JP2005227993A - Access authentication method for network system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To facilitate client management at an access protection target device side by eliminating spoofing at the time of client authentication. <P>SOLUTION: A server 14 being an access protection target transmits an authentication information request A2 when an access request A1 is made from client communication equipment 11, and transmits authentication information A3 from the client communication equipment 11 to network connection equipment 12 (A4). The network connection device 12 performs the authentication processing of authentication information A4 based on the communication and connection information of the client communication equipment 11, and notifies the server 14 of the identification processing result A5. The server 14 determines whether or not the client communication equipment 11 being the access origin is a normal user from the authentication processing result A5, and when the client communication equipment 11 is the normal user, the client communication equipment 11 is connected to a line so that a communication enabled state can be set (A6). <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

  The present invention relates to a network system in which security of an information network is required, and more particularly to an access authentication method and an access authentication service method belonging to so-called client authentication technology.

  The main security of a server published on the Internet is a problem of user access authentication. In the conventional network system, when the server (access protection target device) itself has an access authentication function and receives access from the user terminal (authentication client communication device) via the network connection device, Authenticate. For the user authentication at that time, a method using (1) a user password, (2) a combination of a user ID and a password, and (3) an electronic certificate is often used as authentication information (for example, Non-Patent Document 1, Non-patent document 2).

“Internet Security” by Larry J. Hughes, Jr., p.68-93, February 21, 1997, published by Impress Inc., ISBN4-8443-4916-3

Deborah Russell / G. T. Gangemi Sr., “Basics of Computer Security” p.81-93, December 1, 1994, ASCII Inc., ISBN4-7561-0299-9

  However, in the access authentication method used in the conventional network system as described above, when the client (user) is authenticated, all the persons who access the access protection target device (server) know even the authentication information. Then, there is a problem that impersonation of other people is possible (problem 1). In addition, in order to use authentication, there is an information management problem that client authentication information must be registered in advance in an access protection target device (Problem 2). Furthermore, there is a problem that information that needs to be accurately passed to the target client is applied to information that is a basis for demonstrating that the information has been passed to the target client (problem 3).

  In order to solve the above problems, the present invention eliminates the impersonation of another person in the authentication of the client, can facilitate the client management on the access protection target device side, and can confirm the information transmission result. An object of the present invention is to provide an access authentication method for a network system.

In order to achieve the above object, an access authentication method for a network system according to the present invention is configured as follows.
(1) Used in a network system that performs connection and communication control between an access protection target device and a client communication device by a network connection device arranged on the network, and the access protection target device is connected to the own device from the client communication device. When there is an access request addressed to, the source address information added to the access request is transmitted as authentication information to the network connection device, the network connection device accepts the authentication information and executes authentication, Sending an authentication result to the access protection target device; and determining whether the access of the client communication device is illegal based on the authentication result, and blocking the access if it is determined to be illegal To do.

  (2) Client communication used in a network system for performing connection and communication control between an access protection target device and a client communication device by a network connection device arranged on the network, and the access protection target device is an access source or communicating Requesting authentication information from the device, and receiving authentication information from the client communication device in response to the request, transmitting the authentication information to the network connection device; Receiving and executing authentication, transmitting the authentication result to the access protection target device, determining whether the access protection target device is unauthorized to access or communicate with the client communication device based on the authentication result; If it is determined to be illegal, it will block access or communication. To Bei.

  (3) Client communication used in a network system that performs connection and communication control between an access protection target device and a client communication device by a network connection device arranged on the network, and the access protection target device is an access source or communicating Requesting authentication information from the device, requesting authentication information to the client communication device of the access protection target device and detecting authentication information transmitted from the client communication device in response to the request, and executing authentication, Whether the authentication result is added to the authentication information and transmitted to the access protection target device if the authentication result is proper, or if the authentication result is invalid, the authentication information is transmitted to the access protection target device without adding the authentication result Or blocking the transmission of authentication information, the access protection target device is the authentication information Together based on The added authentication result to the information to determine incorrect or not access or communication of the client communications device comprises a blocking access or communication when determining that illegal.

  (4) Used in a network system that performs connection and communication control between an access protection target device and a client communication device by a network connection device arranged on the network, and the network connection device is replaced with the access protection target device. When an authentication service for performing an authentication process for a client communication device is performed, and as the service content, authentication information obtained by requesting an access source or a communicating client communication device from the access protection target device is received. Then, the authentication is executed, and the authentication result is transmitted to the access protection target device.

  (5) Used in a network system that performs connection and communication control between an access protection target device and a client communication device by a network connection device arranged on the network, and the network connection device replaces the access protection target device. An authentication service for performing an authentication process for a client communication device is performed, and as the service content, a request for authentication information from the access protection target device to an access source or a communicating client communication device, and authentication from the client communication device Information response is automatically detected and authentication is performed. If the authentication result is appropriate, the authentication result is added to the authentication information and transmitted to the access protection target device. If the authentication result is invalid, the authentication result is added. Whether authentication information is transmitted to the access protection target device without performing authentication Or blocking the transmission of authentication information.

(6) In any one of (1) to (5), at least a part of the network is operated by an Internet protocol (IP), and the authentication is performed based on an IP address and connection line information of the client communication device. .
(7) In any one of (1) to (5), the network connection device executes an authentication process based on an account previously given to the client communication device and an identifier of the connection line.

(8) In (7), the network connection device also uses a password for the authentication process.
(9) In any one of (1) to (5), an electronic signature is added when an authentication result is transmitted to the access protection target device.

  According to the present invention, there is provided an access authentication method for a network system that can eliminate impersonation of another person in the authentication of the client, facilitate client management on the access protection target device side, and can confirm the information transmission result. Can be provided.

Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings.
(First embodiment)
FIG. 1 is a diagram showing a configuration of a network system and a sequence of an access authentication method according to the first embodiment of the present invention. In this network system, a client communication device 11 as a user terminal is connected to a network connection device 12 through a telephone line, for example, and this network connection device 12 is connected to an access protection target device (for example, a WWW server) 14 via an IP communication path 13. Connected.

  The network connection device 12 connects the client communication device 11 to the access protection target device 14 and enables communication between the two by line connection. In the present invention, the client communication device 11 replaces the access protection target device 14. It has the authentication function which authenticates whether or not is a regular user.

Hereinafter, the authentication function of the present invention will be described according to the sequence shown in FIG.
The network connection device 12 holds communication and connection information of the client communication device 11 (for example, an IP address of an authentication client, information on a session, a telephone number or information that can uniquely identify a telephone number). The access protection target device 14 transmits an authentication information request A2 to the client communication device 11 when there is an access request A1 for server connection from the client communication device 11 or after communication with the client communication device 11 is started. To do.

  Here, when there is no response from the client communication device 11 to the authentication information request A2, it is determined that the access request source or the client communication device 11 in communication is not an authorized user, and the access is refused and the line connection is blocked. To do. When the authentication information response A3 is received from the client communication device 11, the access protection target device 14 sends the received authentication information to the network connection device 12 (A4) and requests an authentication process.

  The network connection device 12 that has received the authentication information A4 executes an authentication process by determining whether the authentication information is appropriate based on the communication and connection information of the client communication device 11, and notifies the access protection target device 14 of the authentication processing result A5. . Upon receiving this notification, the access protection target device 14 determines whether the access request source or the client communication device 11 in communication is an authorized user or an unauthorized user from the authentication processing result A5. Connect and enable communication (A6).

A first specific example of the access authentication method of this embodiment will be described.
First, a WWW server is assumed as the access protection target device 14, and this WWW server 14 determines whether to permit or not permit access to the WWW service provided by the WWW server 14 based on the IP address of the connected client communication device 11. And In general IP communication, a source IP address that becomes a client can be disguised, so even a third party can impersonate a specific client. Authentication by these IP addresses alone is not sufficient to protect the server. It is said that it is appropriate. According to the access authentication method of the present embodiment, it is possible to protect against access from the malicious third party to the server 14 only by using the IP address.

  Here, the network connection device 12 is a remote access device that realizes dial-up connection, etc., and the identifier (telephone number etc.) of the line to which the client communication device 11 is connected and the IP address used by the client communication device 11 Are managed as line information.

  When the client communication device 11 connects to the server 14 that is an access protection target, the client communication device 11 notifies its own IP address information as authentication information in response to a request from the server 14. At the time of this notification, the remote access device 12 stores the communication contents, the IP address, and the identifier of the used line as a communication record. The server 14 subject to access protection sends the communication contents from the client communication device 11 and the sent IP address as authentication information to the remote access device 12 to confirm whether the notified IP address is authentic. To do.

  Receiving this authentication information, the remote access device 12 searches the communication record to confirm that the corresponding communication record exists, and also searches the line information and compares the IP address with the line identifier, so that the client Confirm that the IP address sent by the communication device 11 is authentic. If the corresponding communication record does not exist, or if the IP address and the line identifier are different, the remote access device 12 determines that the IP address is false.

  As a result of the authentication process, the remote access device 12 sends information on whether the IP address is genuine or fake to the server 14 to be protected for access. As a result, the server 14 can determine that the connected client communication apparatus 11 is using a regular IP address, and by using this IP address to determine whether access is permitted, information can be provided to the regular user. And the provision of services.

  If a malicious user accesses the server 14 by impersonating an IP address, the server 14 sends authentication information to the remote access device 12 to determine whether the client communication device 11 has the IP address. . Upon receiving this notification, the remote access device 12 determines whether or not there is a communication record of the corresponding IP address, and if there is not, confirms to the server 14 that the IP address is false. Even if the corresponding communication record exists, the line information is searched, and if the corresponding IP address does not match the used line identifier, the server 14 is notified that the used IP address is false.

  When the server 14 sends a request for authentication information, a response cannot be obtained unless the communication device 11 with a forged IP address passes through the remote access device 12. Even in this case, the server 14 determines that the IP address is disguised, and rejects the access from the client. With these processes, even when a malicious user impersonates an IP address, it is possible to prevent access to the server 14 by impersonating a regular user.

Here, there is a threat that a malicious user impersonates the remote access device 12 and attempts to access the server 14 by impersonating a reply that the authentication information is a legitimate IP address. This threat can be solved, for example, by adding a public key to the response from the remote access device 12. In this case, the server 14 needs to hold the public key of the remote access device 12, but generally, the number of remote access devices 12 is considered to be significantly smaller than the number of clients, and the client authentication information is managed. Compared to the above, the amount of required authentication information can be greatly reduced.
Next, a second specific example in the access authentication method of this embodiment will be described.

  In normal IP communication, the client communication device 11 transmits its own IP address indicating the source when accessing the server 14. Therefore, by using the source IP address as authentication information, it is possible to use the authentication without being conscious of the above. In this case, since the client communication device 11 simply starts normal WWW access and the source IP address reaches the server 14, the server 14 authenticates the remote access device 12 with respect to the acquired source IP address. Authentication by the IP address of the client communication device 11 can be performed.

  FIG. 2 shows a flow of an authentication method using the IP address. First, the client communication device 11 issues an access request (B1) to the server 14. At this time, an IP address indicating the transmission source is added to the access request (B1). This access request (B 1) is sent to the server 14 via the remote access device 12 and the IP communication path 13. Upon receiving the access request (B1), the server 14 identifies the source IP address added to the access request (B1) and sends the IP address itself as authentication information (B2) to the remote access device 12 for authentication. Request processing.

  Receiving the authentication information B2, the remote access device 12 executes authentication processing based on the authentication information appropriateness determination based on the communication and connection information of the client communication device 11, and sends the authentication processing result (+ electronic signature) B3 to the server 14. Notice. Upon receiving this notification, the server 14 determines from the authentication processing result B3 whether the access request source or the communicating client communication device 11 is an authorized user or an unauthorized user, and if it is an authorized user, connects the client communication device 11 and a line. The communication is enabled (B4).

Next, a third specific example in the access authentication method of this embodiment will be described.
In this specific example, the user of the client communication device 11 has a single account corresponding to a unique account name on the network, for example, an e-mail address, and the server 14 that is an access protection target device goes to the WWW service with a single account. Suppose you decide whether to allow or not. Further, the user of the client communication device 11 has the same single account in both the remote access device 12 which is a network connection device and other servers, and the password for this single account is different for each remote access device and server. Because it is complicated to manage, it is assumed that you want to decide a password uniquely.

  On the other hand, it is assumed that the remote access device 12 that is a network connection device is authenticated by a single account when the client communication device 11 requests connection to the remote access device 12. Assume that the remote access device 12 manages a pair of an authenticated single account and a line identifier (telephone number or the like) as line information for the client communication apparatus 11 that is normally authenticated by a single account.

  When the authenticated client communication apparatus 11 connects to the server 14 that is an access protection target, it notifies a single account as authentication information. At the time of this notification, the remote access device 12 stores the single account and the identifier of the used line as a communication record together with the communication contents. The server 14 as an access protection target sends the communication contents and the sent single account as authentication information to the remote access device 12 in order to confirm whether the notified single account is authentic.

  Upon receiving this authentication information, the remote access device 12 searches the communication record to confirm that the corresponding communication record exists, searches the line information, and compares the single account with the line identifier. It is confirmed that the single account sent by the client communication device 11 is authentic. If the corresponding communication record does not exist, or if the single account and the line identifier are different, the remote access device 12 determines that the single account is false.

  As a result of the authentication processing, the remote access device sends information indicating whether the single account is genuine or fake to the access protection target server 14, so that the client communication device 11 to which the server 14 is connected uses a regular single account. It is possible to determine whether or not the user is authorized, and to determine access permission using the single account, information and services can be provided to authorized users. According to this authentication method, the server 14 does not need to manage the password for the single account of the client communication device 11, and the user sets the password for the remote access device 12, so that all servers using this authentication method can be used. Can be accessed.

In the above embodiment, the network connection device 12 can provide an authentication function as a service. FIG. 3 shows a processing flow of the network connection device 12 in this case.
The network connection device 12 first monitors an access request from the client communication device 11 to the access protection target device 14 (step S11), and holds the communication and connection information of the client communication device 11 when there is an access request. (Step S12). Subsequently, the authentication information received from the access protection target device 14 in response to the access request from the client communication device 11 is monitored (step S13), and when the authentication information is received. Performs authentication processing based on the determination of whether or not the authentication information is appropriate based on the communication and connection information of the client communication device 11 held in advance (step S14). If there is communication and connection information corresponding to the authentication information as a result of authentication, it is determined to be appropriate, and if there is no corresponding communication and connection information, it is determined to be invalid, and each determination result is subject to access protection. The device 14 is notified (step S15).

  As described above, the access protection target device 14 provides access authentication management for a large number of client communication devices by providing the service for performing the authentication process of the access protection target device 14 in the network connection device 12 and notifying the authentication result. And unauthorized access can be surely eliminated.

(Second Embodiment)
FIG. 4 is a diagram showing a network system configuration and an access authentication method sequence according to the second embodiment of the present invention. In this network system, as in the first embodiment, a client communication device 11 that is a user terminal is connected to a network connection device 12 through a telephone line, for example, and this network connection device 12 is protected for access via an IP communication path 13. It is connected to a target device (for example, a WWW server) 14.

  The network connection device 12 connects the client communication device 11 to the access protection target device 14 and enables communication between the two by line connection. In the present invention, the client communication device 11 replaces the access protection target device 14. It has the authentication function which authenticates whether or not is a regular user.

Hereinafter, the authentication function of the present invention will be described in accordance with the sequence shown in FIG.
The network connection device 12 holds communication and connection information of the client communication device 11 (for example, an IP address of an authentication client, information on a session, a telephone number or information that can uniquely identify a telephone number). When there is a server connection request C1 from the client communication device 11, the access protection target device 14 transmits an authentication information request C2 to the client communication device 11.

  Here, the network connection device 12 detects the transmission of the authentication information request C2 from the access protection target device 14 to the client communication device 11 and the response C3 from the client communication device 11 to this authentication information requirement C2, and the client communication device 11 receives authentication information response, the authentication processing is performed on the received authentication information based on the communication and connection information of the client communication device 11, and the authentication processing result C4 is sent to the access protection target device 14. Notice.

Upon receiving this notification, the access protection target device 14 determines from the authentication processing result C4 whether the client communication device 11 as the access request source is a regular user or an unauthorized user, and if it is a regular user, connects the client communication device 11 and a line. The communication is enabled (C5).
A first specific example in the access authentication method of this embodiment will be described.

  As in the first specific example of the access authentication method of the first embodiment, the server 14 that is the access protection target accesses the WWW service provided by itself by the IP address of the client communication device 11 to which the server 14 is connected. Suppose you decide whether to allow or not. It is assumed that the remote access device 12 that is a network connection device manages, as line information, a set of a line identifier (telephone number or the like) to which the authentication client is connected and an IP address used by the authentication client.

  When the client communication device 11 connects to the server 14 to be protected for access, it notifies its own IP address information as authentication information. At the time of this notification, the remote access device 12 searches the line information, confirms that the combination of the used line and the IP address exists, and if it exists, determines that the IP address is not impersonated. If the line information is searched and it is determined that the line being used does not have the corresponding IP address, it is determined that the IP address is impersonated. By adding the determination as to whether or not the IP address is impersonated to the communication from the client communication apparatus 11 to the server 14 as an authentication processing result, the server 14 can check whether the IP address is authentic. Become.

  Here, when the IP address is disguised, there is a method in which the remote access device 12 is configured not to send the authentication information and the authentication processing result to the server 14. When the communication from the client communication device 11 to the server 14 does not reach, the server 14 cannot provide the service, and as a result, the access from the client communication device 11 that impersonates the IP address for the server 14 is excluded. can do.

  If a malicious user attempts to access the server 14 by impersonating the IP address, the client communication device 11 used by the malicious user sends authentication information to the server 14 in response to a request from the server 14. Send to. At this time, the remote access device 12 can detect the authentication information response, search the line information, and confirm that the IP address is impersonated. For this reason, the server 14 notifies the server 14 that the IP address is impersonated as an authentication processing result, or blocks the notification of the authentication information to the server 14 so that the client communication device 11 that impersonates the IP address 14 can be prevented from accessing.

  If this communication does not pass through the remote access device 12, since the authentication processing result is not given to the authentication information, the server 14 determines that the access is an unauthorized user, rejects the access, and impersonates the IP address It is possible to refuse communication from clients using. Thereby, even when a malicious user impersonates an IP address, it is possible to prevent access to the server 14 by impersonating a regular user.

  In the access authentication method of this embodiment, when authentication information is sent from the client communication device 11, authentication is immediately performed by the network connection device 12 through which communication passes, and therefore, compared with the access authentication method of the first embodiment. There is an advantage that the number of types of information to be managed by the network connection device 12 is small. However, when the authentication method differs depending on the server 14, the authentication information to be added by the network connection device 12 cannot be determined in advance, so that there is a problem that it does not function well. When all the access protection target servers perform authentication based on the same data, the access authentication method of the present embodiment enables simple authentication.

  As a second specific example of the access authentication method of the present embodiment, it is conceivable to use a single account as in the second specific example of the access authentication method of the first embodiment. Since it operates in the same manner as the first specific example of the access authentication method, the description thereof is omitted.

Also in the above embodiment, the network connection device 12 can provide an authentication function as a service. FIG. 5 shows a processing flow of the network connection device 12 in this case.
The network connection device 12 first monitors an access request from the client communication device 11 to the access protection target device 14 (step S21), and holds the communication and connection information of the client communication device 11 when there is an access request. (Step S22). Subsequently, the authentication information request from the access protection target device 14 to the client communication device 11 is monitored, and the authentication information sending from the client communication device 11 to the access protection target device 14 is monitored (step S23). In step S24, S25, authentication processing is performed by determining whether or not the authentication information is appropriate based on the communication and connection information of the client communication apparatus 11 held in advance.

  If there is communication and connection information corresponding to the authentication information as a result of authentication, it is determined to be appropriate, and the appropriate determination result is added to the authentication information and notified to the access protection target apparatus 14 (step S26). If there is no corresponding communication and connection information, it is determined to be illegal and the transmission of the authentication information to the access protection target apparatus 14 is blocked (step S27).

  As described above, the network connection device 12 performs the authentication process for the access protection target device 14 and provides a service for notifying the authentication information with the authentication result only when it is appropriate, thereby providing the access protection target device 14. Can be freed from the access authentication management of a large number of client communication devices, and unauthorized access can be reliably eliminated.

Next, as an effect of the invention, in what environment and how the present invention is used will be described in detail.
Generally, a server that is connected to the Internet and is open to the public accepts access from an unspecified number of users. However, depending on the server, there may be cases where it is desired to permit access only to a specific user, or depending on the type of content provided by the server, it is necessary to accurately pass information to the target user.

  Currently, as a mechanism for answering such needs, when a user accesses, a combination of a user ID and a password, or access authentication using an electronic certificate is used. However, with the conventional method, it is possible to impersonate another person (Problem 1), or to use authentication, as long as you have another person's user ID and password or electronic certificate key. Demonstrate that the information management problem (problem 2) that user authentication information must be registered in advance on the server and that the information that needs to be accurately passed to the target user has been passed to the target user. There is a problem (problem 3) that the information is applied to the basis information.

  The present invention uniquely identifies user communication and connection information (eg, IP address of an authentication client, information on a session, telephone number or telephone number) held in a network connection device in addition to authentication in the prior art for access authentication to a server. It is possible to permit only the access of the authorized user from the authorized location (solution of Problem 1). Further, if a trust relationship is established between the server and the network connection device, access authentication can be realized without registering user information on the server side (solution of Problem 2). Further, by performing access authentication using the user's telephone number or information that can uniquely identify the telephone number, high-level authentication linked to the user's location information becomes possible (solution of Problem 3).

  The present invention is not limited to the above embodiment. For example, the present invention is not limited to an IP communication path or the Internet, but can be applied to a communication path using another protocol or a network such as a LAN or WAN.

The figure which shows the sequence of the network system structure of 1st Embodiment which concerns on this invention, and an access authentication method. The figure which shows the sequence of the authentication method using an IP address with the system configuration | structure of the said 1st Embodiment. The flowchart which shows the flow of a process in the authentication service which can be implemented with the network connection apparatus of the said 1st Embodiment. The figure which shows the sequence of the network system structure of 2nd Embodiment which concerns on this invention, and an access authentication method. The flowchart which shows the flow of a process in the authentication service which can be implemented with the network connection apparatus of the said 1st Embodiment.

Explanation of symbols

  DESCRIPTION OF SYMBOLS 11 ... Client communication apparatus (user terminal), 12 ... Network connection apparatus, 13 ... IP communication path, 14 ... Access protection object apparatus (WWW server).

Claims (9)

Used in a network system that performs connection and communication control between an access protection target device and a client communication device by a network connection device arranged on the network,
When the access protection target device has an access request addressed to the own device from the client communication device, the source address information added to the access request is transmitted as authentication information to the network connection device;
The network connection device accepts the authentication information and executes authentication, and transmits the authentication result to the access protection target device;
The access protection target device determines whether or not the access of the client communication device is unauthorized based on the authentication result, and blocks the access when it is determined to be unauthorized,
An access authentication method for a network system, comprising: Used in a network system that performs connection and communication control between an access protection target device and a client communication device by a network connection device arranged on the network,
When the access protection target device requests authentication information from an access source or a communicating client communication device and receives authentication information from the client communication device in response to the request, the authentication information is sent to the network connection device. Sending to
The network connection device accepts the authentication information and executes authentication, and transmits the authentication result to the access protection target device;
The access protection target device determines whether the access or communication of the client communication device is unauthorized based on the authentication result, and if it is determined to be unauthorized, blocks access or communication;
An access authentication method for a network system, comprising: Used in a network system that performs connection and communication control between an access protection target device and a client communication device by a network connection device arranged on the network,
The access protection target device requests authentication information from an access source or a communicating client communication device;
An authentication information request to the client communication device of the access protection target device and authentication information transmitted from the client communication device in response to the request is detected and authentication is performed. If the authentication result is appropriate, authentication is performed. The result is added to the authentication information and transmitted to the access protection target device. In the case of fraud, the authentication information is transmitted to the access protection target device without adding the authentication result, or the authentication information transmission is blocked. about,
The access protection target device determines whether the access or communication of the client communication device is illegal based on the authentication result added to the information together with the authentication information. If it is determined to be illegal, the access or communication is blocked. To do,
An access authentication method for a network system, comprising: Used in a network system that performs connection and communication control between an access protection target device and a client communication device by a network connection device arranged on the network,
The network connection device performs an authentication service for performing authentication processing on the client communication device on behalf of the access protection target device, and the service content from the access protection target device to an access source or a communicating client communication device An access authentication method for a network system, wherein when authentication information obtained by request is received, authentication is executed, and the authentication result is transmitted to the access protection target device. Used in a network system that performs connection and communication control between an access protection target device and a client communication device by a network connection device arranged on the network,
The network connection device performs an authentication service for performing authentication processing on the client communication device in place of the access protection target device, and the service content is from the access protection target device to an access source or a communicating client communication device. Authentication information request and authentication information response from the client communication device are automatically detected to perform authentication, and if the authentication result is appropriate, the authentication result is added to the authentication information and the access protection target An access authentication method for a network system, characterized in that authentication information is transmitted to the access protection target device without adding an authentication result in the case of fraud, or transmission of authentication information is blocked.   6. The network according to claim 1, wherein at least a part of the network is operated by an Internet protocol (IP), and the authentication is performed based on an IP address and connection line information of the client communication device. Network system access authentication method.   6. The network system access authentication method according to claim 1, wherein the network connection device executes an authentication process based on an account previously given to the client communication device and an identifier of a connection line. .   8. The network system access authentication method according to claim 7, wherein the network connection device uses a password together with the authentication processing.   6. The network system access authentication method according to claim 1, wherein the network connection apparatus adds an electronic signature when transmitting an authentication result to the access protection target apparatus.

Images