JP4894432B2 - Cooperation control device - Google Patents

Description

  The present invention relates to a linkage control apparatus that links an entry / exit management system that manages entry / exit in a security management area and a network authentication system that restricts access to terminal devices provided in the security management area.

  In companies that frequently handle confidential information or specific departments within the company, it is possible to prevent leakage of confidential information in advance by applying an entry / exit management system that manages the entry / exit of workers handling confidential information. ing.

  Generally, an entry / exit management system is a user ID (IDentification) incorporated in an IC (Integrated Circuit) card given to a user or biometric information (fingerprint, iris, voiceprint, etc.) to be authenticated information that uniquely identifies the user. Is used to perform personal authentication for users who wish to enter and exit. When it is authenticated that the user is a registered legitimate user, for example, entry into the security management area that handles confidential information is permitted by unlocking the locked door.

  By the way, the above-mentioned confidential information is managed by a network authentication system constructed in a network different from the entrance / exit management system, and is used by accessing the network from a terminal device provided in the security management area. Often possible. In this case, when the terminal device is used to access the network, the network authentication system requires an authentication process similar to the personal authentication in the entry / exit management system described above.

  Therefore, it is possible to further enhance security by linking such an entry / exit management system with a network authentication system. For this reason, a method has been devised that associates user authentication processing at the time of entering / exiting a security management area that handles confidential information with user authentication processing using the terminal device after entering the room (for example, Patent Document 1, Patent). Reference 2).

In addition, a technique for realizing a countermeasure for a problem caused by a lapse of time from entry to logon to the terminal device, and a countermeasure for forgetting to log off the terminal device when leaving, which are not considered in Patent Document 1 and Patent Document 2. Has also been devised (for example, see Patent Document 3).
JP 2000-259878 A JP 2002-41468 A JP 2004-302875 A

  By the way, according to the method disclosed in each patent document, when the entrance / exit management system and the network authentication system are linked, each security management area is individually managed, and a plurality of security management areas are unified. There is a problem that it cannot be managed.

  The present invention has been made in view of such circumstances, and when managing an entry / exit management system and a network authentication system for a plurality of management areas, these management areas are managed in an integrated manner. With the goal.

In order to solve such a problem, the present invention provides a management area according to a result of user authentication based on first authenticated information that uniquely identifies a user, with different management areas as individual management targets. A plurality of entry / exit management systems that manage the passage of users at gates entering / exiting and an authentication server based on second authenticated information that uniquely identifies a user with a terminal device provided in each of the management areas as a processing target In accordance with the result of the user authentication processing by the system, a cooperation control device is provided that mutually cooperates with a network authentication system that restricts access to the network. Here, the cooperation control device associates and stores the gate information indicating the gate and the area information indicating the management area after passing through the gate, the first authentication information, and the first authentication information. User information storage means for associating and storing area information of the management area where the user specified by the authenticated information stays, and gate information and the first object transmitted from the entrance / exit management system in response to the user's gate passing The entrance / exit information including the authentication information is acquired, the area information associated with the acquired gate information is searched in the area storage means, and the user is based on the searched area information and the acquired first authenticated information. By updating the information storage means, the area management means for managing the user's stay status, and the user's stay status managed by the area management means, And a terminal authentication unit for performing use authentication of the terminal device to said area management means comprises: a management area where the user had occupancy before the gate passage, based on the management area specified by the gate passage Then, it is determined whether or not the two correspond to each other. If the two correspond, it is determined that the room is in the normal room, and if the both do not correspond, it is determined that the room is in the abnormal room .

  In addition, the cooperation control device of the present invention includes block information indicating a management block configured by grouping one or more management areas, and area information of a management area configuring a management block specified by the block information. Are further stored in association with each other. In this case, the user information storage means stores the area information associated with the first authenticated information using the block information of the management block including the management area specified by the area information, and the area management means The block information storage means searches the block information associated with the area information searched from the acquired gate information, and the user information storage means based on the searched block information and the acquired first authenticated information The terminal staying means manages the staying state of the user based on the management block, and the terminal authentication means manages the terminal device to the user based on the staying state of the user based on the management block managed by the area managing means. Perform user authentication.

  In addition, the cooperative control device of the present invention includes area information indicating a management area that is an area defined by dividing the management area into one or more areas, and a management area specified by the area information. Area information storage means for storing the area information of the management area in association with each other, and area specifying means for specifying the management area where the user specified by the first authenticated information stays based on the first authenticated information And further. In this case, the user information storage means stores the area information associated with the first authenticated information using the area information of the management area obtained by subdividing the management area specified by the area information. The means searches the area information storage means for area information associated with the area information searched from the acquired gate information, and specifies the area information thus searched and the first authentication information as the entry / exit information. By transmitting to the means, it is possible to identify in which management area that constitutes the management area where the user has entered, the area information identified by the area identifying means, and the acquired first object. The terminal authentication unit manages the staying state of the user based on the management area by updating the user information storage unit based on the authentication information. Performs the use authentication of the terminal device for the user based on the staying state of the user based on the management area managed by the area management means.

  Moreover, the cooperation control apparatus of this invention further has a to-be-authenticated information storage means which associates and memorize | stores 1st to-be-authenticated information and 2nd to-be-authenticated information for every user, A terminal authentication means is from a user. When the access request to the network using the second authenticated information is received via the terminal device, the first authenticated information associated with the second authenticated information is stored in the authenticated information storage. The terminal device is authenticated for use based on the user's stay status specified from the user information storage means using the searched first authenticated information as a key, and the use authentication is performed. It is determined whether to transfer an access request to the authentication server according to the authentication result.

  In addition, the cooperation control apparatus of the present invention further includes a relay device information storage unit that stores area information indicating a management area in which the relay device to which the terminal device is connected is installed, and address information in the network of the relay device. The terminal authentication unit specifies the area information associated with the address information of the relay device by searching the relay device information storage unit based on the address information of the relay device connected to the terminal device included in the access request, Based on the specified area information and the stay state of the user specified from the user information storage unit using the first authenticated information as a key, the use authentication of the terminal device for the user is performed.

  In the cooperation control device of the present invention, the terminal authentication unit authenticates the use of the terminal device to the user based on the stay state of the user managed by the area management unit and the stayable time in the management area.

  According to the present invention, since information between management areas can be linked, a plurality of management areas can be managed in an integrated manner.

  In addition, according to the present invention, a plurality of management areas can be managed in a centralized manner, thereby enabling cooperation between an entry / exit management system and a network authentication system using a block composed of the plurality of management areas as a management unit. Can be achieved. As a result, management can be performed for a rough area, so that situations to which the system is applied can be expanded.

  Furthermore, according to the present invention, a plurality of management areas can be managed in a centralized manner, whereby a plurality of management areas obtained by subdividing the management areas can also be managed in a unified manner. Therefore, cooperation between the entry / exit management system and the network authentication system can be achieved using a management area composed of a plurality of management areas as a management unit. Thereby, since a detailed area can be set and managed, the situation to which the system is applied can be expanded.

  In addition, according to the present invention, not only the use authentication of the terminal device for the user but also the authentication process using an authentication server which is another system can be performed in multiple authentications, thereby enhancing security. be able to.

  In addition, according to the present invention, only when the room where the user is in the room and the room where the terminal device is used is matched, the use authentication of the terminal device for the user is permitted, thereby enhancing security. can do.

  Furthermore, according to the present invention, unauthorized use of the terminal by the user can be suppressed by adding to the time restriction.

(First embodiment)
FIG. 1 is a block diagram showing the overall configuration of a network management system 1 according to the first embodiment of the present invention. FIG. 2 is an explanatory diagram illustrating an application state of the network management system 1 according to the first embodiment. In FIG. 2, the network management system 1 is illustrated in a simplified manner for convenience. The network management system 1 is configured by connecting a plurality of facility systems 10 and a network authentication system 20 to each other by a cooperation control device 30.

  The facility system 10 manages, for example, the entry and exit of a user (user) from a low security level area to a high security level area (security management area) that handles confidential information or the like. It is an entry / exit management system for managing the entry / exit of users to / from the security management area. A plurality of facility systems 10 are provided for different security management areas.

  The security management area may be in any form as long as the facility system 10 can manage user entry / exit. For example, the security management area may be separated by a barrier or the like and electrically operated. The door (gate) provided with the electric lock which can be locked and unlocked is provided.

  The facility system 10 performs user authentication for all users who wish to enter the security management area, and permits authentication only for legitimate users registered in advance. Allow the passage of. In addition, the facility system 10 performs user authentication for users who wish to leave the security management area, and permits authentication only for legitimate users registered in advance. Allow passage.

  Each facility system 10 mainly includes a pair of card readers (an entry card reader 11 and an exit card reader 12) provided corresponding to a gate of a security management area to be managed, and an entrance / exit control unit 13. It is configured. The facility system 10 includes a plurality of sets of entry card readers 11 and exit card readers 12 according to the number of gates included in the security management area.

  The entrance card reader 11 is provided in the vicinity of the gate outside the security management area, and reads information stored in a semiconductor memory of, for example, a non-contact IC card (Integrated Circuit) 2 owned by the user. Information read by the entry card reader 11 is transmitted to the entry / exit control unit 13.

  The leaving card reader 12 is provided in the vicinity of the gate inside the security management area, and reads information stored in the semiconductor memory of the IC card owned by the user. Information read by the leaving card reader 12 is transmitted to the entry / exit control unit 13.

  The entrance / exit control unit 13 performs user authentication based on the card ID of the IC card among the information acquired from the entrance card reader 11. The entrance / exit control unit 13 unlocks the locked electric lock when the user who wants to enter the room (the holder of the IC card) determines that the user is an authorized user by the authentication process (authentication permitted). To do. As a result, the user can pass through the gate of the security management area, and the user can enter the security management area. On the other hand, the entrance / exit control unit 13 keeps the electric lock locked when it is determined by the authentication process that the user who wishes to enter the room is not a valid user (authentication is not permitted). As a result, it is impossible for the user to pass through the gate of the security management area, and the user cannot enter the security management area. Here, the card ID is information to be authenticated that uniquely identifies the user, and the entrance / exit control unit 13 holds in advance a database in which the card ID related to the legitimate user is described, and refers to this database for authentication. Process.

  Further, the entrance / exit control unit 13 performs user authentication based on the card ID of the IC card among the information acquired from the exit card reader 12. The entry / exit control unit 13 unlocks the locked electric lock when it is determined by the authentication process that the user who wants to leave the room is an authorized user (authentication permitted). As a result, the user can pass through the gate of the security management area, and the user is allowed to leave the security management area. On the other hand, the entry / exit control unit 13 keeps the electric lock locked when it is determined by the authentication process that the user who wants to leave the room is not a valid user (authentication is not permitted). As a result, the user remains unable to pass through the gate of the security management area, and the user is not allowed to leave the security management area.

  When the user passes through the gate of the security management area through such user authentication, that is, when the state of the user in the security management area changes, the entrance / exit control unit 13 performs the card ID of the IC card and the entrance operation. Alternatively, the linkage control device includes operation information indicating that any one of the exit operations has been performed, a gate ID unique to the unlocked gate, and a time when the entrance / exit operation was performed (entrance / exit time). 30.

  The network authentication system 20 has a function of restricting the terminal device 21 from accessing the network. One or more terminal devices 21 are provided in each security management area, and the terminal devices 21 are connected to a network via a relay device 22 provided in one or more security management areas. In this network, each relay device 22 is also connected to an authentication server 23.

  The network authentication system 20 uses a terminal device 21 provided in each security management area as a processing target, performs user authentication of a user who desires access to the network using the terminal device 21, and is used by an authorized user. Only the terminal device 21 permits access to the network. In the network authentication system 20, the access request to the network transmitted from the terminal device 21 is authenticated by the relay device 22 and the authentication server 23.

  Specifically, the network authentication system 20 uses a technology for authenticating a user connected to a LAN (Local Area Network) switch or a wireless LAN access point established by IEEE (American Institute of Electrical and Electronics Engineers) 802.1X. Thus, an authentication process corresponding to the network connection request that is an access request from the terminal device 21 is performed. IEEE 802.1X is a protocol on Ethernet (registered trademark) that controls whether or not a LAN can be used. In addition, a RADIUS server that can centrally manage users to be authenticated by communication using RADIUS (Remote Authentication Dial-In-User-Service) as an authentication protocol is used for user authentication.

  The terminal device 21 is a so-called PC (Personal Computer) that can be used by a user who has entered the security management area, and exchanges information with the relay device 22 and the authentication server 23. The terminal device 21 holds authentication client software called a supplicant for requesting connection to a network.

  The relay device 22 is connected to, for example, a plurality of terminal devices 21 by wire, and relays authentication processing between the authentication server 23 and the terminal device 21. The relay device 22 is an authentication device that functions as a RADIUS client for the RADIUS server, and performs communication using RADIUS as an authentication protocol for communication with the RADIUS server. The relay device 22 is a LAN switch or the like that supports IEEE 802.1X and RADIUS, and connects the terminal device 21 to the network for each port 22a in cooperation with the authentication server 23.

  The authentication server 23 is a RADIUS server in RADIUS authentication, and includes a user information storage unit (not shown) that holds information about a user who requests connection to the network, and authenticates the terminal device 21 via the relay device 22 that is a RADIUS client. Processing is performed, and whether to access to the network is notified according to the authentication result.

  A user information storage unit (not shown) included in the authentication server 23 holds an account ID, which is information to be authenticated for uniquely identifying a user in the network, and a password corresponding to the account ID.

  The actual authentication procedure by the network authentication system 20 is defined by EAP (Extensible Authentication Protocol). In the network authentication system 20, a user ID (account ID) and a password are input to various EAP that can be used in IEEE802.1X, for example, EAP-MD5 (EAP-Message Digest alogorithm5) and PEAP (Protected-EAP). EAP that is required to be performed, EAP-TLS (EAP-Transport Layer Security) that authenticates using a digital electronic certificate, or the like can be used.

  The cooperation control device 30 is provided so as to pass through an authentication packet exchanged during the authentication process between the relay device 22 and the authentication server 23 of the network authentication system 20, and the facility system 10 and the network authentication system 20. And linked control.

  The linkage control device 30 manages the staying state (occupancy state) of the user such as entering the security management area using the entrance / exit information transmitted from the facility system 10, and according to the presence state, By determining whether the network authentication request transmitted as an access request from the terminal device 21 to the authentication server 23 via the relay device 22 is passed or rejected without being passed, the user by the authentication server 23 As a premise of authentication, use authentication of the terminal device 21 is performed for the user.

  Further, the cooperation control device 30 manages the occupancy state such as leaving the security management area using the entry / exit information transmitted from the facility system 10, and the user is already permitted to connect to the network. If it is, the control of disconnecting the network connected to the terminal device 21 can be performed according to the occupancy state.

  As one of the features of the present embodiment, the cooperation control device 30 manages and manages the user (user) occupancy status based on a management block configured by grouping one or more security management areas. The use authentication of the terminal device 21 to the user (user) is performed. In the example shown in FIG. 2, the two security management areas indicated by the room A and the room B are collected as one management block α.

  FIG. 3 is a block diagram illustrating a configuration of the cooperation control device 30. The cooperation control device 30 includes an external system I / F (interface) 31, an area management unit 32, an internal database 33, a network I / F (interface) 34, and a terminal authentication unit 35.

  The external system I / F 31 is a communication interface for connecting the facility system 10 and the cooperation control device 30. Communication between the facility system 10 and the cooperation control apparatus 30 via the external system I / F 31 can use a communication standard such as Ethernet (registered trademark), for example. Communication between the facility system 10 and the cooperation control device 30 via the external system I / F 31 is not limited to TCP / IP-based communication, and a non-IP field bus or the like can also be used.

  The area management unit 32 stores the entry / exit information transmitted from the entry / exit control unit 13 via the external system I / F 31 in the internal database 33 or updates the internal database 33 based on the entry / exit information. Thus, the occupancy status of the user is managed based on the management block.

  The internal database 33 is a database that stores various operation parameters necessary for operating the cooperation control device 30, specifically, the area management unit 32 and the terminal authentication unit 35.

  FIG. 4 is an explanatory diagram conceptually showing the configuration of the internal database 33 according to the first embodiment. FIG. 5 is an explanatory diagram illustrating the configuration of the internal database 33 based on the network management system 1 shown in FIG.

  The internal database 33 is mainly composed of user information 33A, room information 33B, gate information 33C, authentication information 33D, account information 33E, block information 33F, and relay device information 33G.

  The user information 33A is information configured by associating a user number, occupancy time, occupancy time, and occupancy block number, and a plurality of user information is prepared according to the number of users. The user number indicates information (authenticated information) that identifies the user. In this embodiment, the card ID of the IC card used when the user passes through the gate of the security management area corresponds to this. To do. The occupancy time indicates the time that the user specified by the user number can stay in the management block. The room entry time indicates the time when the user specified by the user number entered the management block. The occupancy block number indicates information for specifying a management block including a security management area in which the user specified by the user number has entered the room. The occupancy block number of the user information 33A is associated with the block number of the block information 33F corresponding thereto. The block number of the block information 33F will be described later.

  The room information 33B is information configured by associating a room number and a block number, and a plurality of room information 33B is prepared according to the number of security management areas. The room number indicates information for specifying the security management area. The block number indicates information for specifying a management block including a security management area specified by the room number. The block number of the room information 33B is associated with the block number of the corresponding block information 33F.

  The gate information 33C is information configured by associating a gate number, an entrance room number, and an exit room number, and a plurality of gate information 33C is prepared according to the number of gates included in each security management area. The gate number is information for identifying the gate. The entry side room number indicates the room number of the security management area on the side where the entrance card reader 11 operated when entering the security management area from the gate specified by the gate number. The leaving room number indicates the room number of the security management area on the side where the leaving card reader that is operated when leaving the security management area from the gate specified by the gate number is installed. The entrance room number or exit side room number of the gate information 33C is associated with the room number of the room information 33B corresponding to the entrance room number or exit side room number.

  The authentication information 33D is information configured by associating a user number, a relay device IP address, and a connection port number, and a plurality of pieces of authentication information 33D are prepared according to the number of users authenticated by the network authentication system 20. The The user number indicates information for identifying a user who has been authenticated by the network authentication system 20. The relay device IP address indicates an IP address that is address information of the relay device 22 to which the terminal device 21 used by the user specified by the user number is connected. The connection port number indicates the port number of the relay device 22 to which the terminal device 21 used by the user specified by the user number is connected. The user number of the authentication information 33D is associated with the user number of the corresponding user information 33A. Further, the relay device IP address of the authentication information 33D is associated with the relay device IP address of the corresponding relay device information 33G.

  The account information 33E is information configured by associating an account ID with a user number, and a plurality of pieces of account information 33E are prepared according to the number of users. The account ID indicates user account information used at the time of authentication processing in the network authentication system 20, and functions as authenticated information for uniquely identifying the user in the network. The user number indicates information for identifying a user who uses the account ID. The user information of the account information 33E is associated with the user information of the user information A corresponding thereto.

  The block information 33F is information configured by associating a block number, a occupancy time, an available start time, and an available end time, and a plurality of pieces of block information 33F are prepared according to the number of management blocks to be set. The The block number indicates information for identifying the management block. The occupancy time indicates the time that the user can stay in the management block specified by the block number. The available start time indicates the user's occupancy start time allowed for the management block specified by the block number. The available end time indicates the user's occupancy end time allowed for the management block specified by the block number.

  The relay device information 33G is information configured by associating a relay device IP address and an installation block number, and a plurality of relay device information 33G is prepared according to the number of relay devices 22 to be installed. The relay device IP address indicates the IP address of the relay device 22. The installation block number indicates information for specifying a management block in which the relay device 22 specified by the relay device IP address is installed. The installation block number of the relay device information 33G is associated with the block number of the corresponding block information 33F.

  Among these pieces of information, a part of the user information 33A (user number and occupancy time), room information 33B, gate information 33C, account information 33E, block information 33F, and relay device information 33G Is static information, and once set, it is not changed until a new user registration or system change is made. On the other hand, part of the user information 33A (room entry time and occupancy block number) is dynamic information and is updated as needed by the area management unit 32 according to a change in the state of the user managed in the facility system 10. To go. The authentication information 33D is also dynamic information, and is updated as needed by the terminal authentication unit 35 in accordance with the network authentication state by the network authentication system 20.

  The network I / F 34 is a communication interface for performing communication between the cooperation control device 30, the relay device 22, and the authentication server 23. The network I / F 34 can use Ethernet (registered trademark) or a TCP / IP stack.

  When the terminal authentication unit 35 receives an access request to the network using the account ID made to the authentication server 23 from the user via the terminal device 21, the terminal authentication unit 35 manages the user managed by the area management unit 32. Based on the occupancy state (the management block in which the user stays), as a premise of user authentication (RADIUS authentication) by the authentication server 23, use authentication of the terminal device 21 for the user is performed.

  Specifically, the terminal authentication unit 35 executes processing related to RADIUS authentication performed between the terminal device 21, the relay device 22, and the authentication server 23. Therefore, the terminal authentication unit 35 relays the RADIUS packet transmitted / received between the relay device 22 and the authentication server 23 in the RADIUS authentication. The terminal authentication unit 35 also has a function of recalculating an authentication code defined in the RADIUS standard.

  In addition, the terminal authentication unit 35 uses the information included in the RADIUS packet of the network authentication request transmitted from the relay device 22 and the information stored in the internal database 33, the management block where the user stays, the network The use authentication of the terminal device 21 to the user is performed by determining whether or not the management block in which the relay device 22 (terminal device 21) to which the authentication request has been made corresponds is set. Then, it is determined whether the network authentication request is transferred to the authentication server 23 or rejected according to the processing result of the use authentication. When the terminal authentication unit 35 makes a rejection response, the terminal authentication unit 35 generates a rejection response packet and transmits it to the relay device 22.

  Hereinafter, the operation by the cooperation control device 30 according to the first embodiment will be described.

  FIG. 6 is a flowchart illustrating a processing procedure of the cooperation control device 30 according to a change in the state of the user in the equipment system 10. The processing shown in this flowchart is executed by the area management unit 32.

  First, a user enters a security management area from a gate managed by the entrance / exit control unit 13. Specifically, the user puts an IC card in the card reader 11 for entering. In response to this, the entrance / exit control unit 13 reads the information stored in the semiconductor memory of the IC card, authenticates the card ID, and unlocks the locked electric lock of the gate. Then, the entrance / exit control unit 13 includes an IC card ID (user number), entry operation information indicating that the entry card reader 11 has been operated, a gate number that identifies the unlocked gate, The leaving time is transmitted to the cooperation control device 30 as entering / leaving information.

  In step S <b> 1, the area management unit 32 of the cooperation control device 30 receives the entry / exit information from the facility system 10 via the external system I / F 31.

  In step S2, the area management unit 32 searches the internal database 33 based on the received gate number, and specifies gate information 33C corresponding to the gate number.

  In step S3, the area management unit 32 specifies the entry room number and the exit room number in the specified gate information 33C. Further, the area management unit 32 searches the room information 33B having the room number associated with the specified entry room number, specifies the block number included in the room information 33B, and specifies the specified exit. The room information 33B having the room number associated with the side room number is searched, and the block number included in the room information 33B is specified.

  When the area management unit 32 has received the room entry operation information, the block number specified based on the entry side room number is used as the block number of the management block in which the user was present before passing through the gate. As specified. In addition, the area management unit 32 specifies the block number specified based on the leaving room number as the block number of the management block in which the user is present after passing through the gate. The block number of the management block specified in step S3 corresponds to the transition of the actual occupancy state of the user (movement between management blocks).

  In the case where the received entry / exit information includes exit operation information indicating that the exit card reader 12 has been operated instead of entrance operation information indicating that the entrance card reader 11 has been operated. The area management unit 32 identifies the block number identified based on the exit side room number as the management block in which the user was present before passing through the gate, and was identified based on the entry side room number. The block number is specified as a management block in which the user is present after passing through the gate.

  In step S4, the area management unit 32 searches the internal database 33 based on the received user number, and specifies user information 33A corresponding to this user number.

  In step S5, the area management unit 32 specifies the occupancy block number included in the specified user information 33A. The occupancy block number specified in step S5 corresponds to the management block (occupancy state) in which the user is managed in the area management unit 32.

  In step S6, the area management unit 32 compares the block number of the management block in which the user is present before passing through the gate specified in step S3 with the resident block number specified in step S4. It is determined whether or not both correspond.

  If it is determined by the comparison that the two correspond, the area management unit 32 determines that a normal entry operation has been performed by the user. The occupancy block number of the user information 33A is updated with the block number of the management block to be occupying (step S7). If the occupancy block number changes due to this update, the area management unit 32 updates the entry time of the user information 33A with the entry / exit time received in step S1 (step S7).

  On the other hand, if it is determined by the above comparison that the two do not correspond to each other, an abnormal entry operation by the user, specifically, authentication permission by an authentication process performed for another user is permitted. The area management unit 32 warns the facility system 10 (specifically, the entrance / exit control unit 13) that the user has entered / exited the management block (joint entrance / exit). Send a command to issue. Then, the area management unit 32 updates the occupancy block number of the user information 33A with the block number of the management block in which the user occupies after passing through the gate specified in step S3 (step S7). If the occupancy block number changes due to this update, the area management unit 32 updates the entry time of the user information 33A with the entry / exit time received in step S1 (step S7).

  Note that the processing procedure for the user's leaving operation is the same, and a description thereof will be omitted.

  FIG. 7 is a flowchart illustrating a processing procedure of the cooperation control device 30 according to the authentication processing in the network authentication system 20. The processing shown in this flowchart is executed by the terminal authentication unit 35.

  A user who has entered the security management area attempts to connect the terminal device 21 to the network by transmitting a network authentication request as an access request from the terminal device 21 via the relay device 22 according to the IEEE 802.1X procedure. In the initial state, since the connection between the terminal device 21 and the network is disconnected by the relay device 22, the terminal device 21 can communicate only with the relay device 22.

  First, in order to connect to the network, the user inputs an account ID and password from the terminal device 21 and transmits a network authentication request (access request), which is an authentication packet, to the relay device 22.

  The terminal device 21 transmits a network authentication request to the relay device 22 as a MAC (Media Access Control) frame including an EAP message. At this time, the account ID is transmitted in plain text, and the password is transmitted in a hashed state.

  The relay device 22 extracts the EAP message from the MAC frame, transfers it to the IP packet, and transmits it to the cooperation control device 30. Specifically, the relay device 22 stores the EAP message extracted from the relay device 22 in the data portion of the RADIUS packet and transmits it to the cooperation control device 30 using UDP of the upper layer of IP.

  In the authentication sequence in the RADIUS authentication process between the relay device 22 and the authentication server 23, only the EAP message of the first RADIUS packet transmitted as a network authentication request from the relay device 22 is EAP-Type = Identity data that is a plain text account ID. Exists. In the RADIUS packet, in addition to this account ID, the IP address of the relay device 22 as information of the relay device 22, the port number of the relay device 22 to which the terminal device 21 is connected, and the like are described as RADIUS attribute information.

  In step S10, the terminal authentication unit 35 receives the RADIUS packet for the network authentication request via the network I / F 34, and sends the identity data (the network authentication request is attached to the EAP message of the received RADIUS packet for the network authentication request). User's account ID). Further, the terminal authentication unit 35 acquires the IP address of the relay device 22 to which the terminal device 21 that has made the network authentication request is connected and the port number of the relay device 22 to which the terminal device 21 is connected.

  In step S11, the terminal authentication unit 35 searches the internal database 33 based on the IP address of the relay device 22 among the acquired information, and specifies the relay device information 33G corresponding to this IP address. And the terminal authentication part 35 searches the installation block number contained in the specified relay apparatus information 33G. That is, this installation block number indicates the block number of the management block in which the relay device 22 connected to the terminal device 21 that has made the network authentication request is installed.

  In step S12, the terminal authentication unit 35 searches the internal database 33 based on the account ID among the acquired information, and specifies the account information 33E corresponding to the account ID. And the terminal authentication part 35 specifies the user number contained in the specified account information 33E.

  Further, the terminal authentication unit 35 searches for user information 33A having a user number associated with the user number of the account information 33E, and specifies the occupancy block number in the user information 33A. As described above, the user information 33 </ b> A is updated as needed by the area management unit 32 according to a change in the state of the user, and the block number is managed by the user managed by the area management unit 32. Corresponds to a block (occupied state).

  In step S13, the block number of the management block in which the relay device 22 for which the network authentication request has been made specified in step S11 is installed, and the presence of the user managed by the area management unit 32 specified in step S12. The block number of the management block to be used is compared, and it is determined whether or not the management block in which the user is present matches the management block for which the network authentication request has been made.

  If a positive determination is made in step S13, the process proceeds to step S14. In step S <b> 14, the terminal authentication unit 35 transmits (transfers) a network authentication request to the authentication server 23 with permission for use authentication of the terminal device 21 for the user.

  On the other hand, if a negative determination is made in step S14, the present process is terminated. In this case, the use authentication of the terminal device 21 for the user is disapproved, and an authentication rejection packet is transmitted to the relay device 22. Specifically, the terminal authentication unit 35 rejects transmission of the network authentication request to the authentication server 23, generates a rejection response packet, and transmits it to the relay device 22 via the network I / F 34. The relay device 22 notifies the terminal device 21 of a rejection response indicating that the network authentication request has been rejected based on the transmitted rejection response packet.

  In response to the transmission of the network authentication request to the authentication server 23, an authentication response that is a packet transmitted from the authentication server 23 to which the EAP message is attached and an authentication request that is a packet transmitted from the terminal device 21 are exchanged. Thus, the authentication process on the user's network is executed.

  Specifically, the authentication server 23 performs collation processing with information stored in a user information storage unit (not shown) using the account ID attached to the network authentication request as a key. The authentication server 23 hashes the password of the target user associated with the transmitted account ID and stored in the user information storage unit with a predetermined hash function, and is hashed attached to the network authentication request. Compare with the password and check if the hashed passwords match. At this time, the terminal authentication unit 35 of the cooperation control device 30 passes through the authentication request and the authentication response between the terminal device 21 and the authentication server 23 without performing anything. The relay device 22 functions as a relay device that performs only EAP message transfer as described above.

  The authentication server 23 transmits either an authentication permission notification indicating that the authentication by the authentication server 23 has been performed or an authentication disapproval notification indicating that the authentication has not been performed to the terminal authentication unit 35 of the cooperation control device 30. .

  When the terminal authentication unit 35 receives the authentication permission notification, an affirmative determination is made in the external authentication permission determination in step S15, and the process proceeds to step S16. In step S16, the terminal authentication unit 35 updates the authentication information 33D. Specifically, the terminal authentication unit 35 searches the internal database 33 based on the previously searched user number, and specifies authentication information 33D corresponding to this user number. Then, the terminal authentication unit 35 updates the relay device IP address and connection port number of the retrieved authentication information 33D based on the acquired IP address of the relay device 22 and the port number of the relay device 22. In addition, the terminal authentication unit 35 transmits the received authentication permission notification to the relay device 22. When receiving the authentication permission notification from the authentication server 23, the relay device 22 opens the line between the terminal device 21 and the network. Accordingly, the user can access the network via the terminal device 21 and can communicate with other terminal devices 21 on the network.

  On the other hand, when the terminal authenticating unit 35 receives the authentication disapproval notification, a negative determination is made in the external authentication permission determination in step S15, and thus this routine is exited. In this case, the terminal authentication unit 35 transmits the received authentication disapproval notification to the relay device 22. When the relay device 22 receives the authentication disapproval notification from the authentication server 23, the relay device 22 transmits a message notifying that the authentication is disapproved to the terminal device 21 without releasing the line between the terminal device 21 and the network. To do.

  FIG. 8 is a flowchart illustrating a processing procedure of unauthorized occupancy determination by the cooperation control device 30. The processing shown in this flowchart is executed by the area management unit 32, and is executed for all the users described in the user information 33A.

  First, in step S20, the area management unit 32 acquires the occupancy time, entry time, and block number associated with the user number in the user information 33A. If the entry time and the block number do not exist, it is determined that the user specified by the user number has not entered the management block, and the process is terminated.

  The area management unit 32 searches for block information 33F having a block number associated with the occupancy block number of the user information 33A, and in this block information 33F, the occupancy time, the available start time, and the use Identify possible end times.

  In step S <b> 21, the area management unit 32 determines whether the current time is within the range from the available start time to the available end time. If a positive determination is made in step S21, the process proceeds to step S22. On the other hand, if a negative determination is made in step S21, the process proceeds to step S25.

  In step S22, the area management unit 32 determines whether or not the elapsed time from the entry time specified from the user information 33A to the present time exceeds the available time specified from the block information 33F. . If a positive determination is made in step S22, the process proceeds to step S23. On the other hand, if a negative determination is made in step S22, the process proceeds to step S25.

  In step S23, the area management unit 32 determines whether or not the elapsed time from the entry time specified from the user information 33A to the present time exceeds the available time specified from the user information 33A. To do. If a positive determination is made in step S23, the process proceeds to step S24. On the other hand, if a negative determination is made in step S23, the process proceeds to step S25.

  In step S24, the area management unit 32 waits for a predetermined time (for example, 1 minute), and then returns to the process of step S21 described above.

  In step S25, the area management unit 32 is in the user's unauthorized room, that is, the user is present in a time outside the range of the available time set in the management block, or is set in the management block. It is determined that the user stays in excess of the available room time, or the user stays in the room exceeding the available time in the management block set for the user. The determination result of unauthorized occupancy is recorded as unauthorized occupancy in the user information 33A having a user number indicating the corresponding user, for example.

  When an unauthorized occupancy room is recorded in the user information 33A by such processing, the terminal authenticating unit 35 compares the management block when the unauthorized occupancy record is specified in the user information 33A in the process. Without performing, the use authentication of the terminal device 21 with respect to the user is not permitted. Thereby, it is possible to restrict the use of the terminal device 21 before the authentication server 23 authenticates a user who is illegally present in the room.

  In the present embodiment, the area management unit 32 performs unauthorized occupancy determination. For example, the terminal authentication unit 35 performs processing as illustrated in FIG. In the case of an unauthorized occupancy, the use authentication of the terminal device 21 for the user may be denied.

  Thus, according to the present embodiment, information between security management areas can be linked, so that a plurality of security management areas can be managed in an integrated manner.

  In addition, according to the present embodiment, a plurality of security management areas can be managed in an integrated manner, so that an entry / exit management system and a network authentication system can be managed by using blocks composed of the plurality of security management areas as management units. Can be linked. As a result, management can be performed for a rough area, so that situations to which the system is applied can be expanded.

  Moreover, according to this embodiment, not only the use authentication of the terminal device 21 with respect to the user but also the authentication process using the authentication server 23 can enhance security.

  Further, according to the present embodiment, only when the security management area in which the user is present matches the security management area in which the terminal device 21 is used, the use authentication of the terminal device 21 for the user is permitted. Security can be strengthened.

  Furthermore, according to the present invention, unauthorized use of the terminal device 21 by the user can be suppressed by adding to the time restriction.

(Second Embodiment)
FIG. 9 is an explanatory diagram illustrating a state in which the network management system 1 according to the second embodiment is applied. In the network management system 1 shown in the figure, illustration of a part of the system configuration is omitted for convenience.

  The network management system according to the second embodiment differs from that of the first embodiment in that the cooperation control device 30 divides the security management area into one or more management areas and As a base, management of the user's occupancy state and use authentication of the terminal device 21 for the user are performed. In the description of the second embodiment, the same reference numerals are used for the same configurations as those in the first embodiment described above, and detailed description thereof is omitted.

  FIG. 10 is a block diagram illustrating a configuration of the cooperation control device 30 according to the second embodiment. The cooperation control device 30 includes an internal database 36 instead of the internal database 33 according to the first embodiment, and further includes an area specifying unit 37.

  The internal database 36 is a database that stores various operation parameters necessary for operating the cooperation control device 30, specifically, the area management unit 32 and the terminal authentication unit 35.

  FIG. 11 is an explanatory diagram conceptually showing the structure of the internal database 36 according to the second embodiment. FIG. 12 is an explanatory diagram illustrating the configuration of the internal database 36 based on the network management system 1 shown in FIG.

  The internal database 36 is mainly composed of user information 36A, room information 36B, gate information 36C, authentication information 36D, account information 36E, area information 36F, and relay device information 36G. These pieces of information 36A to 36G basically correspond to the pieces of information 33A to 33G of the internal database 33 in the first embodiment, except that the item corresponding to the management block is changed to the management area. However, as shown in the figure, in the internal database 36, the stayable time, the available start time, and the available end time are associated with the room information 36B. Note that these items may be associated with the area information 36F as in the internal database 33 of the first embodiment.

  The area specifying unit 37 specifies the management area where the user specified by the user information stays based on the user information. Each management area is provided with a monitoring sensor 38 adopting a technique such as RFID, for example, and this monitoring sensor 38 acquires a card ID from the IC card by wireless communication with a non-contact IC card. This is output to the area specifying unit 37. Each monitoring sensor 38 is given an ID (device ID) for identifying the device, and the area specifying unit 37 associates the device ID with the area number for specifying the management area in which the device ID is installed. Holding. Therefore, the area specifying unit 37 can specify the area number where the user is present based on the device ID of the monitoring sensor 38 for which a certain user number is specified.

  In the cooperative control device 30 having such a configuration, the area management unit 32 uses the external system I / F 31 to enter / exit information transmitted from the entry / exit control unit 13 and the user specified by the area specifying unit 37. The management area where the user stays is stored in the internal database 33 or the internal database 33 is updated based on the information, thereby managing the occupancy status of the user based on the management area.

  Further, the terminal authentication unit 35 is managed by the area management unit 32 when receiving a request for access to the network using the account ID made from the user to the authentication server 23 via the terminal device 21. Based on the user's occupancy state (the management area in which the user stays), as a premise of user authentication (RADIUS authentication) by the authentication server 23, use authentication of the terminal device 21 for the user is performed.

  Specifically, the terminal authentication unit 35 executes processing related to RADIUS authentication performed between the terminal device 21, the relay device 22, and the authentication server 23. Therefore, the terminal authentication unit 35 relays the RADIUS packet transmitted / received between the relay device 22 and the authentication server 23 in the RADIUS authentication. The terminal authentication unit 35 also has a function of recalculating an authentication code defined in the RADIUS standard.

  In addition, the terminal authentication unit 35 uses the information included in the RADIUS packet of the network authentication request transmitted from the relay device 22 and the information stored in the internal database 36 to use the management area where the user stays, the network The use authentication of the terminal device 21 to the user is performed by determining whether or not the management area in which the relay device 22 (terminal device 21) for which the authentication request has been made is set corresponds. Then, it is determined whether the network authentication request is transferred to the authentication server 23 or rejected according to the processing result of the use authentication. When the terminal authentication unit 35 makes a rejection response, the terminal authentication unit 35 generates a rejection response packet and transmits it to the relay device 22.

  The operations performed by the cooperation control apparatus 30 according to the second embodiment are basically the same as those in the first embodiment as in the processes shown in FIGS. 6 to 8. Is read as management area and area number. When the management area where the user actually stays is specified, first, as in the first embodiment, the security management area in which the user has entered is specified from the entry / exit information acquired by the area management unit 32. . Then, by referring to the area information 36F of the internal database 36, the area number of the management area included in this security management area is specified. The area management unit 32 transmits the specified area information and the user information acquired as the entry / exit information to the area specification unit 37, so that the user can enter any management area constituting the management area where the user has entered the room. You can identify if you are staying.

  As described above, according to the present embodiment, a plurality of security management areas can be managed in a centralized manner, so that a plurality of management areas obtained by subdividing the security management areas can also be managed in a centralized manner. . Therefore, cooperation between the facility system and the network authentication system 20 can be achieved using a security management area composed of a plurality of management areas as a management unit. Thereby, since a detailed area can be set and managed, the situation to which the system is applied can be expanded.

1 is a block diagram showing the overall configuration of a network management system 1 according to a first embodiment Explanatory drawing which illustrates the application state of the network management system 1 according to the first embodiment The block diagram which shows the structure of the cooperation control apparatus 30 Explanatory drawing which shows notionally the structure of the internal database 33 concerning 1st Embodiment. Explanatory diagram illustrating the configuration of the internal database 33 based on the network management system 1 shown in FIG. The flowchart which shows the process sequence of the cooperation control apparatus 30 according to the user's state change in the equipment system 10. The flowchart which shows the process sequence of the cooperation control apparatus 30 according to the authentication process in the network authentication system 20. The flowchart which shows the process sequence of the unauthorized occupancy determination by the cooperation control apparatus 30 Explanatory drawing which illustrates the state where the network management system 1 concerning 2nd Embodiment was applied The block diagram which shows the structure of the cooperation control apparatus 30 concerning 2nd Embodiment. Explanatory drawing which shows notionally the structure of the internal database 36 concerning 2nd Embodiment. Explanatory drawing illustrating the configuration of the internal database 36 based on the network management system 1 shown in FIG.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 Network management system 10 Equipment system 11 Entrance card reader 12 Exit card reader 13 Entrance / exit control unit 20 Network authentication system 21 Terminal device 22 Relay device 22a Port 23 Authentication server 30 Cooperation control device 31 External system I / F
32 Area management unit 33 Internal database 33A User information 33B Room information 33C Gate information 33D Authentication information 33E Account information 33F Block information 33G Relay device information 34 Network I / F
35 Terminal Authentication Unit 36 Internal Database 36A User Information 36B Room Information 36C Gate Information 36D Authentication Information 36E Account Information 36F Area Information 36F Block Information 36G Relay Device Information 37 Area Identification Unit 38 Monitoring Sensor

Claims (6)

Managing each user's passage at the gate entering and exiting the management area according to the result of the user authentication process based on the first authenticated information that uniquely identifies the user, with different management areas as individual management targets Multiple access control systems,
Limiting access to the network according to the result of the user authentication process by the authentication server based on the second authenticated information that uniquely identifies the user, with the terminal device provided in each of the management areas as a processing target In cooperative control devices that link network authentication systems with each other,
Area information storage means for associating and storing gate information indicating the gate and area information indicating a management area after passing through the gate;
User information storage means for storing the first authenticated information in association with the area information of the management area where the user specified by the first authenticated information stays;
Acquires entrance / exit information including gate information and the first authenticated information transmitted from the entrance / exit management system in response to a user's gate passage, and the area information associated with the acquired gate information is An area management means for managing a staying state of the user by searching in the area storage means and updating the user information storage means based on the searched area information and the acquired first authenticated information;
Terminal authentication means for performing use authentication of the terminal device for the user based on the staying state of the user managed by the area management means,
The area management means determines whether or not both correspond based on the management area where the user was present before passing through the gate and the management area specified by passing through the gate. Is determined to be a normal entrance, and if it does not correspond, it is determined to be an abnormal entrance . Block information that associates and stores block information indicating a management block configured by grouping one or more of the management areas and area information of the management area that configures the management block specified by the block information A storage means;
The user information storage means stores the area information associated with the first authentication information using block information of the management block including a management area specified by the area information,
The area management means searches the block information storage means for the block information associated with the area information searched from the acquired gate information, and acquires the searched block information and the acquired first authenticated object. By updating the user information storage means based on the information, the user's stay status is managed based on the management block,
The terminal authentication unit performs use authentication of the terminal device for a user based on a stay state of the user based on the management block managed by the area management unit. Cooperation control device. Associating area information indicating a management area, which is an area defined by dividing the management area into one or more areas, and area information of the management area including the management area specified by the area information Area information storage means for storing
Based on the first authenticated information, further comprising an area specifying means for specifying a management area where a user specified by the first authenticated information stays,
The user information storage means stores the area information associated with the first authentication information using area information of the management area obtained by subdividing a management area specified by the area information,
The area management means searches the area information storage means for the area information associated with the area information searched from the acquired gate information, and includes the searched area information and the entry / exit information. By transmitting the authentication information of 1 to the area specifying means, it is possible to specify in which management area constituting the management area where the user has entered, and the area specifying means specified by the area specifying means. By updating the user information storage means based on the area information and the acquired first authenticated information, the user's stay state is managed based on the management area,
The terminal authentication unit performs use authentication of the terminal device for a user based on a staying state of the user based on the management area managed by the area management unit. Cooperation control device. Further comprising authenticated information storage means for storing the first authenticated information and the second authenticated information in association with each user;
When the terminal authenticating unit receives a request for access to the network using the second authenticated information, which is made from a user through the terminal device, the terminal authenticating unit associates the second authenticated information with the second authenticated information. The first authenticated information is searched from the authenticated information storage unit, and based on the staying state of the user specified from the user information storage unit using the searched first authenticated information as a key, 4. The terminal device according to any one of claims 1 to 3, wherein user authentication of the terminal device is performed, and whether or not the access request is transferred to the authentication server is determined according to an authentication result of the user authentication. The cooperation control apparatus described in any one item. A relay device information storage unit for storing region information indicating the management region where the relay device to which the terminal device is connected is installed, and address information in the network of the relay device;
The terminal authentication unit searches the relay device information storage unit based on address information of the relay device to which the terminal device is connected, and is included in the access request, so that the region information associated with the address information of the relay device And authenticating the use of the terminal device for the user based on the specified area information and the stay status of the user specified from the user information storage means using the first authenticated information as a key The cooperation control apparatus according to claim 4, wherein   2. The terminal authentication unit performs use authentication of the terminal device for a user based on a stay state of the user managed by the area management unit and a stayable time in the management area. To 5. The cooperation control device according to any one of 5 to 5.

Images