JP2006115033A - Automatic setting system and method of user information - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a DHCP (Dynamic Host Configuration Protocol) server in which user information corresponding to user authentication can be set automatically for a terminal by transmitting set information corresponding to a received user name to a DHCP client while including in the message of DHCP. <P>SOLUTION: The automatic setting system of user information comprises an information data base 30 having an authentication function of a user and information about the user, a DHCP server 20 for acquiring relevant information by communicating with the information data base and authenticating the user, and a DHCP client 10 communicating the user information and authentication information with its DHCP server. The server has a function for discriminating information for inquiring the database from information for processing the information received from the client. The server has a function for converting a signal including user information from the client into such a format as the information database can be identified. The client and server have a function for carrying the user information in the DHCP message. Since a terminal authentication function is provided simultaneously, set information adaptable to the information both of the user and the terminal can be communicated. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention performs user authentication in a format in which a client performs an operation on transmission information from a server and transmits the result to the server in the DHCP protocol that can automatically set terminal setting information. The present invention relates to an automatic setting technique for user information linked to authentication for enabling.

  In conventional DHCP (Dynamic Host Configuration Protocol), when an authentication function is added, identification based on a MAC address has been the focus. However, a system has emerged in which an IP address and DNS server address are paid out by DHCP after authentication by a user name and password by a user authentication function (for example, see Non-Patent Document 1). However, in this system, the information to be paid out is the IP address and DNS server address information, and the purpose of cooperation with user authentication is only management of information on which IP address has been paid to whom. On the other hand, in RFC 3315, the DHCP authentication method (for example, see Non-Patent Document 2) is an authentication method for mutual authentication between terminals, although provision for mutual terminal authentication between the client and the server is made. The purpose is to prevent spoofing of servers and terminals, and it is impossible to automatically set the information registered for each user by authenticating the user.

  The above non-patent document 1 is a unique standard in which the IP address registered in DHCP and the information of DNS server address are delivered and managed to the terminal authenticated by linking the user authentication function and the DHCP server function. DHCP server. This is a system for managing information on who has paid out which IP address, but does not pay out the setting information related to the user although user authentication is used. Therefore, since there is no function for transmitting setting information related to the user, it is impossible to realize this system.

In Non-Patent Document 2, Delayed authentication is specified as one protocol of the authentication function in the newly specified DHCP. A DHCP client and a DHCP server hold a shared key in advance, calculate a hash value of a DHCP message based on the shared key, and add it at the time of transfer. This is a method for performing message integrity and mutual authentication of terminals. In this case, there is a drawback that it is not possible to provide a service linked with another system in that it is a closed authentication system that cannot be linked with an external authentication server such as a conventional information database. In addition, although it can be used for terminal authentication, it does not incorporate a user authentication mechanism, so it is not possible to pay out different setting information for each user aiming to realize this system.
VaitalQIP, http: //www.sw.nec.co.jp/middle/WebSAM/products/QIP/index.html Droms, R., Bound, J., Volz, B., Lemon, T., Perkins, C. and M. Carney, ochDynamic Host Configuration Protocol for IPv6 (DHCPv6) capability och, RFC3315, July 2003.

  In an existing automatic setting system using DHCP, user information corresponding to a user to be used for a terminal cannot be automatically set.

  An object of the present invention is to provide a user information automatic setting system and an automatic setting method capable of automatically setting setting information for a different terminal for each user through user authentication for the terminal.

  In order to solve the above problems, the present invention provides an information database that possesses a user authentication function and information related to the user, a DHCP server that acquires the related information by communicating with the information database and authenticating the user, It is assumed that the system includes a DHCP client that communicates user information and authentication information with the DHCP server.

  Further, the DHCP server has a function of discriminating information received from the DHCP client from information processed on the DHCP server and information inquired from the information database. Further, the DHCP server has a function of converting a signal including user information from the DHCP client into a format that can be identified by the information database. The DHCP client and the DHCP server have a function of carrying user information in the DHCP message. In addition, by having a terminal authentication function at the same time, it is possible to communicate setting information adapted to both user and terminal information.

  As described above, the present invention is characterized by the following user information automatic setting system and method.

(Invention of the system)
(1) An automatic setting system for user information in a DHCP client server system comprising a DHCP server and a terminal having a DHCP client function,
An information database with a user authentication function and a setting information holding function for users is provided on the network.
When the terminal is connected to the network, the DHCP client function sends a DHCP message including a user name, a key for authentication, and information requested by the DHCP client function to the DHCP server by the DHCP client function. Providing means,
When receiving the DHCP message, the DHCP server provides a message information determination list for determining whether the information should be returned or information to be acquired from the information database, and the determination result based on the list is transmitted to the information database. The information to be provided is provided with means for converting the information database into a format that can be received,
The information database, when receiving the message information, provides means for performing user authentication and returning setting information corresponding to the user name to the DHCP server,
The DHCP server includes setting information corresponding to the received user name included in the DHCP message and transmits the DHCP client terminal to automatically set user information corresponding to user authentication for the terminal. Provided
It is characterized by that.

  (2) In the above (1), the DHCP server is provided with means for discriminating information to be responded and information for making an inquiry to the information database from user information or acquisition request information included in the received message. It is characterized by that.

  (3) In the above (1), the DHCP server converts the user authentication information and the setting information request message received from the terminal into a form used when performing user authentication and information acquisition request with the information database. It is characterized in that means for performing the above is provided.

  (4) In the above (1), the DHCP server and the terminal are provided with means for transmitting and receiving a user name used for authentication and a key for authentication in a DHCP message.

  (5) The configuration described in any one of (1), (2), (3), and (4) above, wherein the DHCP server and the terminal have authentication information for terminal authentication. .

(Invention of method)
(6) A method for automatically setting user information in a DHCP client server system comprising a DHCP server and a terminal having a DHCP client function,
An information database with a user authentication function and a setting information holding function for users is provided on the network.
When the terminal is connected to the network, the DHCP client function sends a DHCP message including a user name, a key for authentication, and information requested by the DHCP client function to the DHCP server by the DHCP client function. Set a step,
When receiving the DHCP message, the DHCP server provides a message information determination list for determining whether the information should be returned or information to be acquired from the information database, and the determination result based on the list is transmitted to the information database. To convert the information to a format that can be received by the information database;
The information database, when receiving the message information, provides a step of performing user authentication and returning setting information corresponding to the user name to the DHCP server;
The DHCP server includes setting information corresponding to the received user name included in the DHCP message and transmits the DHCP client terminal to automatically set user information corresponding to user authentication for the terminal. Provided
It is characterized by that.

  (7) In the above (6), the DHCP server includes a step of discriminating information to be responded and information for making an inquiry to the information database from user information or acquisition request information included in the received message. It is characterized by that.

  (8) In the above (6), the DHCP server converts the user authentication information and the setting information request message received from the terminal into a form used when performing user authentication and information acquisition request with the information database. The step which performs is provided.

  (9) In the above (6), the DHCP server and the terminal are provided with a step of transmitting and receiving a user name used for authentication and a key for authentication in a DHCP message.

  (10) The configuration described in any one of (6), (7), (8), and (9) above, wherein the DHCP server and the terminal have authentication information for terminal authentication. .

  As described above, according to the present invention, user information can be automatically set in a DHCP client server system including a DHCP server and a terminal having a DHCP client function.

  In the first embodiment, after performing user authentication using the information database, the DHCP server can acquire the setting information based on the user information, and the setting information based on the user information is transmitted to the DHCP client using DHCP. It is possible to automatically set information based on user information of a terminal having a DHCP client.

  In the second embodiment, it is possible to determine whether the information set by the DHCP server for the DHCP client is processed by the DHCP server or to go to the information database and to distribute the setting information in a distributed manner.

  In the third embodiment, the information acquired from the DHCP message received from the DHCP client is converted into a form that can be understood by the information database by the DHCP server by converting the information related to the user name, the authentication key, and the information to be acquired from the information database. The information received by the DHCP server from the information database can be converted into a form understandable to the DHCP client and transmitted to the DHCP client.

  In the fourth embodiment, a user name and an authentication key can be transmitted and received in a DHCP message.

  In the fifth embodiment, terminal authentication can be performed simultaneously with user authentication by a DHCP message.

(Embodiment 1)
FIG. 1 is a system configuration diagram showing an embodiment of the present invention, and corresponds to claim 1 and the like.

  In the figure, a system configuration including a communication interface with a DHCP client 10, a DHCP server 20, and a back-end information database 30 is shown. The DHCP client 10 and the DHCP server 20 have an authentication function described in RFC3118 or RFC3315. The information database 30 has a challenge / response format user authentication function and has setting information for each user. These apparatuses communicate with IPv4 or IPv6.

  The CHAP method is defined as a new protocol using the Challenge / Response method in the DHCP Authentication option.

  The DHCP client 10 includes a message generation function (corresponding to claim 4) 10A including a user name and the like in order to realize the client function of the DHCP client 10. When the DHCP client 10 connects to the network, the message generation function 10A generates a DHCP message including, as user identification information, a user name, an authentication key, and information requested by the DHCP client function.

  As a function of the DHCP server 20, a message determination function (corresponding to claim 2 etc.) 20A, a message conversion function (corresponding to claim 3 etc.) 20B, a message generation function including a user name and a key for authentication (claim) 20C). Communication between the DHCP client 10 and the DHCP server 20 is performed using DHCP.

  In FIG. 2, the setting information delivery sequence in the case of IPv6 compatible DHCP is given as an example. Among the sequences of Solicit / Advertise / Request (Information-request) / Reply, DHCP is performed between Request (Information-request) / Reply. The server 20 executes an authentication / authentication result sequence with the information database 30. FIG. 3 shows a DHCP payout sequence in the case of IPv4, which also corresponds to Discover / Offer / Request / Ack. At this time, the DHCP server 20 plays a role of data relay between the DHCP client 10 and the information database 30. However, it is also possible to manage information by the DHCP server 20 itself and perform payout according to the user identifier.

  The outline of the DHCP payout sequence using the CHAP method will be described below with reference to FIG. Note that the sequence is similar in the case of FIG.

  First, the DHCP client 10 transmits a Solicit message with an Authentication option (S1). Upon receiving this, the DHCP server 20 generates an Identifier and Challenge value (S2), and transmits an Advertise message having an Authentication option including the information to the DHCP client 10 (S3). The DHCP client 10 that has received the Advertise calculates a Response value from the Identifier and Challenge value received using a secret and hash function that are statically or dynamically owned in advance (S4), and the client statically or dynamically An Authentication option in which information User-Name for identifying the owned user is embedded is transmitted in the Request message (S5). The DHCP server 20 that has received the Request message extracts the Identifier, User-Name, and Response values as information necessary for authentication from the received message, and matches the Challenge value that the DHCP server 20 manages in association with the Identifier. Is sent to the information database 30 to request authentication (S6). At this time, a request message for setting information other than the authentication information may be included. The information database 30 requested for authentication authenticates the user by CHAP authentication. When the user authentication is successful, the information database 30 transmits information related to the user held in the information database 30 together with the authentication success message to the DHCP server 20 (S7). The information related to the user transmitted from the information database 30 may be only a message requested from the DHCP server 20, or may include other information owned by the information database 30. If the authentication fails, an authentication failure message is transmitted to the DHCP server 20.

  The DHCP server 20 that has received the authentication success message and the setting information transmits a Reply message to which the DHCP option converted from the Authentication option indicating the authentication success and the setting information is added to the DHCP client 10 (S8). Similarly, the DHCP server 20 that has received the authentication failure message transmits a Reply message with an Authentication option indicating the authentication failure to the DHCP client 10.

  The DHCP client 10 that has received the Reply message with the authentication success sets the received setting information, and the DHCP client 10 that has received the Reply message with the authentication failure discards the message.

  FIG. 4 shows a re-authentication sequence by the server 20. At the time of re-authentication, the DHCP server 20 issues a re-authentication request to the DHCP client 10 at some timing. First, when re-authentication is performed, the DHCP server 20 generates an identifier and a challenge value (S11). The DHCP server 20 generates a Reconfigure message with an Authentication option including the Identifier and Challenge value, and transmits it to the DHCP client 10 (S12). The DHCP client 10 that has received Advertise calculates a Response value from the identifier and Challenge value received using a secret and hash function that are statically or dynamically owned in advance (S13), and the client statically or dynamically possesses it. The Authentication option in which information User-Name for identifying the user to be embedded is embedded in the Renew or Information-request message and transmitted to the DHCP server 20 (S14). The DHCP server 20 extracts an Identifier, User-Name, and Response value as information necessary for authentication from the received message, and combines the Challenge value managed by the DHCP server 20 in association with the Identifier in the information database 30. Transmit and request authentication (S15). At this time, a request message for setting information other than the authentication information may be included.

  The information database 30 requested for authentication authenticates the user by CHAP authentication. When the user authentication is successful, the information database 30 transmits information related to the user held in the information database 30 together with the authentication success message to the DHCP server 20 (S16). The information related to the user transmitted from the information database 30 may be only a message requested from the DHCP server 20, or may include other information owned by the information database 30. If the authentication fails, an authentication failure message is transmitted to the DHCP server 20.

  The DHCP server 20 that has received the authentication success message and the setting information transmits an Authentication option indicating a successful authentication and a Reply message with the DHCP option converted from the setting information to the DHCP client 10 (S17). Further, the DHCP server 20 that has received the authentication failure message transmits a Reply message to which the Authentication option indicating the authentication failure is added to the DHCP client 10. The DHCP client 10 that has received the Reply message with the authentication success sets the received setting information, and the DHCP client 10 that has received the Reply message with the authentication failure discards the message.

  FIG. 5 shows the state transition of the DHCP client 10 in the payout sequence of FIG. 2, and FIG. 6 shows the state transition of the DHCP server 20. 7 shows the state transition of the DHCP client 10 in the re-authentication sequence of FIG. 4, and FIG. 8 shows the state transition of the DHCP server 20. FIG. 9 shows a message verification sequence in these state transitions.

  As described above, according to the present embodiment, the DHCP server can acquire the setting information based on the user information after performing the user authentication using the information database, and the setting information based on the user information can be obtained using the DHCP. By transmitting to the client, automatic setting of information based on user information of a terminal having a DHCP client becomes possible.

(Embodiment 2)
The present embodiment corresponds to claim 2 and the like, and in the first embodiment, when the DHCP server 20 communicates with the information database 30, a list of setting information that communicates with the information database 30 included in the DHCP server 20 Is provided with a message discrimination function 20A for discriminating information to be transmitted (see FIG. 1).

The DHCP server 20 holds a list of setting information to be transmitted to the information database 30 in advance, compares the DHCP message received from the DHCP client 10 with the list, and determines information to be transmitted to the information database 30. To do.
The message information discrimination list that the DHCP server 20 has is shown below.

  Therefore, according to the present embodiment, the setting is made by providing a list for determining whether the information set by the DHCP server 20 for the DHCP client 10 is processed by the DHCP server or going to the information database. Allows distributed deployment of information.

(Embodiment 3)
The present embodiment corresponds to claim 3 and the like, and the DHCP server 20 is provided with an information conversion function 20B for the information transmitted to the information database 30 determined in the second embodiment (see FIG. 1). . Thereby, the DHCP server 20 can generate a message used for communication with the information database 30 from the DHCP message according to the information conversion rule.

  The following table shows an example of a conversion rule from a DHCP message to a RADIUS attribute and an accompanying message conversion taking a user name as an example.

  An example of the format structure of the Auth-info field and the RADIUS attribute field in the DHCP message is shown in FIG.

  Therefore, according to the present embodiment, when a DHCP message is acquired from the DHCP client 10, information related to the information that the DHCP server 20 acquires from the information database 30 is the user name, the authentication key, and the information. Can be converted into a form understandable by the information database 30 and transmitted. Conversely, the information received by the DHCP server 20 from the information database 30 can be converted into a form understandable to the DHCP client 10 and transmitted to the DHCP client 10.

(Embodiment 4)
The present embodiment corresponds to claim 4 and the like, and is provided with a message generation function 20C that holds and transmits a user name and authentication key in the DHCP message (see FIG. 1).

  In order to realize this function, the field value of the Authentication option in the CHAP method is defined as follows.

Protocol CHAP
Algorithm 1
RDM 0
And Since the definition of these values conforms to RFC3315, the processing method can be changed by changing the values.

  FIG. 11 shows the format of the Authentication option in which the above values are substituted according to RFC3315. The Auth-info field format in the Authentication option in this CHAP_Authentication is defined as shown in FIG.

  However, MSG_TYPE is an identifier of a message in CHAP_Authentication, and a value (1 octet) specified this time is shown below.

1 Challenge
2 Response
3 Success
4 Failure
Identifier is an identifier called CHAP_ID and is an ID (1 octet) indicating a series of CHAP sequences. This data is randomly generated when the Challenge is generated.

  MSG_length is the total size of the Auth-info field and includes MSG_TYPE, Identifier, MSG_length, and Attribute fields (in octets).

  Attribute is information required for authentication carried in the CHAP_Authentication message, and the detailed format of the Attribute field is shown in FIG. 13 (Variable length).

  However, TYPE indicates the type of information described in Attribute type and Value. The value of TYPE specified this time and Value at that time (1 octet) are shown below.

1 User-Name
3 CHAP-Password
60 CHAP-Challenge
Also, length indicates the message size of this Attribute field, and includes TYPE, length, and Value fields (1 octet).

  Value is a value along the TYPE of Attribute and is as follows.

User-Name Character string in which user name and domain are connected with @ CHAP-Password Response value calculated according to CHAP sequence CHAP-Challenge Challenge value generated on the DHCP server 20 side Here, the Challenge value is generated on the DHCP server 20 side Is a variable length value. A different Challenge value must be generated for each transmission other than retransmission. The challenge value generation method and the response value generation method conform to RFC1994.

FIGS. 14 to 19 show configuration examples of messages in IPv6 (the following parentheses correspond to IPv4) in the payout sequence. 14 shows a Solicit message (Discover), FIG. 15 shows an Advertise message (Offer), FIG. 16 shows a Request message (Request), and FIG. 17 shows a Reply message (Ack).
A configuration example of a Reconfigure message in IPv6 in the re-authentication sequence is shown in FIG.
With each message configuration described above, it is possible to transmit / receive a user name and a key for authentication within a DHCP message.

(Embodiment 5)
This embodiment corresponds to claim 5 and the like, wherein the DHCP server 20 and the DHCP client 10 have authentication information for terminal authentication.

  It is conceivable to add a hash value of a message for terminal / message authentication to the Auth-info field for storing information for user authentication. In this case, the Auth-info field is defined as shown in FIG. Other fields are the same as those in the first embodiment. The terminal is authenticated between the DHCP client 10 and the DHCP server 20 or between the DHCP client 10 and the information database 30 using the terminal authentication field.

  The handling of the DHCP realm, key ID, and HMAC-MD5 fields specified here, and the message processing conform to the Delayed authentication specified in RFC3315.

  This DHCP message makes it possible to perform terminal authentication simultaneously with user authentication.

1 is a system configuration diagram showing an embodiment of the present invention. A payout sequence in the embodiment (in the case of IPv6). A payout sequence in the embodiment (in the case of IPv4). The re-authentication sequence in the embodiment. The state transition diagram in the payout sequence of the client in the embodiment. The state transition diagram in the payout sequence of the server in the embodiment. The state transition diagram in the re-authentication sequence of the client in the embodiment. The state transition figure in the re-authentication sequence of the server in embodiment. The message verification flowchart in embodiment. An example of the format in a DHCP message. An example of the authentication option format. An example of the Auth-info field format in the Authentication option. Example of detailed format of Attribute field. An example configuration of a Solicit message (Discover) in a payout sequence. Example of configuration of Advertise message (Offer) in payout sequence. 6 shows a configuration example of a Request message (Request) in a payout sequence. 6 shows a configuration example of a Reply message (Ack) in a payout sequence. Configuration example of Reconfigure message in re-authentication sequence. Configuration example of the Auth-info field with the message hash value added.

Explanation of symbols

10 DHCP client 20 DHCP server 30 Information database 10A Message generation function 20A Message discrimination function 20B Message conversion function 20C Message generation function

Claims (10)

An automatic setting system for user information in a DHCP client server system comprising a DHCP server and a terminal having a DHCP client function,
An information database with a user authentication function and a setting information holding function for users is provided on the network.
When the terminal is connected to the network, the DHCP client function sends a DHCP message including a user name, a key for authentication, and information requested by the DHCP client function to the DHCP server by the DHCP client function. Providing means,
When the DHCP server receives the DHCP message, the DHCP server provides a message information determination list for determining whether the information is to be returned or information to be acquired from the information database, and the determination result based on the list is transmitted to the information database. The information to be provided is provided with means for converting the information database into a format that can be received,
The information database, when receiving the message information, provides means for performing user authentication and returning setting information corresponding to the user name to the DHCP server,
The DHCP server includes setting information corresponding to the received user name included in the DHCP message and transmits the DHCP client terminal to automatically set user information corresponding to user authentication for the terminal. Provided
A system for automatically setting user information.   2. The DHCP server according to claim 1, wherein the DHCP server is provided with means for discriminating information to be responded and information for making an inquiry to the information database from user information or acquisition request information included in the received message. Automatic setting system for user information.   The DHCP server according to claim 1, wherein the DHCP server includes means for converting the user authentication information and the setting information request message received from the terminal into a form used when performing user authentication and information acquisition request with the information database. A system for automatically setting user information.   2. The user information automatic setting system according to claim 1, wherein the DHCP server and the terminal are provided with means for transmitting and receiving a user name used for authentication and a key for authentication in a DHCP message.   5. The automatic setting of user information according to claim 1, wherein the DHCP server and the terminal have authentication information for terminal authentication. system. An automatic setting method of user information in a DHCP client server system comprising a DHCP server and a terminal having a DHCP client function,
An information database with a user authentication function and a setting information holding function for users is provided on the network.
When the terminal is connected to the network, the DHCP client function sends a DHCP message including a user name, a key for authentication, and information requested by the DHCP client function to the DHCP server by the DHCP client function. Set a step,
When receiving the DHCP message, the DHCP server provides a message information determination list for determining whether the information should be returned or information to be acquired from the information database, and the determination result based on the list is transmitted to the information database. To convert the information to a format that can be received by the information database;
The information database, when receiving the message information, provides a step of performing user authentication and returning setting information corresponding to the user name to the DHCP server;
The DHCP server includes setting information corresponding to the received user name included in the DHCP message and transmits the DHCP client terminal to automatically set user information corresponding to user authentication for the terminal. Provided
A method for automatically setting user information.   7. The DHCP server according to claim 6, wherein the DHCP server includes a step of determining information to be responded and information for making an inquiry to the information database from user information or acquisition request information included in the received message. To set user information automatically.   7. The DHCP server according to claim 6, wherein the DHCP server includes a step of converting the user authentication information and the setting information request message received from the terminal into a form used when performing user authentication and information acquisition request with the information database. A method for automatically setting user information.   7. The user information automatic setting method according to claim 6, wherein the DHCP server and the terminal have a step of transmitting and receiving a user name used for authentication and a key for authentication in a DHCP message. The user information automatic setting according to any one of claims 6, 7, 8, and 9, wherein the DHCP server and the terminal have authentication information for terminal authentication. Method.

Images