JP3833652B2 - Network system, server device, and authentication method - Google Patents

Description

  The present invention relates to a network system, a server device, and an authentication method.

  The Internet is not only widely used as a content providing tool or a communication tool, but its application field is rapidly expanding as a social infrastructure such as e-government or e-commerce.

  In a network composed of a large number of unspecified communication devices and servers such as the Internet, it is important to take security measures as necessary to prevent social credit deterioration or business opportunity loss due to information leakage or tampering. .

  By the way, in recent years, there has been an increasing need to access the company safely from the outside using the Internet or to provide information to a specific business partner safely.

Conventionally, SSL (Secure Sockets Layer) or mail encryption methods that provide encrypted connections based on dedicated lines or the Internet have been the mainstream for such needs. However, as services diversify, there is an increasing need for encryption without being conscious of the application to be used. In response to such a demand, VPN (Virtual Private Network) disclosed in Patent Document 1 has attracted attention.
JP 2002-208921 A (Claims, Abstract)

  By the way, in the method shown in Patent Document 1, in order to prevent a malicious third party from entering, authentication of whether or not the user is a valid user is performed by using a user ID (Identification) and a password (user identification information).

  Therefore, when the user identification information is leaked to a malicious third party, there is a problem in that it easily enters the system from the outside and information in the system leaks.

  In order to avoid such a problem, a method using a dedicated line as described above can be considered, but there is a problem that a large cost is required for laying the dedicated line.

  The present invention has been made based on the above circumstances, and an object of the present invention is to provide a network system, a server device, and an authentication method capable of realizing highly secure communication at a low cost. And

In order to achieve the above-described object, the present invention provides a network system in which communication is performed between a client device and a server device via a network. The server device performs authentication processing for a user based on user identification information from the client device. Only when user authentication is performed and user authentication is performed by the user authentication unit, information regarding the hardware of the client device communicating with the server device and the client device associated with the authenticated user are registered in advance. Hardware authentication means for authenticating the client device based on the information about the hardware being used, and the client device and the server device or other predetermined communication device only when the hardware is authenticated by the hardware authentication means Allow communication with A communication permission unit, and when the client device is permitted to communicate by the transmission unit that transmits user identification information for authentication to the server device and the communication permission unit of the server device, the client device possess a communication unit to initiate communication with a predetermined communication device, a hardware authentication means of the server device, the client hardware authentication module with information on the hardware of the client apparatus which is registered in advance in the server device The authentication result information based on the information about the hardware of the client device transmitted to the device is transmitted to the server device, and it is determined whether to authenticate the client device based on the authentication result information. When the hardware authentication module is received from the server device, the hardware authentication Run Joule, according to the hardware authentication module the client device determines whether the authentication, and transmits the authentication result information to the server device.

  Therefore, it is possible to provide a network system that can realize highly secure communication at a low cost.

In addition to the above-described invention, the hardware authentication key may include a MAC (Media Access Control Address) address or serial number of hardware constituting the client device, a volume ID or storage capacity of the storage device, or It is created based on registration information of software installed in the storage device. For this reason, the client device can be reliably authenticated.

In another invention, in addition to the above-described invention, the communication unit of the client device encrypts a communication packet transmitted / received to / from the server device or another predetermined communication device by SSH (Secure Shell). I am doing so. For this reason, encrypted communication can be realized at low cost.

According to another invention, in addition to the above-mentioned invention, the communication means of the client device encrypts a communication packet transmitted / received to / from a predetermined communication device by SSL (Secure Sockets Layer). . For this reason, encrypted communication can be realized by using an Internet browser.

In another invention, in addition to the above-mentioned invention, the communication means of the client device encrypts a communication packet transmitted / received to / from a predetermined communication device by IP-sec.

In addition to the above-described inventions, in another invention, the communication permission unit of the server device is configured to provide a predetermined communication device that is a communication partner of the client device when the hardware is authenticated by the hardware authentication unit. The user account of the client device is validated, and in response to a request from a predetermined communication device that is a communication partner of the client device, an authentication process is performed for the user of the client device based on the user account information, and the authentication result is The data is transmitted to the communication device. For this reason, the server apparatus which performs hardware authentication, and a communication apparatus can be provided separately.

According to another invention, in addition to the above-mentioned invention, the communication permission means of the server device has passed a predetermined time from the time when the hardware is authenticated or the time when the user account for the predetermined communication device is validated. In this case, the user account is invalidated. For this reason, it becomes possible to access a predetermined server device only within a certain period of time after authentication, and security can be improved.

The present invention also provides a user authentication unit that performs authentication processing for a user based on user identification information from a client device in a server device that communicates with a client device via a network, and a user authentication unit that performs user authentication. Only when authentication is performed, based on information about the hardware of the client device communicating with the server device and information about hardware registered in advance for the client device associated with the authenticated user, Hardware authentication means for performing authentication, and communication permission means for permitting communication between the client device and the server device or another predetermined communication device only when the hardware is authenticated by the hardware authentication means Hardware authentication of the server device The means transmits a hardware authentication module having information on the hardware of the client device registered in advance in the server device to the client device, and the client device executes the hardware authentication module and executes the hardware authentication module according to the hardware authentication module. When it is determined whether or not the client device is authenticated and the authentication result information is sent, it is determined whether or not to authenticate the client device based on the authentication result information.

For this reason, the server apparatus which can implement | achieve highly secure communication at low cost can be provided.

The authentication method of the present invention includes a step of transmitting user identification information of a user currently used by a client device associated with a specific user to the authentication server device, and receiving the user identification information by the authentication server device, A step of determining whether to authenticate a user currently in use of the client device based on the user identification information; and when the user in use of the client device is authenticated by the authentication server device, the authentication server device The hardware authentication module having information relating to the hardware of the client device registered in advance is transmitted to the client device, the client device executes the hardware authentication module, and the client device is authenticated according to the hardware authentication module. Authentication result A step of determining whether to authenticate the client device based on the authentication result information when the information is sent, and when the client device is authenticated by the authentication server device, Establishing a communication path with the communication device.

For this reason, the authentication method which can implement | achieve highly secure communication at low cost can be provided.

The authentication method of the present invention includes a step of performing authentication processing for a user based on user identification information from a client device by an authentication server device, and an authentication server only when user authentication is performed by the authentication server device. A hardware authentication module having information related to the hardware of the client device registered in advance in the device is transmitted to the client device, the client device executes the hardware authentication module, and the client device authenticates according to the hardware authentication module. Determining whether or not to authenticate the client device based on the authentication result information when the authentication result information is sent and the authentication server device Only when authenticated This has the steps of: permitting communication between the authentication server or another predetermined communication device.

For this reason, the authentication method which can implement | achieve highly secure communication at low cost can be provided.

  The present invention can provide a network system, a server device, and an authentication method that can realize highly secure communication at a low cost.

  Hereinafter, an embodiment of the present invention will be described with reference to the drawings.

  FIG. 1 is a block diagram showing a configuration example of a network system according to the first embodiment of the present invention. The network system shown in FIG. 1 includes a client 10, the Internet 11, a router 12, a firewall 13, and a server 14.

  Here, the client 10 is a portable or fixed terminal device such as a personal computer, a PDA (Personal Digital Assistant), a mobile phone or the like having a communication function that can be directly or indirectly connected to the Internet 11. Etc., information is transmitted to and received from the server 14. The client 10 is associated with a specific user who uses the client 10 in advance.

  FIG. 2 is a diagram illustrating a detailed configuration example of the client 10. As shown in this figure, the client 10 includes a CPU 10a, ROM 10b, RAM 10c, HDD (Hard Disk Drive) 10d, video circuit 10e, I / F 10f, bus 10g, display device 10h, input device 10i, and communication circuit 10j. .

  Here, the CPU 10a is a control unit that executes various arithmetic processes according to a program stored in the ROM 10b or the HDD 10d and controls each unit of the apparatus.

  The ROM 10b is a memory that stores programs executed by the CPU 10a and data. The RAM 10c is a memory that temporarily stores a program being executed by the CPU 10a or data being calculated.

  The HDD 10d is a recording device that reads data or programs recorded on a hard disk, which is a built-in recording medium (not shown), and records various data on the hard disk in response to a request from the CPU 10a.

  The video circuit 10e is a circuit that executes a drawing process according to a drawing command supplied from the CPU 10a, converts the obtained image data into a video signal, and outputs the video signal to the display device 10h.

  The I / F 10f is a circuit that appropriately converts the expression format of the signal output from the input device 10i and exchanges communication data with the communication circuit 10j.

  The bus 10g is a signal line that connects the CPU 10a, the ROM 10b, the RAM 10c, the HDD 10d, the video circuit 10e, and the I / F 10f to each other and enables data exchange between them.

  The display device 10h is, for example, an LCD (Liquid Crystal Display) monitor or a CRT (Cathode Ray Tube) monitor and displays an image corresponding to the video signal output from the video circuit 10e.

  The input device 10i is constituted by, for example, a keyboard or a mouse, and is a device that generates a signal according to a user operation and supplies the signal to the I / F 10f.

  The communication circuit 10j is a communication circuit that can be connected to the Internet 11 directly or indirectly. The communication circuit 10j is, for example, a modem, a wired LAN NIC (Network Interface Card), a wireless LAN NIC, or the like.

  Returning to FIG. 1, the Internet 11 is an open wide area network in which an unspecified number of host computers are connected. The router 12 is a network device that interconnects different networks, and relays data according to a routing table in which communication paths are described.

  The firewall 13 is a router or a host installed for the purpose of preventing unauthorized access from outside between a local network (intranet) inside the organization and the Internet 11 spreading outside.

  When an access request is made from the client 10, the server 14 determines whether or not the user is a valid user. If the server 14 is a valid user, the server 14 establishes a communication path with the client 10 and is determined by the user of the client 10. Allows access to resources of other devices within the server 14 or within the same network or other networks.

  FIG. 3 is a diagram illustrating a detailed configuration example of the server 14. As shown in this figure, the server 14 includes a CPU 14a, ROM 14b, RAM 14c, HDD 14d, I / F 14e, communication circuit 14f, and bus 14g. Note that the CPU 14 a, ROM 14 b, RAM 14 c, HDD 14 d, I / F 14 e, communication circuit 14 f, and bus 14 g of the server 14 have the same functions as components of the same name in the client 10. However, the program stored in the ROM 14b or the HDD 14d and executed by the CPU 14a is for the server. The HDD 14d stores registration information related to users and clients 10 that can access the server 14, for example, as a table.

  FIG. 4 is a diagram illustrating an example of a table having registration information related to the user who can access the server 14 and the client 10 in the first embodiment.

  In FIG. 4, the user name is data indicating the name of the user, the user ID is a part of the user identification information and unique to the user, and the password is a part of the user identification information. Authentication information that is normally kept secret from a third party. In FIG. 4, the client device name is data indicating the name of the client 10 assigned to the user, and the hardware authentication key is information regarding the hardware of the client 10, and the device of the client 10. Information used for authentication.

  For example, in FIG. 4, information about a user whose user name is “TANAKA_TARO” is registered, and a user ID “TANAKA” and a password “1e85f101” are first set for this user. A client 10 whose name is “MOBILE-TANAKA” is assigned to this user. That is, the user (specific user) who uses this client 10 is a user whose user name is “TANAKA_TARO”. Further, a value “98553201” of the hardware authentication key of the client 10 whose name is “MOBILE-TANAKA” is calculated and registered in advance for this user.

  In the first embodiment, the program stored in the ROM 14b and / or HDD 14d of the server 14 is executed by the CPU 14a and the communication circuit 14f is controlled, so that the user is based on the user recognition information from the client 10. User authentication means for performing authentication processing, hardware authentication means for performing device authentication processing of the client 10, and establishment of a communication path by SSH between the client 10 and the server 14 according to the authentication results of the user authentication processing and the hardware authentication processing. A communication permission means for permitting is realized. In the first embodiment, the CPU 10a executes a program stored in the ROM 10b and / or the HDD 10d of the client 10 and further controls the communication circuit 10j, whereby user recognition information and authentication result information are transmitted to the server 14. And a communication means for performing communication with the server 14 are realized.

  Next, the operation of each device in the first embodiment will be described. FIG. 5 is a sequence diagram for explaining the operation of each device in the first embodiment.

  First, as shown in FIG. 4, for each user, a user ID, a password, a hardware authentication key of a specific client 10, and the like are registered in the server 14 in advance. The hardware authentication key is acquired based on information related to the hardware of the client 10.

  Here, as information regarding the hardware, for example, the MAC (Media Access Control Address) address of the communication circuit 10j of the client 10, the serial number of the client 10, the volume ID of the HDD 10d, the storage capacity of the HDD 10d (or the storage of a specific volume) Capacity), registry information of the OS (Operating System) installed in the HDD 10d, the CPU type of the client 10, the OS type, the OS version, the type of process activated at the time of authentication in the client 10, and a specific file exist Whether or not, etc. are used alone or in combination. As the specific file, for example, an execution format file or library of virus check software, or an execution format file or library of specific business software is used. Further, hardware information of peripheral devices directly connected to the client 10 may be used in combination with information about hardware built in the client 10 as described above. Examples of such peripheral devices include a USB memory, a printer, a mouse, a keyboard, a display, and a digital camera. Note that the MAC address may not be uniquely determined when a communication means such as a communication PC card is added or changed, so information determined by the OS after installation (for example, C drive serial number, etc.) Is preferably used. A set of information such as a user ID, a password, and a hardware authentication key for each user is hereinafter referred to as “user information”.

  After the user information is registered in this way, the user can be accessed as a valid user as long as the user accesses the server 14 using the registered client 10.

  When accessing the server 14 from the client 10, the input device 10i of the client 10 is operated and a request for accessing the server 14 is made. As a result, in step S <b> 1 shown in FIG. 5, the client 10 transmits the user ID and password to the server 14. The server 14 determines whether or not to authenticate the user by comparing the received user ID and password with the user ID and password stored in the HDD 14d.

  As a result of the authentication process, if it is determined that the accessing user has been authenticated, the server 14 acquires a hardware authentication key associated with this user stored in the HDD 14d in step S2, A hardware authentication module is generated and transmitted to the client 10 that made the request. The hardware authentication module is a program or script for automatically executing hardware authentication in the client 10. The hardware authentication module has a function to collect specific hardware information, a function to calculate a hardware authentication key from the collected hardware information, and compare this hardware authentication key with the registered hardware authentication key. And a function of returning the comparison result to the server 14.

  The client 10 receives the hardware authentication module. The received hardware authentication module is automatically executed. As a result, the CPU 10a collects specific hardware information according to the control code described in the hardware authentication module. For example, when the specific hardware information is a MAC address, the MAC address of the communication circuit 10j is acquired. Then, the CPU 10a generates a hardware authentication key from the collected hardware information, and compares the hardware authentication key registered in the server 14 included in the module with the generated hardware authentication key. It is determined whether or not they match. As a result, if they match, an authentication success notification indicating that the client 10 has been authenticated is transmitted to the server 14 in step S3.

  Next, in step S <b> 4, when the CPU 14 a of the server 14 receives this authentication success notification, it executes an SSH authentication process with the client 10. That is, the CPU 14a of the server 14 generates a random bit string (challenge), encrypts it with the user's public key, and sends it to the client 10. The client 10 decrypts the encrypted bit string sent from the server 14 with the secret key, and sends the decrypted result back to the server 14. The server 14 refers to the returned result and determines whether or not the client 10 has been successfully decrypted. If it is normal, the server 14 determines that the authentication has succeeded, and otherwise determines that it has failed.

  When the SSH authentication is successful, the client 10 and the server 14 start communication using SSH-VPN. Specifically, first, the public key of the host and the public key of the server 14 are presented from the server 14 to the client 10. Here, the public key of the server 14 refers to a key created at regular intervals. The client 10 generates a session key (random bit string), encrypts the session key with the public key of the host and the public key of the server, and sends it to the server 14. The server 14 decrypts the sent session key with the secret key of the host and the secret key of the server 14. After that, all communication packets are encrypted with this session key and transmitted / received via the VPN tunnel.

  In step S6, when the communication is completed, the SSH session is completed.

  Note that the server 14 establishes the SSH-VPN communication path only when the authentication success notification is received.

  FIG. 6 is a diagram illustrating a state of communication packets exchanged in the first embodiment. As shown in this figure, the packet 30 from the client 10 is encrypted by the SSH 31 into an encrypted packet 32 by SSH, and is received by the server 14 via the Internet 11. Then, the original packet 34 is decoded by the SSH 33. On the other hand, the packet 34 from the server 14 is encrypted by the SSH 33 and received by the client 10 via the Internet 11 as an encrypted packet by SSH. In the client 10, the original packet is decrypted by the SSH 31.

  As described above, according to the first embodiment of the present invention, a communication path (encrypted communication path by SSH) with the server 14 cannot be established unless hardware authentication of the client 10 is performed. Therefore, even when the user ID and password are stolen by a malicious third party, the resources (database, program, etc.) of the server 14 and other predetermined servers from the clients other than the client 10 registered for the user. It is possible to prevent impersonation and the like since the peripheral device is not accessible. As a result, highly secure communication is realized.

  As the SSHs 31 and 33, if a free license Open SSH is used, the cost can be reduced and the development period can be shortened.

  In the first embodiment, the server 14 also serves as an authentication server. However, an authentication server is provided in the same network as the server 14 separately from the server 14, and the above-described authentication server and the client 10 are connected to each other. When the client 10 is authenticated, the authentication server may execute SSH-VPN establishment with respect to the server 14.

  Next, a second embodiment of the present invention will be described.

  FIG. 7 is a diagram illustrating a configuration example of a network system according to the second embodiment of the present invention. In this figure, parts corresponding to those in FIG. In the second embodiment, as compared with the case shown in FIG. 1, the server 14 is excluded, and the hardware authentication server 20, the SSL-VPN device 21, and the servers 22 and 23 are newly added. Other configurations are the same as those in FIG.

  Here, the hardware authentication server 20 is a server for determining the validity of the client 10. The SSL-VPN apparatus 21 realizes a point-to-point connection between the client 10 and the servers 22 and 23 using SSL, which is an encrypted communication technology. The servers 22 and 23 are servers to be accessed by the client 10.

  FIG. 8 is a diagram illustrating a detailed configuration example of the hardware authentication server 20. As shown in this figure, the hardware authentication server 20 has a CPU 20a, ROM 20b, RAM 20c, HDD 20d, I / F 20e, communication circuit 20f, and bus 20g.

  Note that the CPU 20a, ROM 20b, RAM 20c, HDD 20d, I / F 20e, communication circuit 20f, and bus 20g of the hardware authentication server 20 have the same functions as the components of the same name in the server 14. The program stored in the ROM 14b or the HDD 14d and executed by the CPU 14a is for the authentication server. Similarly to the HDD 14d, the HDD 20d stores registration information regarding the user and the client 10 that can access the SSL-VPN device 21 or the servers 22 and 23, for example, as a table.

  FIG. 9 is a diagram illustrating a detailed configuration example of the SSL-VPN apparatus 21 according to the second embodiment. As shown in this figure, the SSL-VPN device 21 includes a CPU 21a, a ROM 21b, a RAM 21c, an I / F 20f, a bus 20g, and a communication circuit 20h.

  Note that the CPU 21a, ROM 21b, RAM 21c, I / F 21d, communication circuit 21e, and bus 21f of the SSL-VPN device 21 have the same functions as the components of the same name in the server 14. In the SSL-VPN apparatus 21, a program for communication control by SSL-VPN is stored in the ROM 21b, and is executed by the CPU 21a.

  The servers 22 and 23 have the same configuration as that shown in FIG. However, the servers 22 and 23 do not perform authentication processing and function as normal servers.

  In the second embodiment, the CPU 20a executes a program stored in the ROM 20b and / or the HDD 20d of the hardware authentication server 20, and further controls the communication circuit 20f, thereby identifying the user from the client 10. User authentication means for performing user authentication processing based on information, hardware authentication means for performing device authentication processing of the client 10, and the client 10 and the SSL-VPN apparatus 21 according to the authentication results of the user authentication processing and hardware authentication processing The communication permission means for permitting establishment of the communication path by SSL is realized. In the second embodiment, the CPU 10a executes a program stored in the ROM 10b and / or the HDD 10d of the client 10, and further controls the communication circuit 10j so that user identification information and authentication result information are stored in hardware. A transmission means for transmitting to the wear authentication server 20 and a communication means for performing encrypted communication with the SSL-VPN apparatus 21 are realized.

  Next, the operation of each device in the second embodiment of the present invention will be described. FIG. 10 is a sequence diagram for explaining the operation of each device according to the second embodiment.

  First, as shown in FIG. 4, for each user, a user ID, a password, a hardware authentication key of a specific client 10, and the like are registered in the server 14 in advance. The hardware authentication key is acquired based on information related to the hardware of the client 10.

  Here, as for the hardware-related information, for example, the hardware MAC address or serial number of the client 10, the volume ID of the HDD 10 d or the OS registry information installed in the HDD 10 d, the client 10, as in the case described above. The CPU type, the OS type, the OS version, the type of process activated at the time of authentication in the client 10, the presence or absence of a specific file, etc. are used alone or in combination. As the specific file, for example, an execution format file or library of virus check software, or an execution format file or library of specific business software is used. Further, hardware information of peripheral devices directly connected to the client 10 may be used in combination with information about hardware built in the client 10 as described above. Examples of such peripheral devices include a USB memory, a printer, a mouse, a keyboard, a display, and a digital camera. Note that the MAC address may not be uniquely determined when a communication means such as a communication PC card is added or changed, so information determined by the OS after installation (for example, C drive serial number, etc.) Is preferably used.

  After the user information is registered in this way, the user can be accessed as a valid user as long as the user accesses the server 14 using the registered client 10.

  For example, when accessing the server 22 from the client 10, the input device 10i of the client 10 is operated, and first, a request for accessing the hardware authentication server 20 is made. As a result, in step S <b> 11 shown in FIG. 10, the client 10 transmits the user ID and password of the user to the hardware authentication server 20. The hardware authentication server 20 determines whether or not to authenticate the user by comparing the user ID and password received from the client 10 with the user ID and password stored in the HDD 20d.

  If the accessing user is authenticated as a result of the authentication processing, the hardware authentication server 20 acquires the hardware authentication key associated with the user stored in the HDD 20d in step S12, and the hardware authentication server 20 A software authentication module is generated and transmitted to the client 10 that made the request. The hardware authentication module is a program or script for automatically executing hardware authentication in the client 10 as in the case described above.

  The client 10 receives the hardware authentication module. The received hardware authentication module is automatically executed. As a result, the CPU 10a collects specific hardware information according to the control code described in the hardware authentication module. For example, when the specific hardware information is a MAC address, the MAC address of the communication circuit 10j is acquired. Then, the CPU 10a generates a hardware authentication key from the collected hardware information, and compares the hardware authentication key registered in the hardware authentication server 20 included in the module with the generated hardware authentication key. , It is determined whether or not they match. As a result, if they match, an authentication success notification indicating that the client 10 has been authenticated is transmitted to the hardware authentication server 20 in step S13.

  When the authentication success notification is received, in step S14, the hardware authentication server 20 validates the user account for performing access control for the SSL-VPN device 21 (and thus the servers 22 and 23) held in the HDD 20d. To. As a method for validating the user account, a new user account of this user may be added for the SSL-VPN device 21 (servers 22 and 23) based on the registration information as shown in FIG. For each user shown in FIG. 4, a flag for access control may be provided, and the validity or invalidity of the user account may be indicated by the value of the flag.

  In step S15, when the client 10 accesses the SSL-VPN apparatus 21 using the user account registered in step S14, the CPU 21a of the SSL-VPN apparatus 21 accesses the hardware authentication server 20 in step S16. The user authentication is performed with reference to the user account to determine whether or not the user is valid. As a result, when the user is authenticated by the SSL-VPN apparatus 20, the client 10 and the hardware authentication server 20 start SSL-VPN communication in step S17.

  Specifically, for example, when accessing the server 22, the URL is https: // sslgw. company. When com / A / is designated, the client 10 communicates with the SSL-VPN apparatus 21 via SSL. In the SSL-VPN apparatus 21, URL mapping is executed. Specifically, “https://sslgw.company.com/A/ is converted to https://intraA.company.com/ on the intranet. For this reason, the client 10 transfers SSL- to the host intraA on the intranet. Connection is made via the VPN device 21.

  The CPU 20a of the hardware authentication server 20 starts timing using a timer (not shown) from the time when the hardware authentication process is executed or the user account is validated based on the request from the client 10. Check whether a timeout has occurred, and if a timeout has occurred, disable the enabled user account. As a method for invalidating the user account, the user account is deleted or the above-described flag value is changed. As a result, the SSL-VPN communication is established only when there is a user authentication request from the SSL-VPN apparatus 21 before the predetermined time has elapsed from the above-mentioned time point. That is, when establishing SSL-VPN after the timeout, the client 10 accesses the hardware authentication server 20 again and receives hardware authentication. Thereby, unauthorized access can be more reliably prohibited. Note that even when communication by SSL-VPN is completed, the user account of the user for the client 10 is invalidated.

  FIG. 11 is a diagram illustrating the state of communication packets exchanged in the second embodiment. As shown in this figure, a packet 41 from the client 10 is encrypted into an SSL encrypted packet 42 by the browser 40 and reaches the SSL-VPN apparatus 21 via the Internet 11. The SSL-VPN apparatus 21 supplies the packet 43 obtained by performing the decryption to the server 22. On the other hand, the packet 43 from the server 22 is encrypted into an SSL encrypted packet 42 by the SSL-VPN apparatus 21 and reaches the client 10 via the Internet 11. In the client 10, the original packet 41 is generated even when the browser 40 performs decryption.

  As described above, according to the second embodiment of the present invention, since hardware authentication is performed, even if the user ID and password are stolen, malicious user intrusion can be prevented. Can be prevented. As a result, highly secure communication can be realized.

  In the second embodiment, since communication is performed using SSL, the client 10 can perform communication using a browser program for the Internet, and can realize a communication environment with high security at low cost. become.

  Each embodiment described above is a preferred example of the present invention, but the present invention is not limited to these, and various modifications and changes can be made without departing from the scope of the present invention. It is.

  For example, in each of the above embodiments, one client 10 and one server 14 are used, but more than this may be used. Further, only one server or 23 servers may be used. In addition, the SSL-VPN device 21 may be connected between the firewall 13 and the router 12.

  Further, as hardware information, information other than the MAC address described above can be used. The hardware authentication key may use certain hardware information as it is.

  In each of the above embodiments, the hardware authentication process is executed in the client 10 and the result is transmitted to the server 14 and the hardware authentication server 20. Information related to hardware and a hardware authentication key may be transmitted to the authentication server 20, and the server 14 and the hardware authentication server 20 may perform hardware authentication processing. In that case, the hardware authentication module need not include the hardware authentication key of the client 10.

  In each of the above embodiments, SSH or SSL is used as the encryption communication method, but IP-sec may be used instead.

  The above processing functions can be realized by a computer. In that case, a program describing the processing contents of the functions that the server should have is provided. By executing the program on a computer, the above processing functions are realized on the computer. The program describing the processing contents can be recorded on a computer-readable recording medium. Examples of the computer-readable recording medium include a magnetic recording device, an optical disk, a magneto-optical recording medium, and a semiconductor memory. Examples of the magnetic recording device include a hard disk device (HDD), a flexible disk (FD), and a magnetic tape. Examples of the optical disk include a DVD (Digital Versatile Disk), a DVD-RAM (Random Access Memory), a CD-ROM (Compact Disk Read Only Memory), and a CD-R (Recordable) / RW (ReWritable). Magneto-optical recording media include MO (Magneto-Optical disk).

  When distributing the program, for example, a portable recording medium such as a DVD or a CD-ROM in which the program is recorded is sold. It is also possible to store the program in a storage device of a server computer and transfer the program from the server computer to another computer via a network.

  The computer that executes the program stores, for example, the program recorded on the portable recording medium or the program transferred from the server computer in its own storage device. Then, the computer reads the program from its own storage device and executes processing according to the program. The computer can also read the program directly from the portable recording medium and execute processing according to the program. In addition, each time the program is transferred from the server computer, the computer can sequentially execute processing according to the received program.

  The present invention can be used, for example, for access control in a network system.

It is a block diagram which shows the structural example of the network system which concerns on the 1st Embodiment of this invention. It is a figure which shows the detailed structural example of the client shown in FIG. It is a figure which shows the detailed structural example of the server shown in FIG. It is a figure which shows an example of the table which has the registration information regarding the user and client which can access a server. It is a sequence diagram for demonstrating operation | movement of each apparatus in the 1st Embodiment of this invention shown in FIG. It is a figure explaining the flow of the packet in 1st Embodiment. It is a block diagram which shows the structural example of the network system which concerns on the 2nd Embodiment of this invention. It is a figure which shows the detailed structural example of the hardware authentication server shown in FIG. It is a figure which shows the detailed structural example of the SSL-VPN apparatus shown in FIG. It is a sequence diagram for demonstrating operation | movement of 2nd Embodiment shown in FIG. It is a figure for demonstrating the flow of the packet in 2nd Embodiment.

Explanation of symbols

10a CPU (part of transmission means, part of communication means)
10f Communication circuit (part of transmission means, part of communication means)
14a, 120a CPU (user authentication means, hardware authentication means, communication permission means)

Claims (10)

In a network system that performs communication between a client device and a server device via a network,
The server device includes user authentication means for performing authentication processing for a user based on user identification information from the client device;
Only when user authentication is performed by the user authentication means, information on the hardware of the client device in communication with the server device and hardware registered in advance for the client device associated with the authenticated user Hardware authentication means for authenticating the client device based on the information;
Only when the hardware is authenticated by the hardware authentication means, the communication apparatus has a communication permission means for permitting communication between the client device and the server device or another predetermined communication device,
The client device includes a transmitting unit that transmits user identification information for authentication to the server device;
If it is permitted to communicate by the communication permission means of the server unit, have a, a communication unit to initiate communication with the server device or other predetermined communication device,
The hardware authentication means of the server device transmits a hardware authentication module having information relating to the hardware of the client device registered in advance in the server device to the client device to obtain information relating to the hardware of the client device. Based authentication result information is transmitted to this server device, and whether to authenticate the client device based on the authentication result information is determined,
When the client device receives the hardware authentication module from the server device, the client device executes the hardware authentication module, determines whether or not the client device is authenticated according to the hardware authentication module, and the authentication result Sending information to the server device;
A network system characterized by this. The hardware authentication key is a MAC (Media Access Control Address) address or serial number of hardware constituting the client device, a volume ID or storage capacity of the storage device, or registration information of software installed in the storage device The network system according to claim 1, wherein the network system is created based on: 2. The network system according to claim 1, wherein the communication unit of the client device encrypts a communication packet transmitted / received to / from the server device or another predetermined communication device by SSH (Secure Shell). . 2. The network system according to claim 1, wherein the communication unit of the client device encrypts a communication packet transmitted / received to / from a predetermined communication device by SSL (Secure Sockets Layer). The network system according to claim 1, wherein the communication unit of the client device encrypts a communication packet transmitted / received to / from a predetermined communication device by IP-sec. The communication permission unit of the server device validates the user account of the user for a predetermined communication device that is a communication partner of the client device when the hardware is authenticated by the hardware authentication unit, and the client device The authentication processing for the user of the client device is performed based on the user account information in response to a request from a predetermined communication device that is a communication partner of the device, and the authentication result is transmitted to the communication device. The network system according to any one of claims 3 to 5. The communication permission means of the server device invalidates the user account when a predetermined time has elapsed since the time when the hardware was authenticated or the time when the user account for the predetermined communication device was validated. The network system according to claim 6. In a server device that communicates with a client device via a network,
User authentication means for performing authentication processing on the user based on user identification information from the client device;
  Only when user authentication is performed by the user authentication means, information on the hardware of the client device in communication with the server device and hardware registered in advance for the client device associated with the authenticated user Hardware authentication means for authenticating the client device based on the information;
  Only when the hardware is authenticated by the hardware authentication means, the communication apparatus has a communication permission means for permitting communication between the client device and the server device or another predetermined communication device,
  The hardware authentication means of the server device transmits a hardware authentication module having information on the hardware of the client device registered in advance in the server device to the client device, and the client device has the hardware authentication module Whether the client apparatus is authenticated according to the hardware authentication module and whether the client apparatus is authenticated based on the authentication result information. To determine,
  The server apparatus characterized by the above-mentioned. Transmitting the user identification information of the user currently used by the client device associated with the specific user to the authentication server device;
  Receiving the user identification information by the authentication server device and determining whether to authenticate the user currently in use of the client device based on the user identification information;
  When the authentication server device authenticates a user currently in use of the client device, a hardware authentication module having information related to hardware of the client device registered in the authentication server device is registered in the client device. When the client device executes the hardware authentication module, determines whether or not the client device is authenticated according to the hardware authentication module, and sends the authentication result information. Determining whether to authenticate the client device based on the result information; and
  Establishing a communication path between the client device and a predetermined communication device when the client device is authenticated by the authentication server device;
  An authentication method characterized by comprising: A step of performing authentication processing for the user based on the user identification information from the client device by the authentication server device ;
By the authentication server, only when the user authentication is a hardware authentication module with information on the hardware of the client devices that are previously registered in the authentication server transmits to the client device, the client device When the client executes the hardware authentication module and determines whether or not the client device is authenticated according to the hardware authentication module and sends the authentication result information, the client based on the authentication result information Determining whether to authenticate the device;
By the authentication server, the method comprising permitted only if the hardware is authenticated, and the client device, the communication between the authentication server or another predetermined communication device,
An authentication method characterized by comprising:

Images