. Method {POP (P
ost Office Protocol) Before SMTP (Simple Mai
l Transfer Protocol) and a method in which the mail server 57 requests an authentication request when sending an e-mail (SMTP
Authentication). Many providers use POP
Before SMTP is adopted, and SMTP Authentication
However, the method is not yet fully supported by the program, and its adoption is low.

According to this POP Before SMTP method, it is possible to send an e-mail only for a predetermined time after the e-mail has been authenticated. However, depending on the reception processing program, the e-mail is authenticated. Log information may or may not be recorded.

As a result, when the authentication log information is not recorded, it is unknown which user the mail server 57 has authenticated, and there is a problem that even if the mail server 57 is illegally used, it cannot be traced later.

On the other hand, when the authentication log information is recorded, it is possible to know which user has used the authentication log information, but whether the user is actually connected to the network or the recording state of another provider 61. I don't know unless I check. However, it is very difficult to receive information from another provider 61 due to the confidentiality of communication.

Next, another internet service utilizing system for utilizing via the internet is shown in FIG.
As shown in (1), a system in which a telecommunications carrier installs a carrier having a large number of access points as part of a wide area telecommunications service and lends it to each provider. This is because in the case where the provider 53 manages the access point 54 by itself, it is not worth the cost.
It can be said that this is a newly developed service utilization system.

This system is provided on the Internet 71.
Provider 72 for company A, which is internally networked, for example company B, which is also internally networked
A plurality of NAS (network access servers) 75, which are installed as a provider 73 for companies, for example, a mail server 74 owned by a university or the like, and are access points for lending to a provider 72 for companies A, a provider 73 for companies B, etc A carrier 75 having -1, 75-2, ... Is provided.

Company A user terminal 76, Company B user terminal 77
Is authenticated by the authentication servers 72a and 73a of the corresponding provider 72 for company A and provider 73 for company B, respectively, via the NAS 75-1 and 75-2 of the carrier 75, and the validity is authenticated by this authentication process. Then, the mail servers 72b and 73b are used to send and receive electronic mail. Reference numeral 78 is a company A user terminal.

[0018]

Among the systems using the Internet as described above, POPB
In the case of the system adopting the efore SMTP and the system adopting the carrier 75, the following problems have been pointed out.

First, in a system adopting POP Before SMTP, as described above, a receiving operation is performed before sending a mail, and a predetermined time (eg 10
Min) Although it is a mechanism that can send mail, there is a problem that mail transmission is rejected because a predetermined time has elapsed while writing mail after the receiving operation. In order to solve this inconvenience, the receiving operation is repeated every predetermined time,
You will be sending an email with the required content. However, it is troublesome in operation, and there are many demands for the user to avoid the operation somehow.

Therefore, systems using carriers that rent out access points have been highlighted.

This system is a mechanism for unconditionally accepting a mail transmission request from the user terminals 76, 77 to which the carrier 75 has been assigned an IP address and performing the required setting. In other words, if there is a mail transmission request from the user terminal 76 of company A and the user terminal 77 of company B, the carrier 75 sends to the user terminals 76 and 77 any one of the IP addresses pooled by itself. It is assigned unconditionally.

As a result, when a mail transmission request is received from the same carrier 75 under the IP address assigned by the same carrier 75, such as the user terminal 76 of company A and the user terminal 77 of company B, provider 72 for company A, Provider 73 for company B
Is unconditionally accepted, there is a problem that the user terminal 77 of company B illegally uses the mail server 72b of the provider 72 for company A and sends a mail.

The present invention has been made in view of the above circumstances, and provides a network service use permission system and a network service use permission method for properly using the mail of a group provider only for legitimate group users and relaying it to the network. The purpose is to do.

[0024]

Means for Solving the Problems (1) In order to solve the above problems, a network service use permission system according to the present invention includes a plurality of groups of user terminals that make network connection requests, and a group of user terminals. Group-enabled NAS that assigns one of its own global IP addresses when it receives a connection request
And a global I
When a NAS connection request is again received from the user terminal of the certain group to which the P address is assigned, it is confirmed that the user is a valid user, and the private IP address shared by the certain group is assigned to the user terminal VP.
This is a configuration provided with the certain group-compatible provider system having N devices.

With the above-described structure according to the present invention, when a network connection request is received from a user terminal belonging to a certain group, the carrier's group corresponding NAS is received.
One of the global IP addresses managed by the carrier itself
Assign one. Subsequently, if the same user terminal issues a VPN connection request to the provider system based on the identification data, the VPN device allocates a group-shared private IP address when it is determined from the identification data that the user is a valid user. IP assigned by carrier
Even if there is a mail transmission request under the address, the provider does not accept it unconditionally, and when it is a legitimate user of the group, it will relay using the mail server.

(2) Further, the network service use permission system according to the present invention is provided with a plurality of groups of user terminals that make a network connection request, and when a network connection request is received from a user terminal of a certain group, the carrier supports. A network service use permission system in which the provider system for a certain group performs a mail service after allocating one of the global IP addresses managed by the NAS itself to the requesting user terminal, the user terminal of the certain group. When the VPN connection request is received after the network connection request from the server, the VPN authentication server that authenticates whether the user is a valid user of the certain group, and the VPN authentication server authenticates the valid user. Shared by user terminals of a certain group And a VPN device for allocating a private IP address to the user terminal.

According to the present invention having the above-mentioned configuration, even if the global IP address is assigned by the network connection request, the user is authenticated by the VPN authentication server when passing through the VPN device and recorded as log information. By doing so, it is possible to easily understand which user is using the mail server in which time zone, and it is not necessary to illegally use the mail server to send mail.

(3) In the network service use permission method according to the present invention, when a network connection request is received from a user terminal of one of a plurality of groups, one of the global IP addresses managed by itself is assigned. The present invention is applied to a network service use permission system provided with a carrier that installs a group-compatible NAS and each group-compatible provider system,
When a network connection request is received from the user terminal of the certain one group through the NAS corresponding to the identification data, the first authentication server of the provider system corresponding to the group is authorized based on the identification data. A first authentication step of authenticating a user and notifying the group corresponding NAS when the user is a legitimate user; and a first IP address allocating step of allocating a global IP address managed by the carrier by the group corresponding NAS. After allocating this global IP address, the V
When the PN connection request is received, the first authentication server of the group-supporting provider system authenticates the user based on the identification data, and when the user is a legitimate user, the group-supporting provider system is authenticated. VPN installed
The device has a second authentication step of notifying the device, and a second IP address assigning step of assigning the private IP address shared by the user terminals of the certain group to the user terminal by the VPN device notified of by the legitimate user. Is the way.

By adopting the above method, the present invention records the usage time and which user is used as log information when authenticating each of the first authentication step and the second authentication step. It is possible to easily understand which user is using the mail server in which time zone, and it is possible to prevent the mail transmission by illegally using the mail server.

[0030]

BEST MODE FOR CARRYING OUT THE INVENTION Embodiments of the present invention will be described below with reference to the drawings.

FIG. 1 is a system configuration diagram showing an embodiment of a network service use permission system according to the present invention.

This system is provided with the Internet 1 which is a collection of computer networks, and the Internet 1 is provided with an internally networked provider 2 for company A (group) and the like, which also provides an Internet connection service. For example, a provider 3 for company B (group) internally networked, a number of other company providers (not shown), and routers (not shown), for example, universities, research institutes, individuals, groups A mail server 4 owned by a company and a user terminal 5 of company A, for example, are connected.

Further, the Internet 1 is provided with NAS (Network Access Servers) 6-1, 6-2, ..., which are referred to as a number of access points by which a telecommunications carrier manages IP addresses as part of a wide area telecommunications service. For example, A that uses Company A's service or Company B's service
When there is a network connection request from the company user terminal 7 or the company B user terminal 8, the NAS (network access server) 6-1, 6-2, ... Corresponds to the group A user terminal 7 or company B A carrier 6 for allocating an IP address (global) is connected to the user terminal 8.

The provider 2 is a virtual private network (VPN) that uses a public network such as a private line.
Private Network) device 21, for example, a NAS authentication server 22 that authenticates whether or not a user is a legitimate user when there is a network connection request from A company user terminal 7 to NAS 6-1 and A company user terminal 7 From V to Provider 2 again
When there is a PN connection request, the VPN device 21 allocates a VPN IP address (private) that can be shared between the company A user terminals described below, but when passing through this VPN device 21, whether or not it is a company A user. A VPN authentication server 23 that authenticates whether or not a mail server 24 is provided. Other providers, for example, the provider 3 for company B also have similar configurations 31 to 34, but it goes without saying that the VPN authentication server 23 does not exist in the case of a provider (not shown) having no VPN device 21, for example. .

Here, the above-mentioned VPN will be described.

The VPN is a network that enables the computer 41 of the A network and the computer 42 of another B network to perform data communication as if they exist on the same network as shown in FIG. 2, in other words, A closed virtual network exists on a wide area network and means a network that enables mutual communication.

Although computers of different networks are assigned completely different IP addresses in this way, encapsulation is used to make it appear as if they exist on the same network. That is, as shown in FIG. 3, each computer 41,
Reference numeral 42 encapsulates a packet of an IP header having a virtual address for allowing it to exist on a virtual network in a packet consisting of an IP header having a unique IP address and a payload which is a real data portion, and sets a different network system. Tunnel between different networks and send an email. This is VPN.

Therefore, the VPN is usually used as a technique for tunneling between different networks, but the system of the present invention does not use the tunneling technique but uses the function of assigning an IP address. When there is a connection request from the user terminal 7, the VPN device 21 on the provider 2 side for the company A sends the IP address for the VPN shared between the user terminals of the company A to the user terminal 7 of the company A who has made the connection request. By assigning B
This is to prevent the company user terminal 8 from illegally using the mail server 24.

The NAS authentication server 22 uses the NAS from the user terminal 7 of company A before using the mail.
When the user ID and password are received through 6-1, it is a server that confirms whether or not the user is an authorized user from the user ID and password. The VPN authentication server 23 again uses the A company user terminal 7 to check the user ID and password. When a VPN connection request is made through the VPN device 21 based on the user ID and password, the server confirms whether the user is a valid user based on the user ID and password. Therefore, VP
When the N authentication server 23 authenticates a valid user, V
The PN device 21 allocates the IP address for VPN shared between the company A user terminals.

The mail server 24 relays the mail transmitted from the A company user terminal 7, and also the A company user terminal 7
It has a function to save emails addressed to it.

The NAS (network access server) 6-1, 6-2, ... Unconditionally accepts a connection request from the user terminals 7, 8 to which the carrier 6 has assigned an IP address. It has the function of setting. This means that the carrier 6, when there is a connection request for mail transmission from the A company user terminal 7 and the B company user terminal 8, selects one of the IP addresses pooled by itself. It is unconditionally assigned to the user terminals 7 and 8.

Next, the operation of the system as described above or the network service use permission method will be described with reference to FIG.

(1) For example, the company A user terminal 7 uses the dial-up connection service provided by the provider 2 or the constant connection service to make a connection request to the Internet 1 based on the user ID and password input ( S1: first network connection request step). From the providers 2 and 3 side, it can be said that this is a network connection request waiting step for receiving a connection request from a user. In this step, the user ID and password from the A company user terminal 7 pass through the NAS 6-1 and are sent to the provider 2.

(2) This provider 2 is NAS6-
User ID and password that pass 1 are NAS
And sends an authentication request to the user authentication server 22. This NAS
The user authentication server 22 stores and manages user IDs and passwords corresponding to the user terminals 7 of company A and the user terminals 8 of company B in advance, and the user IDs passing through the NAS 6-1.
And receive the password, the managed user I
D and the password are referred to, and if there is data that matches the referenced user ID and password, the user is authenticated as a valid user and the information for identifying the A company user terminal 7 is recorded as log information. And, carrier 6
The relevant NAS 6-1 is notified that the user is an authorized user (S2: first authentication step).

(3) The NAS 6-1 which has received the notification that it is a legitimate user uses one of the IP addresses (global) used on the Internet managed in advance as the connection request source. The line connection is completed by assigning it to the user terminal 7 of company A (S3: global IP address assigning step).

(4) Here, the company A user terminal 7 again issues a VPN connection request to the VPN device 21 of the provider 2 based on, for example, the input of the user ID and password (S4: VPN connection request step). ). From the viewpoint of the providers 2 and 3, it can be said that this is a VPN connection request waiting step for receiving a VPN connection request from a user.

(5) The VPN device 21 uses the user ID and password sent from the A company user terminal 7 as V
It is sent to the PN authentication server 23 to make an authentication request. This V
The PN authentication server 23 stores and manages the user ID and password corresponding to the user terminal 7 of company A in advance, and
When the user ID and password coming through the N device 21 are received, the user ID and password that are managed in advance are referred to, and if there is data that matches the referenced user ID and password, the user is an authorized user. At the same time as the authentication, the information for identifying the A company user terminal 7 is recorded as log information, and the VPN device 21 is notified that the user is an authorized user (S5: second authentication step). Naturally, if the user terminal 8 of company B tries to enter the provider 2 for company A, the user authentication by the VPN authentication server 23 will fail.

(6) Upon receiving the notification that the user is an authorized user, the VPN device 21 uses the IP address (private) for the VPN shared between the user terminals of the A company by the A company that has made the VPN connection request. By assigning it to the worker terminal 7,
The VPN connection is completed (S6: private IP address allocation step).

As described above, for the user terminal 7 of company A,
Allocating the VPN IP address shared between the user terminals of the company A actually means, for example, that a mail transmission request comes to the mail server 24 with the global IP address.
When it enters the VPN device 21 of the provider 2 for company A, it becomes a private IP address to be encapsulated. That is, the private IP address is encapsulated in the global IP address.

Therefore, for example, by providing the VPN device 21 in the provider 2, the user terminal is identified from the private IP address of each company A and company B, and the mail server 24 can be used. The mail server 24 is not used illegally and relayed to another user terminal via the Internet 1.

Therefore, according to the above embodiment, the VPN device 21 and the VPN are provided to the providers for each company.
Since the authentication server 23 for VPN is provided, even if the carrier 6 allocates the IP address for each company managed by itself, the VPN authentication server 23 authenticates whether it is a valid user without accepting it unconditionally. If the user is a legitimate user, a virtual IP address shared by the relevant company is allocated, so that, for example, the user terminal of company B, for example, 8 illegally uses the mail server 24 of the provider 2 for company A, In addition, it is possible to avoid sending unsolicited emails.

When the user is authenticated by the VPN authentication server 23, the usage time and which user is stored can be stored as log information, so that it is easy to know who used the mail server 24 in which time zone. Therefore, it is possible to identify the sender even when a spam mail is sent.

In the VPN device 21, the global I
Since the private IP address assigned by the VPN device 21 is encapsulated in the P address, as long as it is a user terminal of the same company on a different network, it can be shown as if it exists on the same network and perform mail communication. .

The invention of the present application is not limited to the above-mentioned embodiment, and various modifications can be carried out without departing from the scope of the invention. Further, the respective embodiments can be implemented in combination as much as possible, and in that case, the effect of the combination can be obtained. Furthermore, each of the above-described embodiments includes various inventions of higher and lower stages,
Various inventions can be extracted by appropriately combining a plurality of disclosed constituent elements. For example, when the invention is extracted by omitting some of the constituent elements from all the constituent elements described in the means for solving the problem, the omitted part when implementing the extracted invention. Are appropriately supplemented by well-known techniques.

[0055]

As described above, according to the present invention, it is possible to provide the network service use permission system and the network service use permission method for properly using and relaying the mail of the provider for the group only for the legitimate group users.

[Brief description of drawings]

FIG. 1 is a system configuration diagram showing an embodiment of a network service use permission system according to the present invention.

FIG. 2 is a diagram illustrating an example in which computers in completely different networks perform data communication.

FIG. 3 is a diagram illustrating an example in which computers use a public network like a private line.

FIG. 4 is an operation sequence diagram illustrating an operation of the system of the present invention and a network service use permission method according to the present invention.

FIG. 5 is a system configuration diagram of a network for explaining mail transmission / reception by a conventional dial-up connection.

FIG. 6 is a system configuration diagram of a network for explaining mail transmission / reception via the conventional Internet.

FIG. 7 is a system configuration diagram of a network that also uses conventional Internet use and describes mail transmission / reception by assigning an IP address by a carrier.

[Explanation of symbols]

1 ... Network 2 ... Provider for company A (group) 3 ... Provider for company B (group) 6 ... Carrier (6-1, 6-2, ...: NAS) 7 ... Company A user terminal 8 ... Company B user terminal 21, 31 ... VPN device 22, 32 ... NAS authentication server 23, 33 ... VPN authentication server 24, 34 ... Mail server

Claims (5)

[Claims] 1. A carrier provided with a plurality of groups of user terminals that make network connection requests and a group-corresponding NAS that allocates one of the global IP addresses managed by itself when a network connection request is received from a user terminal of a certain group. When a NAS connection request is again received from the user terminal of the certain group to which the global IP address is assigned by this carrier based on the identification data, it is confirmed that the user is an authorized user, and the certain group is shared. VPN that assigns a private IP address to the user terminal
A network service use permission system including a group-compatible provider system provided with devices. 2. A plurality of groups of user terminals that make a network connection request are provided, and when a network connection request is received from a user terminal of a certain group, the corresponding NAS in the carrier manages the global I.
In a network service use permission system that assigns one of P addresses to a requesting user terminal and performs a mail service, if a VPN connection request is received following the network connection request from the user terminal of the certain group, the certain group Authentication server for authenticating whether the user is a legitimate user, and when the VPN authentication server authenticates the legitimate user, the private IP address shared by the certain group is assigned to the user terminal V.
A network service use permission system comprising a group-compatible provider system provided with a PN device. 3. The network service use permission system according to claim 1 or 2, wherein when the group compatible provider system receives a network connection request from a user terminal of the certain group, the user terminal is authorized. A NAS authentication server that authenticates whether the user is a valid user, notifies the corresponding NAS when authenticating a valid user, and prompts allocation of the global IP address;
A network provided with a mail server that, after allocating an address and the private IP address, relays a mail transmitted from the user terminal of the certain group to another user terminal of the certain group on the Internet. Service permission system. 4. The network service use permission system according to claim 1, wherein the relationship between the global IP address and the private IP address is that the private IP address corresponds to the global IP address. A network service use permission system, which encapsulates mail and relays a mail transmitted from the user terminal of the certain group to another user terminal of the certain group on the Internet. 5. When a network connection request is received from a user terminal of one of a plurality of groups,
In a network service use permission system provided with a carrier that installs a group-compatible NAS that allocates one of the global IP addresses that it manages and a provider system that supports each group, identification data from the user terminal of the certain one group When a network connection request is received through the NAS corresponding to
Authentication server authenticates the user based on the identification data, and when the user is a valid user, the group correspondence N
A first authentication step of notifying the AS, a first IP address allocation step in which the group corresponding NAS allocates a global IP address managed by the carrier, and a user of the one group after allocation of the global IP address VPN from the terminal based on the identification data
When the connection request is received, the first authentication server of the group corresponding provider system authenticates whether the user is a valid user based on the identification data, and when the user is a valid user, the first authentication server is installed in the group corresponding provider system. A second authentication step of notifying the VPN device, and a second IP address assigning step of assigning the private IP address shared by the certain group to the user terminal by the VPN device notified of by the legitimate user. Characteristic network service usage permission method.