JP2008152570A - Service providing device, authentication method and authentication program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a service providing device, capable of responding to two or more kinds of authentication algorithms and selecting an authentication algorithm according to each terminal to perform authentication. <P>SOLUTION: The service providing device comprises an authentication execution necessity condition information storage means storing information for necessity of authentication for each type of signals received from a terminal for each kind of authentication algorithms; an authentication algorithm determination means for determining the kind of an authentication algorithm the terminal adapts based on a signal received from the terminal; a signal type information acquisition means for acquiring information for the type of the signal transmitted by the terminal from the signal received from the terminal; and an authentication necessity determination means for determining necessity of authentication for the signal received from the terminal in reference to the information of the authentication execution necessity condition information storage means based on the determined kind of algorithm and information acquired by an instruction information acquisition means. <P>COPYRIGHT: (C)2008,JPO&INPIT

Description

  The present invention relates to a service providing apparatus, an authentication method, and an authentication program, and can be applied to authentication for communication from a terminal in a SIP exchange system, for example.

  In a SIP (Session Initiation Protocol) exchange system, communication between a server and a user terminal is prevented in order to prevent unauthorized access from a malfunctioning terminal or unauthorized use of a service by a malicious user impersonating another authorized user. Authenticate about. Authentication is based on the assumption that the authentication algorithm for generating authentication data is provided with a user authentication function that is the same algorithm in both the SIP exchange system and the SIP user terminal. When received, the server confirms the authentication data given to the request signal, thereby authenticating and permitting the requesting user. In other words, unauthorized use of services is prevented by not authorizing a requesting user for a request to which authentication data generated without using a formal authentication algorithm is given. In the SIP exchange system, this authentication function is in response to a request signal (REGISTER request) for registering the user's current location and a call request signal (= INVITE request) for the user to start using the telephone service. Generally, it is implemented.

Therefore, as in the “notification number verification system” described in Patent Document 1, when an IP telephone subscriber terminal makes a call in the SIP server, a method for authenticating whether the calling user is a valid user is known. Proposed.
"Session Initiation Protocol" [IETF RFC3261 June 2002] JP 2006-5880 A

  Today, services provided by SIP exchange systems are diversified, and in addition to telephone connection services, current location information disclosure services (presence services), instant message services, and the like have been provided. SIP defines SUBSCRIBE and PUBLISH requests for presence services, and MESSAGE requests for instant messages. For this reason, it is necessary to perform user authentication for these requests to prevent unauthorized use of the service. In addition, services provided by a plurality of SIP exchange service providers are different for each provider, and various user terminals are accommodated. Some terminals may not have a user authentication function for all requests. When the SIP exchange system authenticates to this user terminal, the user of this terminal cannot use any service. For this reason, depending on the service operation policy of each business operator, the condition of whether or not the authentication is necessary depends on which request signal from the SIP user terminal is subjected to the user authentication process. In addition, in order to enhance the security of authentication, it is expected that the types of authentication algorithms for generating authentication data will increase in the future.

  However, the “notification number verification system” described in Patent Document 1 can only handle a single type of authentication algorithm for one request. Therefore, there is a demand for a service providing apparatus, an authentication method, and an authentication program that can perform authentication by selecting an authentication algorithm corresponding to a plurality of types of authentication algorithms for each user or each terminal.

  The service providing apparatus according to the first aspect of the present invention includes: (1) an authentication implementation necessity condition information storage unit that stores, for each type of authentication algorithm, information on necessity of authentication for each type of signal received from a terminal; 2) Authentication algorithm determination means for determining the type of authentication algorithm adopted by the terminal based on the signal received from the terminal; (3) Type of signal transmitted by the terminal from the signal received from the terminal (4) the authentication execution necessity condition information based on the type of authentication algorithm determined by the authentication algorithm determination unit and the information acquired by the signal type information acquisition unit. Authentication necessity determination means for determining whether or not authentication is necessary for a signal received from the terminal with reference to information in the storage means; and (5) determination as to whether the authentication is necessary Stage by, if it is determined authentication required, using the authentication algorithm of the type determined by the authentication algorithm determining means, characterized in that it has an authentication means for authenticating the communication from the terminal.

  The authentication method of the second aspect of the present invention comprises (0) authentication execution necessity condition information storage means, authentication algorithm determination means, signal type information acquisition means, authentication procedure determination means, and authentication means. The authentication implementation necessity condition information storage means stores authentication necessity information for each type of authentication algorithm for each type of signal received by the service providing apparatus from the terminal, and (2) the authentication algorithm determination means The service providing apparatus determines the type of the authentication algorithm adopted by the terminal from the signal received from the terminal, and (3) the signal type information acquisition means is a signal received by the service providing apparatus from the terminal. From the information about the type of signal transmitted by the terminal, the authentication procedure determination means, the type of authentication algorithm determined by the algorithm determination means, and the above Based on the information acquired by the order information acquisition means, the service providing apparatus refers to the information in the authentication execution necessity condition information storage means, and the signal provided by the service providing apparatus from the terminal is required for authentication. (4) If the authentication means determines that authentication is required by the authentication necessity determination means, the authentication means uses the algorithm of the type determined by the authentication algorithm determination means from the terminal. It is characterized in that authentication is performed for the communication.

  The authentication program of the third aspect of the present invention provides (0) a computer provided in a service providing apparatus that provides a service to a terminal, (1) information on necessity of authentication for each type of signal received from the terminal, Authentication execution necessity condition information storage means stored for each type of authentication algorithm, (2) Authentication in which the service providing apparatus determines the type of authentication algorithm adopted by the terminal based on the signal received from the terminal Algorithm determination means, (3) signal type information acquisition means for acquiring information related to the type of signal transmitted by the terminal from the signal received by the service from the terminal, and (4) acquired by the algorithm information acquisition means. Based on the acquired information and the information acquired by the signal type information acquisition means, referring to the authentication execution necessity condition information, and providing a service An authentication necessity determination unit that determines whether or not authentication is necessary for the signal received from the terminal; and (5) when the authentication necessity determination unit determines that authentication is necessary, the authentication algorithm determination unit determines It is characterized by functioning as an authentication means for authenticating communication from the terminal using the algorithm of the type specified.

  According to the present invention, when the service providing apparatus supports a plurality of types of authentication algorithms, authentication can be performed by selecting an authentication algorithm corresponding to each terminal or the like.

(A) First Embodiment Hereinafter, a first embodiment of a service providing apparatus, an authentication method, and an authentication program according to the present invention will be described in detail with reference to the drawings.

(A-1) Configuration of the First Embodiment FIG. 2 is a block diagram showing the overall configuration of the SIP system of this embodiment.

  The SIP exchange system 100 accommodates the SIP user terminal 400 and provides an exchange service by SIP. The IP network 300 is an IP network for allowing the SIP exchange system 100 and the SIP user terminal 400 to communicate with each other. For example, the IP network 300 includes a network device capable of IP communication such as a router or a switching hub.

  The SIP user terminal 400 is a SIP client terminal, and software for communicating with the SIP exchange system 100 and receiving a service by SIP is installed in an information processing terminal such as a personal computer or a mobile phone that can be connected to the IP network 300. Is.

  The SIP exchange maintenance terminal 200 transmits an operation signal input by a system maintenance person to the SIP exchange system 100, receives a message such as a failure from the SIP exchange system 100, and displays it on the system maintenance person. To do. The SIP exchange maintenance terminal 200 is installed in an information processing terminal such as a personal computer or a mobile phone that can be connected to the IP network 300 with software that communicates with the SIP exchange system 100 and performs transmission / reception and control of information. .

  FIG. 1 is a block diagram showing the internal structure of the SIP exchange system 100 and the connection with the SIP user terminal 400.

  The SIP exchange system generally has a configuration based on the RFC 3261 description of IETF, and can be represented by a SIP layer (layer) structure. In this embodiment, therefore, the inside of the SIP exchange system 100 is divided into three layers, that is, an application layer 110, a transaction layer 120, and a transport layer 130, based on the description of RFC3261.

  The application layer 110, the transaction layer 120, and the transport layer 130 are, for example, information processing devices that can be connected to the IP network 300 such as a personal computer (not limited to one, but a plurality of devices can be distributedly processed. In addition, it is constructed by installing a program for each layer such as the authentication execution necessity determination program (including fixed data) of the embodiment. It can be expressed as The application layer 110, the transaction layer 120, and the transport layer 130 correspond to a CPU (Central Processing Unit) and the like in hardware, and can correspond to various programs in software. In addition, the generation scenario management table 111c, the user authentication implementation necessity condition table 111e, the default algorithm information 111f, and the like in the application layer 110 are storage means. In terms of hardware, volatile storage means (RAM and the like), non-volatile It is constituted by a characteristic storage means (ROM, hard disk, etc.), and various files correspond to software.

  The transport layer 130 has functions such as receiving data from the SIP user terminal 400 and delivering the received SIP signal to the transaction layer 120.

  The transaction layer 120 has a function of searching for a transaction corresponding to the received signal. If there is a transaction as a result of the search, the transaction is searched. If there is a transaction, processing with the corresponding SIP user terminal 400 is performed according to the state of the transaction. If there is no transaction, a new transaction is generated and processing is performed. Then, the SIP signal is delivered to the application layer 110 according to a predetermined condition.

  The application layer 110 has a user authentication function of a signal transmission source, a call connection service, etc. according to the type of the received SIP signal, the parameter content set on the signal, and the program state held by the application layer 110 itself. It is responsible for providing various services. The application layer 110 includes a signal distribution function unit 111, a service scenario function unit 112, a user data management unit 113, and a user authentication function unit 114.

  The service scenario function unit 112 includes a plurality of service scenarios for realizing each service by SIP such as a telephone connection service, a current location information disclosure (presence) service, an instant message service, and the signal distribution function unit 111 starts the service. When the requested SIP signal is received, a service scenario corresponding to the requested service is generated, and thereafter, the SIP is changed while changing the state of the corresponding service scenario according to the received SIP signal notified from the signal distribution function unit 111. The requested service is provided to the SIP user terminal 400 by transmitting the response signal and the SIP request signal to the SIP user terminal via the signal distribution function unit 111, the transaction layer 120, and the transport layer 130. .

  The user authentication function unit 114 has a user authentication function, and refers to the parameters set in the SIP signal input from the signal distribution function unit 111 to authenticate the request transmission source user. When user authentication is performed for the location information registration request (REGISTER signal), the user authentication function unit 114 sets the authentication execution result as a response signal of the REGISTER request, and the signal distribution function unit 111, the transaction layer 120, The data is transmitted to the SIP user terminal 400 via the transport layer 130. In addition, when user authentication is performed for a service start request (INVITE, MESSAGE request, etc.), the user authentication function unit 114 does not successfully authenticate the request only when the authentication execution result is unsuccessful (disapproved). When the authentication execution result is successful (authorization), a service start request signal is delivered from the signal distribution function unit 111 to the service scenario function unit 112, and the service scenario operation is performed. The response signal for the service start request is transmitted.

  The user data management unit 113 manages data of all users accommodated in the SIP exchange system 100. As user data, information for identifying a user such as a telephone number and a user account, user contract information of the user, and authentication data information used in user authentication are managed. When a service scenario for a user is executed or when user authentication is performed, the user data management unit 113 discloses information about the user in response to a request from the service scenario function unit 112 and the user authentication function unit 114. To do.

  The signal distribution function unit 111 functions as an interface between the transaction layer 120 and the application layer 110, and includes a SIP signal transmission / reception processing unit 111a, a service scenario management unit 111b, and a user authentication execution necessity determination processing unit 111d. . The signal distribution function unit 111 first receives the SIP signal delivered from the transaction layer 120 in the application layer 110. Then, the request type and the set parameters are confirmed for the received SIP signal. If the signal is related to the service scenario that has already been generated, the SIP received by the service scenario function unit 112 is received. If the signal is a request signal that requires user authentication, the user authentication function unit 114 is notified of the received SIP signal.

  Further, the signal distribution function unit 111 receives the SIP request number and the SIP response signal transmission request to the SIP user terminal 400 from the service scenario function unit 112 and the user authentication function unit 114, and inputs them to the transaction layer 120. The SIP user terminal 400 is notified via the transport layer 130. Further, the signal distribution function unit 111 receives the result of user authentication performed by the user authentication function unit 114, and when the authentication is successful (authorization), in the case of a location information registration request (REGISTER signal), the user data management unit 113. In the case of a service start request (INVITE, MESSAGE signal, etc.), the service scenario function unit 112 is requested to generate a new service scenario. The location registration request and the service scenario generation request are made by notifying the received SIP signal.

  The SIP signal transmission / reception processing unit 111a receives an SIP signal from the transaction layer 120 as an interface with the transaction layer 120 in the application layer 110, and distributes the SIP signal to the service scenario function unit 112 and the user authentication function unit 114. In response to a request from the function and the service scenario function unit 112 or the user authentication function unit 114, the transaction layer 120 is requested to transmit a SIP signal.

  The service scenario management unit 111b has a function of managing the scenario generated by the service scenario function unit 112, and includes a generation scenario management table 111c.

  FIG. 3 is a diagram illustrating the internal structure of the service scenario management unit 111b and the generation scenario management table 111c, and information transmitted / received between the service scenario function unit 112 and the SIP signal transmission / reception processing unit 111a. The generation scenario management table 111c is a table having the contents of the Call-ID header indicating the identification number of the call from the SIP user terminal 400 and the information on the logical number of the service scenario corresponding to the call with the corresponding Call-ID. Each element of the generation scenario management table 111c requests the service scenario management unit 111b to register when a service scenario is generated at the start of service from the service scenario function unit 112, and a table element is added (S401). When the service scenario is released at the end of the service, deregistration is requested and the table element is deleted (S402). When the SIP signal transmission / reception processing unit 111a receives an inquiry (S403, S405) as to whether a corresponding service scenario exists using the Call-ID as a key, the service scenario management unit 111b The information in the table 111c is searched, and as a result, the presence / absence of the corresponding scenario is answered (S404, S406).

  FIG. 4 is a diagram illustrating an internal structure of the user authentication execution necessity determination processing unit 111d. The user authentication execution necessity determination processing unit 111d has a function of receiving the received SIP signal notified from the SIP signal transmission / reception processing unit 111a as a user authentication execution necessity determination request and determining whether or not user authentication needs to be performed. , A user authentication implementation necessity condition table 111e and default algorithm information 111f.

  FIG. 4 shows an example of the contents of the user authentication implementation necessity condition table 111e and the default algorithm information 111f. In this embodiment, it is assumed that the user authentication function unit 114 corresponds to three user authentication algorithms “algorithm 1”, “algorithm 2”, and “algorithm 3”, and the SIP user terminal 400 has It is assumed that at least one of them is supported.

  The user authentication implementation necessity condition table 111e stores request types (REGISTER, INVITE, etc.) and flag information of “authentication implementation required” or “authentication execution unnecessary” for each authentication algorithm for each request type. Yes. The default algorithm information 111f stores information on any of the user authentication algorithms (algorithms 1 to 3) supported by the user authentication function unit 114.

  When the user authentication implementation necessity determination processing unit 111d accepts the received SIP signal notification from the SIP signal transmission / reception processing unit 111a as a user authentication implementation necessity determination request, the request type and its signal are determined from the requested SIP signal. Information of the algorithm parameter (“Algorithm” parameter described in RFC 3261) set in the authentication header (“Authorization” header described in RFC 3261) is extracted as the algorithm type. At this time, if the authentication header is omitted or the algorithm parameter on the authentication header is omitted, the value set in the default algorithm information 111f is used as the algorithm type. By using the extracted request type and algorithm type, the user authentication execution necessity condition table 111e is searched to obtain the set value of the user authentication execution means condition. When the user authentication execution necessity condition is “authentication execution required”, the user authentication function unit 114 is notified of the SIP signal together with the type of the authentication algorithm, and the user authentication function unit 114 performs user authentication. . When the user authentication execution necessity condition is “authentication execution unnecessary”, the user authentication function unit 114 is not particularly notified of information, and the processing is continued assuming that the user authentication is successful (authorization).

  In the user authentication function unit 114, when the result of the user authentication is success (authorization), the user authentication execution necessity determination processing unit 111d, if the SIP signal is a location information registration request (REGISTER signal), the user data management unit 113. If the SIP signal is a service start request (INVITE, MESSAGE signal, etc.), the service scenario function unit 112 is requested to create a new service scenario.

(A-2) Operation of the First Embodiment Next, the operation of the SIP exchange system 100 of the first embodiment having the above functional configuration will be described with reference to the drawings.

  FIG. 5 and FIG. 6 are flowcharts showing processing for receiving a SIP request signal from the transaction layer 120 and determining user authentication means in the signal distribution function unit 111 inside the application layer 110 of the SIP exchange system 100.

  First, a SIP signal is input from the SIP user terminal 400 to the SIP exchange system 100, and is input to the SIP signal transmission / reception processing unit 111a of the signal distribution function unit 111 via the transaction layer 120 (S501). Here, it is assumed that the SIP exchange system 100 receives a REGISTER signal as a location information registration request from the SIP user terminal 400, and an authentication header is not set in this signal.

  Next, in the SIP signal transmission / reception processing unit 111a, the Call-ID is acquired from the header information of the received SIP signal, and the acquired Call-ID information is input to the service scenario management unit 111b. As a result, an inquiry is made as to whether there is a service scenario corresponding to the Call-ID (S502).

  Upon receiving an inquiry about the presence or absence of a service scenario, the service scenario management unit 111b searches the generated scenario management table 111c using the received Call-ID as a key. If a corresponding service scenario exists, the corresponding scenario is “Yes” If it does not exist, the inquiry result is returned to the SIP signal transmission / reception processing unit 111a as “None” (S503).

  When receiving an answer about the presence / absence of a scenario, the SIP signal transmission / reception processing unit 111a determines whether the scenario corresponding to the answer is “present” or “not present” (S504). When the corresponding scenario is “present”, the received SIP signal is notified to the service scenario management unit 111b (S509). Thereafter, the notified SIP signal is input to the service scenario function unit 112 and used in the service scenario operation.

  On the other hand, when the corresponding scenario is “none”, the SIP signal transmission / reception processing unit 111a notifies the user authentication execution necessity determination processing unit 111d of the received SIP signal. Upon receiving the notification of the received SIP signal, the user authentication implementation necessity determination processing unit 111d starts a user authentication implementation necessity determination procedure (S505), and first extracts request type information from the received SIP signal (S506). ). Here, as described above, the request type of the corresponding SIP signal is REGISTER.

  Next, the user authentication implementation necessity determination processing unit 111d determines whether an authentication header is set in the received SIP signal (S507).

  If the authentication header is not set, the algorithm indicated in the default algorithm information 111f is determined as the user authentication algorithm as the algorithm type (S514). On the other hand, when the authentication header is set, the user authentication implementation necessity determination processing unit 111d further determines whether an algorithm parameter is set in the authentication header (S508). When the algorithm parameter is not set, the algorithm indicated in the default algorithm information 111f is determined as the user authentication algorithm (S514). When the algorithm parameter is set, the user authentication implementation necessity determination processing unit 111d determines the corresponding algorithm as the user authentication algorithm (S510). Here, as described above, since the authentication header is not set in the received SIP signal, the algorithm type is determined as algorithm 1 which is the algorithm indicated in the default algorithm information 111f.

  Next, the user authentication implementation necessity determination processing unit 111d refers to the user authentication implementation necessity condition table 111e using the request type acquired in step S506 and the user authentication algorithm type determined in step S510 or S514, The setting value of the corresponding user authentication execution necessity condition is acquired (S511). Here, if the set value is “authentication not required”, it is considered that the user authentication has been successfully executed (authorized) (S515). On the other hand, if the set value is “authentication required”, the user authentication function unit 114 is notified of the received SIP signal and the user authentication algorithm type determined in step S510 or S514 to request user authentication. (S513).

  Here, since the request type of the received SIP signal is “REGISTER” and the algorithm type of user authentication is “algorithm 1”, the setting value is “authentication required” according to the user authentication execution necessity condition table 111e of FIG. It becomes. Therefore, the user authentication implementation necessity determination processing unit 111d notifies the user authentication function unit 114 that the received SIP signal and the user authentication type is “algorithm 1”, and the SIP exchange system 100 and the SIP user terminal 400 Authentication is performed.

(A-3) Effects of the First Embodiment According to the first embodiment, the SIP exchange system 100 is provided with the user authentication implementation necessity condition table 111e and the default algorithm information 111f, and the SIP user terminal 400 starts the SIP. When the signal is received, the setting value of the user authentication implementation necessity condition table 111e is referred to using the request type and algorithm type as keys. As a result, the type of authentication algorithm supported by each SIP user terminal 400 is different, and even in an environment where a plurality of authentication algorithms are mixed, the SIP exchange system 100 appropriately determines the authentication algorithm and whether or not authentication is necessary. Authentication.

(B) Second Embodiment Hereinafter, a second embodiment of the service providing apparatus, the authentication method, and the authentication program according to the present invention will be described in detail with reference to the drawings.

(B-1) Configuration of Second Embodiment FIG. 7 is a block diagram showing the overall configuration of the SIP system of the second embodiment. The same and corresponding parts as those in FIGS. 1 and 2 in the first embodiment described above are shown with the same and corresponding reference numerals. In the second embodiment, the SIP exchange system 100 includes the maintenance operation function unit 115, so that information stored in the user authentication execution necessity determination processing unit 111d (user authentication execution necessity condition table 111e, default The algorithm information 111f) is updated.

  Hereinafter, the content of the configuration of the second embodiment will be described differently from the first embodiment.

  In the second embodiment, a maintenance operation function unit 115 is added to the SIP exchange system 100 of the first embodiment. The maintenance operation function unit 115 is disposed in the application layer 110. The maintenance operation function unit 115 has a function of changing information in the SIP exchange system 100 and responding to information in response to a request signal from the SIP exchange maintenance terminal 200 to the SIP exchange system 100.

  When changing the information stored in the user authentication implementation requirement table 111e and the default algorithm information 111f, the maintenance operation function unit 115 first receives a request signal from the SIP exchange maintenance terminal 200, and the maintenance operation function unit 115 A signal for changing information is transmitted to the user authentication execution necessity determination processing unit 111d via the SIP signal transmission / reception processing unit 111a of the signal distribution function unit 111, and the change is performed based on the information. The user authentication execution necessity determination processing unit 111d determines whether or not user authentication execution is necessary based on the changed contents immediately after the information is changed.

(B-2) Operation of Second Embodiment Next, the operation of the SIP exchange system 100 of the embodiment having the functional configuration as described above will be described with reference to the drawings.

  Here, an operation when a user inputs a signal for changing the information in the user authentication implementation necessity condition table 111e and the default algorithm information 111f to the SIP exchange maintenance terminal 200 will be described.

  8, FIG. 9, and FIG. 10 are examples of information input in the SIP exchange maintenance terminal 200 when changing the information in the user authentication necessity condition table 111e and the default algorithm information 111f.

  FIG. 8 shows a format of settings input to the SIP exchange maintenance terminal 200. FIG. 9 shows a list of setting contents and setting values of each parameter in the format shown in FIG. Hereinafter, the contents of the setting format of FIG. 8 will be described based on the contents of the parameter list of FIG.

  The first line of the setting format in FIG. 8 sets the number of pieces of information to be changed in the user authentication implementation necessity condition table 111e as a request-number parameter. The second and subsequent lines have a request-method parameter, an algorithm1-condition parameter, and an algorithm2-condition parameter. The request-method parameter sets the request type (REGISTER, INVITE, etc.) of the received SIP signal in the user authentication implementation requirement table 111e. The algorithm1-condition parameter and the algorithm2-condition parameter are set to “0” if authentication is not necessary and “1” if authentication is not necessary, as the necessity of user authentication for algorithm 1 and algorithm 2, respectively. If three or more types of algorithms are supported, an algorithm N-condition parameter (N = 3, 4,. For the last line, the algorithm type set in the default algorithm information 111f is set as the default-algorithm parameter.

  FIG. 10 shows an example of setting change request information in this embodiment, which is described based on the data format shown in FIG. The contents of this setting example will be described below.

  For the first line, “2” is input as the content of the request-number parameter. Therefore, two pieces of information are changed in the user authentication execution necessity condition table 111e, and the contents are input to the second and third lines. For the second line, “REGISTER” is set as the content of the request-method parameter, “0” is set as the content of the algorithm1-condition parameter, “0” is set as the content of the algorithm2-condition parameter, and “0” is set as the content of the algorithm3-condition parameter. Entered. For the third line, “INVITE” is the content of the request-method parameter, “1” is the content of the algorithm1-condition parameter, “1” is the content of the algorithm2-condition parameter, and “1” is the content of the algorithm3-condition parameter. Entered. For the fourth line, “3” is input as the content of the default-algorithm parameter.

  FIG. 11 shows that the information shown in FIG. 10 is input to the SIP exchange maintenance terminal 200 when the information in the user authentication implementation requirement table 111e and the default algorithm information 111f are in the state shown in FIG. It is the figure which showed how it changes when being done.

  In the user authentication execution necessity condition table 111e, for the algorithm type with the request type “REGESTER”, the information of the algorithm 1 is updated from “authentication required” to “no authentication required”, and the information of the algorithm 2 is “authentication executed”. “Authentication is not necessary” is updated from “Required”, and the information of Algorithm 3 is not changed to “Authentication is not necessary”. For the algorithm type whose request type is “INVITE”, the information of algorithm 1 is not changed from “authentication required”, and the information of algorithm 2 is updated from “authentication not required” to “authentication required”. There is no change in “No certification required”. The default algorithm information 111f is updated from “algorithm 1” to “algorithm 3”.

(B-3) Effects of the Second Embodiment According to the second embodiment, not only the same effects as the first embodiment but also the following effects can be achieved.

  In the application layer 110 of the SIP exchange system 100, a maintenance operation function unit 115 is provided, and based on a control signal from the SIP exchange maintenance terminal 200, two pieces of information of the user authentication execution requirement table 111e and the default algorithm information 111f are updated. By performing the above, it is possible to change the user authentication conditions without stopping the system of the SIP exchange system 100.

(C) Other Embodiments (C-1) In each of the above embodiments, the SIP exchange system 100 includes the user authentication execution necessity determination processing unit 111d and selects the authentication means and the necessity of authentication execution. However, the same configuration may be applied to other service providing apparatuses that provide services to user terminals. Examples of other service providing apparatuses include a server that performs communication using HTTP (Hyper Text Transfer Protocol), a RADIUS (Remote Authentication Dial In User Service) server, and a proxy server for various services.

(C-2) In each of the embodiments described above, the user authentication implementation necessity determination processing unit 111d is configured to be included in the SIP exchange system 100, but the function that the user authentication implementation necessity determination processing unit 111d is responsible for. As a single device, for example, a “user authentication execution necessity determination processing device” may be arranged outside the SIP exchange system 100 and connected to the SIP exchange system 100 via the IP network 300. At this time, the SIP authentication system 100 inquires about the user authentication authentication means and the necessity of authentication execution from the SIP exchange system 100 to the above-described user authentication execution necessity determination processing apparatus together with necessary information such as request type and algorithm parameter, and the response is sent to the SIP exchange. The system 100 is configured to receive.

(C-3) In each of the above embodiments, in order to determine the algorithm type supported by the SIP user terminal 400, the user authentication execution necessity determination processing unit 111d uses the Algorithm parameter of the Authorization header based on RFC3261. Although information is referred to, if information on the type of algorithm supported by each SIP user terminal 400 is obtained, other information may be referred to, and a parameter having the same information may be newly placed. May be.

It is a block diagram which shows the whole structure of the SIP exchange system of 1st Embodiment. It is explanatory drawing which shows the whole SIP communication system of 1st Embodiment. It is explanatory drawing which shows the internal structure of the service scenario management part of 1st Embodiment. It is explanatory drawing which shows the internal structure of the user authentication implementation necessity determination processing part of 1st Embodiment. It is a figure which shows the first half part of the flowchart which shows the operation | movement of the user authentication means of 1st Embodiment and the judgment of necessity of implementation. It is a figure which shows the latter half part of the flowchart which shows the operation | movement of judgment of the user authentication means and implementation necessity of 1st Embodiment. It is a block diagram which shows the structure of the SIP exchange system and SIP exchange maintenance terminal of 2nd Embodiment. It is explanatory drawing which shows the format of the data input into the SIP exchange maintenance terminal of 2nd Embodiment. It is explanatory drawing shown about the content of each parameter about the data input into the SIP exchange maintenance terminal of 2nd Embodiment. It is a figure which shows the example of the data input into the SIP exchange maintenance terminal of 2nd Embodiment. It is explanatory drawing shown about the update condition of the user authentication implementation necessity condition table and default algorithm information of 2nd Embodiment.

Explanation of symbols

  DESCRIPTION OF SYMBOLS 100 ... SIP exchange system, 110 ... Application layer, 111 ... Signal distribution function part, 111a ... SIP signal transmission / reception processing part, 111b ... Service scenario management part, 111c ... Generation | occurrence | production scenario management table, 111d ... User authentication implementation necessity determination processing part 111e ... user authentication implementation necessity condition table, 111f ... default algorithm information, 112 ... service scenario function unit, 113 ... user data management unit, 114 ... user authentication function unit, 400 ... SIP user terminal.

Claims (5)

Authentication implementation necessity condition information storage means for storing authentication necessity information for each type of authentication algorithm for each type of signal received from the terminal,
Authentication algorithm determination means for determining the type of authentication algorithm adopted by the terminal based on the signal received from the terminal;
Signal type information acquisition means for acquiring information on the type of signal transmitted by the terminal from the signal received from the terminal;
Based on the type of authentication algorithm determined by the authentication algorithm determination unit and the information acquired by the signal type information acquisition unit, the signal received from the terminal with reference to the information in the authentication execution necessity condition information storage unit Authentication necessity determination means for determining whether authentication is necessary, and
An authentication means for authenticating communication from the terminal using the type of authentication algorithm determined by the authentication algorithm determination means when the authentication necessity determination means determines that authentication is necessary; A service providing apparatus characterized by the above.   If the authentication algorithm determination means cannot determine the type of authentication algorithm adopted by the terminal based on a signal received from the terminal, the terminal adopts a predetermined type of algorithm. The service providing apparatus according to claim 1, wherein the service providing apparatus determines the service.   3. The service providing apparatus according to claim 1, further comprising authentication execution necessity condition update means for updating information on the authentication execution necessity condition information. Authentication implementation necessity condition information storage means, authentication algorithm determination means, signal type information acquisition means, authentication procedure determination means, and authentication means,
The authentication implementation necessity condition information storage means stores authentication necessity information for each type of authentication algorithm for each type of signal received by the service providing apparatus from the terminal,
The authentication algorithm determination means determines the type of authentication algorithm adopted by the terminal from the signal received by the service providing apparatus from the terminal,
The signal type information acquisition means acquires information on the type of signal transmitted by the terminal from the signal received by the service providing apparatus from the terminal,
The authentication procedure determining means is configured so that, based on the type of the authentication algorithm determined by the algorithm determining means, and the information acquired by the command information acquiring means, the service providing apparatus stores information on the authentication execution necessity condition information storage means. The service providing apparatus determines whether or not authentication is necessary for the signal received from the terminal,
The authentication means authenticates the communication from the terminal using the type of algorithm determined by the authentication algorithm determination means when the authentication necessity determination means determines that authentication is necessary. An authentication method characterized by. A computer provided in a service providing apparatus that provides a service to a terminal,
Information on whether or not authentication is necessary for each type of signal received from the terminal, authentication implementation necessity condition information stored for each type of authentication algorithm,
Authentication algorithm determination means for determining the type of authentication algorithm adopted by the terminal based on the signal received from the terminal by the service providing device,
A signal type information acquisition means for acquiring information related to a type of a signal transmitted by the terminal from a signal received by the service providing apparatus from the terminal;
Based on the information acquired by the algorithm information acquisition unit and the information acquired by the signal type information acquisition unit, the signal received from the terminal by the service providing apparatus with reference to the information in the authentication execution necessity condition information storage unit Authentication necessity determination means for determining whether authentication is necessary, and
When it is determined that the authentication is necessary by the authentication necessity determination means, the authentication algorithm determination means uses the type of algorithm determined by the authentication algorithm determination means to function as an authentication means for authenticating communication from the terminal. An authentication program characterized by

Images