JP2016057835A - Equipment authentication access control system for specific equipment - Google Patents

Abstract

PROBLEM TO BE SOLVED: To solve the problem that it is necessary to register information for authentication including terminal information in advance under control to connect only a specific terminal to a network service server.SOLUTION: A client terminal transmits connection information including the URL of a network service server to an access control system and an equipment authentication system in the case of requesting service use. An access control system generates equipment authentication information on the basis of connection information from the client terminal when determining that equipment authentication is necessary, and makes an inquiry request to the equipment authentication system, and determines the propriety of connection to the server on the basis of an inquiry result. The equipment authentication system generates equipment authentication information on the basis of connection information from the client terminal, stores the equipment authentication information in an equipment authentication information management DB, inquires whether or not the equipment authentication information whose inquiry request has been made by the access control system is stored in the equipment authentication information management DB, and transmits the inquiry result.SELECTED DRAWING: Figure 1

Description

  The present invention relates to a device authentication access control system that gives an access right to a fixed or mobile client terminal based on device authentication for access to a network service server by a specific device.

  With the spread of client terminals such as smartphones and tablet terminals, it has become possible to easily access a network service server regardless of location. However, since it is necessary to prohibit access from unspecified client terminals to services that require confidentiality, device authentication systems for client terminals that use services that require confidentiality have become widespread.

  FIG. 7 is a block configuration diagram showing a device authentication system described in Patent Document 1. A client terminal 701 that uses a service, a device authentication server 702 that performs device authentication of the client terminal 701, and a service to the client terminal 701. And a service server 703 that provides the service. In this device authentication system, a device ID (Identification) of the client terminal 701 and a passphrase necessary for generating an encryption key for device authentication are registered in the device authentication server 702.

  When a service is requested from the client terminal 701 to the service server 703, the service server 703 requests device authentication at the device authentication server 702. The client terminal 701 causes the device authentication server 702 to perform device authentication, and transmits a device authentication result to the service server 703. The service server 703 receives the device authentication result from the client terminal 701, and after confirming with the device authentication server 702 that this is indeed performed by the device authentication server 702, starts providing the service. The client terminal 701 and the device authentication server 702 share a passphrase, and the client terminal 701 and the device authentication server 702 authenticate each other by confirming that the other party stores the passphrase. .

JP 2005-102163 A

  By the way, with the widespread use of client terminals such as personally-owned smartphones and tablet terminals, a movement called BYOD (Bring your own device) that attempts to use personally-owned client terminals for business operations has emerged. However, many people feel resistance to registering device-specific information of personally owned client terminals in the device authentication system, which is one of the factors that hinder the spread of BYOD.

  In the case of a company having a large number of client terminals, registration and deletion of device-specific information for authentication that occurs every time the client terminals are replaced is a heavy burden.

  As another method, there is a method in which an external connection device dedicated for authentication in which device-specific information for authentication is registered is connected to the client terminal and used instead of the device-specific information. However, there is a risk that the external connection device dedicated for authentication may be lost, and there is a risk that the time and effort for device management will increase. Some smartphones do not provide an external device for authentication itself, which is not a fundamental solution.

  An object of the present invention is to provide a specific device that can grant an access right based on device authentication for access to a network service server by a specific device without registering device-specific information for authentication in advance in the device authentication system. An apparatus authentication access control system is provided.

In order to achieve the above object, the present invention provides the following configurations.
An aspect of the present invention includes a client terminal and an access control system and a device authentication system that are connected to and connected to each other, and the client terminal is connected to a network service server via the access control system. A device authentication access control system to be connected,
The client terminal comprises connection information transmitting means for transmitting connection information including a URL of the network service server to the access control system and the device authentication system when making a service use request to the network service server,
When the access control system receives connection information from the client terminal and the access control target management DB in which the URL of the network service server that performs device authentication for the specific device is registered in advance, the access control system stores the URL included in the connection information. An access control determination means for determining whether or not device authentication is necessary by inquiring the access control target management DB based on the above, and generating device authentication information based on the connection information when it is determined that device authentication is necessary. 1 device authentication information generation means, device information inquiry request means for requesting the device authentication system to make an inquiry about the device authentication information generated by the first device authentication information generation means, and the inquiry result received from the device authentication system Based on the above, determine whether or not the client terminal service use request can be connected to the network service server Includes a stage, a,
The device authentication system is generated by a second device authentication information generation unit that generates device authentication information based on the connection information when the connection information is received from the client terminal, and the second device authentication information generation unit. A device authentication information storage unit that stores the device authentication information in the device authentication information management DB, and inquires whether the device authentication information requested by the access control system is stored in the device authentication information management DB; Device authentication information inquiry means for transmitting an inquiry result to the access control system.

  In the above aspect, when the device authentication system includes means for inquiring the access control target management DB, the device authentication system receives connection information from the client terminal based on a URL included in the connection information. The second device authentication information generating means determines the device based on the connection information only when it is determined whether device authentication is necessary by inquiring the access control object management DB and device authentication is necessary. The authentication information is generated.

  In the above aspect, the first device authentication information generation unit of the access control system generates device authentication information by encrypting based on the connection information, and the device authentication information inquiry unit of the device authentication system includes: The device authentication information included in the inquiry request from the access control system is decrypted, and then the device authentication information management DB is inquired.

  In the above aspect, the connection information transmitting means in the client terminal is realized by a program installed in advance in the client terminal.

According to the device authentication access control system for a specific device via the network of the present invention, the following effects can be obtained.
Even if the device-specific information of the client terminal is not registered in advance, a predetermined connection information generation program is installed in the client terminal so that only the client terminal that has installed the connection information generation program can connect to the network service server. Access control can be performed.

FIG. 1 is a system configuration diagram showing an embodiment of the present invention. FIG. 2 is a configuration diagram of connection information passed from the client terminal. FIG. 3 is a configuration diagram of data stored in the access control target management database. FIG. 4 is a configuration diagram of data stored in the device authentication information management database. FIG. 5 is a flowchart of a device authentication procedure according to the present invention. FIG. 6 is a block diagram for explaining a device authentication procedure according to the present invention. FIG. 7 is a schematic configuration diagram of a conventional device authentication system.

  Hereinafter, an embodiment of a device authentication access control system for a specific device to which the present invention is applied will be described. FIG. 1 is a system configuration diagram showing an example of an embodiment of the present invention.

  The device authentication access control system for a specific device includes a client terminal 1, an access control system 3, and a device authentication system 4. A connection information generation program 2 is installed in the client terminal 1 and thereby connects to the access control system 3 and the device authentication system 4 via an appropriate network. The access control system 3 and the device authentication system 4 are connected to each other. The client terminal 1 may be a mobile device such as a smartphone or a tablet terminal, or may be a fixed device. The access control system 3 and the device authentication system 4 are computers in which a program that realizes a predetermined function is installed. The CPU reads and executes the predetermined program, thereby realizing each function processing unit in FIG.

  The network service server 5 is connected to the access control system 3. The network service server 5 is a server that can provide a predetermined service to the client terminal 1 via the network. Here, the service providing function corresponding to one URL is regarded as one server. Although only one network service server 5 is shown in FIG. 1, it is assumed that there are many. Many network service servers 5 include those that perform device authentication for specific devices and those that do not. The client terminal 1 connects to one of these various network service servers to make a predetermined service use request.

  The access control system 3 has an access control target management DB (database) 6 in which URLs (Uniform Resource Locators) of network service servers that perform device authentication for specific devices are registered.

  The device authentication system 4 includes a device authentication information management DB 7 that stores device authentication information generated based on connection information received from the client terminal 1. In the example of the present invention illustrated in FIG. 1, the device authentication system 4 does not refer to the access control object management DB 6. However, in another example, the device authentication system 4 refers to the access control object management DB 6. It is good also as a structure which can be shown (it shows with a dotted line).

  The client terminal 1 and the network service server 5 are connected via the access control system 3, and the access control system 3 functions as a gateway.

  The connection information generation program 2 installed in the client terminal 1 sends the connection information to the access control system 3 and the device authentication system 4 when the client terminal 1 connects to the network service server 5 for a service use request. A connection information transmission unit 8 for transmission is provided.

  The access control system 3 includes an access control determination unit 9 that determines whether or not device authentication is necessary when there is a connection request from the client terminal 1 to the network service server 5, and makes an inquiry to the access control target management DB 6, and a client A device authentication information generation unit 10 that generates device authentication information based on the connection information received from the terminal 1, and a device information inquiry request that requests the device authentication system 4 to query the device authentication information generated by the device authentication information generation unit 10. Part 11.

  The device authentication system 4 includes a device authentication information generation unit 12 that generates device authentication information based on connection information received from the client terminal 1, and device authentication information generated by the device authentication information generation unit 12 in the device authentication information management DB 7. The device authentication information storage unit 13 to be registered and the device authentication information requested by the device information inquiry request unit 11 of the access control system 3 are searched for whether the device authentication information is registered in the device authentication information management DB 7, and the device authentication information inquiry to be inquired is made. Part 14.

  FIG. 2 is a diagram showing the contents of the connection information 201 which is the basic information of the device authentication information. The connection information is acquired from packet information when the client terminal 1 connects to the network service server.

  In FIG. 2, a client IP address 202, a port number 203, a user ID 204, a process ID 205, and a multiplex ID 206 acquired from SMB / CIF packet information that is a file server protocol are exemplified. The device information generation unit 10 of the access control system 3 and the device authentication information generation unit 12 of the device authentication system 4 connect these pieces of connection information and generate device authentication information, respectively.

  FIG. 3 is a diagram showing the access control target information 301 registered in advance in the access control target management DB 6 of the access control system 3. As the access control target information 301, URLs indicated by access control target service URLs 302a to 302c are registered. Although only three cases are illustrated in FIG. 3 for the access control target service URLs 302a to 302c, an arbitrary number of access control target service URLs of four or more can be registered.

  The access control determination unit 9 of the access control system 3 determines whether the URL of the network service server 5 requested by the client terminal 1 matches any of the access control target service URLs 302a to 302c. If they match, the device authentication information generation unit 10 generates device authentication information, and the device information inquiry request unit 11 requests the device authentication system 4 to inquire about device authentication information.

  FIG. 4 is a diagram showing device authentication information storage information 401 stored in the device authentication information management DB 7 of the device authentication system 4. The device authentication information accumulation information 401 registers the device authentication information 402 generated by the device authentication information generation unit 12 and the device authentication information storage date 403 indicating the date and time when the device authentication information 402 is generated and stored. The device authentication information registration date and time 403 is used to make a decision to delete the registered device authentication information.

  In one example, in the device authentication system 4, the device authentication information generation unit 12 generates device authentication information for all connection information received from the client terminal 1, and the device authentication information storage unit 13 generates the device authentication information. Stored in the authentication information management DB 7.

  As another example, when the device authentication system 4 can refer to the access control object management DB 6, the device authentication system 4 refers to the access control object management DB 6 when receiving connection information from the client terminal 1, and It is determined whether or not the URL included in the connection information matches any of the access control target service URLs 302a to 302c. Only when they match, the device authentication information generation unit 12 generates device authentication information, and the device authentication information storage unit 13 stores the generated device authentication information in the device authentication information management DB 7.

  FIG. 5 shows an example of the flow of a device authentication procedure according to the present invention. FIG. 6 shows a device authentication procedure according to the present invention as a block diagram.

  FIG. 5 shows a flow when the device authentication system 4 of FIG. 1 can refer to the access control object management DB 6 as an example.

  When a service use request from the client terminal to the network service server is issued (step 501), the access control system refers to the access control target information DB based on the URL included in the connection information acquired from the service use request, It is determined whether it is an access control target (device authentication is required) (step 502). If it is not an access control target, a service use request (step 511) is executed. In the case of an access control target, device authentication information is generated by acquiring a public key and encrypting it based on connection information transmitted from the client terminal (step 503).

  In the client terminal in which the connection information 5-component program is installed, after making a use request to the network service server in step 501, the connection information is transferred to the device authentication system (step 504). When the device authentication system receives the connection information, the device authentication system refers to the access control target information DB based on the URL included in the connection information, and determines whether or not the device is an access control target (device authentication is required) (step 505). If the URL included in the connection information is not subject to access control, the process is terminated at this point.

  If the URL included in the connection information is an access control target, device authentication information is generated from the connection information (step 506) and stored in the device authentication information management DB (step 507).

  After generating the device authentication information in step 503, the access control system issues a device authentication information inquiry request to the device authentication system (step 508). The inquiry request includes device authentication information.

  The device authentication system decrypts the device authentication information received from the access control system, checks whether it is stored in the device authentication information management DB (step 509), and returns the inquiry result to the access control system (step 510). . For the client terminal in which the connection information generation program is installed, since the device authentication information is stored in the device authentication information DB, the inquiry result is “device authentication complete”. Here, in the case of a client terminal in which the connection information generation program is not installed, since the connection information is not transmitted to the device authentication system, the device authentication information is not stored in the device authentication information DB, and the inquiry result is “ Device authentication is not complete ”.

  If the access control system determines that the device authentication has been completed based on the inquiry result from the device authentication system, the access control system transmits a use request to the network service server (steps 511 and 512).

  1 client terminal, 2 connection information transmission program, 3 access control system, 4 device authentication system, 5 network service server, 6 access control object management DB, 7 device authentication information management DB, 8 connection information transmission unit

Claims (4)

A client terminal, and an access control system and a device authentication system that are connected to each other and connected to each other, wherein the client terminal is connected to a network service server via the access control system. A system,
The client terminal comprises connection information transmitting means for transmitting connection information including a URL of the network service server to the access control system and the device authentication system when making a service use request to the network service server,
The access control system includes:
An access control target management DB in which URLs of network service servers that perform device authentication for specific devices are registered in advance;
An access control determination unit that, when receiving connection information from the client terminal, inquires of the access control object management DB based on a URL included in the connection information and determines whether device authentication is necessary;
If it is determined that device authentication is necessary, first device authentication information generating means for generating device authentication information based on the connection information;
Device information inquiry requesting means for requesting the device authentication system to inquire about the device authentication information generated by the first device authentication information generating means;
Means for determining whether or not to connect to the network service server of the service use request of the client terminal based on the inquiry result received from the device authentication system,
The device authentication system includes:
A second device authentication information generating means for generating device authentication information based on the connection information when connection information is received from the client terminal;
Device authentication information storage means for storing the device authentication information generated by the second device authentication information generation means in the device authentication information management DB;
Device authentication information inquiry means for inquiring whether or not the device authentication information requested by the access control system is stored in the device authentication information management DB and transmitting the inquiry result to the access control system. A device authentication access control system for specific devices. When the device authentication system includes means for inquiring the access control target management DB,
When the device authentication system receives connection information from the client terminal, the device authentication system queries the access control object management DB based on the URL included in the connection information to determine whether device authentication is necessary, and device authentication 2. The device authentication access control for a specific device according to claim 1, wherein the device authentication information is generated based on the connection information by the second device authentication information generation unit only when it is determined that the device authentication is necessary. system. The first device authentication information generating unit of the access control system generates device authentication information by encrypting based on the connection information, and the device authentication information inquiry unit of the device authentication system includes the access control. 3. The device authentication access control system for a specific device according to claim 1, wherein the device authentication information included in the inquiry request from the system is decrypted, and then the device authentication information management DB is referred to.   The device authentication access control system for a specific device according to any one of claims 1 to 3, wherein the connection information transmission means in the client terminal is realized by a program installed in the client terminal in advance.

Images