JP2014042095A - Authentication system and method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an authentication system and a method that can simplify the management of a certificate used for authentication of a communication device and reduce resources required for transmission and reception of the certificate.SOLUTION: An authentication system 1 comprises: an authentication database 50 which stores certificates used for authenticating radio devices 10a-10c connected with a radio network N1; and a system manager 40 which, when there was a connection request from the radio devices 10a-10c, reads out a certificate to authenticate the radio device (for example, the radio device 10a) which performed the connection request from the authentication database 50, and authenticates the communication device (for example, the radio device 10a) which performed the connection request using the read out certificate.

Description

  The present invention relates to an authentication system and method for authenticating a communication device connected to a network.

  Conventionally, in plants and factories, field devices (measuring instruments, operating devices) called field devices and control devices for controlling these devices are connected via communication means in order to realize advanced automatic operations. A distributed control system (DCS) has been constructed. Most of the communication systems that form the basis of such a distributed control system perform communication by wire, but in recent years, wireless communication that conforms to industrial wireless communication standards such as ISA100.11a and WirelessHART (registered trademark). Something that communicates has also been realized.

  The above communication system is provided with an authentication system for authenticating a communication device connected to a wired or wireless network using PKI (Public Key Infrastructure) in order to ensure security. In particular, in a communication system that performs communication via a wireless network, if the communication device (wireless device) is disposed within a radio wave reachable area, the communication system can be connected to the wireless network. Becomes mandatory.

  Here, the authentication system includes a management apparatus that manages a certificate issued by a trusted certification authority (CA) and authenticates a communication device using the certificate. Specifically, this management apparatus verifies the validity of the certificate presented by the communication device using the certificate managed by itself, and then performs data exchange with the communication device using a challenge / response method. The communication device is authenticated by transmitting and receiving (message).

  The communication device presents a certificate to the management device as a method for presenting a certificate together with a connection request (join request) to the network (PiggyBack method), and anonymity for the network. And a method of presenting a certificate during connection (anonymous connection method). The following Patent Document 1 discloses a challenge / response authentication method using a conventional PKI, which is not used in an authentication system provided in a plant or factory.

JP 2008-167107 A

  By the way, a certificate granted to a communication device (a communication device that is authenticated by a management apparatus of the authentication system) from the above-described certificate authority is generally set with an expiration date in order to increase security. When a certificate with such an expiration date is used, it is necessary to renew the certificate by secure communication (secure communication) via the network before the expiration date elapses. .

  However, communication devices such as field devices used in plants, factories, and the like are stored for a long period of time in addition to those used immediately after shipment. Such a communication device cannot be connected to the network if the expiration date of the certificate elapses during storage. As described above, since the certificate is updated through communication via the network, the certificate cannot be updated when the certificate cannot be connected to the network due to the expiration of the certificate expiration date. For this reason, conventionally, there has been a problem that certificate expiration management has to be performed for all communication devices that may be connected to the network, which requires extremely complicated work.

  In addition, a wireless network compliant with the above-described wireless communication standard ISA100.11a or the like is formed by a wireless device (wireless field device) or a wireless router that performs intermittent operation using a battery as a power source. Is narrow). Due to these characteristics, the size of a packet transmitted / received via the wireless network is limited to about 100 bytes (for example, 128 bytes), such as pressure, flow rate, temperature, etc. measured by the wireless device. Data indicating the process amount is communicated in units of this packet.

  However, the certificate used for authentication of the wireless device has a data amount of about several kilobytes or more, and has a larger data amount than the data indicating the process amount. For this reason, in order to transmit the certificate from the wireless device to the management apparatus, a lot of resources are required, and the wireless device disposed on the communication path between the wireless device that transmits the certificate and the management apparatus. Many resources of wireless devices such as routers are consumed. As a result, there were problems such as the battery replacement time being advanced, and the data transmission of the original process amount may be hindered.

  The present invention has been made in view of the above circumstances, and an authentication system capable of simplifying management of a certificate used for authentication of a communication device and reducing resources required for transmitting and receiving a certificate, and Aims to provide a method

In order to solve the above problems, an authentication system of the present invention is for authenticating the communication device in an authentication system (1, 2) that authenticates communication devices (10a to 10c) connected to a network (N1). A first database (50) for storing the first certificate (C11 to C13) used for the authentication, and a first authentication for authenticating the communication device that has made the connection request when there is a connection request from the communication device. And a management device (40) that reads a certificate from the database and authenticates the communication device that has made the connection request using the first certificate.
According to the present invention, when there is a connection request from a communication device, the first certificate for authenticating the communication device that has made the connection request is read from the database, and the read first certificate is The management device authenticates the communication device that has used the connection request.
In the authentication system of the present invention, the first certificate stored in the database is verified using a second certificate (C20) for verifying the first certificate. It is a feature.
The authentication system of the present invention includes a server device (70) connected to the management device via a network (N3) different from the network and providing information stored in the database. A device is characterized in that the first certificate stored in the database is acquired from the server device.
In addition, the authentication system of the present invention includes a certificate authority server device (80) that issues first certificates (C31 to C33) stored in the database.
In the authentication system of the present invention, the first certificate is given to the communication device, and the management apparatus authenticates the communication device that has made the connection request. Is not stored in the database, the first certificate assigned to the communication device that has made the connection request is acquired, and the communication device that has made the connection request is authenticated. It is characterized by.
The authentication method of the present invention is an authentication method for authenticating the communication devices (10a to 10c) connected to the network (N1), and the first step of receiving a connection request from the communication device (S22, S31). And reading a first certificate for authenticating the communication device that has made the connection request from a database (50) storing a first certificate (C11 to C13) used for authenticating the communication device. A second step (S23); and a third step (S24) for authenticating the communication device that has made the connection request using the first certificate read in the second step. Yes.

  According to the present invention, when there is a connection request from a communication device, the first certificate for authenticating the communication device that has made the connection request is read from the database, and the connection is made using the read first certificate. The communication device that made the request is authenticated. For this reason, since the management of the first certificate for authenticating the communication device only needs to manage what is stored in the database, it is possible to simplify the management of the certificate used for authentication of the communication device. There is. Further, since the certificate is not transmitted / received to / from the communication device that has made the connection request, it is possible to reduce the resources required for the certificate transmission / reception.

It is a block diagram which shows the whole structure of the authentication system by 1st Embodiment of this invention. It is a figure for demonstrating PKI used by 1st Embodiment of this invention. It is a figure which shows an example of the incorporating method of the certificate in 1st Embodiment of this invention. It is a flowchart which shows 1st operation | movement of the authentication system by 1st Embodiment of this invention. It is a timing chart which shows the 1st operation | movement of the authentication system by 1st Embodiment of this invention. It is a flowchart which shows 2nd operation | movement of the authentication system by 1st Embodiment of this invention. It is a timing chart which shows the 2nd operation | movement of the authentication system by 1st Embodiment of this invention. It is a block diagram which shows the whole structure of the authentication system by 2nd Embodiment of this invention. It is a figure for demonstrating PKI used by 3rd Embodiment of this invention. It is a flowchart which shows operation | movement of the authentication system by 4th Embodiment of this invention.

  Hereinafter, an authentication system and method according to embodiments of the present invention will be described in detail with reference to the drawings.

[First Embodiment]
FIG. 1 is a block diagram showing the overall configuration of an authentication system according to the first embodiment of the present invention. As shown in FIG. 1, the authentication system 1 of this embodiment includes wireless devices 10a to 10c (communication devices), wireless routers 20a and 20b, a backbone router 30, a system manager 40 (management device), and an authentication database 50 (database). The system manager 40 authenticates the wireless devices 10a to 10c connected to the wireless network N1 (network) using the authentication database 50. The numbers of the wireless devices 10a to 10c and the wireless routers 20a and 20b shown in FIG. 1 are arbitrary.

  The wireless network N1 in FIG. 1 is formed by the wireless devices 10a to 10c, the wireless routers 20a and 20b, and the backbone router 30 under the management control of the system manager 40, and is power-saving and low-speed (the communication band is narrow). It is a wireless network with the characteristic of being. The backbone network N2 to which the backbone router 30 and the system manager 40 are connected is a wired or wireless network that is the backbone of the authentication system 1 having the characteristic of being broadband.

  The wireless devices 10a to 10c are wireless field devices installed in plants or factories such as sensor devices such as flow meters and temperature sensors, valve devices such as flow control valves and on-off valves, and actuator devices such as fans and motors. . These wireless devices 10a to 10c perform intermittent operation using a battery as a power source, and perform wireless communication conforming to ISA100.11a which is a wireless communication standard for industrial automation.

  Here, the wireless devices 10a to 10c cannot be properly connected to the wireless network N1 unless authenticated by the system manager 40. Therefore, certificates C11 to C13 (see FIG. 2) indicating that the wireless devices 10a to 10c themselves are legitimate wireless devices are prepared in advance. However, although details will be described later, since the certificates C11 to C13 are stored in the authentication database 50, they are not necessarily held in the wireless devices 10a to 10c.

  The wireless routers 20a and 20b perform wireless communication based on the wireless communication standard ISA100.11a with the wireless devices 10a to 10c and the backbone router 30, and are transmitted and received between the wireless devices 10a to 10c and the backbone router 30. Relay data. These wireless routers 20a and 20b also perform intermittent operation using a battery as a power source, similarly to the wireless devices 10a to 10c. The wireless devices 10a to 10c, the wireless routers 20a and 20b, and the backbone router 30 are wirelessly connected to each other, thereby forming a star-mesh wireless network N1. Instead of the wireless routers 20a and 20b, a wireless device having the functions (relay function) of the wireless routers 20a and 20b may be provided.

  The backbone router 30 connects the wireless network N1 and the backbone network N2, and relays various data transmitted and received between the wireless devices 10a to 10c and the system manager 40. The backbone router 30 is continuously operated by, for example, DC power supplied from the backbone network N2 or DC power supplied via a route different from the backbone network N2, and is in compliance with the wireless communication standard ISA100.11a. Compliant wireless communication.

  The system manager 40 operates continuously with power supplied from, for example, a commercial power source, and manages and controls the authentication system 1 in an integrated manner. For example, the system manager 40 controls wireless communication performed via the wireless network N1. Specifically, allocation control of radio communication resources (time slots and communication channels) to the radio devices 10a to 10c, the radio routers 20a and 20b, and the backbone router 30 is performed to perform TDMA (Time Division Multiple) via the radio network N1. (Access: Time division multiple access) to achieve wireless communication.

  In addition, the system manager 40 authenticates the wireless devices 10a to 10c connected to the wireless network N1 using the certificates C11 to C13 and the certificate C20 (see FIG. 2) stored in the authentication database 50. Specifically, when there is a connection request from the wireless devices 10a to 10c, the system manager 40 replaces the certificates C11 to C13 (see FIG. 2) stored in the authentication database 50 with the certificate C20 (see FIG. 2). ) Is used to authenticate the wireless devices 10a to 10c that have requested connection by the challenge / response method.

  The authentication database 50 is a database in which information necessary for authenticating the wireless devices 10a to 10c is stored. Specifically, the authentication database 50 includes certificates C11 to C13 (first certificate: see FIG. 2) for the wireless devices 10a to 10c and a certificate issued by a trusted certificate authority, A certificate C20 (second certificate: see FIG. 2) used for verifying C11 to C13 is stored. The certificates C11 to C13 for the wireless devices 10a to 10c are stored in the authentication data database 50 in association with identifiers (for example, EUI64 addresses) that uniquely specify the wireless devices 10a to 10c.

  Here, the certificates C11 to C13 for the wireless devices 10a to 10c are originally held in the wireless devices 10a to 10c, respectively, but are stored in the authentication database 50 in this embodiment. . This is necessary for the transmission and reception of the certificates C11 to C13 by simplifying the management of the certificates for the wireless devices 10a to 10c and eliminating the transmission and reception of the certificates C11 to C13 via the wireless network N1. This is to reduce resources.

  FIG. 2 is a diagram for explaining a PKI (Public Key Infrastructure) used in the first embodiment of the present invention. As shown in FIG. 2, the certificates C11 to C13 for the wireless devices 10a to 10c, and the certificate C20 used to verify these certificates C11 to C13, are certificate authorities 60 (for example, trusted by the system manager 40) Issued by a public certificate authority). The certificates C11 to C13 and the certificate C20 issued by the certificate authority 60 are stored in the authentication database 50. The certificates C11 to C13 for the wireless devices 10a to 10c may be stored in the authentication database 50 and held in the wireless devices 10a to 10c, respectively.

  Here, although not shown in FIG. 2, the certificates C11 to C13 and the certificate C20 include different public keys. Private keys corresponding to the public keys included in the certificates C11 to C13 are held in the wireless devices 10a to 10c, respectively. The private key corresponding to the public key included in the certificate C20 is held in the certificate authority 60 and is strictly managed.

  When a connection request for the wireless network N1 is received from the wireless device 10a, the authentication of the wireless device 10a using the certificate C11 and the certificate 20 stored in the authentication database 50 is performed as shown in FIG. Is done by. If a connection request for the wireless network N1 is received from the wireless device 10b, the wireless device 10b is authenticated using the certificate C12 and the certificate 20 stored in the authentication database 50, and the connection request is received. If it is from the wireless device 10c, the wireless device 10c is authenticated using the certificate C13 and the certificate 20 stored in the authentication database 50.

  Next, a method for incorporating the certificates C11 to C13 and the certificate C20 issued by the certificate authority 60 will be described. FIG. 3 is a diagram showing an example of a certificate incorporation method according to the first embodiment of the present invention. Unlike a general network such as the Internet, the wireless network N1 realized in a plant or factory is installed with devices (wireless devices 10a to 10c, wireless routers 20a and 20b, and a backbone router 30) constituting the wireless network N1. It is a network that is carefully planned and designed in terms of location, number, type, etc. For this reason, when the design of the wireless network N1 is completed, a wireless device that needs to be connected to the wireless network N1 is determined, and a certificate necessary for the authentication is also determined.

  When the design of the wireless network N1 is completed, the vendor V of the wireless device issues a certificate C11 to C13 and a certificate C20 for the wireless devices 10a to 10c that need to be connected to the wireless network N1 to the certificate authority 60. Request. Upon obtaining the certificates C11 to C13 and the certificate C20 issued from the certificate authority 60, the vendor V incorporates the certificates C11 to C13 into the wireless devices 10a to 10c, respectively, and the certificates C11 to C13 and the certificate C20. Copy to a computer-readable recording medium M such as CD-ROM or DVD (registered trademark) -ROM. Then, the vendor V stores the wireless device (in the example shown in FIG. 3, the wireless device 10a) that has finished incorporating the certificate, and the recording medium M on which the certificates C11 to C13 and the certificate C20 are recorded, as a user U (for example, , Those who operate the authentication system 1 in a plant or factory).

  The user U installs the wireless device 10a sent from the vendor V at a position defined in the design stage, and the certificates C11 to C13 and the certificate C20 recorded on the recording medium M sent from the vendor V. Is incorporated into the system manager 40. The certificates C11 to C13 incorporated in the system manager 40 are stored in the authentication data database 50 in association with identifiers that uniquely identify the wireless devices 10a to 10c, and the certificate C20 incorporated in the system manager 40. Is stored in the authentication data database 50 alone. In this manner, the certificates C11 to C13 and the certificate C20 are incorporated into the authentication database 50.

  Here, if the user U refers to the network design document ND of the wireless network N1 and requests the vendor V, the certificate of the wireless device to be connected to the wireless network N1 is stored in the authentication database 50. It is possible to get something that is not. Further, if the user U requests the vendor V to obtain the certificates C11 to C13 or the certificate C20 in which a new expiration date is set, the certificates C11 to C13 or the certificate C20 stored in the authentication database 50 are obtained. It is also possible to update. Note that since the certificates C11 to C13 and the certificate C20 may be disclosed, the route through which the user U obtains the recording medium M from the vendor V can be selected as appropriate.

  Next, operation | movement of the authentication system 1 in the said structure is demonstrated. In the following description, it is assumed that the wireless device to be connected to the wireless network N1 is the wireless device 10a, and the operation when the wireless device 10a is authenticated will be described as an example. Here, the operation of the authentication system 1 is an operation when a certificate is presented by a method according to the PiggyBack method (first operation) and an operation when a certificate is presented by the anonymous connection method. (Second operation). Below, these 1st, 2nd operation | movement is demonstrated in order.

<First operation>
FIG. 4 is a flowchart showing a first operation of the authentication system according to the first embodiment of the present invention, and FIG. 5 is a timing chart showing a first operation of the authentication system. As shown in FIG. 4 and FIG. 5, first, an offline operation for preparing a certificate used for authenticating the wireless device 10a is performed (step S10), and then wireless is performed using the certificate prepared in the offline state. An online operation for authenticating the device 10a is performed (step S20).

  When the offline operation is started, the system manager 40 first acquires the certificate C20 issued by the certificate authority 60 and stores it in the authentication database 50 (step S11). For example, the system manager 40 reads the certificate C20 recorded on the recording medium M (recording medium M sent out from the vendor V) described with reference to FIG. 3 and stores it in the authentication database 50.

  Next, the system manager 40 performs processing for obtaining the certificates C11 to C13 issued by the certificate authority 60 and verifying the validity of the certificates C11 to C13 using the certificate C20 (step S12). For example, the certificates C11 to C13 recorded on the recording medium M described with reference to FIG. 3 (the recording medium M shipped from the vendor V) are read, and the certificate C20 stored in the authentication database 50 in the process of step S11. The system manager 40 performs a process of verifying the validity of the certificates C11 to C13 using the certificate C20.

  Next, the system manager 40 determines whether or not the certificates C11 to C13 are valid (step S13). If the system manager 40 determines that the certificates C11 to C13 are invalid (when the determination result is “NO”), the series of processing illustrated in FIG. 4 ends. On the other hand, when the system manager 40 determines that the certificates C11 to C13 are valid (when the determination result is “YES”), it is associated with an identifier that uniquely identifies the wireless devices 10a to 10c. Then, the process of storing the certificates C11 to C13 in the authentication database 50 is performed (step S14). When the above processing is completed, the offline operation is terminated and the online operation is started.

  When the online operation is started, the system manager 40 waits to receive a connection request via the wireless network N1 (step S21). In this state, if a connection request for the wireless network N1 is transmitted from the wireless device 10a, the connection request is received by the system manager 40 (step S22: first step). Here, if the original piggyback method is used, a certificate for the wireless device 10a is transmitted from the wireless device 10a to the system manager 40 together with the connection request, but in this embodiment, only the connection request is sent without sending the certificate. Is sent. Therefore, the system manager 22 receives only the connection request for the wireless device 10a.

  When receiving the connection request from the wireless device 10a, the system manager 40 reads the certificate C11 associated with the identifier of the wireless device 10a from the authentication database 50 (step S23: second step). The identifier of the wireless device 10a used when searching the authentication database 50 is transmitted from the wireless device 10a accompanying the connection request.

  When the certificate C11 for the wireless device 10a is read, the system manager 40 performs authentication of the wireless device 10a by transmitting / receiving data (message) to / from the wireless device 10a by the challenge / response method (step S24: No. 1). 3 steps). Specifically, first, the system manager 40 encrypts a special message using the public key included in the certificate C11 read from the authentication database 50 in step S23, and transmits the encrypted message to the wireless network N1. Via the wireless device 10a (challenge).

  When receiving the message transmitted from the system manager 40, the wireless device 10a decrypts the message using the secret key held by itself. Since the message from the system manager 40 is encrypted using the public key included in the certificate C11 for the wireless device 10a, it can be decrypted only with the private key held in the wireless device 10a. .

  When the message from the system manager 40 is decrypted, the wireless device 10a presents the decrypted message to the system manager 40 in a secure manner (response). For example, the wireless device 10 a encrypts a message (decrypted message) using the public key of the system manager 40 and transmits the encrypted message to the system manager 40.

  Note that since the message transmitted from the wireless device 10a to the system manager 40 can be decrypted only with the private key held and managed by the system manager 40, the wireless device 10a can securely decrypt the decrypted message. Can be presented to the system manager 40. Alternatively, the wireless device 10a regards a part of the decrypted message as a target key, and encrypts the decrypted message or a part of the message with the key, thereby presenting it to the system manager 40 in a secure manner. it can.

  When receiving the message presented from the wireless device 10a, the system manager 40 determines whether or not the authentication of the wireless device 10a has been successful from the content of the message transmitted to the wireless device 10a (step S25). Specifically, whether or not the wireless device 10a has been successfully authenticated depends on whether or not the message transmitted to the wireless device 10a matches the message presented from the wireless device 10a according to a predetermined verification rule. Determine whether.

  When it is determined that the authentication has succeeded (when the determination result in step S25 is “YES”), the system manager 40 accepts the connection request from the wireless device 10a, and displays the authentication result indicating that the authentication has been successful. The device 10a is notified (step S26). Through the above processing, the wireless device 10a is properly connected to the wireless network N1, and can communicate via the wireless network N1 under the management of the system manager 40.

  On the other hand, when it is determined that the authentication has failed (when the determination result of step S25 is “NO”), the system manager 40 rejects the connection request from the wireless device 10a and indicates that the authentication has failed. The authentication result shown is notified to the wireless device 10a (step S27). Through the above processing, since the connection request to the wireless network N1 of the wireless device 10a is rejected, the wireless device 10a is not connected to the wireless network N1 and cannot communicate via the wireless network N1.

<Second operation>
FIG. 6 is a flowchart showing the second operation of the authentication system according to the first embodiment of the present invention, and FIG. 7 is a timing chart showing the second operation of the authentication system. 6 and 7, the same reference numerals are given to steps in which the same processes as those shown in FIGS. 4 and 5 are performed. As shown in FIGS. 6 and 7, also in this operation, the offline operation is first performed (step S10), and then the online operation is performed (step S20). However, since the offline operation in this operation is the same as the offline operation in the first operation, description of the offline operation will be omitted and only the online operation will be described below.

  When the online operation is started, the system manager 40 waits to receive a connection request via the wireless network N1 (step S21). In this state, if an anonymous connection request for the wireless network N1 is transmitted from the wireless device 10a, the anonymous connection request is received and accepted by the system manager 40, and anonymous between the wireless device 10a and the system manager 40. Connection is established (step S31: first step). Here, similarly to the conventional anonymous connection method, the certificate is not sent from the wireless device 10a to the system manager 40.

  When the anonymous connection with the wireless device 10a is established, the system manager 40 reads the certificate C11 associated with the identifier of the wireless device 10a from the authentication database 50 (step S23). Note that the identifier of the wireless device 10a used when searching the authentication database 50 is transmitted from the wireless device 10a accompanying the anonymous connection request.

  When the certificate C11 for the wireless device 10a is read, the system manager 40 transmits / receives data (message) to / from the wireless device 10a by the challenge / response method to authenticate the wireless device 10a (step S24). Note that the authentication of the wireless device 10a by the challenge / response method is performed by the same processing as the first operation, and thus detailed description thereof is omitted.

  Next, the system manager 40 determines whether or not the wireless device 10a has been successfully authenticated (step S25). When it is determined that the authentication is successful (when the determination result is “YES”), the system manager 40 performs a process of switching the anonymous connection established with the wireless device 10a to a normal connection (step) S32). Through the above processing, the wireless device 10a is properly connected to the wireless network N1, and can communicate via the wireless network N1 under the management of the system manager 40.

  On the other hand, when it is determined that the authentication has failed (when the determination result of step S25 is “NO”), the system manager 40 performs a process of disconnecting the anonymous connection with the wireless device 10a (step S25). S33). As a result of the above processing, the wireless device 10a is disconnected from the wireless network N1, and therefore cannot communicate via the wireless network N1.

  As described above, in this embodiment, the authentication database 50 that stores the certificates C11 to C13 (verified using the certificate C20) for the wireless devices 10a to 10c is provided. When there is a connection request or an anonymous connection request from the wireless device 10a, the system manager 40 reads the certificate C11 for the wireless device 10a from the authentication database 50 and authenticates the wireless device 10a. Yes.

  Thereby, the management of the certificates C11 to C13 for the wireless devices 10a to 10c may be performed for those stored in the authentication database 50, and it is not necessary to perform the management for those held in the wireless devices 10a to 10c. Management of the certificates C11 to C13 can be simplified. In addition, even if any of the first and second operations described above is performed, the certificates C11 to C13 are not transmitted / received via the wireless network N1, so that the certificates C11 to C13 are transmitted / received. It is possible to reduce the resources required for this.

[Second Embodiment]
FIG. 8 is a block diagram showing the overall configuration of the authentication system according to the second embodiment of the present invention. In FIG. 8, the same components as those shown in FIG. 1 are denoted by the same reference numerals. As shown in FIG. 8, the authentication system 2 of this embodiment includes an authentication server 70 (server device) that provides a certificate stored in the authentication database 50, and connects the system manager 40 and the authentication server 70 to a LAN (Local This is a configuration connected by a network N3 such as Area Network).

  In the authentication system 1 of the first embodiment described above, the system manager 40 is directly connected to the authentication database 50, and the system manager 40 reads the certificates C11 to C13 from the authentication database 50. On the other hand, in the authentication system 2 of the present embodiment, when the system manager 40 makes a read request for the certificates C11 to C13 to the authentication server 70, the certificates C11 to C13 corresponding to the request are sent by the authentication server 70. Provided. When the system manager 40 makes a read request for the certificates C11 to C13, it is necessary to provide the authentication server 70 with an identifier that uniquely identifies the wireless devices 10a to 10c.

  As described above, in this embodiment, since the authentication server 70 that provides the certificate stored in the authentication database 50 is provided, the load on the system manager 40 can be reduced. FIG. 8 illustrates a configuration in which one authentication server 70 is connected to the system manager 40 via the network N3, but a plurality of authentication servers 70 are connected to the system manager 40 via the network N3. It may be a configuration. Further, the authentication server 70 may be connected to the system manager 40 via the backbone network N2.

[Third Embodiment]
Next, a third embodiment of the present invention will be described. In the first and second embodiments described above, the wireless devices 10a to 10c are registered using the certificates C11 to C13 and the certificate C20 issued by the certificate authority 60 (for example, a public certificate authority) that the system manager 40 can trust. Authentication was performed. On the other hand, in this embodiment, the wireless devices 10a to 10c are authenticated using a certificate issued by a certificate authority uniquely constructed by the user U.

  FIG. 9 is a diagram for explaining the PKI used in the third embodiment of the present invention. As shown in FIG. 9, in the present embodiment, a certificate authority server device 00 that is a certificate authority uniquely constructed by the user U is provided. The certificate authority server device 80 issues certificates C31 to C33 (first certificate) used to authenticate the wireless devices 10a to 10c. The certificate authority server device 80 may be connected to the network N3 provided in the authentication system 2 shown in FIG. 8, for example, but may be separated from the authentication system 2 in order to improve security. .

  If the certificates C31 to C33 newly issued by the certificate authority server device 80 are stored in the authentication database 50, the wireless devices 10a to 10c using the certificates C31 to C33 are authenticated by the system manager 40. However, it is not easy to update the secret key stored in the wireless devices 10a to 10c.

  Therefore, as shown in FIG. 9, the system manager 40 extracts, for example, the certificate C11 corresponding to the wireless device 10a from the authentication database 50, presents the public key included therein, and makes a signature request to the certificate authority server device 80. . If such a certificate authority server device 80 is provided, it is possible to authenticate a wireless device using PKI as described above using a certificate authority uniquely constructed by the user U. Further, the certificate C31 generated in this way may be incorporated into the wireless device 10a via the system manager 40. When the wireless devices 10a to 10c provide an interface for setting a secret key, a certificate including a public key that is paired with the secret key by the certificate authority server device 80 as performed by the vendor V in FIG. May be generated and incorporated via the system manager 40.

[Fourth Embodiment]
Next, a fourth embodiment of the present invention will be described. In the first and second embodiments described above, the system manager 40 authenticates the wireless devices 10a to 10c using the certificates C11 to C13 stored in the authentication database 50. In the present embodiment, even when the certificates C11 to C13 for authenticating the wireless devices 10a to 10c are not stored in the authentication database 50, the certificates C11 to C13 held in the wireless devices 10a to 10c are stored. By acquiring this, the wireless devices 10a to 10c can be authenticated (fallback).

  For this reason, in the present embodiment, it is assumed that the certificates C11 to C13 whose expiration dates have not expired are held in the wireless devices 10a to 10c. The overall configuration of the authentication system according to this embodiment is the same as that of the authentication system 1 according to the first embodiment shown in FIG. 1 or the authentication system 2 according to the second embodiment shown in FIG.

  FIG. 10 is a flowchart showing the operation of the authentication system according to the fourth embodiment of the present invention. The flowchart shown in FIG. 10 shows the operation (second operation) when a certificate is presented by the anonymous connection method, similarly to the flowchart shown in FIG. In FIG. 10, the offline operation (step S10) is omitted, and only the online operation (step S20) is shown. In FIG. 10, the same reference numerals are given to steps in which the same processing as the processing shown in FIG. 6 is performed.

  When the online operation is started, the system manager 40 waits to receive a connection request via the wireless network N1 as in the second operation in the first embodiment (step S21). In this state, if an anonymous connection request for the wireless network N1 is transmitted from the wireless device 10a, the anonymous connection request is received and accepted by the system manager 40, and anonymous between the wireless device 10a and the system manager 40. A connection is established (step S31). Here, similarly to the conventional anonymous connection method, the certificate is not sent from the wireless device 10a to the system manager 40.

  When the anonymous connection with the wireless device 10a is established, the system manager 40 reads the certificate C11 associated with the identifier of the wireless device 10a from the authentication database 50 (step S23). Note that the identifier of the wireless device 10a used when searching the authentication database 50 is transmitted from the wireless device 10a accompanying the anonymous connection request.

  Next, the system manager 40 determines whether or not the certificate C11 has been successfully read from the authentication database 50 (step S41). When it is determined that the certificate C11 has been successfully read (when the determination result is “YES”), the system manager 40 authenticates the wireless device 10a by the challenge / response method, as in the first embodiment. (Step S24).

  On the other hand, when it is determined that the reading of the certificate C11 has failed (when the determination result is “NO”), the system manager 40 requests the wireless device 10a to transmit the certificate C11 and wirelessly The certificate C11 is acquired from the device 10a (step S42). Then, using the public key included in the certificate C11 acquired from the wireless device 10a, the wireless device 10a is authenticated by the challenge / response method (step S24).

  If the authentication of the wireless device 10a is successful, the system manager 40 performs a process of switching the anonymous connection established with the wireless device 10a to a regular connection as in the first embodiment ( Step S32). If the authentication of the wireless device 10a fails, the system manager 40 performs processing for disconnecting the anonymous connection with the wireless device 10a as in the first embodiment (step S33).

  As described above, in the present embodiment, when the certificates C11 to C13 for the wireless devices 10a to 10c are not stored in the authentication database 50, the certificates C11 to C13 held in the wireless devices 10a to 10c are stored. The wireless devices 10a to 10c are authenticated and acquired. For this reason, for example, even when a failure occurs in the authentication database 50, the wireless devices 10a to 10c can be connected to the wireless network N1 by the same method as before.

  The authentication system and method according to the embodiment of the present invention have been described above, but the present invention is not limited to the above-described embodiment, and can be freely changed within the scope of the present invention. For example, in the above embodiment, when offline (step S10 in FIGS. 4 and 6), the certificates C11 to C13 used for authentication of the wireless devices 10a to 10c are verified in advance using the certificate C20 and verified. Only those that have been processed are stored in the authentication database 50. However, the verification of the certificates C11 to C13 when offline (verification using the certificate C20) is not performed, and the above verification is performed when there is a connection request or an anonymous connection request from the wireless devices 10a to 10c when online. You may do it.

  In the above embodiment, the aspect in which the backbone router 30 and the system manager 40 are provided separately has been described. However, the present invention is an aspect in which the backbone router 30 and the system manager 40 are integrated. Also good. In such a case, the backbone network N2 can be omitted. Moreover, although the said embodiment demonstrated the example which authenticates the wireless devices 10a-10c connected to the wireless network N1, this invention is applicable also to the authentication of the communication device connected to a wired network.

DESCRIPTION OF SYMBOLS 1, 2 Authentication system 10a-10c Wireless device 40 System manager 50 Authentication database 70 Authentication server 80 Certification authority server apparatus C11-C13 Certificate C20 Certificate C31-C33 Certificate N1 Wireless network N3 network

Claims (6)

In an authentication system that authenticates communication devices connected to a network,
A database that stores a first certificate used to authenticate the communication device;
When there is a connection request from the communication device, a first certificate for authenticating the communication device that has made the connection request is read from the database, and the connection request is made using the first certificate. And a management device that authenticates the communication device.   The authentication system according to claim 1, wherein the first certificate stored in the database is verified using a second certificate for verifying the first certificate. A server device connected to the management device via a network different from the network and providing information stored in the database;
The authentication system according to claim 1, wherein the management device acquires the first certificate stored in the database from the server device.   The authentication system according to any one of claims 1 to 3, further comprising a certificate authority server device that issues a first certificate stored in the database. The communication device is provided with the first certificate,
If the first certificate for authenticating the communication device that has made the connection request is not stored in the database, the management apparatus is assigned to the communication device that has made the connection request The authentication system according to any one of claims 1 to 4, wherein the first certificate is acquired, and the communication device that has made the connection request is authenticated. An authentication method for authenticating a communication device connected to a network,
A first step of receiving a connection request from the communication device;
A second step of reading a first certificate for authenticating the communication device that has made the connection request from a database that stores a first certificate used for authenticating the communication device;
And a third step of authenticating the communication device that made the connection request using the first certificate read in the second step.

Images