JP2010231396A - Communication system, communication device and authentication device - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To restrict a use place of a communication device to be connected to a connection destination network at low cost. <P>SOLUTION: This communication system includes the communication device, and an authentication device performing authentication related to whether or not to connect the communication device to the connection destination network. The communication device has: a means generating position peculiar information related to an installed position based on peripheral communication device identification information; and a means imparting at least the position peculiar information when requesting the authentication from the authentication device. The authentication device has: a means storing position peculiar information related to a position for performing the authentication wherein the connection to the connection destination network is permitted to the communication device; and a means deciding an authentication result based on at least a collation result of the position peculiar information when the authentication is requested from the communication device. <P>COPYRIGHT: (C)2011,JPO&INPIT

Description

  The present invention relates to a communication system, a communication apparatus, and an authentication apparatus, and can be applied to, for example, a remote access point that accommodates a communication terminal and connects it to a connection destination network.

  For example, a communication device (for example, a remote access point device) for remotely accessing a client terminal from a destination or the like to a connection destination network (for example, an in-house network) may be used in an unspecified location outside the company. There are companies that restrict the use by restricting the use location from the viewpoint of security (eg, restricting the use location for telecommuting use to the employee's home).

  As a conventional method for restricting the place of use of remote access, for example, an authentication method described in Patent Document 1 can be cited. In Patent Document 1, a GPS (Global Positioning System) receiver is built-in or a GPS receiver is provided with a GPS connection interface in order to identify a use place of a client terminal (personal authentication device) and limit the use place. The client terminal is connected to acquire position information of the client terminal from the GPS receiver, and the client terminal transmits the position information as authentication information to the authentication device when connecting to the connection destination network. On the authentication device side, authentication is performed as to whether or not to connect to the connection destination network in accordance with the position information transmitted from the client terminal.

JP 2007-220075 A

  However, in the method described in Patent Document 1, since the radio wave from the GPS satellite is weak, it is often difficult to obtain the position information due to the attenuation of the radio wave indoors, and as a result, the location where the remote access point is used It will be a problem if you try to indoors.

  In addition, a GPS receiver must be built in the remote access point or connected to the outside, and the cost of the equipment becomes expensive.

  Therefore, there is a demand for a communication system, a communication apparatus, and an authentication apparatus that can limit the use place of the communication apparatus to be connected to the connection destination network at low cost.

  A communication system according to a first aspect of the present invention is a communication system including (1) a communication device and an authentication device that performs authentication relating to whether or not the communication device is connected to a connection destination network. (2-1) Identification information holding means for holding peripheral communication device identification information from each of the peripheral communication devices arranged around the communication device, and (2-2) The identification information holding means And (2-3) when requesting authentication from the authentication device, position specific information generating means for generating position specific information related to the position where the communication device is installed, based on the peripheral communication device identification information. Authentication request means for providing at least the position specific information generated by the position specific information generation means to the authentication apparatus, and (3) the authentication apparatus is (3-1) the connection destination to the communication apparatus. Net Position-specific information storage means for storing position-specific information related to a connection-permitted position that performs authentication for permitting connection to a workpiece; and (3-2) the communication device when authentication is requested from the communication device. And authentication determination means for verifying the authentication result based on at least the result of the verification, and the position specific information stored in the position specific information storage means. Features.

  The communication apparatus according to a second aspect of the present invention is the communication apparatus constituting the communication system including (1) a communication apparatus and an authentication apparatus that performs authentication relating to whether or not the communication apparatus is connected to a connection destination network. (2) Identification information holding means for holding peripheral communication apparatus identification information from each of the peripheral communication apparatuses arranged around the communication apparatus, and (3) Peripheral communication apparatus identification information held by the identification information holding means And (4) at the time of requesting the authentication apparatus to perform authentication, at least the position of the position is determined by the authentication apparatus. And an authentication requesting unit that provides the position specific information generated by the specific information generating unit.

  The authentication apparatus according to the third aspect of the present invention is the authentication apparatus constituting the communication system comprising (1) a communication apparatus and an authentication apparatus that performs authentication relating to whether or not the communication apparatus is connected to a connection destination network. (2) Peripheral communication device of the peripheral communication device arranged around the connection permission position as position specific information related to the connection permission position for performing authentication for permitting connection to the connection destination network with respect to the communication device A position-specific information storage means for storing identification information; and (3) a position-specific information given from the communication apparatus when authentication is requested from the communication apparatus, and a position-specific information storage means. And authentication determination means for determining an authentication result based at least on the result of the comparison.

  At low cost, limit the place of use of the communication device to connect to the destination network.

1 is a block diagram showing an overall configuration of a communication system according to a first embodiment. It is the block diagram shown about the functional structure inside the remote access point (communication apparatus) which concerns on 1st Embodiment. It is explanatory drawing shown about the structural example of the position specific information which concerns on 1st Embodiment. It is the flowchart explaining the authentication operation | movement in the communication system of 1st Embodiment. It is the block diagram shown about the functional structure inside the remote access point (communication apparatus) which concerns on 2nd Embodiment. It is explanatory drawing shown about the structural example of the position specific information which concerns on 2nd Embodiment.

(A) First Embodiment Hereinafter, a first embodiment of a communication system, a communication device, and an authentication device according to the present invention will be described in detail with reference to the drawings. Note that the accommodation apparatus of the first embodiment is a remote access point. In the first embodiment, an example in which the communication apparatus of the present invention is applied to a remote access point is described.

(A-1) Configuration of the First Embodiment FIG. 1 is a block diagram showing the overall configuration of the communication system of this embodiment.

  In the communication system shown in FIG. 1, a client terminal 3 accommodated in a remote access point 2 installed at a predetermined position (such as a user's home) is connected via a VPN connection to the in-house network 10 via the Internet 9. (For example, an internal network to which the user of the client terminal 3 belongs) is connected.

  As the client terminal 3, for example, a terminal such as an existing personal computer (notebook personal computer or the like) can be applied.

  In the first embodiment, as an example, as shown in FIG. 1, a remote access point 2, a client terminal 3, a home terminal 7, and a broadband router 4 are arranged at the user's home of the client terminal 3. And

  As the home terminal 7, for example, a terminal such as an existing personal computer (desktop personal computer or the like) can be applied.

  As shown in FIG. 1, it is assumed that the remote access point 2, the broadband router 4, and the home terminal 7 are connected to the home wired LAN 11. Although not shown in FIG. 1, the home wired LAN 11 may be configured by a device such as a hub, or may be directly wired under the broadband router 4. Is not limited.

  The broadband router 4 allows a subordinate communication device or communication terminal to access the Internet 9. For example, an existing broadband router can be applied. The home terminal 7 is a communication terminal under the broadband router 4, and for example, an existing terminal such as a personal computer can be applied.

  The remote access point 2 is arranged under the broadband router 4 and is a communication device that accommodates the client terminal 3 and connects the client terminal 3 to the in-house network 10. The remote access point 2 forms a VPN tunnel with the in-house network 10 and connects the client terminal 3 to the in-house network 10 via the VPN tunnel.

  In FIG. 1, a VPN gateway 5, an authentication device 6, and an in-house server group 8 are arranged in the in-house network 10.

  The VPN gateway 5 is a gateway for connecting a communication device on the Internet 9 to the corporate network 10 through a VPN. As the VPN gateway 5, for example, an existing VPN gateway device or a server having a VPN gateway function can be applied.

  In FIG. 1, the VPN gateway 5 receives an authentication request from the remote access point 2 and when authentication information is given from the remote access point 2 at the time of the authentication request, an authentication request is sent to the authentication device 6 based on the authentication information. Only when an authentication OK response is received from the authentication device 6, VPN connection is performed in response to the connection request of the remote access point 2, and the remote access point 2 (client terminal 3) is connected to the in-house network 10. Note that the authentication information in the authentication request from the remote access point 2 includes at least information related to the position of the remote access point 2 (hereinafter referred to as “location-specific information”). Details of the position specific information will be described later.

  As described above, the authentication device 6 makes a response such as authentication OK or authentication NG to the VPN gateway 5 in response to a request from the VPN gateway 5.

  The authentication device 6 includes an authentication information storage unit 61 that stores authentication information for each communication device (for example, remote access point 2) related to the authentication request.

  In the authentication device 6, authentication OK or authentication NG is determined using at least the verification information given together with the authentication request from the VPN gateway 5 and the authentication information stored in the authentication information storage unit 61. . As described above, the authentication information in the authentication request from the remote access point 2 includes at least location specific information, and the authentication information stored in the authentication information storage unit 61 also includes at least location specific information. . That is, the authentication device 6 authenticates at least the result of collating the position specific information given from the remote access point 2 with the position specific information related to the remote access point 2 stored in the authentication information storage unit 61. Alternatively, it is used for determination of authentication NG (authentication determination may be made in combination with other methods). In addition, the collation method of the position specific information in the authentication device 6 will be described later.

  The in-house server group 8 is a server group such as an application server or a file server to be accessed by the client terminal 3. The functions and number of servers in the in-house server group 8 are not limited.

  Next, details of the configuration of the remote access point 2 and details of the “location specific information” will be described.

  FIG. 2 is an explanatory diagram showing a functional configuration inside the remote access point 2.

  The remote access point 2 has a function of generating location-specific information in an existing network device such as a router or access point that can control VPN tunneling, and authentication when requesting the VPN gateway 5 for authentication when creating VPN tunneling. The information can be constructed by adding a function of including at least the generated position specific information.

  The remote access point 2 includes a main control unit 21, a position specific information holding unit 22 (MAC address holding unit 221, position specific information output unit 222), a WAN side I / F control unit 25, a WAN side I / F 23, and a LAN side I. / F control unit 26 and LAN side I / F 34.

  In FIG. 2, the remote access point 2 is, for example, a CPU, ROM, RAM, etc. for executing communication processing, data processing, etc. (programs related to the functions of the main control unit 21) in addition to the hardware communication unit. And a program executed by the CPU (including a program related to the function of the position-specific information holding unit 22) is installed. A functional configuration of the remote access point 2 including the above-described program is as shown in FIG. The main control unit 21 and the position specific information holding unit 22 may all be constructed by software, or part or all may be constructed by hardware.

  The WAN side I / F 23 and the LAN side I / F 34 are wired LAN interfaces in the remote access point 2. The WAN side I / F 23 is an interface for connecting to the Internet 9 side (broadband router 4), and the LAN side I / F 34 is an interface for connecting to the LAN side (client terminal 3).

  The WAN side I / F control unit 25 and the LAN side I / F control unit 26 perform control related to the physical layer of the WAN side I / F 23 and the LAN side I / F 34, respectively. In a network device such as an access point, this corresponds to a chip that performs control related to the physical layer of the LAN interface.

  The main control unit 21 has a function of controlling the entire operation of the remote access point 2. As the main control unit 21, for example, when requesting authentication to the authentication device 6 (VPN gateway 5), a control unit that controls the overall operation in a network device such as an existing router capable of VPN tunneling control or an access point. The authentication information may be constructed by adding a function (program) that includes at least position-specific information generated by the position-specific information holding unit 22 described later.

  The position specific information holding unit 22 has a function of generating position specific information.

  The position-specific information generated by the position-specific information holding unit 22 includes unique identification information (hereinafter, “peripheral device identification”) of communication devices (hereinafter referred to as “peripheral communication devices”) installed around the remote access point 2. Information ”). In the first embodiment, the peripheral communication device identification information is described as applying the MAC address of the peripheral communication device. However, the peripheral device identification information is not limited to this, and other peripheral communication device-specific information may be used. Information (for example, a serial number or an electronic certificate) may be applied, or a plurality of types of information may be applied in combination. For example, in FIG. 1, the peripheral communication device of the remote access point 2 corresponds to the broadband router 4 and the home terminal 7 which are other communication devices in the home network N3 to which the remote access point is connected. The position specific information holding unit 22 generates position specific information based on peripheral communication device identification information of all peripheral communication devices.

  FIG. 3 is an explanatory diagram showing a configuration example of position specific information related to the remote access point 2.

  In FIG. 3, “address A1” included in the position-specific information indicates the MAC address (LAN side) of the broadband router 4, and “address A2” indicates the MAC address of the home terminal 7. Shall.

  As the position-specific information, for example, as shown in FIG. 3, it may be data in which all peripheral communication device identification information is simply arranged, or all peripheral device identification information is collectively processed such as encryption and compression. Data may be used, and the format is not limited as long as the information is based on the peripheral communication device identification information of all the peripheral communication devices.

  The MAC address holding unit 221 has a function of holding the peripheral communication device identification information (MAC address) of the peripheral communication device in the position specific information holding unit 22.

  As a method for the MAC address holding unit 221 to hold the MAC address of the peripheral communication device, for example, the WAN side I / F unit 23 is monitored and a packet (Ethernet (registered trademark) that reaches the WAN side I / F unit 23 is monitored. The MAC address of the peripheral communication device may be extracted from the content of () frame). For example, when the home wired LAN 11 is configured with an existing repeater hub, all packets generated on the home wired LAN 11 reach the WAN side I / F unit 23, so the MAC address holding unit 221. Then, the MAC address of the peripheral communication device can be extracted from the contents of those packets. Further, for example, even when the home wired LAN 11 is configured by an existing switching hub (so-called layer 2 switch or the like), a packet having the remote access point 2 as a transmission destination or a broadcast packet generated on the home wired LAN 11 Arrives at the WAN side I / F unit 23, the MAC address holding unit 221 can extract the MAC address of the peripheral communication device from the contents of those packets.

  In addition, the remote access point 2 not only passively monitors packets that have reached the WAN-side I / F unit 23 but also actively searches for communication devices on the home wired LAN 11 and You may make it acquire a MAC address. As a method for the remote access point 2 to actively search for a communication device on the home wired LAN 11, for example, a Ping (ICMP ECHO) is transmitted with the broadcast address of the home wired LAN 11 as a destination, and from the peripheral communication device For example, obtaining a response packet. Thus, the means for holding the MAC address of the peripheral communication device in the MAC address holding unit 221 may be a passive or active method as described above, and is not limited.

  All the MAC addresses held by the MAC address holding unit 221 are input to the position specific information output unit 222. Then, the position specific information output unit 222 generates position specific information by collecting all the MAC addresses input from the MAC address holding unit 221 and delivers the position specific information to the main control unit 21.

  Next, details of the authentication method in the authentication device 6 will be described.

  As described above, in the authentication device 6, at least the position specific information given from the remote access point 2 and the position specific information related to the remote access point 2 stored in the authentication information storage unit 61 are collated. Used for judgment of authentication OK or authentication NG.

  For example, in the authentication device 6, the position-specific information given from the remote access point 2 is information “address A 1 + address A 2” as shown in FIG. 3, and the remote access point 2 stored in the authentication information storage unit 61. If the position-specific information related to is exactly the same as “address A1 + address A2,” authentication OK may be determined.

  The authentication device 6 also determines that the authentication is OK even when the location-specific information given from the remote access point 2 includes at least the MAC address of the location-specific information stored in the authentication information storage unit 61. You may do it. For example, in the authentication device 6, the location unique information stored in the authentication information storage unit 61 is only “address A 1”, and the location unique information given from the remote access point 2 is “address A 1 + address A 2”. It can be determined that at least the MAC address of the position specific information stored in the authentication information storage unit 61 is included, and authentication OK may be determined. Further, the order in which the MAC addresses are described in the position specific information may be collated without being limited.

  Further, the location information may be stored in the authentication information storage unit 61 for each communication device (for example, remote access point 2) on the client side that makes an authentication request. For example, identification information (for example, a manufacturing number, ID, MAC address, etc.) of the remote access point 2 and position specific information of the remote access point 2 may be stored in association with each other. Then, when the identification information of the remote access point 2 is given together with the authentication request from the remote access point 2, the authentication device 6 searches for the position-specific information related to the remote access point 2 using the identification information as a key. May be.

  Further, in the authentication device 6, a plurality of location-specific information related to the remote access point 2 is stored in the authentication information storage unit 61, and any one of the plurality of location-specific information and the location-specific information given from the remote access point 2 are stored. It may be determined that the authentication is OK when the information matches.

  The authentication device 6 may perform authentication in combination with other authentication methods such as existing password authentication in addition to the above-described collation result of the position specific information. Further, even when the authentication for the remote access point 2 is a result of the authentication OK, the authentication (for example, password authentication) for the subordinate client terminal 3 may be performed.

(A-2) Operation of the First Embodiment Next, an authentication operation in the communication system 1 of the first embodiment having the above configuration will be described.

  FIG. 4 is a flowchart showing an operation related to authentication between the remote access point 2 and the authentication device 6 in the communication system 1.

  In the flowchart of FIG. 4, the authentication information storage unit 61 will be described assuming that the information shown in FIG. 3 described above is registered in advance as the position-specific information related to the remote access point 2. Further, in FIG. 4, illustration is omitted for the sake of simplicity, but communication related to authentication between the remote access point 2 and the authentication device 6 is actually interposed between the VPN gateway 5. ing.

  First, there is an authentication request from the remote access point 2 to the authentication device 6 via the VPN gateway 5 (S101), and the authentication device 6 has received a confirmation response to the authentication request from the remote access point 2. (S102).

  Next, in the remote access point 2, position specific information is generated based on the peripheral communication device identification information (MAC address) of the peripheral communication device held by the position specific information holding unit 22 (the same contents as FIG. 3 are generated). The position specific information is given to the authentication device 6 (S103). The position-specific information holding unit 22 may hold position-specific information in advance or may be generated every time authentication is performed, and the timing for generating the position-specific information is not limited. When the position specific information holding unit 22 generates position specific information in advance, an expiration date may be provided for the position specific information, and the position specific information after the expiration date may be discarded.

  Next, the authentication device 6 collates the position specific information related to the remote access point 2 stored in the authentication information storage unit 61 with the position specific information given from the remote access point 2 in step S103 described above, If they match, it is determined that the authentication is OK, and if they do not match, it is determined that the authentication is NG (S104), and the authentication result is notified to the remote access point 2 (S105).

  In the above-described step S105, in the case of authentication OK, VPN connection is then started between the remote access point 2 and the VPN gateway 5, and the client terminal 3 under the remote access point 2 accesses the corporate network 10. In-house server group 8 and the like can be used, but in the case of authentication NG, VPN connection is not made between remote access point 2 and VPN gateway 5.

  Here, both the location-specific information given from the remote access point 2 to the authentication device 6 and the location-specific information registered as related to the remote access point 2 in the authentication device 6 are both shown in FIG. Since the content is shown, the result is authentication OK.

(A-3) Effects of First Embodiment According to the first embodiment, the following effects can be achieved.

  The authentication device 6 determines the authentication NG when the position-specific information of the position where registration is permitted, that is, the stored position-specific information does not match the position-specific information given from the remote access point 2. For example, even if the remote access point 2 is stolen and a password etc. is leaked, the location-specific information generated differs depending on the installation location and connection location. Can be prevented.

  In the communication system 1, since the MAC address of the communication device around the remote access point 2 is used as the position-specific information of the remote access point 2 (client terminal 3), the remote access point 2 has a built-in GPS receiver, or Without using an external connection, it is possible to limit the place where the remote access point 2 is used, and the cost for authentication can be reduced.

  In addition, since the communication system 1 can generate the position-specific information of the remote access point 2 (client terminal 3) without using the GPS, the radio waves that cannot receive the GPS position information because the GPS is not used. Even when the use of the remote access point 2 (client terminal 3) is permitted under the indoor environment, it is possible to manage the place where the remote access point 2 is used.

  Further, in the communication system 1, the MAC address of the peripheral communication device is used as the position specific information. However, since the MAC address is usually information specific to the device and the interface, there is no device having the same MAC address. In addition, since it is very difficult to change the IP address as in the case of IP address, it is possible to prevent forgery of position specific information.

(B) Second Embodiment Hereinafter, a second embodiment of a communication system, a communication device, and an authentication device according to the present invention will be described in detail with reference to the drawings. Note that the accommodation apparatus of the first embodiment is a remote access point. In the first embodiment, an example in which the communication apparatus of the present invention is applied to a remote access point is described.

(B-1) Configuration of the Second Embodiment FIG. 5 is a block diagram showing the overall configuration of the communication system 1A of this embodiment. The same and corresponding parts as those in FIG. It is attached.

  In the communication system 1A of the second embodiment, a remote access point 2A is connected to a client terminal 3A via a wireless communication LAN, and the remote access point 2A further connects to the Internet 9 via a mobile phone network (mobile phone terminal 4A). This is different from the first embodiment in that remote access is performed without using a wired LAN.

  Further, it is assumed that a wireless LAN access point 9 and a home terminal 7A accommodated in the wireless LAN access point 9 are arranged around the remote access point 2A. The wireless LAN access point 9 is an access point device compatible with an existing wireless LAN, and the home terminal 7A is also a terminal such as a personal computer compatible with the existing wireless LAN.

  In addition, the mobile phone terminal 4A can be an existing mobile phone terminal capable of data communication by connecting a subordinate communication device to the Internet via a mobile phone network.

  In FIG. 5, it is assumed that the remote access point 2A, the client terminal 3A, the home terminal 7A, and the wireless LAN access point 9 are compatible with the same wireless LAN system. The adopted wireless LAN method is not limited. For example, a method such as IEEE 802.11 series may be applied.

  In FIG. 5, the same configuration as that of the first embodiment can be applied to the configuration on the in-house network 10 side (VPN gateway 5, authentication device 6, in-house server group 8), and detailed description thereof is omitted. To do.

  FIG. 6 is an explanatory diagram showing the functional configuration inside the remote access point 2A, and the same and corresponding parts as in FIG. 2 described above are shown with the same and corresponding reference numerals.

  The remote access point 2A includes a main control unit 21A, a position specific information holding unit 22A, a WAN side I / F unit 23A, and a LAN side I / F unit 24A.

  The WAN-side I / F unit 23A includes a connector 235 for connecting to the mobile phone terminal 4A, an I / F circuit 234, and a mobile phone data communication control unit 233. The WAN-side I / F unit 23A can apply an interface for connecting to the Internet or the like via a mobile phone terminal in an existing communication device such as an access point or a personal computer.

  The LAN side I / F unit 24A includes an RF circuit 244 having a connection antenna and a circuit for a wireless LAN, and a wireless LAN communication control unit 243. The LAN side I / F unit 24A can apply an interface for wireless LAN connection in a communication device such as an existing access point or a personal computer.

  The main control unit 21A is different from that of the first embodiment in that the control content generated due to the difference in the type of interface (WAN side I / F unit 23A, LAN side I / F unit 24A) of the remote access point 2A is different. It is different from the one.

  The location specific information holding unit 22 of the first embodiment monitors the packet that has reached the WAN-side I / F unit 23 and acquires the MAC address of the peripheral communication device. In the second embodiment, Since the remote access point 2A employs a wireless LAN instead of a wired LAN as an interface on the LAN side, the acquisition of the MAC address of the peripheral communication device is different from the first embodiment.

  The position-specific information holding unit 22A includes a MAC address holding unit 221A and a position-specific information output unit 222. Since the position-specific information output unit 222 is the same as that of the first embodiment, a detailed description will be given. Omitted.

  The MAC address holding unit 221A is the first in that it monitors the LAN side I / F unit 24A and extracts and holds the MAC address from the content of the beacon packet by the communication device corresponding to the peripheral wireless LAN such as the remote access point 2A. It differs from that of the embodiment. Then, similarly to the MAC address holding unit 221 of the first embodiment, the MAC address holding unit 221A collectively holds the held MAC addresses to the position specific information output unit 222, and the position specific information output unit 222 performs the first operation. Position specific information is generated as in the embodiment.

(B-2) Operation | movement of 2nd Embodiment Next, the operation | movement of the authentication in the communication system 1A of 2nd Embodiment which has the above structures is demonstrated.

  The operation related to the authentication between the remote access point 2A and the authentication device 6 in the communication system 1A can also be shown by the flowchart of FIG. As a difference from the first embodiment, in the above-described step S103, the position specific information holding unit 22A (MAC address holding unit 221A) holds the MAC address of the peripheral communication device based on the beacon packet of the wireless LAN. It is.

(B-3) Effects of Second Embodiment According to the second embodiment, the following effects can be obtained in addition to the effects of the first embodiment.

  Since the remote access point 2A can acquire a MAC address from a peripheral communication device on the wireless LAN and create position-specific information, the remote access point 2A can manage the usage location of the remote access point 2A even if it does not support the wired LAN. it can.

(C) Other Embodiments The present invention is not limited to the above-described embodiments, and may include modified embodiments as exemplified below.

(C-1) In the first embodiment, the MAC address is used as the specific information of the peripheral device to which the remote access point is connected. However, an IP address (for example, a global IP address) is used. Also good.

(C-2) In each of the above embodiments, the example in which the communication apparatus of the present invention is applied to a remote access point has been described. However, for example, the present invention is applied to another communication apparatus (for example, the client terminal 3 in FIG. 1). You may do it.

  For example, referring to FIG. 1 described above, when the client terminal 3 is directly connected to the in-house network 10 through the VPN, the reclient terminal 3 includes the position specific information holding unit 22 of the mote access point 2 and the position specific information holding unit 22. May be authenticated using the position-specific information held by the user.

(C-3) In each of the above embodiments, the remote access point establishes a VPN tunnel with the VPN gateway and is connected to the in-house network through the VPN connection, but accesses without using the VPN. You may do it. In this case, the in-house network may be provided with a gateway (such as a file or a wall) instead of the VPN gateway to establish communication with the remote access point 2.

(C-4) In the first embodiment, the remote access point holds the MAC address of the peripheral communication device based on the packet flowing on the wired LAN as the position-specific information. In the second embodiment, the remote access point The access point holds the MAC address of the peripheral communication device based on the beacon packet on the wireless LAN as position specific information. However, if the remote access point supports both the wired LAN and the wireless LAN, the access point Alternatively, position-specific information using both LAN and wired LAN packets may be applied.

  DESCRIPTION OF SYMBOLS 1 ... Communication system, 2 ... Remote access point, 3 ... Client terminal, 4 ... Broadband router, 5 ... VPN gateway, 6 ... Authentication apparatus, 61 ... Authentication information storage part, 7 ... Home terminal, 8 ... In-house server group, 9 ... Internet, 10 ... In-house network (destination network), 11 ... Home wired LAN.

Claims (7)

In a communication system comprising a communication device and an authentication device for performing authentication relating to whether or not to connect the communication device to a connection destination network,
The communication device is
Identification information holding means for holding peripheral communication device identification information from each of the peripheral communication devices arranged around the communication device,
Based on the peripheral communication device identification information held by the identification information holding unit, position specific information generation means for generating position specific information related to the position where the communication device is installed;
When requesting authentication from the authentication device, the authentication device has authentication request means for giving at least the position specific information generated by the position specific information generation means,
The authentication device
Position-specific information storage means for storing position-specific information related to a connection-permitted position that performs authentication for permitting connection to the connection destination network with respect to the communication device;
When authentication is requested from the communication device, the location-specific information given from the communication device is collated with the location-specific information stored in the location-specific information storage means, and at least based on the collation result An authentication determination means for determining an authentication result.     2. The communication system according to claim 1, wherein the peripheral communication device identification information held by the identification information holding means is a MAC address of the peripheral communication device. When the communication device is a communication device compatible with at least a wired LAN,
The identification information holding unit holds identification information of a communication device connected on the same wired LAN as the communication device as peripheral communication device identification information of the peripheral communication device. Communication system. When the communication device is a communication device compatible with at least a wireless LAN,
The said identification information holding | maintenance means hold | maintains the identification information of the communication apparatus of the transmission source of the beacon packet which the said communication apparatus received directly as peripheral communication apparatus identification information of a peripheral communication apparatus. Communications system.   The communication system according to any one of claims 1 to 4, wherein the communication device accommodates a communication terminal under control and connects the communication terminal to the connection destination network. In the communication device that constitutes a communication system comprising a communication device and an authentication device that performs authentication related to whether or not to connect the communication device to a connection destination network,
Identification information holding means for holding peripheral communication device identification information from each of the peripheral communication devices arranged around the communication device,
Based on the peripheral communication device identification information held by the identification information holding unit, position specific information generation means for generating position specific information related to the position where the communication device is installed;
A communication apparatus, comprising: authentication requesting means for providing at least position-specific information generated by the position-specific information generating means to the authentication apparatus when requesting authentication from the authentication apparatus. In the above-mentioned authentication device constituting a communication system comprising a communication device and an authentication device that performs authentication relating to whether or not to connect the communication device to a connection destination network,
Peripheral communication device identification information of peripheral communication devices arranged around the connection-permitted position as position-specific information related to a connection-permitted position that performs authentication for permitting connection to the connection destination network with respect to the communication device. The stored location-specific information storage means;
When authentication is requested from the communication device, the location-specific information given from the communication device is collated with the location-specific information stored in the location-specific information storage means, and at least based on the collation result And an authentication determination means for determining an authentication result.

Images