JP2017194862A - Communication device, authentication system, communication method, and computer program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a technique that allows for providing control to approve or disapprove communication by communication devices regardless of the presence/absence of legitimate authentication information possessed thereby.SOLUTION: In a communication device 100, an authentication unit 103 performs authentication processing on one or more authentication target devices 200, and updates authentication states in an authentication condition table stored in an authentication condition storage unit 105. A communication control unit 106 determines approval or disapproval of communication by the one or more authentication target devices on the basis of communication approval conditions in the authentication condition table defined by combinations of authentication states of the authentication target devices.SELECTED DRAWING: Figure 1

Description

  The present invention relates to a technology for controlling permission / inhibition of communication.

  In service provision via a network, authentication processing is often performed to determine whether or not a service request source is a user having a legitimate authority. Previously, authentication processing using only an ID and a password was performed. However, for the purpose of improving the security of authentication processing, multi-factor authentication processing using elements other than IDs and passwords has recently been proposed (for example, see Patent Document 1).

JP 2009-071430 A

  However, unauthorized access is still increasing. In particular, with the development of IoT (Internet of Things) technology, there is a demand for a technology for controlling communication permission / rejection with respect to a communication device regardless of whether or not it has valid authentication information.

  In view of the above circumstances, an object of the present invention is to provide a technique capable of controlling whether communication is permitted or not with respect to a communication device regardless of whether or not it has valid authentication information.

  According to one aspect of the present invention, an authentication unit that performs authentication processing on one or more devices to be authenticated and communication by the device to be authenticated based on a result of the authentication processing on each of the one or more devices to be authenticated. A communication control unit that determines whether to permit or not.

  One aspect of the present invention is the above-described communication device, further including a communication status storage unit that stores a communication permission condition that is a condition based on a result of the authentication process for one or more devices to be authenticated. The control unit permits communication by the authenticated device associated with the condition when the condition stored in the communication status storage unit is satisfied.

  One aspect of the present invention is the communication device described above, wherein the communication status storage unit satisfies an authentication state value indicating a result of the authentication processing for the one or more devices to be authenticated and the communication permission condition. A communication permission state value indicating whether or not the authentication is performed, the authentication unit updates the authentication state value based on a result of the authentication process, and the communication control unit includes the authentication state value. Is updated to a different value, the value of the communication permission condition relating to one or more devices to be authenticated is updated.

  One aspect of the present invention is the communication device, wherein the authentication unit or the communication control unit newly connects another device to be authenticated from the device to be authenticated that has already been authenticated by the authentication unit. When the request is received, the connection of the other device to be authenticated is permitted.

  One aspect of the present invention is the communication device described above, wherein the authentication unit transmits random information to one or more devices to be authenticated, and is generated from the devices to be authenticated based on the random information. The processing authentication information is received, and authentication processing is executed based on the processing authentication information.

  One aspect of the present invention transmits random information to one or more devices to be authenticated, receives processing authentication information generated based on the random information from the devices to be authenticated, and stores the processing authentication information in the processing authentication information. A communication unit including: an authentication unit that executes authentication processing based on the authentication unit; and a communication control unit that determines whether to permit communication by the authenticated device based on a result of the authentication process for one or more authenticated devices. Device, receiving the random information from the communication device, generating processing authentication information based on the authentication information stored in the device in advance and the random information, and sending the processing authentication information to the communication device An authentication system comprising: a device to be authenticated comprising a control unit for transmission.

  According to one aspect of the present invention, communication by an authenticated device is performed based on an authentication step of executing authentication processing on one or more devices to be authenticated and a result of the authentication processing on each of the one or more devices to be authenticated. A communication control step of determining whether to permit or not.

  According to one aspect of the present invention, communication by an authenticated device is performed based on an authentication step of executing authentication processing on one or more devices to be authenticated and a result of the authentication processing on each of the one or more devices to be authenticated. A computer program for causing a computer to execute a communication control step for determining whether to permit or not.

  According to the present invention, it becomes possible to control whether communication is permitted or not with respect to a communication device regardless of whether or not it has valid authentication information.

It is a system configuration figure showing the system configuration of an authentication system. It is a figure which shows the specific example of an authentication condition table. 5 is a flowchart showing a flow of processing when the communication device 100 performs authentication processing on the device to be authenticated 200. It is a flowchart which shows the flow of a process when the communication apparatus 100 updates the value of the communication permission state of an authentication condition table. 4 is a flowchart showing a flow of processing when communication device 100 receives communication data from device 200 to be authenticated. 5 is a sequence chart showing a flow of processing when a device to be authenticated 200 is newly connected to a communication device 100.

  FIG. 1 is a system configuration diagram showing the system configuration of the authentication system. The authentication system includes a communication device 100 and a plurality of devices 200 to be authenticated. The communication device 100 and the plurality of devices to be authenticated 200 are connected to each other via a network 300 so that they can communicate with each other. The network 300 may be constructed by any network. For example, the network 300 may be configured with the Internet.

  The communication device 100 is configured using an information processing device such as a network device, an industrial computer, a mainframe, a workstation, or a personal computer. The communication device 100 includes devices that are assumed to be touched by the user and devices that are not assumed to be touched by the user. The industrial computer is a computer used in industries such as vending machines and factory control devices. The communication device 100 can be any device as long as it can have the following functions. The communication device 100 includes a CPU (Central Processing Unit) and a memory connected by a bus. The communication apparatus 100 is an apparatus including a communication unit 101, a control unit 102, an authentication unit 103, an authentication information storage unit 104, an authentication status storage unit 105, a communication control unit 106, and an information processing unit 107 by executing an authentication program. Function. Note that all or some of the functions of the communication device 100 may be realized using hardware such as an application specific integrated circuit (ASIC), a programmable logic device (PLD), or a field programmable gate array (FPGA). The authentication program may be recorded on a computer-readable recording medium. The computer-readable recording medium is a portable medium such as a flexible disk, a magneto-optical disk, a ROM, a CD-ROM, a semiconductor storage device (for example, SSD: Solid State Drive), a hard disk built in a computer system, or a semiconductor storage. A storage device such as a device. The authentication program may be transmitted via a telecommunication line. The communication device 100 may be configured using a plurality of information processing devices. The authentication program may be executed in a cloud or a virtual machine.

  The communication unit 101 is a network interface. The communication unit 101 communicates with the authentication target device 200 via the network 300. The communication unit 101 passes the data received from the authentication target device 200 to the control unit 102. When the communication unit 101 receives data addressed to the authentication target device 200 from the control unit 102, the communication unit 101 transmits the data to the authentication target device 200 via the network 300.

  The control unit 102 executes a transfer process for data transmitted and received by the communication apparatus 100. If the data received from the communication unit 101 is authentication information, the control unit 102 passes the received data to the authentication unit 103. The authentication information is information assigned in advance to a device (authenticated device 200) that requests authentication or a user thereof. For example, the authentication information may be a combination of an ID and a password, or may be only a password. The password may be any information as long as it is information used as a password, such as a character string including numbers and alphabets, a combination of patterns, and a line pattern. The authentication information may be biometric information such as a fingerprint or a face. The authentication information may be a combination of a plurality of information. If the data received from the communication unit 101 is data other than the authentication information, the control unit 102 passes the received data to the communication control unit 106. The control unit 102 passes the data received from the authentication unit 103 or the communication control unit 106 to the communication unit 101.

  The authentication unit 103 performs authentication processing based on the authentication information received from the control unit 102 and the authentication information stored in the authentication information storage unit 104 by performing authentication processing. The authentication unit 103 is a device in which the authenticated device 200 has a legitimate authority when the received authentication information and the authentication information stored in the authentication information storage unit 104 satisfy a predetermined authentication condition (for example, match). Is determined. That is, in such a case, the authentication unit 103 authenticates the device 200 to be authenticated. On the other hand, if the received authentication information and the authentication information stored in the authentication information storage unit 104 do not satisfy a predetermined authentication condition (for example, they do not match), the authentication unit 103 determines that the authenticated device 200 has a valid authority. It is determined that it is not a device having. That is, in such a case, the authentication unit 103 does not authenticate the device 200 to be authenticated. The authentication unit 103 records the authentication result in the authentication status storage unit 105.

  The authentication information storage unit 104 is configured using a storage device such as a magnetic hard disk device or a semiconductor storage device. The authentication information storage unit 104 stores authentication information for each device to be authenticated 200 or its user.

  The authentication status storage unit 105 is configured using a storage device such as a magnetic hard disk device or a semiconductor storage device. The authentication status storage unit 105 stores an authentication status table. The authentication status table has a plurality of authentication status records. The authentication status record represents information for executing processing corresponding to the authentication status for each device 200 to be authenticated. FIG. 2 is a diagram illustrating a specific example of the authentication status table. The authentication status record has each value of a device ID, an authentication state, a communication permission state, and a communication permission condition. The device ID is identification information of the device 200 to be authenticated. The device ID is a value that does not overlap with another device 200 to be authenticated, such as an IP address, a MAC address, or a device name. The authentication state represents the result of authentication processing by the authentication unit 103. The communication permission state indicates whether the communication control unit 106 permits communication with the device to be authenticated 200. The value of the communication permission state is a “communication permitted” value when the communication permission condition is satisfied, and a “communication not permitted” value when the communication permission condition is not satisfied. The communication permission condition represents a condition for allowing the communication control unit 106 to permit communication of the device 200 to be authenticated. The values of the device ID and the communication permission condition are registered by an authorized person such as an administrator or a designer.

  In the example shown in FIG. 2, the uppermost authentication status record in the authentication status table has a device ID value of “device A”, an authentication status value of “authenticated”, and a communication permission status value of “communication permitted”. The value of the communication permission condition is “device B and (not device C)”. This authentication status record indicates that the device 200 to be authenticated with the device ID “device A” has been authenticated and communication with the communication device 100 is permitted. Further, in this authentication status record, the authentication state of the device 200 to be authenticated with the device ID “device B” is “authenticated” and the authentication state of the device 200 to be authenticated with the device ID “device C” is “unauthenticated”. "" Indicates that the communication permission condition is set. The authentication status table shown in FIG. 2 is only a specific example. Therefore, the authentication status table may be configured in a manner different from that in FIG. For example, the authentication status record does not necessarily have a value of the communication permission state. For example, values set as default values may be automatically registered as the values of the device ID and the communication permission condition. Further, the value of the authentication state is not necessarily limited to one of “authenticated” and “unauthenticated”. For example, a value “unconnected” indicating that the device 200 to be authenticated is not connected in the first place, or “authentication failure” indicating that the authentication process has been executed but not authenticated (authentication was NG). The value may be defined as the value of the authentication state. Note that the value of “not connected” may include that the power of the device to be authenticated 200 is not turned on. Further, the value of the communication permission state is not necessarily limited to one of “communication permitted” and “communication not permitted”. For example, the value “pending” may be registered as the value of the communication permission state.

  Returning to FIG. 1, the description of the communication device 100 will be continued. The communication control unit 106 determines whether or not a communication permission condition is satisfied for each authenticated device 200 based on the value of the authentication state in the authentication state table. The communication control unit 106 records the determination result as a value of the communication permission state. The communication control unit 106 determines whether or not to proceed with the communication data received from the authenticated device 200 based on the value of the communication permission state. The communication data is data received from the device to be authenticated 200 and data other than the authentication request. The communication control unit 106 passes the communication data to a function unit that executes subsequent processing when the communication permission state of the device 200 to be authenticated is communication permission. In the specific example of this embodiment, the communication control unit 106 passes the communication data to the information processing unit 107. On the other hand, the communication control unit 106 returns an error to the transmission source of the communication data when the communication permission state of the authenticated device 200 that is the transmission source of the communication data is communication disapproved. Note that communication data may be simply discarded without returning an error. When “pending” is registered as the value of the communication permission state, the communication control unit 106 may hold the communication data for a predetermined time and return an error after the predetermined time has elapsed.

  When the information processing unit 107 receives communication data from the communication control unit 106, the information processing unit 107 executes predetermined processing on the communication data. For example, when the communication data is a request for referring to accumulated data, the information processing unit 107 reads the designated data and transmits the data to the request source apparatus. For example, when the communication data is an instruction to control another device, the information processing unit 107 transmits a control signal indicating the instructed control to the other device instructed. For example, when the communication data includes data indicating the detection result of the sensor, the information processing unit 107 may update the history data using the detection result. The information processing unit 107 may execute a predetermined estimation process (for example, estimation of electricity usage, estimation process of water level, etc.) based on data indicating the detection result of the sensor, for example. For example, the information processing unit 107 may determine whether or not the value indicated by the communication data is an abnormal value. The information processing unit 107 may store communication data in a storage device. The information processing unit 107 may present the communication data to the user by outputting the communication data to the user interface.

  The authenticated device 200 is configured using an information processing device such as a network device, an industrial computer, a mainframe, a workstation, or a personal computer. Authentication target device 200 may be configured using a sensor capable of information processing. The authenticated device 200 includes devices that are assumed to be touched by the user and devices that are not assumed to be touched by the user. The authenticated device 200 includes a CPU, a memory, an auxiliary storage device, and the like connected by a bus. The authenticated device 200 functions as a device including a communication unit 201, a control unit 202, an authentication information storage unit 203, an output unit 204, and an input unit 205 by executing an authenticated program. All or some of the functions of the device to be authenticated 200 may be realized using hardware such as an ASIC, PLD, or FPGA. The authenticated program may be recorded on a computer-readable recording medium. The computer-readable recording medium is a portable medium such as a flexible disk, a magneto-optical disk, a ROM, a CD-ROM, and a semiconductor storage device (for example, SSD), and a storage such as a hard disk and a semiconductor storage device built in the computer system. Device. The authenticated device 200 may be configured using a plurality of information processing devices.

  The communication unit 201 is a network interface. The communication unit 201 communicates with the communication device 100 via the network 300. The communication unit 201 passes the data received from the communication device 100 to the control unit 202. Upon receiving data addressed to the communication device 100 from the control unit 202, the communication unit 201 transmits data to the communication device 100 via the network 300.

  The communication unit 201 communicates with another device to be authenticated 200 via the network 300. The communication unit 201 transmits an addition request including an instruction to request addition to the communication device 100 to another authenticated device 200 that has already been authenticated (hereinafter referred to as “authenticated device to be authenticated”). . The communication unit 201 receives an addition request from a device 200 to be authenticated (hereinafter referred to as a “new device to be authenticated”) that the administrator of the authentication system desires to newly add to the communication device 100. The communication unit 201 passes the received addition request to the control unit 202.

The control unit 202 executes processing for receiving authentication by the communication device 100 and authentication processing for a newly added device to be authenticated.
The authentication information storage unit 203 is configured using a storage device such as a magnetic hard disk device or a semiconductor storage device. The authentication information storage unit 203 stores authentication information. The authentication information stored in the authentication information storage unit 203 is authentication information corresponding to the authentication information stored in the authentication information storage unit 104. The authentication information is, for example, a predetermined character string or numerical value (hereinafter referred to as “passphrase”).

  The output unit 204 is an image display device such as a CRT (Cathode Ray Tube) display, a liquid crystal display, or an organic EL (Electro Luminescence) display. The output unit 204 may be an interface for connecting the image display apparatus to the authentication target apparatus 200. In this case, the output unit 204 generates a video signal and outputs the video signal to an image display device connected to the output unit 204.

  The input unit 205 is configured using an existing input device such as a keyboard, a pointing device (such as a mouse or a tablet), a button, or a touch panel. The input unit 205 is operated by the user when inputting a user instruction to the authentication target device 200. The input unit 205 receives input of authentication information, for example. The input unit 205 may be an interface for connecting the input device to the authentication target device 200. In this case, the input unit 205 inputs an input signal generated in response to a user input in the input device to the device to be authenticated 200.

  FIG. 3 is a flowchart showing the flow of processing when the communication device 100 performs authentication processing on the device to be authenticated 200. The communication unit 101 of the communication device 100 receives an authentication request from the device to be authenticated 200 (step S101). The authentication request includes authentication information used when receiving authentication processing. The communication unit 101 passes the received authentication request to the control unit 102.

  Upon receiving an authentication request from the communication unit 101, the control unit 102 passes authentication information included in the authentication request to the authentication unit 103. The authentication unit 103 executes an authentication process based on the authentication information received from the control unit 102 and the authentication information stored in the authentication information storage unit 104 (step S102). When authenticated device 200 is authenticated (YES in step S103), authentication unit 103 sets the authentication state value of the authentication status record having the device ID of authenticated device 200 as a value indicating that authentication is permitted ( For example, it is updated to “authenticated” (step S104).

  On the other hand, if the device to be authenticated 200 has not been authenticated (NO in step S103), the value of the authentication status of the authentication status record having the device ID of the device to be authenticated 200 is a value indicating that authentication has not been accepted (for example, ("Unauthenticated") (Step S105).

  FIG. 4 is a flowchart showing a flow of processing when the communication apparatus 100 updates the value of the communication permission state in the authentication status table. When the authentication state stored in the authentication status table is updated, the communication control unit 106 executes processing for updating the value of the communication permission state.

  The communication control unit 106 selects one authentication status record constituting the authentication status table. The communication control unit 106 determines whether the communication permission condition of the selected authentication status record is satisfied (step S201). When the communication permission condition is satisfied (step S201—YES), the communication control unit 106 sets the value of the communication permission state of the selected authentication status record to a value indicating that communication is permitted (for example, “communication permission”). (Step S202).

  When the communication permission condition is not satisfied (step S201—NO), the communication control unit 106 sets the communication permission state of the selected authentication status record to a value indicating that communication is not permitted (for example, “communication not permitted”). (Step S203).

  The communication control unit 106 executes the processing from step S201 to S203 for all authentication status records in the authentication status table. In addition, it is possible to speed up the processing by creating an index of a record including each device ID in the communication permission condition at a predetermined timing.

FIG. 5 is a flowchart showing a processing flow when the communication device 100 receives communication data from the device to be authenticated 200.
When receiving the communication data, the control unit 102 passes the communication data to the communication control unit 106 (step S301). The communication control unit 106 determines whether communication of the authentication target device 200 that is the transmission source of the communication data is permitted (step S302). Specifically, the communication control unit 106 determines whether the communication permission state of the authenticated device 200 that is the transmission source of communication data is “communication permitted” or “communication not permitted”.

  When the communication of the authenticated device 200 that is the transmission source of communication data is permitted (step S302—YES), the communication control unit 106 passes the communication data to the information processing unit 107. The information processing unit 107 executes a predetermined process using the communication data (step S303). On the other hand, when the communication of the device to be authenticated 200 that is the transmission source of communication data is not permitted (step S302—NO), the communication control unit 106 discards the communication data (step S304).

  FIG. 6 is a sequence chart showing the flow of processing when the device to be authenticated 200 is newly connected to the communication device 100. The administrator performs login processing for the newly added device to be authenticated (step S401). The newly added device to be authenticated transmits an addition request to the communication device 100 to the authenticated device to be authenticated in accordance with the operation of the logged-in administrator (step S402).

  When receiving the addition request from the newly added device to be authenticated, the control unit 202 of the authenticated device to be authenticated requests the newly added device to be authenticated to transmit authentication information (step S403). Authentication information (for example, ID and password) is input to the newly added device to be authenticated by the operation of the administrator. The control unit 202 of the newly added device to be authenticated transmits the input authentication information to the authenticated device to be authenticated (step S404).

  When receiving the authentication information from the newly added device to be authenticated, the control unit 202 of the authenticated device to be authenticated executes authentication processing based on the received authentication information (step S405). For example, the control unit 202 may execute an authentication process based on authentication information stored in the authentication information storage unit 203, or may perform an authentication process based on other authentication information stored in a storage unit (not shown). May be executed. If the newly added device to be authenticated has not been authenticated, the process ends (step s406). On the other hand, when the newly added device to be authenticated is authenticated (step S405—YES), the control unit 202 transmits a request for adding the newly added device to be authenticated to the communication device 100 (step S407).

  When the control unit 102 of the communication device 100 receives the request to add a new additional authenticated device, the control unit 102 adds a record of the newly added authenticated device to the authentication information storage unit 104 and the authentication status storage unit 105 (step S408). The communication control unit 106 sends a presence confirmation notification, which is a notification for confirming that the newly added device to be authenticated is connected to the network 300, via the network 300 (step S409). For example, the communication control unit 106 may transmit the presence confirmation notification by making an ICMP echo request by Ping to the newly added device to be authenticated.

  Upon receiving the presence confirmation notification from the communication device 100, the control unit 202 of the newly added device to be authenticated transmits a response notification indicating that it is connected to the network 300 to the communication device 100 (step S410). For example, the control unit 202 may transmit a response notification by performing an ICMP echo response using Ping to the communication apparatus 100.

  When receiving the response notification, the communication control unit 106 of the communication device 100 updates the authentication status record of the newly added device to be authenticated. And the communication control part 106 updates the value of the communication permission state of each authentication status record (step S411). Specifically, the communication control unit 106 executes the processing of the flowchart shown in FIG.

  In the authentication system configured as described above, whether one communication target apparatus 200 is permitted or not is determined based on the authentication state of one or a plurality of authenticated apparatuses 200 including the other authenticated apparatus 200. Is done. Specifically, communication is permitted when the authentication state of one or a plurality of authenticated devices 200 including other authenticated devices 200 satisfies the communication permission condition. With this configuration, even if the device 200 to be authenticated is authenticated using authentication information as a single device, communication may be refused depending on the authentication status of other devices to be authenticated. . On the other hand, even if the device 200 to be authenticated is not authenticated using authentication information as a single device, communication may be permitted depending on the authentication status of other devices to be authenticated. Furthermore, when “not” is included in the communication permission condition, even if authentication using authentication information is performed as a single device, communication may not be permitted because another device is connected. is there. As described above, in the authentication system according to the present embodiment, it is possible to control whether communication is permitted or not with respect to the communication apparatus regardless of whether or not the authentication system has valid authentication information. As a result, it is possible to perform more advanced communication control than in the case of determining whether communication is permitted or not by relying only on authentication information. For example, when “not” is included in the communication permission condition as described above, the number of devices that can be connected to the authentication system at the same time is limited even if authentication can be performed for each device alone. It becomes possible.

(Modification)
The communication device 100 may distribute random information to the device to be authenticated 200 when executing the authentication process of the device 200 to be authenticated. The random information is, for example, a random number. In such a case, the device to be authenticated 200 generates processing authentication information based on the authentication information stored in the authentication information storage unit 203 and random information. For the generation of such processing authentication information, a logical operation or a hash operation may be used. In this case, the device to be authenticated 200 transmits the processing authentication information generated to the communication device 100. Based on the random information distributed to the device to be authenticated 200 and the authentication information stored in the authentication information storage unit 104, the communication device 100 processes the authentication device 200 using the same method as that used to generate the processing authentication information. Generate authentication information. The communication device 100 executes the authentication process by determining whether the processing authentication information received from the device to be authenticated 200 and the processing authentication information generated by the own device satisfy a predetermined authentication condition. With this configuration, the authentication information stored in the authentication information storage unit 203 does not flow through the network 300, so that security can be improved.

  In the process flow of FIG. 6, the authentication process (authentication process for the newly added device to be authenticated) in step S <b> 405 is not necessarily executed by the authenticated device 200. For example, the communication device 100 may receive authentication information from the newly added device to be authenticated and execute authentication processing.

In the process flow of FIG. 6, the existence confirmation process in steps S409 and S410 may not be executed.
The information processing unit 107 may be mounted on a device different from the communication device 100.

The authenticated device 200 does not necessarily have to be an information processing device. For example, the device to be authenticated 200 may be configured using a sensor that outputs a signal indicating the detected value.
In the process of permitting a new connection of a newly added device to be authenticated, the communication device 100 has received a device addition request from the device to be authenticated 200 that has already been authenticated and whose communication permission state value is also permitted to communicate. Only in this case, the connection of the newly added device to be authenticated may be permitted (the process in step S408).

  In the device to be authenticated 200, the output unit 204 and the input unit 205 are not essential components. That is, the device to be authenticated 200 does not have to include one or both of the output unit 204 and the input unit 205. For example, even if the input unit 205 is not provided, authentication processing and data transmission may be started by using a newly added device to be authenticated connected to the same network as the authenticated device to be authenticated.

  The output unit 204 is not necessarily a functional unit related to image display. For example, the output unit 204 may be configured using a speaker that outputs sound, or may be configured using a light emitting element such as an LED (Light Emitting Diode).

  The communication device 100 may be configured not to execute the authentication process of the device to be authenticated 200 when the authentication is not successful even if the authentication process is executed a predetermined number of times or more. This ensures security against brute force attacks.

The communication device 100 may be configured to periodically request authentication processing from the authenticated device 200. Thereby, the addition and removal of the device 200 to be authenticated can be detected at an early stage. Therefore, security can be improved.
The number of authenticated devices 200 is not necessarily plural, and may be one.

DESCRIPTION OF SYMBOLS 100 ... Communication apparatus, 101 ... Communication part, 102 ... Control part, 103 ... Authentication part, 104 ... Authentication information storage part, 105 ... Authentication status storage part, 106 ... Communication control part, 107 ... Information processing part, 200 ... Authentication object Device 201 communication unit 202 control unit 203 authentication information storage unit 204 output unit 205 input unit 300 network

Claims (8)

An authentication unit that performs an authentication process on one or more devices to be authenticated;
A communication control unit for determining whether to permit communication by the device to be authenticated based on a result of the authentication processing for one or more devices to be authenticated;
A communication device comprising: A communication status storage unit for storing a communication permission condition that is a condition based on a result of the authentication process for each of the one or more devices to be authenticated;
The communication device according to claim 1, wherein the communication control unit permits communication by an authenticated device associated with the condition when the condition stored in the communication status storage unit is satisfied. The communication status storage unit includes an authentication status value indicating a result of the authentication process for the one or more devices to be authenticated, and a communication permission status value indicating whether or not the communication permission condition is satisfied. Remember more,
The authentication unit updates the value of the authentication state based on a result of the authentication process,
The communication device according to claim 2, wherein the communication control unit updates the value of the communication permission condition regarding one or more devices to be authenticated in response to the value of the authentication state being updated to a different value.   When the authentication unit or the communication control unit receives a request for connection of another device to be authenticated from a device already authenticated by the authentication unit, the authentication unit or the communication control unit permits the connection of the other device to be authenticated. The communication apparatus as described in any one of Claims 1-3.   The authentication unit transmits random information to one or more devices to be authenticated, receives processing authentication information generated based on the random information from the devices to be authenticated, and based on the processing authentication information The communication apparatus according to claim 1, wherein the authentication process is executed. Random information is transmitted to one or a plurality of authenticated devices, processing authentication information generated based on the random information is received from the authenticated devices, and authentication processing is executed based on the processing authentication information An authentication unit;
A communication control unit for determining whether to permit communication by the device to be authenticated based on a result of the authentication processing for one or more devices to be authenticated;
A communication device comprising:
Control that receives the random information from the communication device, generates processing authentication information based on authentication information stored in the device in advance and the random information, and transmits the processing authentication information to the communication device And
An authenticated device comprising:
An authentication system comprising: An authentication step of performing an authentication process on one or more devices to be authenticated;
A communication control step for determining whether to permit communication by the device to be authenticated based on the result of the authentication process for each of the one or more devices to be authenticated;
A communication method. An authentication step of performing an authentication process on one or more devices to be authenticated;
A communication control step for determining whether to permit communication by the device to be authenticated based on the result of the authentication process for each of the one or more devices to be authenticated;
A computer program for causing a computer to execute.

Images