JP2012073892A - Authentication server, authentication system, authentication method and authentication program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an authentication server, an authentication system, an authentication method and an authentication program which can provide functions provided on a network for appropriate users.SOLUTION: An authentication server comprises: a storage unit (11); an authentication unit (16) for performing user authentication of an information terminal in response to a connection request from the information terminal; and a response unit (17) for permitting the information terminal to connect to a network which can provide an additional function required by the information terminal that is indicated by information transmitted from the information terminal or stored in the storage unit (11), after the user authentication by the authentication unit (16).

Description

  The present invention relates to a technology of an authentication server, an authentication system, an authentication method, and an authentication program for performing user authentication on an information terminal that makes a connection request to a network.

In recent years, ISPs (Internet Service Providers) provide services in which various functions are added to Internet connection services. For example, there is a technique called DPI (Deep Packet Inspection) as one of the techniques for realizing this added function. DPI is a technique for collecting and analyzing data (packets) exchanged over the Internet. With this DPI, the tendency of data exchanged over the Internet can be examined, and for example, advertisement data matching the tendency can be provided to the user.

FIG. 9 shows a configuration example of a network in which a conventional DPI is used. As shown in FIG. 9, the network configuration in which the conventional DPI is used includes, for example, a user terminal 2, a broadband router 3, a BAS (Broadband Access Server) 4, an authentication server 10, an ISP network 5,
An ISP network termination device 51, the Internet 6, a DPI device 70, and a DPI server 80 are included.

  In the network configuration using the conventional DPI, data exchanged between the user terminal 2 of the user a who desires the DPI function and the user b who does not desire the DPI function and the Internet 6 passes through the DPI device 70 once. The DPI device 70 sends a copy of all data to the DPI server 80, regardless of whether or not the user desires the DPI function. The DPI server 80 collects and analyzes these data, and provides, for example, advertisement data that matches the data trend to the user terminal 2 of the user a who desires the DPI function.

  With regard to such a technique, for example, there are techniques listed in Patent Document 1 and Patent Document 2.

  Japanese Patent Application Laid-Open No. 2004-151867 discloses a technique for preparing a cookie in a client via a certain advertisement page (Web page), browsing a packet from the client in which the cookie is stored, and checking a tendency of the Web page being browsed by the client. ing.

  Patent Document 2 discloses a technique for browsing all packets and checking whether or not the authentication has been completed in order to prevent access by the authenticated terminal when accessing the charged content.

Japanese translation of PCT publication No. 2010-51461 JP 2010-050775 A

As described above, in the conventional technology that provides a service with various functions added to the Internet connection service, regardless of whether the user wants (permits) or does not want (not permit), the data can be analyzed once. Data was being collected. Therefore, depending on the number of user terminals connected to the network, a large-scale and high-speed device (for example, a DPI device and a DP)
I server) was required. In addition, since all data is collected once, it has not been possible to meet the demands of users who do not allow data collection.

  The present invention has been made in consideration of such points, and provides an authentication server, an authentication system, an authentication method, and an authentication program capable of providing a function provided on a network to an appropriate user. With the goal.

  The present invention employs the following configuration in order to solve the above-described problems.

  That is, an authentication server of the present invention that performs user authentication for an information terminal that makes a connection request to a network includes a storage unit, an authentication unit that performs user authentication of the information terminal in response to a connection request from the information terminal, After user authentication of the authentication unit, the information terminal is connected to a network that can provide an additional function requested by the information terminal transmitted from the information terminal side or indicated by the information stored in the storage unit. A response unit to be permitted.

  According to the above configuration, an information terminal that requests an additional function is permitted to connect to a network that can provide the additional function. For this reason, the additional function provided on a network can be provided to an appropriate user. Also, unlike conventional systems, it is not necessary to provide functions to all users, and it is only necessary to prepare a network that can provide additional functions to appropriate users. , Providing functionality.

  Further, the information transmitted from the information terminal may be a domain name including a character string indicating an additional function requested by the information terminal.

  According to the above configuration, the additional function requested by the information terminal is specified by the domain name. For this reason, switching of the additional function required by the information terminal can be achieved by switching the domain name.

  Further, the authentication system of the present invention is configured such that the information transmitted from the information terminal side or stored in the storage unit by the application for switching the additional function from the authentication server of the present invention and the information terminal is stored. And an application server for switching the additional function shown.

  According to the above configuration, the additional function requested by the information terminal is switched by applying for the information terminal. For this reason, the user can arbitrarily switch a desired additional function. Further, since the additional function requested by the information terminal can be arbitrarily switched by the user, the side providing the additional function can notify the user of the additional function to be provided.

  As another aspect of the present invention, a method for realizing any of the above configurations, a system, a program, or such a program may be recorded. It may be a computer-readable storage medium.

  According to the present invention, it is possible to provide an authentication server, an authentication system, an authentication method, and an authentication program that can provide functions provided on a network to an appropriate user.

1 is a diagram illustrating a network configuration according to an embodiment. The figure which illustrates the screen which selects the additional function which concerns on embodiment. The figure which illustrates the structure of the authentication server which concerns on embodiment. The figure which illustrates the additional function network which concerns on embodiment. The figure which illustrates the structural example of the additional function network which concerns on embodiment. The sequence chart which showed an example of the process sequence at the time of the connection to the network (Internet) which concerns on embodiment. Examples of attributes and attribute values included in a packet related to user authentication between the BAS and the authentication server. Examples of attributes and attribute values included in a packet related to a connection request between the additional function network termination device and the authentication server. The figure which illustrates the conventional network structure.

  Hereinafter, an authentication server and an authentication system according to an aspect of the present invention will be described as an embodiment (hereinafter also referred to as “this embodiment”). However, the following embodiments are merely examples, and the present invention is not limited to the configurations of the following embodiments.

  In the following embodiments, for example, in FIG. 7 and FIG. 8, the attribute names and attribute values of the packet configuration examples are illustrated in natural language (Japanese etc.), but more specifically, the computer It is specified in a recognizable pseudo language, command, parameter, machine language, etc.

§1 Network configuration example First, a network configuration example according to the present embodiment will be described. FIG. 1 shows a configuration example of a network according to the present embodiment. As shown in FIG. 1, the network according to the present embodiment includes an authentication server 1, a user terminal 2, a broadband router 3, a BAS 4, an ISP network 5, an ISP network termination device 51, the Internet 6, an application server 60, and an additional function network. 7 and an additional function network termination device 71.

  The authentication server 1 can communicate with the BAS 4, the ISP network termination device 51 (ISP network 5), and the additional function network termination device 71 (additional function network 7) via the network. The user terminal 2 can communicate with the broadband router 3 via a network. The broadband router 3 can communicate with the user terminal 2 and the BAS 4 via a network. The BAS 4 can communicate with the authentication server 1, the broadband router 3, the ISP network termination device 51 (ISP network 5), and the additional function network termination device 71 (additional function network 7) via a network.

  The user terminal 2 can be connected to the Internet 6 via the broadband router 3, the BAS 4, the ISP network 5 and the ISP network termination device 51, or the additional function network 7 and the additional function network termination device 71.

  The ISP network 5 is a conventional ISP network and is a network that provides connection to the Internet 6 without providing an additional function to the user terminal 2. On the other hand, the additional function network 7 is a network that provides the user terminal 2 with an additional function and a connection to the Internet 6.

§2 Device configuration example Next, each node of the network according to the present embodiment will be described.

§2-1 User terminal 2
The user terminal 2 has, for example, a hardware configuration and a functional configuration known as a PC (Personal Computer). For example, the user terminal 2 has, as its hardware configuration, a communication unit connected via a bus for storing various data and programs, a control unit for executing programs stored in the storage unit, and communication with a network A communication unit for performing an operation, an input unit for inputting a user operation on a mouse, a keyboard, and the like. With such a hardware configuration, the user terminal 2 can display and operate a general communication function for connecting to the Internet 6 via a network and a screen based on provided data. Realize functions, etc.

  In the present embodiment, the user terminal 2 accesses a server (such as a Web server or a mail server) existing on the Internet 6 via the ISP network 5 or the additional function network 7. At this time, when a communication path is not established between the broadband router 3 and the ISP network 5 or the additional function network 7, the authentication server 1 performs user authentication of the user terminal 2. As will be described later, when user authentication is established, the authentication server 1 is information transmitted from the user terminal 2 side (in the present embodiment, the broadband router 3) and is based on information indicating an additional function requested by the user terminal 2. To determine the network to which connection is permitted. Thereby, a communication path is established between the broadband router 3 and the ISP network 5 or the additional function network 7, and the user terminal 2 can access a server existing on the Internet 6.

  Further, in the present embodiment, an additional function requested by the user terminal 2 is switched by operating a Web page acquired by the user terminal 2 accessing the application server 60 existing on the Internet 6. FIG. 2 shows a display screen example of the Web page.

  On the user terminal 2, the Web page shown in FIG. The user operates the user terminal 2 to select a desired additional function from the additional function selection screen (20) (21). When the selected additional function is set and operated (22), the user terminal 2 requests the broadband router 3 to switch information indicating the additional function requested by the user terminal 2. The broadband router 3 switches information indicating the additional function requested by the user terminal 2 in response to the request.

  As another method of the present embodiment, the switching of the additional function may be realized by a program executed on the user terminal 2 instead of the application server 60.

§2-2 Broadband router 3
The broadband router 3 has a general hardware configuration and functional configuration as a well-known broadband router. For example, the broadband router 3 includes a storage unit for storing various data and programs, a control unit that executes a program stored in the storage unit, and a communication unit that is controlled by the control unit to communicate with other communication devices. It has multiple physical interfaces. With such a hardware configuration, the broadband router 3 realizes a general routing function or the like for establishing a communication path between the broadband router 3 and the ISP network 5 or the additional function network 7.

  In this embodiment, the broadband router 3 connects to the BAS 4 in order to establish a communication path with the ISP network 5 or the additional function network 7 in response to an access request from the user terminal 2 to the server on the Internet 6. A connection request is made to the server. When a connection request is made, information indicating an additional function requested by the user terminal 2 is transmitted from the broadband router 3 to the BAS 4 together with information used for user authentication (for example, user ID and password). Details will be described later.

In response to this connection request, user authentication of the user terminal 2 is performed by the authentication server 1. Then, according to the result of user authentication, in the present embodiment, the broadband router 3 establishes a communication path with the ISP network 5 or the additional function network 7 based on the connection permission information transmitted from the BAS 4. . In order to establish this communication path, the broadband router 3 communicates with the BAS 4 for establishing the communication path.

  In the present embodiment, the broadband router 3 switches information indicating the additional function requested by the user terminal 2 in response to a request from the user terminal 2. A specific example of information indicating the additional function requested by the user terminal 2 will be described later.

§2-3 BAS4
The BAS 4 has a general hardware configuration and functional configuration as a well-known access server. For example, the BAS 4 includes a storage unit for storing various data and programs, a control unit that executes a program stored in the storage unit, and a plurality of units that are controlled by the control unit and communicate with other communication devices. It has a physical interface. The BAS 4 realizes a general authentication client function and the like by such a hardware configuration.

  In this embodiment, the BAS 4 inquires of the authentication server 1 about user authentication in response to a connection request from the broadband router 3 to the ISP 5 or the additional function network 7.

  In the present embodiment, the BAS 4 sends the ISP network termination device 51 or the additional function network termination device 71 according to the connection permission returned from the authentication server 1 (for example, notification of packet data including connection permission information). A connection request is made to the server. The connection request is for establishing a communication path between the broadband router 3 and the ISP network 5 or the additional function network 7. In response to this connection request, a connection permission response is returned from the ISP network termination device 51 or the additional function network termination device 71. The BAS 4 returns a connection permission to the ISP network 5 or the additional function network 7 to the broadband router 3 in response to the connection permission response.

§2-4 Authentication server 1
FIG. 3 shows a configuration example of the authentication server 1 in this embodiment.

As shown in FIG. 3, the authentication server 1 has existing hardware such as a storage unit 11, a control unit 12, and a communication unit 14 connected by a bus 13 as a hardware configuration. The storage unit 11 is, for example, a hard disk, and stores various data and programs used in processing executed by the control unit 12. The control unit 12 is one or a plurality of processors such as a CPU (Central Processing Unit), and a peripheral circuit (
ROM (Read Only Memory), RAM (Random Access Memory), interface circuit, and the like. The communication unit 14 transmits and receives IP (Internet Protocol) packets and the like to and from the BAS 4, the ISP network termination device 51, the additional function network termination device 71, and the like via the network.
The authentication server 1 may be configured by a general-purpose computer such as a PC, or may be configured by a dedicated computer such as a network connection storage.

  As shown in FIG. 3, the authentication server 1 has a user authentication information database 15 in the storage unit 11 for storing information for performing user authentication.

  The user authentication information database 15 stores information for the authentication unit 16 described later to perform user authentication. The information for performing user authentication is information corresponding to information used for user authentication transmitted from the broadband router 3 to the BAS 4, for example, information obtained by combining a user ID and a password.

As shown in FIG. 3, the authentication server 1 authenticates the user by using the information in the user authentication information database 15 and the response (connection to the network) according to the result of the user authentication of the authentication unit 16. The control unit 11 has a response unit 17 that performs (permission).

  In response to the user authentication inquiry from the BAS 4, the authentication unit 16 performs user authentication of the user terminal 2 that is the target of the inquiry. The authentication unit 16 uses this user authentication as information stored in the user authentication information database 15 and information used for user authentication transmitted from the broadband router 3 to the BAS 4 included in the user authentication inquiry from the BAS 4. Implement by using.

  For example, the user authentication information database 15 stores information that combines a user ID and a password, and the information used for user authentication transmitted from the broadband router 3 to the BAS 4 is the user ID and password. Suppose there is. In this case, the authentication unit 16 determines whether or not the user ID and password included in the user authentication inquiry from the BAS 4 match the user ID and password stored in the user authentication information database 15. As a result, user authentication is performed.

  For example, the authentication unit 16 determines that the user authentication is established when the ID and password included in the inquiry of the BAS 4 match the ID and password stored in the user authentication information database 15. On the other hand, if the ID and password included in the BAS 4 query do not match the ID and password stored in the user authentication information database 15, the authentication unit 16 determines that user authentication is not established.

  In the present embodiment, the response unit 17 permits the BAS 4 to connect to the network when the authentication unit 16 determines that user authentication is established. In this embodiment, the network that is the object of this connection permission is the ISP network 5 or the additional function network 7. A communication path is formed between the broadband router 3 and these networks when the authentication unit 16 permits the connection to these networks to the BAS 4.

  In this connection permission, the response unit 17 transmits the connection permission to the BAS 4 based on the information indicating the additional function requested by the user terminal 2 transmitted from the broadband router 3 included in the user authentication inquiry from the BAS 4. Determine the connection destination. In the present embodiment, the information indicating the additional function requested by the user terminal 2 is a domain name.

For example, when the domain name is “ccc.com”, the response unit 17 determines that there is no additional function requested by the user terminal 2 and permits the BAS 4 to connect to the ISP network 5.

For example, when the domain name is “dpi.ccc.com”, the response unit 17 determines that the additional function requested by the user terminal 2 is a DPI function to be described later, and adds the additional function network that provides the DPI function. 7 is permitted to connect to BAS 4 (DPI dedicated network 7a described later).

For example, when the domain name is “tctrl.ccc.com”, the response unit 17 determines that the additional function requested by the user terminal 2 is a band restriction function described later, and provides an additional function that provides the band restriction function. The BAS 4 is permitted to connect to the functional network 7 (band-regulation dedicated network 7b described later).

Further, for example, when the domain name is “sec.ccc.com”, the response unit 17 determines that the additional function requested by the user terminal 2 is a security strengthening function to be described later, and provides the security strengthening function. The BAS 4 is permitted to connect to the functional network 7 (security-enhanced network 7c described later).

  For example, when the domain name is “prem.ccc.com”, the response unit 17 determines that the additional function requested by the user terminal 2 is a premium function to be described later, and adds an additional function network that provides the premium function. 7 is permitted to connect to BAS4 (premium network 7d described later).

  As another form of the present embodiment, the information indicating the additional function requested by the user terminal 2 may be a user ID. In this case, for example, the user authentication information database 15 includes information on connection destinations associated with a set of IDs and passwords used for user authentication (for example, the ISP network 5 or the additional function network 7 that provides each of the above services). IP address of the terminal device) is stored. When the authentication unit 16 determines that the user authentication is established, the response unit 17 acquires the connection destination information associated with the set of ID and password used for the user authentication from the user authentication information database 15. To do. The response unit 17 permits connection to the BAS 4 using the acquired connection destination information.

  Moreover, as another form of this embodiment, the information which shows the additional function which the user terminal 2 requests | requires may be previously stored in the memory | storage part 11 of the authentication server 1, for example. In this case, for example, the user authentication information database 15 includes information on connection destinations associated with a set of IDs and passwords used for user authentication (for example, the ISP network 5 or the additional function network 7 that provides each of the above services). IP address of the terminal device) is stored. When the authentication unit 16 determines that the user authentication is established, the response unit 17 acquires the connection destination information associated with the set of ID and password used for the user authentication from the user authentication information database 15. To do. The response unit 17 permits connection to the BAS 4 using the acquired connection destination information.

  In the present embodiment, when the response unit 17 permits the connection to the ISP network 5 or the additional function network 7 to the BAS 4, the connection permission is issued from the ISP network termination device 51 or the additional function network termination device 71. Connection confirmation is performed. At this time, the response unit 17 notifies the ISP network termination device 51 or the additional function network termination device 71 of connection permission corresponding to the connection permission for the BAS 4 performed by itself. In response to the connection permission notification, the ISP network termination device 51 or the additional function network termination device 71 allows the authentication server 1 (the response unit 17) to perform connection permission for establishing a communication path between the broadband router 3 and itself. Recognize that.

  On the other hand, when the authentication unit 16 determines that the user authentication is not established, the response unit 17 returns arbitrary information to the BAS 4. For example, the response unit 17 rejects the connection to each network to the BAS 4 in the same manner as the conventional connection method to the Internet.

§2-5 Additional function network 7
<Additional function network 7>
In the present embodiment, the additional function network 7 is a network that provides an additional function to the user terminal 2 and provides connection to the Internet 6. The additional function network 7 will be described with reference to FIGS.

FIG. 4 illustrates the additional function network 7 in the present embodiment. As shown in FIG. 4, the additional function network 7 constitutes an independent network according to the additional function permitted or desired by the user. In the present embodiment, as a network in which the additional function is realized, a DPI dedicated network 7a in which the DPI function is realized, a bandwidth restriction dedicated network 7b in which the bandwidth restriction is realized, a security enhanced network 7c in which the security enhancement function is realized, and A premium network 7d in which a function of providing a service with high communication quality such as securing a communication band is realized is illustrated. Each network is connected to the BAS 4 via its terminating devices (DPI dedicated network terminating device 71a, bandwidth regulation dedicated network terminating device 71b, enhanced security network terminating device 71c, premium network terminating device 71d).

  FIG. 5 shows a configuration example of the additional function network 7 in the present embodiment. The additional function network 7 in which each of the additional functions is realized includes an additional function device 72 and an additional function server 81 for realizing the additional function.

  Each of the additional function device 72 and the additional function server 81 has, as its hardware configuration, a storage unit for storing various data and programs connected via a bus, and a control for executing the program stored in the storage unit. A communication unit for communicating with the network. Each of the additional function device 72 and the additional function server 81 implements the above additional functions and the like by such a hardware configuration.

  For example, the DPI dedicated network 7a realizes the DPI function when the user terminal 2 connects to the Internet 6. The DPI function is as described above. For example, the additional function device 72 shown in FIG. 5 is the aforementioned DPI device, and the additional function server 81 is the aforementioned DPI server. Thereby, the DPI dedicated network 7a realizes the DPI function when the user terminal 2 connects to the Internet 6. Then, for example, the DPI server acquires advertisement information that matches the user's preference by the DPI function, and transmits the advertisement information to the user terminal 2 that permits the function.

  In addition, for example, the band regulation dedicated network 7 b implements a band regulation function when the user terminal 2 connects to the Internet 6. The bandwidth regulation function is a function for regulating the communication bandwidth when the user terminal 2 accesses a server on the Internet 6. For example, the additional function device 72 shown in FIG. 5 is a device for measuring a communication amount, and the additional function server 81 is a server for realizing band regulation based on the measured communication amount. Thereby, the band regulation dedicated network 7b realizes a band regulation function when the user terminal 2 connects to the Internet 6. For example, when the user terminal 2 of the user who permits the band restriction function is executing communication exceeding the band restriction, the server for realizing the band restriction is connected to the user terminal 2 with respect to the network. Send usage warning information.

Further, for example, the enhanced security network 7 c implements a security enhancement function when the user terminal 2 connects to the Internet 6. The security enhancement function is a function of performing virus check and existing filtering by analyzing packets distributed on the network, for example. For example, the additional function device 72 shown in FIG. 5 is a device for collecting packets passing on the security enhanced network 7c. Further, for example, the additional function server 81 shown in FIG. 5 is a server for analyzing the collected packets, executing virus checking, existing filtering, and the like to enhance security. Thereby, the security strengthening network 7c implements a security strengthening function when the user terminal 2 connects to the Internet 6. Then, for example, a server for enhancing security transmits an execution result of virus checking or the like (for example, warning of “abuse” or “attack”) to the user terminal 2 of the user who desires enhanced security.

  For example, the premium network 7d realizes a function of providing a service with high communication quality such as securing a communication band when the user terminal 2 connects to the Internet 6. For example, the additional function device 72 shown in FIG. 5 is a device for confirming QoS (Quality of Service). Further, for example, the additional function server 81 shown in FIG. 5 is a server for realizing QoS. Thereby, the premium network 7d realizes a function of providing a service with high communication quality such as securing a communication band when the user terminal 2 connects to the Internet 6.

  An ISP that provides such an additional function may change the billing system for each user who uses these networks. In this case, for example, a charging server (not shown) that implements the charging system is connected to the BAS 4. When the additional function requested by the user terminal 2 is switched by the application for the user terminal 2 described above, the information on the accounting server is also switched. The billing server charges each user based on the switched information. For example, the billing server charges a cheap fee for a user who permits a bandwidth regulation function, and charges a high fee for a user who permits a security enhancement function.

<Additional function network termination device 71>
Additional function network termination device 71 (DPI dedicated network termination device 71a, bandwidth regulation dedicated network termination device 71b, enhanced security network termination device 71c, premium network termination device 71d) is a well-known hardware as a termination device for each additional function network. It has a configuration and a functional configuration. For example, the additional function network termination device 71 communicates with other communication devices controlled by the storage unit for storing various data and programs, a control unit for executing the program stored in the storage unit, and the control unit. A plurality of physical interfaces are provided. The additional function network termination device 71 realizes a function as an interface of the additional function network 7 with such a hardware configuration.

  In the present embodiment, as described above, the additional function network termination device 71 establishes a communication path from the BAS 4 to the broadband router 3 and each additional function network 7 in response to the connection permission returned from the authentication server 1. Connection request is made. In response to this, the additional function network termination device 71 performs communication (connection confirmation) for confirmation of connection permission performed by the authentication server 1 to the authentication server 1.

  In the present embodiment, as described above, the additional function network termination device 71 receives a connection permission notification from the authentication server 1 in response to the connection confirmation. In response to this, the additional function network termination device 71 permits the BAS 4 to connect to the BAS 4 connection request.

  In the present embodiment, a communication path is established between the broadband router 3 and each additional function network 7 after the connection permission. At this time, the BAS 4 requests the additional function network termination device 71 to establish the communication path, and the additional function network termination device 71 responds to the request, thereby establishing the communication path.

§2-6 Others As shown in FIG. 1, the network configuration example in the present embodiment includes an ISP network 5, an ISP network termination device 51, the Internet 6, and an application server 60.

  In this embodiment, the ISP network 5 is a conventional ISP network, and provides a connection to the Internet 6 without providing an additional function to the user terminal 2.

  The ISP network termination device 51 has a known hardware configuration and functional configuration as a network termination device. For example, the ISP network termination device 51 communicates with other communication devices under the control of a storage unit for storing various data and programs, a control unit for executing a program stored in the storage unit, and the control unit. For multiple physical interfaces. The ISP network termination device 51 realizes a function as an interface of the ISP network 5 and the like by such a hardware configuration.

In the present embodiment, as described above, when user authentication is established in the authentication server 1, a communication path is established between the broadband router 3 and the ISP network 5. Since the operation at this time is the same as that of the additional function network termination device 71, the description thereof is omitted.

  The Internet 6 is a network (Internet) existing ahead of the ISP network 5 when viewed from the user terminal 2.

  The application server 60 has a general hardware configuration and functional configuration as a well-known server. For example, the application server 60 is connected to each other via a bus for storing various data and programs, a control unit for executing a program stored in the storage unit, and for communicating with a network. It has a communication unit. The application server 60 realizes the function of providing the above-described Web page with such a hardware configuration.

  Note that an existing protocol such as IP is used as a communication protocol such as assignment of an IP address to the broadband router 3 performed when establishing a communication path. An existing protocol (for example, RADIUS protocol) is also used for user authentication performed in the authentication server.

§3 Operation example Next, the processing procedure of the method for connecting the user terminal 2 to the Internet 6 in the present embodiment will be described with reference to FIGS. In the present embodiment, the processing procedure when the user authentication is not established in the authentication server 1 is the same as the processing procedure of the conventional method for connecting to the Internet, and a description thereof will be omitted.

  FIG. 6 shows an example of a processing procedure when connected to the Internet 6 (user authentication is established) according to the present embodiment. FIG. 7 is a packet configuration example of a user authentication inquiry and connection permission performed between the BAS 4 and the authentication server 1 in the processing procedure.

  FIG. 8 is a packet configuration example of connection confirmation and connection permission performed between the ISP network 5 or the additional function network 7 (the ISP network termination device 51 or the additional function termination device 71) and the authentication server 1 in the processing procedure. . Note that the packet configuration examples in FIGS. 7 and 8 are based on the RADIUS protocol, and thus description of each attribute is omitted.

  Note that the packet configuration examples in FIGS. 7 and 8 each have an attribute name field, a type field, and an attribute value field. The attribute name field stores an attribute name conforming to the RADIUS protocol. The type field stores an ID corresponding to the attribute stored in the attribute name field. The attribute value field stores the attribute value of the attribute stored in the attribute name field.

  First, as shown in FIG. 6, the broadband router 3 responds to an access request to the Internet 6 from the user terminal 2 when a communication path is not established between itself and the ISP network 5 or the additional function network 7. Then, a connection request to the ISP network 5 or the additional function network 7 is made to the BAS 4 (S101). The connection request includes an ID and a password used for user authentication, and a domain name as information indicating an additional function requested by the user terminal 2.

  In response to the connection request from the broadband router 3, the BAS 4 inquires the user authentication of the user terminal 2 to the authentication server 1 (S102).

FIG. 7A shows a configuration example of a packet constituting this inquiry. The attribute value stored in “User-Name” is a combination of a user ID and a domain name. For example, a character string “ID @ domain name” is stored. As a specific example, as shown in FIG.
For the user a who desires the DPI function, the attribute value is “a@dpi.ccc.com”. In the case of the user b who does not want the additional function, the attribute value is “b@ccc.com”.

The attribute value stored in “User-Password” and “CHAP-Password” is a password included in the connection request, and is used for user authentication of the authentication server 1. "User-Password"
And “CHAP-Password” is an authentication protocol used between the BAS 4 and the authentication server 1 (
Either one is selected by PAP (Password Authentication Protocol) or CHAP (Challenge Handshake Authentication Protocol). In addition, the attribute values stored in other attributes are used for communication between the BAS 4 and the authentication server 1.

  Returning to FIG. 6, the authentication server 1 performs user authentication of the user terminal 2 in response to a user authentication inquiry from the BAS 4. User authentication is performed by the authentication unit 16. For example, the authentication unit 16 determines whether or not the ID and password included in the user authentication inquiry from the BAS 4 match the set of ID and password stored in the user authentication information database 15. If the ID and password included in the user authentication inquiry from the BAS 4 match the set of ID and password stored in the user authentication information database 15, the authentication unit 16 is established when the user authentication is established. Is determined (S103).

  When the authentication unit 16 determines that the user authentication is established, the response unit 17 permits connection to the ISP network 5 or the additional function network 7 based on the domain name (S104). For example, in the case of the user a, the response unit 17 permits connection to the additional function network 7 (DPI dedicated network 7a). For example, in the case of the user b, the response unit 17 permits connection to the ISP network 5.

FIG. 7B shows a configuration example of a packet constituting this connection permission. The attribute values of “Service-Type” and “Framed-Protocol” are used for communication between the BAS 4 and the authentication server 1 as described above. The attribute values of “Framed-IP-Address” and “Framed-IP-Netmask” are an IP address assigned to the broadband router 3 and its subnet mask.

In addition, the attribute value of “Ascend-Primary-Home-Agent” is set to BA in S105 described later.
S4 is used to access the ISP network termination device 51 (ISP network 5) or the additional function termination device 71 (additional function network 7). For example, in the case of the user a, the attribute value is the IP address of the additional function termination device 71 (DPI dedicated network termination device 71a). For example, in the case of the user b, the attribute value is the IP address of the ISP network termination device 51.

Returning to FIG. 6, in response to the connection permission from the authentication server 1 to the ISP network 5 or the additional function network 7, the BAS 4 sends a connection request based on the connection permission to an ISP network termination device that is a termination device of each network. 51 or the additional function network termination device 71 (S105). At the time of the connection request, as described above, the BAS 4 uses the attribute value “Ascend-Primary-Home-Agent” to access the ISP network termination device 51 or the additional function network termination device 71 to make a connection request. For example, in the case of the user a, the BAS 4 accesses the additional function network termination device 71 (DPI dedicated network termination device 71a) and makes a connection request. For example, in the case of the user b, the BAS 4 accesses the ISP network termination device 51 and makes a connection request.

  In response to the connection request from the BAS 4, the ISP network termination device 51 or the additional function network termination device 71 performs a connection confirmation for the connection permission (S 104) related to the connection request made by the authentication server 1 to the authentication server 1. (S106).

FIG. 8A shows a configuration example of a packet constituting this connection confirmation. The attribute values from “User-Name” to “NAS-Port-Id” are used for specifying the connection permission performed by the authentication server 1.
The attribute values of “Tunnel-Type”, “Tunnel-Medium-Type”, and “Tunnel-Server-Endpoint” are communication paths (tunnels) established between the broadband router 3 and the ISP network 5 or the additional function network 7. ) Is used to confirm with the authentication server 1. In S110 and S111 described later, a communication path is established based on these attribute values.

  Returning to FIG. 6, in response to the connection confirmation from the ISP network termination device 51 or the additional function network termination device 71, the authentication server 1 (response unit 17) assigns a connection permission corresponding to the connection permission performed in S 104 to the ISP network termination. This is performed for the device 51 or the additional function network termination device 71 (S107).

  FIG. 8B shows a configuration example of a packet constituting this connection permission. As described above, the attribute values of “Framed-IP-Address” and “Framed-IP-Netmask” are the IP address assigned to the broadband router 3 and its subnet mask. The additional function network termination device 71 uses these values to identify the broadband router 3 that establishes a communication path with the additional function network 7.

  Returning to FIG. 6, in response to the connection permission from the authentication server 1, the ISP network terminating device 51 or the additional function network terminating device 71 performs connection permission for the connection request from the BAS 4 to the BAS 4 (S 108).

  In response to the connection permission from the ISP network termination device 51 or the additional function network termination device 71, the BAS 4 returns a connection permission to the ISP network 5 or the additional function network 7 to the broadband router 3 (S109). The connection permission includes an IP address assigned to the broadband router 3 and its subnet mask.

For establishing a communication path between the broadband router 3 and the ISP network 5 or the additional function network 7 from the broadband router 3 to the BAS 4 according to the connection permission from the BAS 4 to the ISP network 5 or the additional function network 7. (S110). In response to this, communication for establishing a communication path between the broadband router 3 and the ISP network 5 or the additional function network 7 is performed from the BAS 4 to the ISP network termination device 51 or the additional function network termination device 71. (S111). Note that the type of communication path established at this time is based on the attribute values of “Tunnel-Type”, “Tunnel-Medium-Type”, and “Tunnel-Server-Endpoint” as described above.

  Through the above processing, a communication path is established between the BAS 4 and the ISP network 5 or the additional function network 7. Thereby, for example, in the case of the user a, the user terminal 2 can access a server on the Internet 6 via the additional function network 7 (DPI dedicated network 7a). For example, in the case of the user b, the user terminal 2 can access a server existing on the Internet 6 via the ISP network 5.

  In the setting of a program or the like that realizes the above operation of the BAS 4, the connection to the ISP network 5 may be set as a default. In this case, after receiving the connection permission from the authentication server 1 (S104), the BAS 4 omits the processes of S105 to S108 and permits the broadband router 3 to connect to the ISP network 5 (S109). Further, in this case, since the processes of S105 to S108 are omitted, the ISP network termination device 51 and the authentication server 1 do not have to be in the state of FIG. 1 in which direct communication is possible via the network.

§4 Operation and effect according to embodiment As described above, in the authentication server and the authentication system according to the present embodiment, the authentication server 1 uses the user terminal 2 based on the information indicating the additional function requested by the user terminal 2. Determines the network (ISP network 5 or additional function network 7) through which the network connects to the Internet 6. For this reason, when the authentication server 1 permits connection to the network, the user terminal 2 can connect to the Internet 6 via a network that can provide an additional function requested by the user terminal 2. Therefore, in this embodiment, an additional function provided on the network can be provided to an appropriate user. Also, unlike conventional systems, it is not necessary to provide functions to all users, and it is only necessary to prepare a network that can provide additional functions to appropriate users. , Providing functionality.

  In the present embodiment, the authentication server 1 determines a connection destination network based on the domain name. Thereby, the user can achieve switching of additional functions permitted or desired by the user by switching the domain name.

  Moreover, in this embodiment, the user terminal 2 switches an additional function by operation of a web page. For this reason, the user can arbitrarily switch a desired additional function. Further, since the additional function requested by the user terminal 2 can be switched arbitrarily by the user, the side providing the additional function (for example, ISP) can notify the user of the additional function to be provided.

§5 Supplement Although the embodiment of the present invention has been described in detail above, the above description is merely an example of the present invention in all respects and is not intended to limit the scope thereof. It goes without saying that various improvements and modifications can be made without departing from the scope of the present invention. The scope of the present invention is construed only by the claims. Moreover, those skilled in the art can implement an equivalent range from the description of the present embodiment based on the description of the claims and the common general technical knowledge. Moreover, the term used in this specification is used by the meaning normally used in the said field unless there is particular mention. Thus, unless defined otherwise, all technical and technical terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs. In the event of a conflict, terms used herein will be understood in the meaning set forth herein (including definitions).

  In the above description, an embodiment of the authentication server and authentication system according to the present invention has been described. However, the embodiment of the authentication method and authentication program according to the present invention can also be described in the same manner. That is, a procedure in which each process of the authentication server is a step is an embodiment of an authentication method according to the present invention, and a program used to execute each process of the authentication server is an authentication program according to the present invention. It is one embodiment.

1 Authentication Server 11 Storage Unit 12 Control Unit 13 Bus 14 Communication Unit 15 User Authentication Information Database 16 Authentication Unit 17 Response Unit 2 User Terminal 3 Broadband Router 4 BAS
5 ISP Network 51 ISP Network Termination Device 6 Internet 7 Additional Function Network 7a DPI Dedicated Network 7b Bandwidth Restriction Dedicated Network 7c Enhanced Security Network 7d Premium Network 71 Additional Function Network Termination Device 71a DPI Dedicated Network Termination Device 71b Bandwidth Restriction Dedicated Network Termination Device 71c Security Enhanced Network Termination Device 71d Premium Network Termination Device 72 Additional Function Device 81 Additional Function Server

Claims (5)

In an authentication server that performs user authentication for an information terminal that makes a connection request to the network,
A storage unit;
An authentication unit that performs user authentication of the information terminal in response to a connection request from the information terminal;
After the user authentication of the authentication unit, it is possible to provide the information terminal with an additional function requested by the information terminal transmitted from the information terminal side or indicated by information stored in the storage unit A response unit that permits connection to the network;
An authentication server comprising:   The authentication server according to claim 1, wherein the information transmitted from the information terminal side is a domain name including a character string indicating an additional function requested by the information terminal. In an authentication system comprising an authentication server that performs user authentication for an information terminal that makes a connection request to a network, and an application server,
The authentication server is
A storage unit;
An authentication unit that performs user authentication of the information terminal in response to a connection request from the information terminal;
After the user authentication of the authentication unit, it is possible to provide the information terminal with an additional function requested by the information terminal transmitted from the information terminal side or indicated by information stored in the storage unit A response unit that permits connection to the network;
With
The application server switches an additional function indicated by information transmitted from the information terminal side or stored in the storage unit in response to an application for switching the additional function from the information terminal. system. An authentication method for performing user authentication on an information terminal that makes a connection request to a network,
Performing a user authentication of the information terminal in response to a connection request from the information terminal;
After the step of performing user authentication of the authentication unit, an additional function requested by the information terminal indicated by the information transmitted from the information terminal side or stored in the storage unit is provided to the information terminal Allowing connections to possible networks;
An authentication method comprising: An authentication program used in an authentication server that performs user authentication for an information terminal that makes a connection request to a network,
Performing a user authentication of the information terminal in response to a connection request from the information terminal;
After the step of performing user authentication of the authentication unit, an additional function requested by the information terminal indicated by the information transmitted from the information terminal side or stored in the storage unit is provided to the information terminal Allowing connections to possible networks;
An authentication program for causing the authentication server to execute.

Images