JP2005149337A - Gateway device - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a gateway device capable of controlling connection between a specific virtual network and a communication terminal that a user utilizes in accordance with the authentication result of the user. <P>SOLUTION: The gateway device is provided with; a user authorizing means 134 which connects one of a plurality of VLANs constituting an intra-company network 10 and the communication terminal which the user utilizes; an authentication information transmission/reception means 121 which receives authentication information for authenticating the user from the communication terminal 11; an authentication request means 132 which requests authentication to an authenticating server on an authentication network 20 in accordance with received authentication information; and an authentication response means 133 which receives authentication response information representing a response to the authentication request from the authentication server. When authentication response information shows successful authentication, the user authorizing means 134 connects a virtual network and and the communication terminal which the user utilizes in accordance with virtual network discrimination information for discriminating the virtual network corresponding to the user. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

  The present invention relates to a gateway device that is communicably connected to a terminal used by a user via a network and is communicably connected to another network.

  In recent years, in a corporate network used in a company, in order to reduce the management cost of the corporate network, an authentication server for authenticating a user or the like is not connected to the corporate network and is connected to an external network via a gateway device. Research and development of an authentication system that connects and entrusts user authentication to an external company is underway.

  For example, as shown in FIG. 24, a conventional authentication system that connects a corporate network and an external network includes a gateway device 920 equipped with a network 923 and a network address 913 that connects a network 913, and a network 923. The communication terminal 921a and the communication terminal 921b are connected, and the authentication proxy server 912 and the server 910 are connected to the network 913.

As the conventional authentication system described above, when a user logs in to the server 910a via the communication terminal 921a, connection information including a user ID and a password is transmitted to the authentication proxy server 912 via the gateway device 920, and the authentication proxy server 912 authenticates the transmitted connection information, and when the authentication is successful, the communication terminal 921a is notified to the user that the authentication is successful, and the server 910a or the server 910b can be logged in. (For example, refer to Patent Document 1).
JP 2002-123491 A (paragraph [0033], FIG. 2)

However, in the above-described system, the server 910 can be logged in according to the user authentication result. However, when the network 923 is configured by a plurality of virtual networks, the virtual network is determined according to the user authentication result. There remains a problem that control for connecting the communication terminal to the communication terminal cannot be performed.
The present invention has been made in order to solve the conventional problems, and provides a gateway device capable of controlling to connect a specific virtual network and a communication terminal used by a user according to a user authentication result. With the goal.

The gateway device according to claim 1 is communicably connected to a communication terminal used by a user via a first network, and is communicably connected to an authentication server for authenticating the user via a second network. In the gateway apparatus, virtual network connection means for connecting any one of a plurality of virtual networks constituting the first network and a communication terminal used by the user, and authentication information for authenticating the user Authentication information receiving means for receiving the authentication information from the communication terminal, authentication request means for requesting authentication to the authentication server in accordance with the authentication information received by the authentication information receiving means, and An authentication response means for receiving authentication response information representing a response, and received by the authentication response means When authentication response information indicates that the authentication is successful, the virtual network connection means includes the virtual network and a communication terminal used by the user according to virtual network identification information for identifying a virtual network corresponding to the user. Are connected.
With this configuration, when the authentication response information indicates successful authentication, the user connects the virtual network and the communication terminal used by the user according to the virtual network identification information for identifying the virtual network corresponding to the user. Control for connecting a specific virtual network and a communication terminal used by the user can be performed according to the authentication result.

The gateway device according to claim 2 is connected to the mediation device that mediates the communication terminal and the communication terminal so as to be communicable with each other via the first network, and the authentication information receiving unit is configured to communicate with the first network. The authentication information is received from the intermediary device that connects any one of the plurality of virtual networks constituting the communication terminal used by the user, and the authentication response information received by the authentication response means is the authentication The virtual network connection means has a configuration for connecting the virtual network corresponding to the user and the communication terminal used by the user to the mediation device.
With this configuration, since the intermediary device can be installed for each location for constructing the first network, the convenience for the user to connect to the network can be enhanced.

The gateway device according to claim 3, further comprising: available device information storage means for storing available device information representing the mediation device that can be used by the user, wherein the virtual network connection means is configured so that the user can use the mediation device. Is determined according to the available device information, and when it is determined that connection is possible, the virtual network and a communication terminal used by the user are connected to the mediation device.
With this configuration, whether the user can use the mediation device is determined according to the available device information, and when it is determined that the connection is possible, the virtual network and the communication terminal used by the user are connected to the mediation device. Thus, the use of the mediation device can be restricted.

The gateway device according to claim 4, further comprising usage time information storage means for storing usage time information indicating a usage time that can be used by the user, wherein the virtual network connection means allows the user to connect to the virtual network. Whether or not it is determined according to the use time information, and when it is determined that connection is possible, the virtual network and the communication terminal used by the user are connected.
With this configuration, whether or not the user can connect to the virtual network is determined according to the usage time information, and when it is determined that the user can connect, the virtual network is connected to the communication terminal used by the user. Use time can be limited.

6. The gateway device according to claim 5, further comprising virtual network identification information storage means for storing the virtual network identification information, wherein the virtual network connection means is a communication used by the virtual network indicated by the virtual network identification information and the user. It has the structure which connects with a terminal.
With this configuration, since the virtual network indicated by the virtual network identification information is connected to the communication terminal used by the user, the gateway device can select and connect the virtual network corresponding to the user.

The gateway device according to claim 6, wherein the authentication information includes virtual network identification information for identifying the virtual network, and the virtual network connection means includes the virtual network identification information included in the authentication information. And a communication terminal used by the user.
With this configuration, since the virtual network indicated by the virtual network identification information included in the authentication information and the communication terminal used by the user are connected, the user can select and connect the virtual network corresponding to the user.

The gateway device according to claim 7, further comprising permission information storage means for storing permission information for permitting connection to only the virtual network available to the user among the plurality of virtual networks. Network connection means determines whether or not the user can connect to the virtual network indicated by the virtual network identification information according to the permission information, and determines that the virtual network and the communication terminal used by the user when connecting is determined. It has the structure to connect.
With this configuration, whether or not the user can connect to the virtual network indicated by the virtual network identification information is determined according to the permission information, and when the connection is determined to be possible, the user connects the virtual network and the communication terminal used by the user. The virtual network that can be used can be limited.

The gateway apparatus according to claim 8, wherein the authentication information includes a certificate for proving the user, and the virtual network connection unit includes the virtual network and the certificate indicated by the virtual network identification information. And a communication terminal used by the user shown.
With this configuration, in order to connect the virtual network indicated by the virtual network identification information to the communication terminal used by the user indicated by the certificate, the virtual network is illegally used by falsely providing information for identifying the user. Can be prevented.

The gateway device according to claim 9, wherein the certificate includes permission information for permitting connection to only the virtual network that can be used by the user among the plurality of virtual networks. The network connection means determines whether or not the user indicated in the certificate can connect to the virtual network indicated by the virtual network identification information according to the permission information, and determines that the user can connect to the virtual network and the certificate. And a communication terminal used by the user shown.
With this configuration, the user indicated in the certificate determines whether or not the user can connect to the virtual network indicated by the virtual network identification information according to the permission information, and uses the virtual network and the user indicated in the certificate when determining that connection is possible. Since the communication terminal is connected, the virtual networks that can be used by the user can be restricted according to the certificate.

The gateway device according to claim 10, wherein inquiry information for receiving inquiry about the virtual network available to the user is received from the communication terminal, and inquiry information received by the inquiry information receiving means Accordingly, there is provided a configuration comprising virtual network identification information response means for returning virtual network identification information for corresponding to the user from the permission information storage means to a communication terminal used by the user.
With this configuration, the virtual network identification information is returned in response to an inquiry from the user. Therefore, even if the user does not know the virtual network identification information in advance, the connectable virtual network identification information can be notified to the user. When there are a plurality of pieces of network identification information, it is possible to connect to a virtual network desired by the user.

12. The gateway device according to claim 11, further comprising permission information storage means for storing permission information for permitting connection to only the virtual network that can be used by the user among the plurality of virtual networks. The apparatus notifies the communication terminal used by the user of information representing all virtual networks configured by the first network, and the communication terminal used by the user uses the virtual network based on the notified information. When the authentication information receiving unit receives authentication information including the virtual network list, the virtual network connection unit has a higher priority based on the virtual network list. Whether or not the user can connect in order from the virtual network is determined according to the permission information. Determining Te, the said virtual network when it is determined to be connectable users has a structure for connecting a communication terminal to use.
With this configuration, it is determined according to the permission information whether the user can connect in order from the virtual network with the highest priority based on the virtual network list to which the priority of the virtual network is given. Can connect to virtual network

  The present invention provides a gateway device capable of controlling to connect a specific virtual network and a communication terminal used by a user according to a user authentication result.

Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.
FIG. 1 is a system configuration diagram of an authentication system according to the first embodiment of the present invention.
As shown in FIG. 1, an authentication system 1000 includes a communication device 11a to a communication terminal 11d used by a user, and a gateway device 100 that relays information is connected to be communicable via an in-house network 10, and the gateway device 100 and an authentication server 21 for authenticating a user are connected via an authentication network 20 so that they can communicate with each other.

  Note that the communication terminals 11a to 11d may be mobile terminals capable of wireless communication, personal computers, or the like. Although four communication terminals 11 are shown in FIG. 1, the number is not limited. The in-house network 10 or the authentication network 20 may be wired or wireless. The in-house network 10 is a LAN or the like, and is not limited to a network used in a company. The in-house network 10 includes a plurality of virtual networks, and the virtual network includes, for example, a VLAN (Virtual Local Area Network) 31 and a VLAN 32. Hereinafter, the virtual network will be described as a VLAN.

  Further, the user a, the user b, the user c, or the user d may use any communication terminal 11. However, in this embodiment, for convenience of explanation, the user a uses the communication terminal 11a, the user b uses the communication terminal 11b, the user c uses the communication terminal 11c, and the user d communicates. It is assumed that the terminal 11d is used.

  When a user using the communication terminal 11 logs in to the VLAN, the communication terminal 11 transmits authentication information for authenticating the user to the gateway device 100. The gateway device 100 receives the authentication information transmitted from the communication terminal 11, and requests authentication from the authentication server 21 in accordance with the received authentication information.

  When the gateway device 100 makes a request for authentication, the authentication server 21 authenticates the user based on the authentication information, and the authentication response information indicating the result of the authentication and indicating the response to the authentication request is displayed on the gateway. The data is transmitted to the apparatus 100.

  The gateway device 100 receives the authentication response information transmitted from the authentication server 21, and when the received authentication response information indicates successful authentication, the gateway device 100 uses one of the VLAN 31 and the VLAN 32 and the communication terminal 11 used by the user. It comes to connect. The management terminal 12 displays authentication failure information and the like.

  FIG. 2 is a block diagram of the gateway device according to the first embodiment of the present invention. As shown in FIG. 2, the gateway device 100 is configured to include a database 110, a communication interface 120, a control unit 130, a log information storage unit 140, and a communication interface 150.

  The database 110 (usage time information storage means, virtual network identification information storage means) stores virtual network identification information for identifying the VLAN to which the user is connected and usage time information representing the usage time available to the user. It has become. An example of information stored in the database 110 is shown in Table 1. Hereinafter, the virtual network identification information will be described as a VLAN number.

  As shown in Table 1, for example, the user a is an employee of a managerial position, can use the VLAN 31, and has no restriction on the use time. The user b is a temporary employee, can use the VLAN 32, and can use it from 9:00 to 18:00. The user c is a member of the union member, can use the VLAN 31, and can use it from 9:00 to 22:00. Further, the user d is a visitor, can use the VLAN 32, and can use it from 9:00 to 18:00.

  The communication interface 120 is configured to communicate with the in-house network 10 and includes an authentication information transmission / reception unit 121 and a virtual network connection unit (HUB) 122.

  The authentication information transmission / reception means 121 communicates with the communication terminal 11 in conformity with an authentication protocol related to authentication such as EAP-TLS (PPP Extensible Authentication Protocol-Transport Layer Security). Further, the authentication information transmitting / receiving unit 121 receives authentication information for authenticating the user from the communication terminal 11 using a packet conforming to EAP-TLS. The virtual network connection means (HUB) 122 may be configured as a VLAN HUB, and connects one VLAN and the communication terminal 11 among a plurality of VLANs.

  The control means 130 is configured to include a CPU (Central Processing Unit) that processes a program, a memory that stores the program, and the like. The control unit 130 includes an authentication information analysis unit 131, an authentication request unit 132, an authentication response unit 133, a user authorization unit 134, and an authentication failure information transmission unit 135. These means may be program modules.

  The authentication information analysis unit 131 analyzes information including authentication information conforming to the authentication protocol received by the authentication information transmission / reception unit 121. For example, the authentication information analysis unit 131 analyzes authentication information such as a user identifier included in a packet conforming to EAP-TLS.

  The authentication request unit 132 makes an authentication request to the authentication server 21 in accordance with the authentication information analyzed by the authentication information analysis unit 131. For example, the authentication request unit 132 requests authentication by transmitting a packet including authentication information to the authentication server 21.

  The authentication response means 133 is information representing the result of authentication, and receives authentication response information representing a response to the authentication request from the authentication server 21 via the communication interface 150. For example, the authentication response means 133 may receive an Access-Accept packet, an Access-Challenge packet, or an Access-Reject packet that conforms to Radius (Remote Authentication Dial-In User Service). Note that a packet corresponding to an Access-Request packet serving as an authentication request is an Access-Challege packet serving as an authentication response, and an Access-Accept packet and an Access-Reject packet are packets for informing an authentication result.

  The user authorization unit 134 acquires the VLAN number corresponding to the user identifier included in the authentication information from the database 110 when the authentication response information received by the authentication response unit 133 indicates successful authentication. The VLAN corresponding to the VLAN number and the communication terminal 11 are connected to the HUB 122.

  Further, the user authorization unit 134 may acquire the usage time information corresponding to the user identifier from the database 110, and may determine whether the connection to the VLAN is possible according to the acquired usage time information. When it is determined that the connection is possible, the user authorization unit 134 connects the VLAN corresponding to the VLAN number and the communication terminal 11 to the HUB 122.

  For example, when authenticating the user a, the user authorization unit 134 acquires the VLAN number representing “31” corresponding to the user a and the usage time information from the database 110, and the acquired usage time information represents unlimited. Therefore, it is determined that the connection is possible, and the VLAN 31 and the communication terminal 11a are connected to the HUB 122.

  Further, when the authentication response information indicates a failure of authentication, the user authorization unit 134 outputs authentication failure information indicating that the authentication has failed to the log information storage unit 140. The authentication failure information transmission unit 135 displays the authentication failure information output by the user authorization unit 134 on the management terminal 12.

  The log information storage unit 140 stores information transmitted / received from the in-house network 10 and the authentication network 20 via the communication interface 120 and the communication interface 150, and displays the stored information on a display (not shown) or the like. . Further, the log information storage unit 140 may store the authentication failure information output by the user authorization unit 134.

  The communication interface 150 is configured to communicate with the authentication network 20 and includes an authentication information transmitting / receiving unit 151. The authentication information transmission / reception unit 151 communicates with the authentication server 21 in accordance with, for example, a protocol related to authentication including Radius.

  The authentication information transmission / reception unit 151 makes an authentication request to the authentication server 21 in response to an Access-Request packet including the authentication information received by the authentication information transmission / reception unit 121. The authentication information transmission / reception unit 151 receives authentication response information representing a response to the authentication request from the authentication server 21 and outputs the received authentication response information to the authentication response unit 133. For example, the authentication information transmission / reception unit 151 receives an Access-Accept packet or an Access-Reject packet conforming to Radius.

  Hereinafter, the operation of the gateway apparatus according to the first embodiment of the present invention will be described with reference to the drawings. FIG. 3 is a flowchart showing an operation flow of the gateway device according to the first embodiment of the present invention.

  First, the authentication information transmitted from the communication terminal 11 is received by the authentication information transmitting / receiving unit 121 (S101). Next, the usage time information is acquired from the database 110 after the authentication information analysis unit 131 analyzes the authentication information. Based on the acquired usage time information, whether or not connection to the VLAN is possible is determined by the user authorization unit 134. Determination is made (S102).

  When it is determined that connection is possible, an authentication request to the authentication server 21 is made by the authentication request unit 132 according to the authentication information analyzed by the authentication information analysis unit 131 (S103). Thereafter, the authentication response information is received from the authentication server 21 by the authentication response means 133 (S104).

  Whether or not the authentication is successful is determined based on the authentication response information received by the authentication response means 133 (S105). When the authentication is successful, the VLAN number corresponding to the user is acquired from the database 110 by the user authorization unit 134, and the communication terminal 11 is connected to the VLAN corresponding to the acquired VLAN number (S106).

As described above, the gateway device according to the first embodiment of the present invention, when the authentication response information indicates successful authentication, according to the virtual network identification information for identifying the VLAN corresponding to the user, Since the VLAN 31 or the VLAN 32 is connected to the communication terminal 11 used by the user, it is possible to perform control for connecting the specific VLAN and the communication terminal 11 used by the user according to the authentication result of the user.
Further, it is determined whether or not the user can connect to the VLAN according to the usage time information, and when it is determined that the connection is possible, the VLAN 31 or the VLAN 32 is connected to the communication terminal 11 used by the user, so that the user uses the VLAN. Use time can be limited.
Further, since the VLAN indicated by the virtual network identification information is connected to the communication terminal 11 used by the user, the gateway device 100 can select and connect the VLAN corresponding to the user.

FIG. 4 is a system configuration diagram of an authentication system according to the second embodiment of the present invention.
As shown in FIG. 4, the authentication system 2000 includes a communication terminal 41a to a communication terminal 41d used by a user, a gateway device 200 that relays information, and authentication clients 13a and b (mediation between the communication terminals 41a to 41d). Device) is communicably connected via the in-house network 10, and the gateway device 200 and the authentication server 21 for authenticating the user are communicably connected via the authentication network 20.

  Of the elements constituting the authentication system according to the second embodiment of the present invention, the same elements as those constituting the authentication system according to the first embodiment of the present invention are denoted by the same reference numerals. Each description is omitted.

  Further, the user a, the user b, the user c, or the user d may use any communication terminal 41. However, in this embodiment, for convenience of explanation, the user a uses the communication terminal 41a, the user b uses the communication terminal 41b, the user c uses the communication terminal 41c, and the user d communicates. It is assumed that the terminal 41d is used.

  For example, when a user using the communication terminal 41 logs in to the VLAN, the communication terminal 41 transmits authentication information for authenticating the user to the gateway device 200 via the authentication client 13.

  The authentication client 13 relays the authentication information transmitted from the communication terminal 41 to the gateway device 200, and corresponds to the VLAN number transmitted from the gateway device 200 out of the VLAN 31 and the VLAN 32 constituting the in-house network 10. And the communication terminal 41 are connected to each other. The authentication client 13 is installed at each location for building the in-house network 10, and may be installed on each floor of a building, for example.

  FIG. 5 is an image diagram of a sequence of the authentication system according to the second embodiment of the present invention. Authentication in accordance with EAP-TLS (PPP Extensible Authentication Protocol-Transport Layer Security) is performed between the communication terminal 41 and the authentication client 13. Further, between the authentication client 13 and the authentication server 21, authentication based on Radius is performed. The authentication client 13 mutually converts a packet conforming to EAP-TLS and a packet conforming to Radius.

  The gateway device 200 relays the Access-Request packet including the authentication information transmitted from the authentication client 13 to the authentication server 21, and transmits the Access-Accept packet including the authentication response information transmitted from the authentication server 21 to the authentication client 13. It comes to relay.

  When receiving the Access-Accept packet from the authentication server 21, the gateway device 200 includes the VLAN number corresponding to the user identifier included in the authentication information in the Access-Accept packet, and the Access-Accept packet includes the Access-Accept packet. By transmitting the -Request packet to the authenticating client 13, the VLAN and the communication terminal 41 are connected.

  FIG. 6 is a block diagram of a gateway device according to the second embodiment of the present invention. As shown in FIG. 6, the gateway device 200 is configured to include a database 210, a communication interface 220, a control unit 230, a log information storage unit 140, and a communication interface 150. Note that the image of this sequence is an example, and the present invention may use other protocols related to authentication.

  Of the elements constituting the gateway apparatus according to the second embodiment of the present invention, the same elements as those constituting the gateway apparatus according to the first embodiment of the present invention are denoted by the same reference numerals. Each description is omitted.

  The database 210 (usable device information storage means, usage time information storage means, virtual network identification information storage means) is a VLAN number for identifying a VLAN to which a user is connected, and usage time information indicating a usage time available to the user. , And available device information representing the authentication client 13 available to the user. An example of information stored in the database 210 is shown in Table 2.

As shown in Table 2, for example, the user a is an employee of a managerial position, can use the VLAN 31, has no restriction on the use time, and can use the authentication client 13 a and the authentication client 13 b. Further, the user b is a temporary employee, can use the VLAN 32, can be used from 9:00 to 22:00, can use the authentication client 13a and the authentication client 13b from 9:00 to 18:00, and can Until 22:00, only the authentication client 13b can be used. The user c is an employee of the union member, can use the VLAN 31, can use from 9 o'clock to 22 o'clock, and can use the authentication client 13a and the authentication client 13b. Further, the user d is a visitor, can use the VLAN 32, can be used from 9:00 to 18:00, and can use only the authentication client 13b.

  The communication interface 220 is configured to communicate with the in-house network 10 and includes an authentication information transmitting / receiving unit 121.

  The control unit 230 is configured to include a CPU (Central Processing Unit) that processes a program, a memory that stores the program, and the like. The control unit 230 includes an authentication information analysis unit 131, an authentication request unit 132, an authentication response unit 133, a user authorization unit 234, and an authentication failure information transmission unit 135. These means may be program modules.

  When the authentication response information received by the authentication response unit 133 indicates successful authentication, the user authorization unit 234 (virtual network connection unit) sets the VLAN number corresponding to the user identifier included in the authentication information to the database 210. The VLAN and the communication terminal 41 are connected to the authentication client 13 according to the acquired VLAN number. For example, the user authorization means 234 includes the acquired VLAN number in the Access-Accept packet, and transmits the Access-Accept packet to the authentication client 13 to connect the VLAN and the communication terminal 41.

  For example, when an Access-Request packet is received from the authentication server 21 after an Access-Request packet is transmitted from the user a via the authentication client 13a, the user authorization unit 234, “31” corresponding to the user a. And the usable client information representing the authentication client 13a and the authentication client 13b are acquired from the database 210, and can be used by the authentication client 13a according to the acquired usable device information. Therefore, the acquired VLAN number representing “31” is used. An Access-Request packet included in the Access-Accept packet is transmitted to the authentication client 13a.

  Further, the user authorization unit 234 may acquire usage time information corresponding to the user identifier from the database 210, and may determine whether or not connection to the VLAN is possible according to the acquired usage time information. When it is determined that the connection is possible, the user authorization unit 234 connects the VLAN corresponding to the VLAN number and the communication terminal 41 to the authentication client 13.

  For example, when an Access-Request packet is received from the authentication server 21 after an Access-Request packet is transmitted from the user b via the authentication client 13a at time 19, the user authorization unit 234 corresponds to the user b. The VLAN number representing “32”, the usage time information representing “18:00 to 22:00”, and the usable device information representing the authentication client 13b are acquired from the database 210 and used by the authentication client 13b in accordance with the acquired usable device information. Because it can, the connection is not allowed.

  Further, the user authorization unit 234 outputs authentication failure information indicating that the authentication has failed to the log information storage unit 140 when the authentication response information indicates that the authentication has failed.

  The operation of the gateway device according to the second embodiment of the present invention will be described below with reference to the drawings. FIG. 7 is a flowchart showing an operation flow of the gateway device according to the second embodiment of the present invention.

  Of the operations of the gateway device according to the second embodiment of the present invention, the same operations as those of the gateway device according to the first embodiment of the present invention are denoted by the same reference numerals.

  First, the authentication information transmitted from the communication terminal 41 is received by the authentication information transmitting / receiving unit 121 (S101). Next, the usage time information is acquired from the database 210 by the user authorization unit 234 after the authentication information analysis unit 131 analyzes the authentication information, and whether or not it is connectable to the VLAN according to the acquired usage time information is determined by the user authorization. The determination is made by means 234 (S102).

  When it is determined that the connection is possible, the user authorization unit 234 further determines whether or not the authentication client 13 that transmitted the Access-Request packet can be used by the user according to the available device information acquired from the database 210. It is judged (S201).

  When it is determined that the authentication client 13 can be used, the authentication request unit 132 makes an authentication request to the authentication server 21 in accordance with the authentication information analyzed by the authentication information analysis unit 131 (S103). Thereafter, the authentication response information is received from the authentication server 21 by the authentication response means 133 (S104).

  Whether or not the authentication is successful is determined based on the authentication response information received by the authentication response means 133 (S105). When the authentication is successful, the VLAN number corresponding to the user is acquired from the database 210 by the user authorization unit 234, and the communication terminal 41 is connected to the VLAN corresponding to the acquired VLAN number (S106).

As described above, the gateway device according to the second embodiment of the present invention can be installed at each location where the authentication client 13 constructs the in-house network 10, so that the user can connect to the network. Convenience can be improved.
In addition, it is determined whether or not the user can use the authentication client 13 according to the available device information, and when it is determined that the connection is possible, the VLAN 31 or the VLAN 32 and the communication terminal 41 used by the user are connected to the authentication client 13. However, the use of the authentication client 13 can be restricted.

  FIG. 8 is a system configuration diagram of an authentication system according to the third embodiment of the present invention. As shown in FIG. 8, the authentication system 3000 includes a communication terminal 51a to a communication terminal 51d used by a user, a gateway device 300 that relays information, and authentication clients 53a and b (mediation devices) that mediate the communication terminal 51. However, the gateway apparatus 300 and the authentication server 21 for authenticating the user are communicably connected via the in-house network 10 and communicably connected via the authentication network 20.

  Of the elements constituting the authentication system according to the third embodiment of the present invention, the same elements as those constituting the authentication system according to the second embodiment of the present invention are denoted by the same reference numerals. Each description is omitted.

  The user a, the user b, the user c, or the user d may use any communication terminal 51. However, in this embodiment, for convenience of explanation, the user a uses the communication terminal 51a, the user b uses the communication terminal 51b, the user c uses the communication terminal 51c, and the user d communicates. It is assumed that the terminal 51d is used.

  For example, when a user using the communication terminal 51 logs in to the VLAN, the communication terminal 51 transmits authentication information for authenticating the user to the gateway apparatus 300 via the authentication client 53. The authentication information includes a VLAN number for identifying one of the VLAN (Virtual Local Area Network) 31 and the VLAN 32.

  The authentication client 53 relays the authentication information transmitted from the communication terminal 51 to the gateway device 300, and corresponds to the VLAN number transmitted from the gateway device 300 out of the VLAN 31 and the VLAN 32 constituting the in-house network 10. The communication terminal 51 and the communication terminal 51 are connected. The authentication client 53 is installed at each location for building the in-house network 10, and may be installed on each floor of a building, for example.

FIG. 9 is an image diagram of a sequence of the authentication system according to the third embodiment of the present invention. Between the communication terminal 51 and the authentication client 53, authentication conforming to EAP-TLS (PPP Extensible Authentication Protocol-Transport Layer Security) is performed.
Further, between the authentication client 53 and the authentication server 21, authentication conforming to Radius that supports EAP-TLS is performed. The authentication client 53 mutually converts a packet conforming to EAP-TLS and a packet conforming to Radius.

  Further, the authentication client 53 receives authentication information including a VLAN number, and receives an EAP-Response packet including the authentication information from the communication terminal 51, and converts the received EAP-Response packet into an Access-Request packet conforming to Radius. The converted Access-Request packet is transmitted to the gateway device 300. Note that the authentication client 53 transmits the VLAN number included in the EAP-Response packet to the gateway device 300 by taking over the Access-Request packet.

The gateway device 300 relays the Access-Request packet transmitted from the authentication client 53 to the authentication server 21, and relays the Access-Accept packet including the authentication response information transmitted from the authentication server 21 to the authentication client 53. ing.
The gateway device 300 receives the Access-Request packet transmitted from the authentication client 53, removes the VLAN number included in the received Access-Request packet, and relays it to the authentication server 21.

  When the gateway device 300 receives the Access-Accept packet, the gateway device 300 includes the VLAN number included in the Access-Request packet in the Access-Accept packet, and the Access-Accept packet is transmitted to the authentication that transmitted the Access-Request packet. By transmitting to the client 53, the VLAN and the communication terminal 51 are connected.

  FIG. 10 is a block diagram of a gateway device according to the third embodiment of the present invention. As shown in FIG. 10, the gateway device 300 is configured to include a database 310, a communication interface 220, a control unit 330, a log information storage unit 140, and a communication interface 150.

  Of the elements constituting the gateway device according to the third embodiment of the present invention, the same elements as those constituting the gateway device according to the second embodiment of the present invention are denoted by the same reference numerals. Each description is omitted.

  The database 310 (usable device information storage means, usage time information storage means, permission information storage means) is a VLAN number for identifying a VLAN to which a user is connected, and only a usable VLAN among a plurality of VLANs. , Permission information for permitting the connection of the VLAN, usage time information indicating the usage time available to the user, and usable device information indicating the authentication client 53 available to the user are stored. An example of information stored in the database 310 is shown in Table 3.

  As shown in Table 3, for example, the user a is a managerial employee, can use only the VLAN 31 and the VLAN 32, has no limitation in use time, and can use the authentication client 53a and the authentication client 53b. is there. The user b is a temporary employee, can use only the VLAN 32, can be used from 9 o'clock to 22 o'clock, can use the authentication client 53a and the authentication client 53b from 9 o'clock to 18 o'clock, Only the authentication client 53b can be used from 12:00 until 22:00. The user c is an employee of the union member, can use only the VLAN 31 and the VLAN 32, can be used from 9:00 to 22:00, and can use the authentication client 53a and the authentication client 53b. Further, the user d is a visitor, can use only the VLAN 32, can be used from 9:00 to 18:00, and can use only the authentication client 53b.

  The control means 330 is configured to include a CPU (Central Processing Unit) that processes the program, a memory that stores the program, and the like. The control unit 330 includes an authentication information analysis unit 131, an authentication request unit 132, an authentication response unit 133, a user authorization unit 334, and an authentication failure information transmission unit 135. These means may be program modules.

  When the authentication information including the VLAN number is transmitted via the authentication client 53, the user authorization unit 334 stores the VLAN number included in the authentication information, removes the stored VLAN number from the authentication information, and removes the VLAN number. The authentication information is output to the authentication information transmission / reception means 151. Thereafter, when the authentication response information received by the authentication response unit 133 indicates that the authentication is successful, the user authorization unit 334 connects the VLAN corresponding to the stored VLAN number and the communication terminal 51 to the authentication client 53. It has become.

  For example, when an Access-Request packet including the VLAN number “32” is transmitted from the user b via the authentication client 53a, the user authorization unit 334 stores the VLAN number “32” included in the Access-Request packet. The VLAN number “32” is removed from the Access-Request packet. Thereafter, when the authentication response means 133 receives the Access-Accept packet, the user authorization means 334 includes the VLAN number “32” in the Access-Accept packet, and transmits this Access-Accept packet to the authentication client 53b. The communication terminal 51b is connected to the authentication client 53a.

  Further, when the authentication information is transmitted via the authentication client 53, the user authorization unit 334 obtains permission information corresponding to the user identifier included in the authentication information from the database 310, and authenticates according to the obtained permission information. It may be determined whether or not it is possible to connect to the VLAN corresponding to the VLAN number included in the information. When it is determined that the connection is possible, the user authorization unit 334 connects the VLAN and the communication terminal 51 to the authentication client 53 according to the VLAN number included in the authentication information.

  For example, when an Access-Request packet including the VLAN number “31” is transmitted from the user b via the authentication client 53a, the user authorization unit 334 acquires permission information indicating that only the VLAN 32 can be used from the database 310, Since the acquired permission information represents the VLAN 32, the connection is not permitted.

  Further, the user authorization unit 334 may acquire the usage time information corresponding to the user identifier from the database 310, and may determine whether or not connection to the VLAN is possible according to the acquired usage time information. When it is determined that connection is possible, the user authorization unit 334 connects the VLAN and the communication terminal 51 to the authentication client 53 according to the VLAN number.

  Further, the user authorization unit 334 acquires available device information corresponding to the user identifier from the database 310, and according to the acquired available device information, whether or not the user can use the authentication client 53 that has transmitted the Access-Request packet. May be determined. When it is determined that it can be used, the user authorization unit 334 connects the VLAN and the communication terminal 51 to the authentication client 53 according to the VLAN number.

  Further, the user authorization unit 334 outputs authentication failure information indicating the authentication failure to the log information storage unit 140 when the authentication response information indicates that the authentication has failed.

  The operation of the gateway device according to the third embodiment of the present invention will be described below with reference to the drawings. FIG. 11 is a flowchart showing an operation flow of the gateway device according to the third embodiment of the present invention.

  Note that, among the operations of the gateway device according to the third embodiment of the present invention, the same operations as those of the gateway device according to the second embodiment of the present invention are denoted by the same reference numerals.

  First, authentication information including a VLAN number transmitted from the communication terminal 51 is received by the authentication information transmitting / receiving unit 121 (S101). Next, the usage time information corresponding to the user identifier is acquired from the database 310 by the user authorization unit 334, and the user authorization unit 334 determines whether or not connection to the VLAN is possible according to the acquired usage time information (S301). ).

  When it is determined that connection is possible, the available device information corresponding to the user identifier is further acquired from the database 310, and whether or not the authentication client 53 to which the user has transmitted the authentication information can be used according to the acquired available device information. Is determined by the user authorization unit 334, and when it is determined that the authentication client 53 can be used, the VLAN number included in the authentication information is stored by the user authorization unit 334, and the VLAN number included in the authentication information is removed. (S302).

  When it is determined that the authentication client 53 can be used, an authentication request to the authentication server 21 is made according to the authentication information analyzed by the authentication information analysis unit 131 by the authentication request unit 132 (S103). Thereafter, the authentication response information is received from the authentication server 21 by the authentication response means 133 (S104).

  Whether or not the authentication is successful is determined based on the authentication response information received by the authentication response means 133 (S105). When the authentication is successful, the communication terminal 51 is connected to the VLAN corresponding to the VLAN number stored by the user authorization unit 334 (S303).

As described above, the gateway device according to the third embodiment of the present invention connects the VLAN indicated by the virtual network identification information included in the authentication information and the communication terminal 51 used by the user. A VLAN corresponding to the user can be selected and connected.
Further, it is determined whether or not the user can connect to the VLAN indicated by the virtual network identification information according to the permission information, and when it is determined that the connection is possible, the VLAN 31 or the VLAN 32 is connected to the communication terminal 53 used by the user. VLANs that can be restricted can be limited.

  FIG. 12 is a system configuration diagram of an authentication system according to the fourth embodiment of the present invention. As shown in FIG. 12, the authentication system 4000 includes a communication terminal 61a to a communication terminal 61d used by a user, a gateway device 400 that relays information, and authentication clients 63a and b (mediation devices) that mediate the communication terminal 61. Are connected to each other via the in-house network 10, and the gateway device 400, the authentication server 21 for authenticating the user, and the certificate issuing server 22 for issuing a certificate for certifying the user are connected to the authentication network 20. It has the structure connected via.

  Of the elements constituting the authentication system according to the fourth embodiment of the present invention, the same elements as those constituting the authentication system according to the second embodiment of the present invention are denoted by the same reference numerals. Each description is omitted.

  Further, the user a, the user b, the user c, or the user d may use any communication terminal 61. However, in this embodiment, for convenience of explanation, user a uses communication terminal 61a, user b uses communication terminal 61b, user c uses communication terminal 61c, and user d communicates. It is assumed that the terminal 61d is used.

  The certificate issuing server 22 issues a certificate corresponding to each user in advance, and each user stores the certificate issued by the certificate issuing server 22 in the communication terminal 61 used by the user in advance. Good. However, it is desirable for users to manage certificates themselves. The certificate is X. An electronic certificate such as a 509 certificate is included and used instead of the user identifier.

  For example, when a user using the communication terminal 61 logs in to the VLAN, the communication terminal 61 transmits authentication information for authenticating the user to the gateway device 400 via the authentication client 63.

  The authentication client 63 is configured to connect the communication terminal 61 with the VLAN corresponding to the VLAN number transmitted from the gateway device 400 among the VLAN 31 and the VLAN 32 configuring the in-house network 10. Further, the authentication client 63 is installed at each location for building the in-house network 10, and may be installed on each floor of the building, for example.

  FIG. 13 is an image diagram of a sequence of the authentication system according to the fourth embodiment of the present invention. Authentication in accordance with EAP-TLS (PPP Extensible Authentication Protocol-Transport Layer Security) is performed between the communication terminal 61 and the authentication client 63. Further, between the authentication client 63 and the authentication server 21, authentication conforming to Radius that supports EAP-TLS is performed.

  In addition, the authentication client 63 mutually converts a packet conforming to EAP-TLS and a packet conforming to Radius. The authentication client 63 receives authentication information including a certificate, receives an EAP-Request packet including the authentication information from the communication terminal 61, and converts the received EAP-Response packet into an Access-Request packet conforming to Radius. The converted Access-Request packet is transmitted to the gateway device 400. In addition, the authentication client 63 takes over the certificate included in the EAP-Response packet and transmits it to the gateway device 400 by taking over the Access-Request packet.

  The gateway device 400 relays the Access-Request packet transmitted from the authentication client 63 to the authentication server 21, and relays the Access-Accept packet including the authentication response information transmitted from the authentication server 21 to the authentication client 63. ing.

  When the Access-Accept packet is received, the gateway device 400 includes the VLAN number corresponding to the user having the certificate included in the Access-Request packet in the Access-Accept packet, and authenticates the Access-Accept packet. By transmitting to the client 63, the VLAN and the communication terminal 61 are connected.

  FIG. 14 is a block diagram of a gateway device according to the fourth embodiment of the present invention. As shown in FIG. 14, the gateway device 400 is configured to include a database 210, a communication interface 220, a control unit 430, a log information storage unit 140, and a communication interface 150.

  Of the elements constituting the gateway device according to the fourth embodiment of the present invention, the same elements as those constituting the gateway device according to the second embodiment of the present invention are denoted by the same reference numerals. Each description is omitted.

  The control means 430 is configured to include a CPU (Central Processing Unit) that processes a program, a memory that stores the program, and the like. The control unit 430 includes an authentication information analysis unit 131, an authentication request unit 132, an authentication response unit 133, a user authorization unit 434, and an authentication failure information transmission unit 135. These means may be program modules.

  When the authentication information including the certificate is transmitted via the authentication client 63, the user authorization unit 434 stores the certificate included in the authentication information by converting it into a user identifier. Thereafter, when the authentication response information received by the authentication response unit 133 indicates successful authentication, the user authorization unit 434 acquires a VLAN number corresponding to the stored user identifier from the database 210, and acquires the acquired VLAN number. The corresponding VLAN and the communication terminal 61 are connected to the authentication client 63.

  For example, the user authorization unit 434 connects the VLAN and the communication terminal 61 by including the acquired VLAN number in the Access-Accept packet and transmitting the Access-Accept packet to the authentication client 63.

  Further, the user authorization unit 434 may acquire usage time information corresponding to the stored user identifier from the database 210, and may determine whether or not connection to the VLAN is possible according to the acquired usage time information. When it is determined that the connection is possible, the user authorization unit 434 connects the VLAN corresponding to the VLAN number and the communication terminal 61 to the authentication client 63.

  Further, the user authorization unit 434 obtains usable device information corresponding to the stored user identifier from the database 210, and according to the obtained usable device information, can the user use the authentication client 63 that has transmitted the Access-Request packet? It may be determined whether or not. When it is determined that connection is possible, the user authorization unit 434 connects the VLAN and the communication terminal 61 to the authentication client 63 according to the VLAN number.

  Further, the certificate includes permission information for permitting connection to only a VLAN that can be used by the user among a plurality of VLANs, and the user authorization unit 434 stores the database according to the permission information included in the certificate. Whether or not connection to the VLAN corresponding to the VLAN number acquired from 210 is possible may be determined according to the permission information. When it is determined that the connection is possible, the user authorization unit 434 connects the VLAN corresponding to the VLAN number and the communication terminal 61 to the authentication client 63.

  For example, when a certificate including permission information for permitting only the VLAN 31 is transmitted from the user b via the authentication client 63a, the user authorization unit 434 indicates that the VLAN number acquired from the database 210 represents the VLAN 32. The connection is not allowed.

  The operation of the gateway device according to the fourth embodiment of the present invention will be described below with reference to the drawings. FIG. 15 is a flowchart showing an operation flow of the gateway device according to the fourth embodiment of the present invention.

  Note that, among the operations of the gateway device according to the fourth embodiment of the present invention, the same operations as those of the gateway device according to the second embodiment of the present invention are denoted by the same reference numerals.

  First, the authentication information transmitted from the communication terminal 61 is received by the authentication information transmitting / receiving unit 121 (S101). Next, the usage time information is acquired from the database 210 by the user authorization unit 434 after the authentication information analysis unit 131 analyzes the authentication information, and whether or not connection to the VLAN is possible according to the acquired usage time information is determined by the user authorization. The determination is made by the means 434 (S102).

  When it is determined that the connection is possible, the available device information is acquired from the database 210, and whether or not the authentication client 13 that has transmitted the Access-Request packet by the user can be used according to the acquired available device information is determined. It is judged by the user authorization means 434 (S201).

  When it is determined that the authentication client 63 can be used, a user identifier corresponding to the certificate is stored by the user authorization unit 434, and an authentication request to the authentication server 21 is made according to the authentication information analyzed by the authentication information analysis unit 131. This is performed by the authentication request unit 132 (S103). Thereafter, the authentication response information is received from the authentication server 21 by the authentication response means 133 (S104).

  Whether or not the authentication is successful is determined based on the authentication response information received by the authentication response means 133 (S105). When the authentication is successful, the VLAN number corresponding to the stored user identifier is acquired from the database 210 by the user authorization unit 434, and the communication terminal 61 is connected to the VLAN corresponding to the acquired VLAN number (S106). .

As described above, the gateway device according to the fourth embodiment of the present invention identifies the user in order to connect the VLAN indicated by the virtual network identification information and the communication terminal 61 used by the user indicated by the certificate. Therefore, it is possible to prevent the VLAN from being used illegally by falsifying the information for doing so.
Further, it is determined according to the permission information whether the user indicated by the certificate can connect to the VLAN indicated by the virtual network identification information, and when it is determined that the connection is possible, the VLAN and the communication terminal 61 used by the user indicated by the certificate Therefore, VLANs that can be used by the user can be restricted according to the certificate.

  FIG. 16 is a system configuration diagram of an authentication system according to the fifth embodiment of the present invention. As shown in FIG. 16, the authentication system 5000 includes a communication terminal 71a to a communication terminal 71d used by a user, a gateway device 500 that relays information, and authentication clients 53a and 53b (mediation devices) that mediate the communication terminal 71. However, the gateway device 500 and the authentication server 21 for authenticating the user are communicably connected via the in-house network 10 and communicably connected via the authentication network 20.

  Of the elements constituting the authentication system according to the fifth embodiment of the present invention, the same elements as those constituting the authentication system according to the third embodiment of the present invention are denoted by the same reference numerals. Each description is omitted.

  Further, the user a, the user b, the user c, or the user d may use any communication terminal 71. However, in this embodiment, for convenience of explanation, the user a uses the communication terminal 71a, the user b uses the communication terminal 71b, the user c uses the communication terminal 71c, and the user d communicates. Assume that the terminal 71d is used.

  For example, when a user using the communication terminal 71 logs in to the VLAN, the communication terminal 71 transmits authentication information for authenticating the user to the gateway device 500 via the authentication client 53. The authentication information includes a VLAN number for identifying one of the VLAN (Virtual Local Area Network) 31 and the VLAN 32.

  FIG. 17 is an image diagram of a sequence of the authentication system according to the fifth embodiment of the present invention. The communication terminal 71 used by the user transmits an EAP-Response packet including inquiry information for inquiring about a VLAN that can be used to the gateway device 500 via the authentication client 53.

  When the gateway device 500 receives the inquiry information, the gateway device 500 returns an Access-Challenge packet including the VLAN number corresponding to the user to the communication terminal 71 via the authentication client 53. The communication terminal 71 adds the returned VLAN number to the authentication information, and transmits an EAP-Response packet including the added authentication information to the gateway device 500 via the authentication client 53. When there are a plurality of replied VLAN numbers, the communication terminal 71 selects one of the plurality of VLAN numbers and adds the selected VLAN number to the authentication information.

  The gateway device 500 relays the Access-Request packet transmitted from the authentication client 53 to the authentication server 21, and relays the Access-Accept packet including the authentication response information transmitted from the authentication server 21 to the authentication client 53. ing. Further, when the gateway device 500 receives the Access-Accept packet, the gateway device 500 includes the VLAN number included in the Access-Request packet in the Access-Accept packet, and authenticates the Access-Accept packet by transmitting the Access-Request packet. By transmitting to the client 53, the VLAN and the communication terminal 71 are connected.

  FIG. 18 is a block diagram of a gateway apparatus according to the fifth embodiment of the present invention. As shown in FIG. 18, the gateway device 500 is configured to include a database 310, a communication interface 220, a control unit 530, a log information storage unit 140, and a communication interface 150.

  Of the elements constituting the gateway device according to the fifth embodiment of the present invention, the same elements as those constituting the gateway device according to the third embodiment of the present invention are denoted by the same reference numerals. Each description is omitted.

  The control means 530 is configured to include a CPU (Central Processing Unit) that processes the program, a memory that stores the program, and the like. The control unit 330 includes an authentication information analysis unit 131, an authentication request unit 132, an authentication response unit 133, a user authorization unit 334, an authentication failure information transmission unit 135, an inquiry information reception unit 536, and a virtual network identification information response unit 537. Have. These means may be program modules.

  The inquiry information receiving unit 536 receives inquiry information for inquiring about a user's available VLAN from the communication terminal 71. For example, the inquiry information receiving unit 536 may receive the inquiry information included in the packet after the authentication information analyzing unit 131 analyzes the packet conforming to Radius or the like.

  The virtual network identification information response means 537 returns a VLAN number for responding to the user from the database 310 to the communication terminal 71 used by the user according to the inquiry information received by the inquiry information receiving means 536. Yes.

  For example, when the inquiry information receiving unit 536 receives the inquiry information transmitted from the user c, the virtual network identification information response unit 537 receives permission information indicating VLAN 31 and VLAN 32 from the information shown in Table 3 stored in the database 310. The acquired information is returned to the communication terminal 71c. The communication terminal 71c that has received the permission information indicating the VLAN 31 and the VLAN 32 selects one of the plurality of VLAN numbers, adds the selected VLAN number to the authentication information, and transmits the authentication information to the gateway device 500. It has become.

  The operation of the gateway device according to the fifth embodiment of the present invention will be described below with reference to the drawings. FIG. 19 is a flowchart showing an operation flow of the gateway apparatus according to the fifth embodiment of the present invention.

  Note that, among the operations of the gateway device according to the fifth embodiment of the present invention, the same operations as those of the gateway device according to the third embodiment of the present invention are denoted by the same reference numerals.

  First, the inquiry information for inquiring the user's available VLAN and transmitted from the communication terminal 71 is received by the inquiry information receiving means 536 (S501). Next, permission information corresponding to the user is acquired from the database 310 by the virtual network identification information response means 537 (S502), and is returned to the communication terminal 71 used by the user (S503). In addition, you may perform operation | movement of S301 and S302 after S502.

  Thereafter, the authentication information including the VLAN number transmitted from the communication terminal 71 is received by the authentication information transmitting / receiving unit 121 (S101). Next, the usage time information corresponding to the user identifier is acquired from the database 310 by the user authorization unit 334, and the user authorization unit 334 determines whether or not connection to the VLAN is possible according to the acquired usage time information (S301). ).

  When it is determined that connection is possible, the available device information corresponding to the user identifier is further acquired from the database 310, and whether or not the authentication client 53 to which the user has transmitted the authentication information can be used according to the acquired available device information. Is determined by the user authorization unit 334, and when it is determined that the authentication client 53 can be used, the VLAN number included in the authentication information is stored by the user authorization unit 334, and the VLAN number included in the authentication information is removed. (S302).

  When it is determined that the authentication client 53 can be used, an authentication request to the authentication server 21 is made according to the authentication information analyzed by the authentication information analysis unit 131 by the authentication request unit 132 (S103). Thereafter, the authentication response information is received from the authentication server 21 by the authentication response means 133 (S104).

  Whether or not the authentication is successful is determined based on the authentication response information received by the authentication response means 133 (S105). When the authentication is successful, the communication terminal 71 is connected to the VLAN corresponding to the VLAN number stored by the user authorization unit 334 (S303).

  As described above, since the gateway device according to the fifth embodiment of the present invention returns a VLAN number in response to an inquiry from the user, it can be connected even if the user does not know the VLAN number in advance. The number can be notified to the user, and when there are a plurality of connectable VLAN numbers, the user can connect to the desired VLAN.

  FIG. 20 is a system configuration diagram of an authentication system according to the sixth embodiment of the present invention. As shown in FIG. 20, the authentication system 6000 includes a communication terminal 81a to a communication terminal 81d used by a user, a gateway device 600 that relays information, and authentication clients 73a and b (mediation device) that mediate the communication terminal 81. However, the gateway device 600 and the authentication server 21 for authenticating the user are communicably connected via the in-house network 10 and communicably connected via the authentication network 20.

  Of the elements constituting the authentication system according to the sixth embodiment of the present invention, the same elements as those constituting the authentication system according to the third embodiment of the present invention are denoted by the same reference numerals. Each description is omitted.

  The user a, the user b, the user c, or the user d may use any communication terminal 81. However, in this embodiment, for convenience of explanation, user a uses communication terminal 81a, user b uses communication terminal 81b, user c uses communication terminal 81c, and user d communicates. It is assumed that the terminal 81d is used.

  For example, when a user using the communication terminal 81 logs in to the VLAN, the communication terminal 81 transmits authentication information for authenticating the user to the gateway device 600 via the authentication client 73. The authentication information includes a VLAN number for identifying any one of the VLAN (Virtual Local Area Network) 31, the VLAN 32, and the VLAN 33.

  FIG. 21 is an image diagram of a sequence of the authentication system according to the sixth embodiment of the present invention. Information representing all VLANs configured by the in-house network 10 is registered in the authentication client 73 in advance, and the authentication client 73 uses the EAP-Request packet including information representing all the VLANs as a communication terminal 81 used by the user. To be notified.

  The communication terminal 81 used by the user creates a virtual network list to which the priority of the VLAN is given based on the notified information, adds the created virtual network list to the authentication information, and includes the added EAP- The response packet is transmitted to the gateway device 600 via the authentication client 73. For example, in the virtual network list, VLAN numbers are described in the order that the user wants to use.

  When receiving the Access-Request packet including the authentication information, the gateway device 600 determines whether or not the user can connect in order from the VLAN with the highest priority based on the virtual network list, and determines that the connection is possible. The Access-Request packet transmitted from the authentication client 73 is relayed to the authentication server 21, and the Access-Accept packet including the authentication response information transmitted from the authentication server 21 is relayed to the authentication client 73.

  Further, when the gateway device 600 receives the Access-Accept packet, the gateway device 600 includes the VLAN number included in the Access-Request packet in the Access-Accept packet, and authenticates the Access-Accept packet by transmitting the Access-Request packet. By transmitting to the client 73, the VLAN that is determined to be connectable and the communication terminal 81 are connected.

  FIG. 22 is a block diagram of a gateway apparatus according to the sixth embodiment of the present invention. As shown in FIG. 22, the gateway device 600 is configured to include a database 310, a communication interface 220, a control unit 630, a log information storage unit 140, and a communication interface 150.

  Of the elements constituting the gateway device according to the sixth embodiment of the present invention, the same elements as those constituting the gateway device according to the third embodiment of the present invention are denoted by the same reference numerals. Each description is omitted.

  Control unit 630 is configured to include a CPU (Central Processing Unit) that processes a program, a memory that stores the program, and the like. The control unit 630 includes an authentication information analysis unit 131, an authentication request unit 132, an authentication response unit 133, a user authorization unit 634, and an authentication failure information transmission unit 135. These means may be program modules.

  When the authentication information including the VLAN number is transmitted via the authentication client 73, the user authorization unit 634 determines whether or not the user can connect in order from the virtual network with the highest priority based on the virtual network list included in the authentication information. Is determined according to the permission information.

  For example, the user authorization unit 634 extracts VLAN numbers in order from the virtual network with the highest priority based on the virtual network list. Further, the user authorization unit 634 acquires permission information indicating the VLAN 31 and the VLAN 32 from the information shown in Table 3 stored in the database 310, and determines whether or not the extracted VLAN number is connectable according to the acquired permission information. It is like that. When connection is not possible, VLAN numbers are extracted in order from the next highest priority virtual network based on the virtual network list, and it is repeated to determine whether or not the extracted VLAN number is connectable. .

  More specifically, when the virtual network list is a virtual network list in which VLAN numbers are described in the order that the user wants to use, and is described in the order of “VLAN33”, “VLAN32”, and “VLAN31” transmitted from user c The user authorization unit 634 extracts the VLAN 32 having the next highest priority after the VLAN 33 to which connection is not permitted, stores the extracted VLAN number, removes the virtual network list from the authentication information, and removes the virtual network list. The authentication information is output to the authentication information transmission / reception means 151.

  Thereafter, when the authentication response information received by the authentication response unit 133 indicates successful authentication, the user authorization unit 634 connects the VLAN corresponding to the stored VLAN number and the communication terminal 81 to the authentication client 73. It has become.

  The operation of the gateway device according to the sixth embodiment of the present invention will be described below with reference to the drawings. FIG. 23 is a flowchart showing an operation flow of the gateway apparatus according to the sixth embodiment of the present invention.

  Of the operations of the gateway device according to the sixth embodiment of the present invention, the same operations as those of the gateway device according to the third embodiment of the present invention are denoted by the same reference numerals.

  First, the authentication information including the virtual network list transmitted from the communication terminal 81 is received by the authentication information transmitting / receiving unit 121 (S601). Next, the usage time information corresponding to the user identifier is acquired from the database 310 by the user authorization unit 634, and it is determined by the user authorization unit 634 whether or not the VLAN can be connected according to the acquired usage time information (S301). ).

  When it is determined that connection is possible, the available device information corresponding to the user identifier is further acquired from the database 310, and whether or not the authentication client 73 to which the user has transmitted the authentication information can be used according to the acquired available device information. Is determined by the user authorization means 634 (S302).

  When it is determined that the authentication client 73 can be used, VLAN numbers are extracted in order from the virtual network with the highest priority based on the virtual network list included in the authentication information by the user authorization unit 634 (S602). Whether or not the number is connectable is determined by the user authorization unit 634, and if it is determined that the extracted VLAN number is connectable, the virtual network list stored in the user authorization unit 634 and included in the authentication information is removed. (S603). If all the VLAN numbers described in the virtual network list are not connectable, the operation ends.

  When it is determined that the VLAN number is connectable, an authentication request to the authentication server 21 is made according to the authentication information analyzed by the authentication information analysis unit 131 by the authentication request unit 132 (S103). Thereafter, the authentication response information is received from the authentication server 21 by the authentication response means 133 (S104).

  Whether or not the authentication is successful is determined based on the authentication response information received by the authentication response means 133 (S105). When the authentication is successful, the communication terminal 81 is connected to the VLAN corresponding to the VLAN number stored by the user authorization unit 634 (S303).

  As described above, the gateway device according to the sixth embodiment of the present invention determines whether a user can connect in order from the VLAN with the highest priority based on the virtual network list to which the priority of the VLAN is given. Since the determination is made according to the permission information, it is possible to connect to the VLAN in the order of the priority desired by the user. Further, the user can connect to a connectable VLAN without the user knowing the VLAN number in advance.

It is a system configuration figure of an authentication system concerning a 1st embodiment of the present invention. It is a block block diagram of the gateway apparatus which concerns on the 1st Embodiment of this invention. It is a flowchart which shows the flow of operation | movement of the gateway apparatus which concerns on the 1st Embodiment of this invention. It is a system block diagram of the authentication system which concerns on the 2nd Embodiment of this invention. It is an image figure of the sequence of the authentication system which concerns on the 2nd Embodiment of this invention. It is a block block diagram of the gateway apparatus which concerns on the 2nd Embodiment of this invention. It is a flowchart which shows the flow of operation | movement of the gateway apparatus which concerns on the 2nd Embodiment of this invention. It is a system configuration | structure figure of the authentication system which concerns on the 3rd Embodiment of this invention. It is an image figure of the sequence of the authentication system which concerns on the 3rd Embodiment of this invention. It is a block block diagram of the gateway apparatus which concerns on the 3rd Embodiment of this invention. It is a flowchart which shows the flow of operation | movement of the gateway apparatus which concerns on the 3rd Embodiment of this invention. It is a system configuration | structure figure of the authentication system which concerns on the 4th Embodiment of this invention. It is an image figure of the sequence of the authentication system which concerns on the 4th Embodiment of this invention. It is a block block diagram of the gateway apparatus which concerns on the 4th Embodiment of this invention. It is a flowchart which shows the flow of operation | movement of the gateway apparatus which concerns on the 4th Embodiment of this invention. It is a system configuration figure of the authentication system concerning a 5th embodiment of the present invention. It is an image figure of the sequence of the authentication system which concerns on the 5th Embodiment of this invention. It is a block block diagram of the gateway apparatus which concerns on the 5th Embodiment of this invention. It is a flowchart which shows the flow of operation | movement of the gateway apparatus which concerns on the 5th Embodiment of this invention. It is a system configuration | structure figure of the authentication system which concerns on the 6th Embodiment of this invention. It is an image figure of the sequence of the authentication system which concerns on the 6th Embodiment of this invention. It is a block block diagram of the gateway apparatus which concerns on the 6th Embodiment of this invention. It is a flowchart which shows the flow of operation | movement of the gateway apparatus which concerns on the 6th Embodiment of this invention. It is a block diagram which shows the conventional authentication system.

Explanation of symbols

10: In-house network 11 (11a-11d), 41 (41a-41d), 51 (51a-51d), 61 (61a-61d), 71 (71a-71d), 81 (81a-81d), 921 (921a, 921b): Communication terminal 12: Management terminal 13, 53, 63, 73: Authentication client 20: Authentication network 21: Authentication server 22: Certificate issuing server 31, 32, 33: VLAN
100, 200, 300, 400, 920: Gateway device 110, 210, 310: Database 120, 150, 220: Communication interface 121, 151: Authentication information transmission / reception means 122: Virtual network connection means (HUB)
130, 230, 330, 430, 530, 630: Control means 131: Authentication information analysis means 132: Authentication request means 133: Authentication response means 134, 234, 334, 434, 634: User authorization means 135: Authentication failure information transmission means 140: Log information storage means 536: Inquiry information reception means 537: Virtual network identification information response means 910a, 910b: Server 912: Authentication proxy server 913, 923: Network 1000, 2000, 3000, 4000, 5000, 6000: Authentication system a ~ D: user

Claims (11)

In the gateway device connected to be able to communicate with the communication terminal used by the user via the first network, and connected to be able to communicate with the authentication server for authenticating the user via the second network,
Virtual network connection means for connecting any one of a plurality of virtual networks constituting the first network to a communication terminal used by the user;
Authentication information receiving means for receiving authentication information for authenticating the user from the communication terminal;
Authentication request means for requesting authentication to the authentication server in accordance with authentication information received by the authentication information receiving means;
Authentication response means for receiving authentication response information representing a response to the authentication request from the authentication server,
When the authentication response information received by the authentication response means indicates the success of the authentication,
The gateway device characterized in that the virtual network connection means connects the virtual network and a communication terminal used by the user according to virtual network identification information for identifying a virtual network corresponding to the user. The gateway device is connected so as to be able to communicate with the mediation device that mediates the communication terminal and the communication terminal via the first network,
The authentication information receiving means receives the authentication information from the intermediary device that connects any one of the plurality of virtual networks constituting the first network and a communication terminal used by the user,
When the authentication response information received by the authentication response means indicates that the authentication is successful, the virtual network connection means sends a virtual network corresponding to the user and a communication terminal used by the user to the mediation device. The gateway device according to claim 1, wherein the gateway device is connected. The gateway device comprises available device information storage means for storing available device information representing the mediation device available to the user,
The virtual network connection means determines whether or not the user can use the mediation device according to the available device information, and determines that the user can connect the virtual network and the communication terminal used by the user when the mediation is performed. The gateway device according to claim 2, wherein the gateway device is connected to the device. The gateway device includes usage time information storage means for storing usage time information indicating a usage time available for the user,
The virtual network connection means determines whether or not the user can connect to the virtual network according to the usage time information, and connects the virtual network and a communication terminal used by the user when determining that connection is possible. The gateway device according to any one of claims 1 to 3, wherein The gateway device comprises virtual network identification information storage means for storing the virtual network identification information,
5. The gateway device according to claim 1, wherein the virtual network connection unit connects a virtual network indicated by the virtual network identification information and a communication terminal used by the user. 6. The authentication information includes virtual network identification information for identifying the virtual network,
The virtual network connection unit connects a virtual network indicated by virtual network identification information included in the authentication information and a communication terminal used by the user. Gateway equipment. The gateway device comprises permission information storage means for storing permission information for permitting connection to only the virtual network available to the user among the plurality of virtual networks,
The virtual network connection means determines whether or not the user can connect to the virtual network indicated by the virtual network identification information according to the permission information, and the communication terminal used by the virtual network and the user when determining that the connection is possible The gateway device according to claim 6, wherein the gateway device is connected. The authentication information includes a certificate for proving the user,
The said virtual network connection means connects the virtual network which the said virtual network identification information shows, and the communication terminal which the user shown by the said certificate uses, The any one of Claim 1 to 5 characterized by the above-mentioned. Gateway equipment. The certificate includes permission information for permitting connection to only the virtual network available to the user among the plurality of virtual networks,
The virtual network connection means determines whether the user indicated by the certificate can connect to the virtual network indicated by the virtual network identification information according to the permission information, and when determining that the user can connect, the virtual network and the certificate 9. The gateway device according to claim 8, wherein the gateway device is connected to a communication terminal used by a user indicated in the document. The gateway device receives inquiry information for inquiring about the virtual network available to the user from the communication terminal;
Virtual network identification information response means for returning virtual network identification information for corresponding to the user from the permission information storage means to the communication terminal used by the user in response to the inquiry information received by the inquiry information receiving means. 8. The gateway device according to claim 7, further comprising: The gateway device comprises permission information storage means for storing permission information for permitting connection to only the virtual network available to the user among the plurality of virtual networks,
The intermediary device notifies the communication terminal used by the user of information representing all virtual networks configured by the first network,
The communication terminal used by the user creates a virtual network list giving priority of the virtual network based on the notified information,
When the authentication information receiving unit receives the authentication information including the virtual network list, the virtual network connection unit determines whether or not the user can connect in order from the virtual network with the highest priority based on the virtual network list. 5. The gateway device according to claim 2, wherein the gateway device is determined according to the permission information and connects the virtual network and a communication terminal used by the user when it is determined that connection is possible.

Images