JP2004021761A - Authentication access control server device, authentication access control method, authentication access control program, and storage medium with the program stored therein - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To enable the access to a plurality of contents on a server by one authentication in the access to a virtual closed network. <P>SOLUTION: When the remote access to the virtual closed network is realized, an authentication mechanism which performs the processing of separating authentication function from gateway function, passing only the access request to a content permitted to pass by use of the gateway function, and performing authentication for other access requests by use of the authentication function to set passing permission to the gate way function is prepared. When a structure for realizing the single-sign-on authentication to a content on the server in the virtual closed network is adapted, the authentication for the access to the network is used also for the authentication for the access to the content on the server in the network. Accordingly, the access to a plurality of contents on the server is performed by one authentication. <P>COPYRIGHT: (C)2004,JPO

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention performs authentication for remotely accessing a virtual closed network constructed on a connectionless communication network from a remote place, realizes connection of a user terminal to the virtual closed network, and simultaneously establishes a connection in the virtual closed network. An authentication access control server device that collectively performs authentication for access to content on a plurality of servers to which the user has access authority; an authentication access control method used in the authentication access control server device; The present invention relates to an authentication access control program used for realizing the authentication access control method, and a recording medium recording the authentication access control program.
[0002]
[Prior art]
2. Description of the Related Art Conventionally, a virtual closed network has been introduced to construct a closed network that connects only a specific ground such as a corporate communication network. The virtual closed network in the connectionless communication network not only shares a transmission path and a transfer node but also shares a logical path and a logical line to perform transfer control with security.
[0003]
In addition, the virtual closed area network can receive remote access from a specific terminal or a specific user, instead of connecting only to a specific terminal. For example, an employee's home terminal can access a company's virtual closed network via a telephone network or an ADSL network or the like and connect to a company's host computer. A remote access server is installed between a telephone network or the like and a virtual closed network, and a terminal connects to the remote access server by dial-up or the like to access the virtual closed network.
[0004]
The network includes a transfer node that connects the remote access server and the virtual closed network, and a closed network group control server that controls the remote access server and the transfer node, and is shared by a plurality of virtual closed network users.
[0005]
The present applicant has previously filed Japanese Patent Application No. 2000-380838 (not disclosed) to make the physical line between a remote access server and a forwarding node available to a plurality of virtual closed networks, thereby making it possible to install equipment. We have applied for an invention to improve utilization efficiency.
[0006]
In this prior invention, the remote access server assigns a virtual router (hereinafter, VR: Virtual Router) for each virtual closed network based on a connection request from a user, and connects the VR to one physical line. Like that. Then, upon disconnection from the user, the remote access server releases the VR and allocates it to a user of another virtual closed network.
[0007]
On the other hand, the applicant of the present application has disclosed in Japanese Patent Application No. 2002-71277 (not disclosed) that a connection environment to a communication network represented by a virtual closed network is prepared, and An invention in which an authentication access control server device and a gateway device are installed in a network as a method for enabling access to contents on a plurality of connected servers with one authentication (hereinafter, referred to as single sign-on). Filed.
[0008]
In the prior invention, as shown in FIG. 11, a gateway function is cut out from a conventional reverse proxy type authentication access control server, and based on information (URL or the like) for identifying a content in addition to an address and a port number. Separated into a dedicated gateway device that can perform packet filtering hardware processing and an authentication access control server device that performs authentication control, and authenticates only access requests addressed to servers that do not have an entry permitted to pass through the gateway device By transferring the data to the access control server, concentration of the load on the authentication access control server can be avoided.
[0009]
[Problems to be solved by the invention]
When a user accesses a virtual closed network from a remote place, usually, after connecting to the virtual closed network, it is conceivable to access a server in the virtual closed network in order to perform some business.
[0010]
At this time, once connected to the virtual closed network, single sign-on to content on a server in the virtual closed network is possible by applying Japanese Patent Application No. 2002-71277, which is a prior invention, Since separate authentication is required for access to the closed network itself, more than one authentication is required for the user to access the server in the virtual closed network by remote access. Is not enough.
[0011]
The present invention has been made in view of such a problem, and in remote access to a virtual closed network, authentication is performed only once when accessing the virtual closed network, without impairing security strength, and the virtual closed network is not lost. It is an object of the present invention to realize a system that does not require a user to take a further authentication procedure for content on a server in a network to which a user has access authority.
[0012]
[Means for Solving the Problems]
The authentication access control server device of the present invention comprises an authentication access control server device, a gateway, a transfer node, and a remote access server, and allows a user terminal to connect to a virtual closed network from a remote place via the remote access server and the transfer node. After being connected, it is used in an authentication access control system that authenticates a request for access to content in a virtual closed network issued from a user terminal.
[0013]
In order to realize the present invention, the authentication access control server device of the present invention receives (1) a connection request to a virtual closed network from a user terminal via a remote access server, and performs authentication in connection to the virtual closed network. Means for receiving necessary information from the user terminal, and (2) a communication between the user terminal and the virtual closed network to the remote access server and the transfer node based on a result of the authentication using the received information. Means for connecting the user terminal and the virtual closed network by dynamically setting the connection path; and (3) the user is authorized to access the virtual closed network by authenticating the connection to the virtual closed network. Of a group of contents that are permitted to be simultaneously authenticated from among the group of contents that have an authentication function. (4) means for obtaining authentication of the contents, (4) means for receiving the access request when the access request to the content is not set in the gateway, and (5) access request. Means for acquiring information necessary for authentication of a content group to which the simultaneous authentication to which the content belongs is not permitted only in the case of a first access request from the user terminal to the content group, and {circle around (6)} using the acquired information. Means for executing authentication for the content group to which the simultaneous authentication to which the access request content belongs is not permitted, and obtaining authentication for the content under the content group owned by the content server having no authentication function; To a content server with an authentication function that holds A means for obtaining authentication by requesting authentication by designating information necessary for the certificate; and (8) means for setting entry information indicating permission of an access request to the authenticated content in the gateway. Constitute.
[0014]
When employing this configuration, the authentication access control server device of the present invention may further include a unit for invalidating the entry information set in the gateway when a prescribed state is reached.
[0015]
The authentication access control method realized by the operation of the authentication access control server device of the present invention can be specifically realized by a computer program. It can be provided by being recorded on a recording medium.
[0016]
Next, an example of the flow of the authentication processing of the present invention configured as described above will be described.
[0017]
The authentication access control server device of the present invention configured as described above, when a connection request to the virtual closed network is issued, acquires authentication information necessary for accessing the virtual closed network from the user terminal. Then, based on that, authentication of access to the virtual closed network is performed.
[0018]
When this authentication is obtained, the authentication access control server device of the present invention specifies a content group for which the authentication and the authentication are shared, and determines the content under the content group that is owned by the content server having no authentication function. Assuming that the authentication has been obtained, entry information indicating permission of an access request to the content is set in the gateway.
[0019]
Thereafter, since the entry information is set, an access request (access request from the authenticated user) to the content under the above-mentioned group of contents that is also used for authentication and held in the content server having no authentication function will be described. Will not be forwarded from the gateway.
[0020]
On the other hand, when an access request to the content is issued from the user terminal and the entry information relating to the content is not set in the gateway, the access request is transmitted to the authentication access control server apparatus of the present invention. In response to the transfer, the authentication access control server device of the present invention determines whether the access request is the first access request to the content group to which the content to which the content belongs (first access request from the user). Then, when it is determined that this is the first access request, information necessary for authentication of the content group (information defined for each user and content group) is obtained from the user terminal.
[0021]
Subsequently, the authentication access control server device of the present invention performs authentication on the content group to which the access request content belongs by using the information necessary for the obtained authentication, whereby the content is held by the content server having no authentication function. Then, authentication is performed on the contents under the contents group, and entry information indicating permission of an access request to the contents is set in the gateway.
[0022]
Since the entry information has been set, access requests (access requests from authenticated users) to the contents under the content group held in the content server having no authentication function are set by the gateway. Will no longer be forwarded.
[0023]
When the first access request is an access request to a content held by a content server having no authentication function, the authentication access control server device of the present invention sets the entry information so that the first access request Finish setting the entry information for the gateway.
[0024]
On the other hand, the authentication access control server device of the present invention, when the first access request is an access request to the content held in the content server having the authentication function, when the authentication for the content group is obtained, In response to a request from the content server, specify information necessary for authentication of the content (information defined for each user and content and held inside the authentication access control server device). By making an authentication request to the content server, the content is authenticated, and entry information indicating permission of an access request to the content is set in the gateway.
[0025]
Thereafter, since the entry information is set, an access request to the content (an access request from the authenticated user) is not transferred from the gateway.
[0026]
Then, when an access request for another content under the same content group issued after the first access request is transferred, the authentication for the content group has already been completed, so that the content is retained. In response to a request from the content server, specify information necessary for authentication of the content (information defined for each user and content and held inside the authentication access control server device). By making an authentication request to the content server, the content is authenticated, and entry information indicating permission of an access request to the content is set in the gateway.
[0027]
Thereafter, since the entry information is set, an access request to the content (an access request from the authenticated user) is not transferred from the gateway.
[0028]
By setting the entry information in the gateway in such a manner, the access request to the content is not transferred to the authentication access control server device of the present invention, but the connection relationship between the user terminal and the content server is changed. Leaving it as is is not preferable for security.
[0029]
Therefore, when the user terminal is disconnected from the virtual closed network, the authentication access control server device of the present invention performs processing so as to invalidate all entry information relating to the user terminal set in the gateway.
[0030]
Further, the authentication access control server device of the present invention transmits the program to the user terminal in association with the authenticated content group, and when a response from the program disappears for a certain period of time, the authentication set in the gateway. There is a case where processing is performed to invalidate all entry information on the content under the content group according to the user terminal.
[0031]
Also, the authentication access control server device of the present invention transmits a program to the user terminal in association with the authenticated content group, and when the program issues an authentication invalidation instruction, the authentication access control server device transmits the program to the gateway. In some cases, processing is performed to invalidate all entry information on the content under the content group for the set user terminal.
[0032]
Further, the authentication access control server device of the present invention, when a certain period of time has passed since the authentication of the content group authenticated in response to the access request from the user terminal, the user In some cases, processing is performed to invalidate all entry information for content under the content group.
[0033]
Here, in order to execute the invalidation processing, the authentication access control server device of the present invention performs processing to record what entry information is set in the gateway.
[0034]
As described above, according to the present invention, when remote access to the virtual closed network is realized, the authentication function and the gateway function are separated, and only the access request to the content permitted to pass through using the gateway function is performed. By providing an authentication mechanism that performs authentication using the authentication function for other access requests and sets pass permission for the gateway function. When adopting a configuration that implements single sign-on authentication on the other hand, authentication for access to the virtual private network is also used as authentication for access to content on servers in the virtual private network. User, the user can efficiently perform business without requiring a separate authentication procedure from servers in the virtual private network. An effect that can be obtained.
[0035]
BEST MODE FOR CARRYING OUT THE INVENTION
Hereinafter, the present invention will be described in detail according to embodiments.
[0036]
FIG. 1 shows an embodiment of a system configuration for realizing the present invention.
[0037]
As shown in FIG. 1, an authentication access control system 1 for realizing the present invention includes an authentication access control server device 2, a gateway 3, a transfer node 4, and a remote access server 5 configured according to the present invention. Reference numeral 3 has a packet filtering function based on an IP address, a port number, and a content URL (Uniform Resource Locator).
[0038]
When adopting this configuration, it is assumed that the user 7 accesses the virtual closed network 8 from the user terminal 6 by dial-up from a remote place. There are two content groups 11 and 12 to which the access right 7 has an access right. Access to these two content groups 11 and 12 requires separate authentication, and the content group 11 is authenticated by authenticating the connection to the virtual closed network 8. Access authentication.
[0039]
The content group 11 is composed of contents 13 and 15, the content group 12 is composed of contents 14 and 16, the content server 9 has an authentication function, and the content server 10 has no authentication function.
[0040]
The authentication access control server device 2 includes a virtual private network access authentication table 20, a content group access authentication table 21, and a content access authentication table 22 in order to execute an authentication process characteristic of the present invention.
[0041]
FIG. 2 illustrates an embodiment of the virtual closed network access authentication table 20, FIG. 3 illustrates an embodiment of the content group access authentication table 21, and FIG. The example of an embodiment is illustrated.
[0042]
The virtual closed network access authentication table 20 manages authentication information required for each user to remotely access each virtual closed network.
[0043]
Specifically, as shown in FIG. 2, in association with each user identification number, it is determined whether each virtual closed network has an access right, and whether the virtual closed network has an access right. Manages authentication information (pair data of a user ID and a password) necessary for the access.
[0044]
For example, the user 7 having the user identification number “001” has an access right for the virtual closed network x, and the authentication information has such a value, while the user 7 has an access right for the virtual closed network y. It manages information that does not exist.
[0045]
On the other hand, the content group access authentication table 21 is defined for each user in the virtual private network, authentication information required for the user to access each content group in the virtual private network, and virtual information on the content group. It manages information indicating whether authentication is also performed by authentication at the time of login to the closed network, and information indicating whether access to the content group has been authenticated.
[0046]
Specifically, as shown in FIG. 3, for each user, authentication information (pair data of a user ID and a password) necessary for accessing the content group is associated with each content group, and the content It manages information indicating whether or not the group is also used for authentication at the time of login to the virtual closed network, and information indicating whether or not access to the content group has already been authenticated. .
[0047]
For example, the authentication information required when the user 7 with the user identification number “001” accesses the content group 11 is such a value, and the access to the content group 11 is performed when logging in to the virtual closed network. The information is also managed by authentication, and information such as authentication of access to the content group 11 has not been performed yet is managed.
[0048]
On the other hand, the content access authentication table 22 is defined for each content, and the identification information of the content group to which the content belongs, the identification information of the content server holding the content, and the content server authenticating the content to access the content. Is required or not, and when authentication is required, information necessary for the authentication (pair data of a user ID and a password) is managed.
[0049]
Specifically, as shown in FIG. 4, in association with each content, the name of the content group to which the content belongs, the name of the content server holding the content, and the content server holding the content require authentication. Or not, and if authentication is required, manages authentication information (pair data of a user ID and a password) required for the authentication.
[0050]
For example, the content 13 belongs to the content group 11, is held by the content server 9, and the content server 9 requires authentication, and the authentication information for the user 7 with the user identification number "001" has such a value. It manages information such as
[0051]
In the present invention, as described above, the function of implementing single sign-on for content on a server in the virtual closed network is added to the closed network group control server for accessing the virtual closed network, thereby realizing the present invention. An authentication access control server device 2 constructed according to the present invention is constructed so that access to a virtual closed network is permitted and, at the same time, access permission to those contents can be obtained.
[0052]
To briefly explain the authentication processing executed by the authentication access control server device 2 of the present invention, the authentication access control server device 2 of the present invention is a virtual closed network from the user terminal 6 via the remote access server 5. When receiving the access request, first, it requests the user terminal 6 for information necessary for authentication of access to the virtual closed network 8.
[0053]
Upon receiving the authentication information transmitted in response to the request, the authentication is performed by checking the authentication information registered in the virtual private network access authentication table 20. If the authentication is successful, the remote access server A connection path from the user terminal 6 to the virtual private network 8 is established for the transfer node 5 and the transfer node 4.
[0054]
Further, a content group that the user 7 is permitted to authenticate at the same time as logging in to the virtual private network 8 is searched from the content group access authentication table 21, and the contents under the content group are authenticated for virtual private network access. And the gateway 3 sets entry information for permitting access to the content held by the content server having no authentication function.
[0055]
Thereafter, when the user 7 attempts to access content that requires authentication at the content server, the user 7 searches the content access authentication table 22 to obtain authentication information, specifies the authentication information, and specifies the authentication information to the content server. The authentication is obtained by requesting the authentication, and entry information for permitting access to the content is set in the gateway 3.
[0056]
Then, for a content group for which authentication at the same time as the virtual closed network login is not permitted, after the user logs in to the virtual closed network, the first access request to the content in the content group is triggered, and the user terminal 6 , And authenticates by comparing the authentication information registered in the content group access authentication table 21 with the authentication information registered in the content group access authentication table 21. Set the entry information that permits access to.
[0057]
Next, the authentication processing executed by the authentication access control server device 2 of the present invention will be described in detail according to the flow of the processing shown in FIGS.
[0058]
(1) Processing when user 7 attempts to access virtual closed network 8
FIG. 5 and FIG. 6 show processing when the user 7 attempts to access the virtual closed network 8 by dial-up.
[0059]
When a remote connection by dial-up is attempted from the user terminal 6 to the virtual closed network 8 via the telephone network, access to the virtual closed network 8 is established after a communication path between the user terminal 6 and the remote access server 5 is established. As a request, pair data of a user ID and a password required for authentication is transmitted to the remote access server 5 (step 101).
[0060]
The remote access server 5 transmits the access request to the authentication access control server device 2 and requests authentication (step 102).
[0061]
The authentication access control server device 2 authenticates the received access request by referring to the virtual closed network access authentication table 20 (step 103), and transmits the authentication result to the user terminal 6 via the remote access server 5. (Steps 104 and 105).
[0062]
If the authentication is successful, the authentication access control server device 2 refers to the content group access authentication table 21 and, at the same time, logs in to the virtual closed network 8 of the content group to which the user 7 has access right. A content group (the content group 11 in the present embodiment) for which the authentication is permitted is specified, and the authentication is performed by the content server that belongs to the content group 11 on the content servers 9 and 10 with the user terminal 6 as a transmission source. The entry information is set in the gateway 3 so as to pass a packet having a destination (content 15 in the present embodiment) that does not require a destination (step 106).
[0063]
Further, the authentication access control server device 2 transmits a Java applet (Java is a registered trademark) to the user terminal 6 in order to determine whether or not the browsing of the content by the user 7 has been completed (step S1). 107).
[0064]
Thereafter, according to the corresponding entry information set in the gateway 3, all the contents (contents 15 in the present embodiment) belonging to the contents group 11 which do not require authentication by the contents server are authenticated by the authentication access control server device 2. (Steps 108 and 109).
[0065]
When an access request is issued from the user terminal 6 to a content belonging to the content group 11 and requiring authentication by the content server (the content 13 in this embodiment), the corresponding entry information is set in the gateway 3. Since the access request has not been made, the access request is transferred to the authentication access control server device 2 (step 110).
[0066]
The authentication access control server device 2 specifies the content group to which the content of the access request belongs by searching the content access authentication table 22, and searches the content group access authentication table 21 using the content group as a key. It determines that the authentication for the content group 11 to which it belongs has been completed, and immediately transmits an access request to the content server 9 (content server holding the content 13) (step 111).
[0067]
In response to the access request, the content server 9 issues a password request for access to the content 13 (step 112), and the authentication access control server device 2 searches the content access authentication table 22 in response to the request. Then, the corresponding data of the user ID and the password is acquired and transmitted to the content server 9 (step 113).
[0068]
Further, the authentication access control server device 2 sets the entry information to the gateway 3 so as to pass the packet having the user terminal 6 as the transmission source and the content 13 as the transmission destination (step 114).
[0069]
The content server 9 performs authentication based on the user ID and the password received from the authentication access control server device 2 (step 115), and transmits the requested content (steps 116 and 117).
[0070]
After that, according to the corresponding entry information set in the gateway 3, the content file access request addressed to the content 13 from the user terminal 6 is transmitted directly to the content server 9 without passing through the authentication access control server device 2. (Steps 118 and 119).
[0071]
For a content group 12 for which authentication at the same time as login to the virtual closed network 8 is not permitted, a password is input at the first access to the content belonging to the content group 12 (contents 14 and 16 in the present embodiment). After that, since the processing corresponding to steps 106 to 119 described above is performed, the user 7 is not required to obtain a new password for the content in the content group 12.
[0072]
Next, the authentication processing executed by the authentication access control server device 2 described above will be summarized according to the processing flows shown in FIGS. 7 to 9.
[0073]
The authentication access control server device 2 receives pair data of a user ID and a password required for authentication from the remote access server 5 in response to a remote connection request to the virtual closed network issued by the user terminal 6. First, as shown in the processing flow of FIG. 7, the authentication is received in step 10 and the authentication registered in the virtual private network access authentication table 20 having the data structure shown in FIG. The access request is authenticated with reference to the information.
[0074]
Subsequently, in step 12, it is determined whether or not the authentication has succeeded. When it is determined that the authentication has not succeeded, the process proceeds to step 13, in which an authentication failure is returned to the remote access server 5, and The process ends.
[0075]
On the other hand, when it is determined in step 12 that the authentication has succeeded, the process proceeds to step 14 and the user 7 has the access right by referring to the content group access authentication table 21 having the data structure shown in FIG. In addition, a content group that permits simultaneous authentication with the virtual network of the access request destination is specified.
[0076]
Subsequently, in step 15, the identified content group is authenticated in the content group access authentication table 21. That is, it is considered that the authentication has been performed by the authentication of the access request to the virtual closed network, and the fact that the specified content group has been authenticated is recorded in the content group access authentication table 21.
[0077]
Subsequently, in step 16, referring to the content access authentication table 22 having the data structure shown in FIG. 4, the content held by the content server having no authentication function is specified from the specified content group.
[0078]
Subsequently, in step 17, entry information indicating permission to pass the access request to the specified content is set in the gateway 3, and in the following step 18, the Java applet is transmitted to the user terminal 6 which issued the access request. Send it and end the process.
[0079]
In this manner, the authentication access control server device 2 responds to the remote connection request to the virtual private network issued by the user terminal 6 and, in response to the request for access to the virtual private network, authenticates the content group. In order to prevent the access request to the content under the content group held in the content server having no authentication function from being transferred from the gateway 3, the gateway 3 Processing is performed so as to set entry information indicating permission to pass the access request.
[0080]
On the other hand, when the access request is transferred from the gateway 3 because the entry information indicating the passage permission is not set, first, as shown in the processing flow of FIG. 8 and FIG. Next, in step 20, the content group to which the access request content belongs is specified with reference to the content access authentication table 22 having the data structure shown in FIG.
[0081]
Subsequently, in step 21, it is checked with reference to the content group access authentication table 21 having the data structure shown in FIG. 3 whether or not the specified content group has been authenticated.
[0082]
Subsequently, in step 22, it is determined whether or not it has been authenticated by this check, and when it is determined that authentication has not been completed, the process proceeds to step 23, where the user 7 performs a single sign-on Get the password for.
[0083]
Subsequently, in step 24, referring to the authentication information registered in the content group access authentication table 21 having the data structure shown in FIG. 3, based on the obtained single sign-on password, authentication is performed for the specified content group. Then, “authorized” is recorded in the content group access authentication table 21.
[0084]
Subsequently, in step 25, referring to the content access authentication table 22 having the data structure shown in FIG. 4, the content held by the content server having no authentication function is specified from the specified content group.
[0085]
Subsequently, in step 26, entry information indicating permission to pass the access request to the specified content is set in the gateway 3, and in the following step 27, the Java applet is transmitted to the user terminal 6 that issued the access request. Send.
[0086]
By the entry information setting process in step 26, the access request to the content held in the content server having no authentication function which has been authenticated by single sign-on is transferred from the gateway 3 thereafter. There is no.
[0087]
Subsequently, in step 28, the access request is transferred to the content server holding the access request content in order to process the access request transferred from the gateway 3.
[0088]
Subsequently, in step 29, it is determined whether or not the content server holding the access request content has the authentication function. If it is determined that the content server does not have the authentication function, the process proceeds to step 30, and step 28 is performed. The content transferred from the content server in response to the transfer process is received and transferred to the user terminal 6, and the process ends.
[0089]
Thereafter, since the entry information is set in the gateway 3, the exchange between the user terminal 6 that issued the access request and the content server that does not have the authentication function and holds the content specified by the access request is performed. (The exchange of the contents) is not transferred to the authentication access control server device 2.
[0090]
On the other hand, when it is determined in step 29 that the content server holding the access request content has the authentication function, the process proceeds to step 31 in which the password of the password requested from the content server in response to the transfer process in step 28 is determined. The transfer request is received, and in subsequent step 32, the content server authentication is obtained by returning the pair data of the user ID and the password registered in the content access authentication table 22 having the data structure shown in FIG.
[0091]
Subsequently, in step 33, entry information indicating permission to pass the access request to the access request content is set in the gateway 3, and in step 34, the entry information is transferred from the content server having the authentication function to hold the access request content. The received content is transferred to the user terminal 6, and the process is terminated.
[0092]
After that, since the entry information is set in the gateway 3, the exchange between the user terminal 6 that issued the access request and the content server having the authentication function to hold the content specified by the access request ( The exchange of the content is not transferred to the authentication access control server device 2.
[0093]
On the other hand, when it is determined in step 22 that the content group to which the access request content belongs has been authenticated, the process proceeds to step 35, in which the access request is transferred to the content server holding the access request content. Then, the processing of steps 31 to 34 described above is performed, and the processing ends.
[0094]
That is, in step 22, determining that the content group to which the access request content belongs has been authenticated means that the content group has been authenticated according to the processing flow of FIG. 7 or the processing flow of FIG. Means that the content group has been authenticated in accordance with the processing of step 24 of the above. Therefore, the content server holding the access request content has an authentication function, and the gateway 3 has entry information related to the access request content. Is not set, the process proceeds to step 35, where the access request is transferred to the content server having the authentication function for holding the access request content, and then the processing of steps 31 to 34 described above is performed. To end the process. .
[0095]
In this way, when the access request is transferred from the gateway 3, if the content group to which the access request content belongs is not authenticated, the authentication access control server device 2 obtains the authentication information acquired from the user terminal 6. By performing single sign-on using, a request for access to content under the content group held by a content server having no authentication function is prevented from being transferred from the gateway 3. Processing is performed to set entry information indicating permission to pass the access request to the specified content.
[0096]
The content held by the content server having the authentication function is authenticated by requesting the content server for authentication when the access to the content is requested, and the access request to the content is transmitted to the gateway 3. Is processed so as to set entry information indicating permission to pass the access request to the content to the gateway 3 so as not to be transferred from the gateway.
[0097]
(2) Processing for disconnecting the user terminal 6 from the virtual closed network 8
When the user 7 disconnects the user terminal 6 from the telephone network in order to disconnect the user terminal 6 connected to the virtual closed network 8 from the virtual closed network 8, the authentication access control server device 2 is sent from the remote access server 5. , A signal indicating that the user terminal 6 has been disconnected is transmitted.
[0098]
Based on the signal, the authentication access control server device 2 invalidates the authentication of all the content groups in the virtual closed network 8 owned by the user 7 and deletes the corresponding pass-permitted entry information on the gateway 3.
[0099]
(3) Authentication invalidation processing by user's browser termination
After authenticating the user 7 for the content group 11 (or the content group 12), the authentication access control server device 2 transmits the resident program (here, a Java applet) transmitted to the user terminal 6 for a predetermined time. Communication is performed every time.
[0100]
When there is no response from the Java applet of the user terminal 6, the authentication access control server device 2 determines that the browsing of the content of the content group 11 (content group 12) by the user 7 has been completed, and In this case, all the entry information of the passage permission which is set to the user terminal 6 as the transmission source and the transmission destination is the content belonging to the content group 11 (the content group 12) is deleted.
[0101]
As a result, the authentication is invalidated, and an access request from the user terminal 6 to a content belonging to the content group 11 (content group 12) is required to be authenticated again via the authentication access control server device 2.
[0102]
(4) Authentication invalidation processing by user logout processing
As shown in FIG. 10, a resident program (here, a Java applet) transmitted to the user terminal 6 after authenticating the content group 11 (or the content group 12) of the user 7 is transmitted to the browser on the user terminal 6 as shown in FIG. Then, logout buttons 31 and 32 for instructing forced revocation of authentication are displayed.
[0103]
In response to the display of the logout buttons 31 and 32, the user terminal 6 sends the content to the authentication access control server device 2 when the user 7 clicks the logout button 31 (logout button 32). A packet for instructing the group 11 (content group 12) to forcibly revoke the authentication is transmitted.
[0104]
When the authentication access control server device 2 receives the packet, the access permission server device 2 previously set for the gateway 3 permits the user terminal 6 as the transmission source and the content belonging to the content group 11 (the content group 12) as the transmission destination. Delete all the entry information.
[0105]
As a result, the authentication is invalidated, and an access request from the user terminal 6 to a content belonging to the content group 11 (content group 12) is required to be authenticated again via the authentication access control server device 2.
[0106]
(5) Invalidation processing of authentication after a certain time elapses after authentication
The authentication access control server device 2 records the time at which the user 7 authenticates the content group 11 (or the content group 12). All the entry information of the passage permission which has the sender terminal 6 as the transmission source and the contents belonging to the content group 11 (the content group 12) as the transmission destination is deleted.
[0107]
As a result, the authentication is invalidated, and an access request from the user terminal 6 to a content belonging to the content group 11 (content group 12) is required to be authenticated again via the authentication access control server device 2.
[0108]
【The invention's effect】
As described above, according to the present invention, when remote access to a virtual closed network is realized, the authentication function and the gateway function are separated from each other, and the access request to the content permitted to pass through using the gateway function is performed. Only the content on the server in the virtual closed network is prepared by preparing an authentication mechanism that performs the process of passing only the access request and performing authentication using the authentication function for the other access requests and setting the passage function to the gateway function. When a configuration is adopted in which single sign-on authentication is implemented, authentication for access to a virtual private network is also used to authenticate access to content on servers in the virtual private network. The configuration allows users to work efficiently without requiring separate authentication procedures from servers in the virtual closed network. An effect that can be performed is obtained.
[Brief description of the drawings]
FIG. 1 is an embodiment of a system configuration for realizing the present invention.
FIG. 2 is an example of an embodiment of a virtual private network access authentication table.
FIG. 3 is an example of an embodiment of a content group access authentication table.
FIG. 4 is an example of an embodiment of a content access authentication table.
FIG. 5 is a diagram showing a processing flow in the embodiment.
FIG. 6 is a diagram showing a processing flow in the embodiment.
FIG. 7 is an embodiment of a processing flow executed in the present invention.
FIG. 8 is an embodiment of a processing flow executed in the present invention.
FIG. 9 is an embodiment of a processing flow executed in the present invention.
FIG. 10 is a diagram illustrating a screen image of a browser on a user terminal.
FIG. 11 is a diagram illustrating an authentication access control system according to the invention of the prior application.
[Explanation of symbols]
1 authentication access control system
2 Authentication access control server device
3 gateway
4 Forwarding node
5 remote access server
6 user terminals
7 Users
8 Virtual closed network
9 Content server
10 Content server
11 Contents
12 contents group
13 Contents
14 Contents
15 Contents
16 Contents
20 Virtual Private Network Access Authentication Table
21 Content group access authentication table
22 Content Access Authentication Table

Claims (10)

An authentication access control server device for authenticating an access request to content in a virtual closed network issued from a user terminal,
By performing the authentication required for the connection to the virtual closed network, means for obtaining the authentication of the content under the group of contents held by a server having no authentication function, the authentication and the authentication being shared,
When an access request is transferred to the gateway in the virtual closed network because access permission to the content is not set, a means for receiving the request,
The above-mentioned authentication is performed by acquiring information necessary for the authentication of the content group to which the access request content belongs from the user terminal only in the case of the first access request, and executing the authentication by targeting the content group for which the above-mentioned authentication is not permitted. Means for obtaining authentication for content under the content group held by a server having no
Means for obtaining authentication by requesting a server having an authentication function holding the access request content and designating information necessary for authentication of the content, and requesting authentication;
Means for setting entry information indicating permission of an access request to the authenticated content in the gateway,
Characteristic authentication access control server device. The authentication access control server device according to claim 1,
When a prescribed state is provided, a means for invalidating the entry information set in the gateway is provided.
Characteristic authentication access control server device. The authentication access control server device according to claim 2,
The invalidating means, when the user terminal is disconnected from the virtual closed network, to invalidate all entry information related to the user terminal set in the gateway,
Characteristic authentication access control server device. The authentication access control server device according to claim 2,
The invalidating means is configured to, when there is no response from the program transmitted to the user terminal in association with the authenticated content group for a certain period of time, for the content under the content group of the user terminal set in the gateway. Invalidating all entry information of
Characteristic authentication access control server device. The authentication access control server device according to claim 2,
The means for invalidating is, when an instruction for invalidating authentication is issued from a program transmitted to the user terminal in association with the group of authenticated contents, under the control of the content group for the user terminal set in the gateway. Invalidating all entry information for the content of
Characteristic authentication access control server device. The authentication access control server device according to claim 2,
The invalidating means is configured such that, when a predetermined time has elapsed from the authentication of the content group authenticated in response to the access request from the user terminal, the content under the content group of the user terminal set in the gateway is set. To invalidate all entry information for
Characteristic authentication access control server device. An authentication access control method for authenticating an access request to content in a virtual closed network issued from a user terminal,
By performing authentication required for connection to the virtual closed network, a process of obtaining authentication for content under a content group owned by a server having no authentication function and for which authentication and authentication are shared,
When an access request is transferred to the gateway in the virtual closed network because access permission to the content is not set, a process of receiving the request,
The above-mentioned authentication is performed by acquiring information necessary for the authentication of the content group to which the access request content belongs from the user terminal only in the case of the first access request, and executing the authentication by targeting the content group for which the above-mentioned authentication is not permitted. Obtaining authentication for the content under the content group held by the server having no server,
A process of obtaining authentication by designating information required for authentication of the content and requesting authentication to a server having an authentication function holding the access request content;
Setting entry information indicating permission of an access request to the authenticated content in the gateway,
An authentication access control method characterized by the following. The authentication access control method according to claim 7,
In a case where a prescribed state is reached, a step of invalidating the entry information set in the gateway is provided,
An authentication access control method characterized by the following. An authentication access control program for causing a computer to execute a process used to implement the authentication access control method according to claim 7. A recording medium storing an authentication access control program for causing a computer to execute processing used for implementing the authentication access control method according to claim 7.

Images