JP5453882B2 - Communication device, communication device authentication notification method, and communication device authentication notification program - Google Patents

Description

  The present invention relates to a communication device, a communication device authentication notification method, and a communication device authentication notification program, and more particularly to a communication device that performs authentication registration using a digest authentication method, a communication device authentication notification method, and a communication device authentication notification program. .

Communication devices such as IP telephones using conventional SIP (Session Initiation Protocol) and telephone applications using software realize communication with security when performing voice communication and video communication over an IP network. In order to do this, connection authentication is performed with respect to the server device and registered as a client terminal.
As a method of ensuring security by authentication registration of such a client terminal, authentication is performed based on a user ID or password input in the terminal device, and if authenticated, this terminal device can be registered as a client terminal and communicated In addition, a technique for notifying the terminal device of an authentication error or the like when the authentication is not performed is known (Patent Document 1).

A “digest authentication method” is widely used for authentication registration between a server device and a client terminal via such an IP network.
The digest authentication method is one of authentication methods on the Web using HTTP (Hyper Text Transfer Protocol) defined in RFC2069. The server device stores a user ID and a password corresponding to the client account in advance. When the server device receives a request for authentication from an account of the client, the server device transmits a digest authentication request to which encryption key data is added to the client. When the client receives the digest authentication request, the client transmits a registration request to which the encryption authentication data including the encryption key data added to the digest authentication request and the user ID and password corresponding to the account are added to the server apparatus. The server apparatus determines whether the encryption authentication data added to the received registration request is encryption authentication data generated from a user ID and password corresponding to a client account stored in advance and the transmitted encryption key data If the encryption authentication data transmitted from the terminal device matches the encryption authentication data generated from the encryption key data transmitted from the server device to the terminal device, the terminal device is authenticated and registered as a client. If they do not match, registration is not performed.

JP 2006-187041 A

  However, in the above-described conventional technology, the client terminal makes a registration request to the server apparatus when the authentication function of the server apparatus is invalid due to human causes such as erroneous operation or incorrect setting or due to system operation force majeure. In some cases, the client terminal is notified of the completion of registration similar to when the authentication function is operating. In such a case, the client terminal cannot determine whether it has been authenticated and registered in the server device or registered in the server device without authentication. Therefore, even if the authentication function of the server device is disabled and the security of the communication system is not secured, such a situation cannot be recognized on the client terminal side, and unauthorized access from the outside There was a problem that important information could be stolen.

  In order to solve the above-described problems, an object of the present invention is to provide a communication device serving as a client terminal that can confirm whether or not an authentication operation when registering with a server device has been normally performed.

In order to achieve the above object, the present invention provides an authentication request transmission unit that transmits an authentication request to a server device connected to a communication network, a response reception unit that receives a response to the authentication request, and an authentication request A determination unit that determines whether or not a response is a digest authentication request; a digest authentication response transmission unit that transmits a response based on a digest authentication method to the server device when the response is a digest authentication request; and the authentication An authentication status notifying unit is provided for notifying the server device of information related to the authentication status when an authentication completion response is received without receiving a digest authentication request from the server device in response to the request.
The authentication status notification unit may send information related to the authentication status to the server device to the communication network.
The communication apparatus of the present invention may further include an application control unit that controls the operation of the application based on information related to the authentication status notified by the authentication status notification unit.

According to the present invention, when a communication device serving as a client terminal requests authentication to the server device, the communication device notifies the user whether or not digest authentication is performed in response to the request for authentication. It is possible to confirm whether or not a regular authentication operation has been executed on the communication terminal side.
Therefore, it can be confirmed on the communication device side whether or not the authentication function of the server device is valid, that is, the security state of the communication system to which the communication device is connected can be recognized on the communication device side. . As a result, it is possible to quickly confirm the problem of the security state of the communication system on the client terminal side.

It is a block diagram which shows the structure of the communication apparatus which concerns on the 1st Embodiment of this invention. It is a flowchart which shows operation | movement of the communication apparatus which concerns on 1st Embodiment. It is a sequence diagram which shows the notification operation | movement of the authentication execution result of the communication apparatus which concerns on 1st Embodiment. It is a block diagram which shows the structure of the communication apparatus which concerns on the 2nd Embodiment of this invention. It is a flowchart which shows operation | movement of the communication apparatus which concerns on 2nd Embodiment. It is a sequence diagram which shows the notification operation | movement of the authentication execution result of the communication apparatus which concerns on 2nd Embodiment. It is a block diagram which shows the structure of the communication apparatus which concerns on the 3rd Embodiment of this invention. It is a flowchart which shows operation | movement of the communication apparatus which concerns on 3rd Embodiment. It is a sequence diagram which shows the notification operation | movement of the authentication execution result of the communication apparatus which concerns on 3rd Embodiment.

Embodiments of the present invention will be described below with reference to the drawings.
[First Embodiment]
FIG. 1 is a block diagram showing a configuration of a communication apparatus according to the first embodiment of the present invention.
The communication device 10 according to the present embodiment operates as a client terminal of the server device 2 via the communication network 1 and performs packet communication with the server device 2, and in particular, the client terminal of the server device 2. Is registered using the digest authentication method.
As shown in FIG. 1, the communication apparatus 10 according to the present embodiment includes a network interface 110, an authentication request transmission unit 120, a response reception unit 130, a determination unit 140, a digest authentication response transmission unit 150, an authentication The status notification unit 160 is configured.

The network interface 110 transmits and receives packet data to and from the communication network 1 and performs packet communication with the server device 2 connected to the communication network 1.
The authentication request transmission unit 120 transmits a request (hereinafter referred to as “authentication request”) for requesting authentication performed when the server apparatus 2 registers the communication apparatus 10 as a client terminal to the server apparatus 2.
The response receiving unit 130 receives the response transmitted by the server device 2.
The determination unit 140 determines whether the response received by the response reception unit 130 is a digest authentication request or an authentication completion response, and stores a determination result history (hereinafter referred to as “determination history”).
The digest authentication response transmission unit 150, when the determination unit 140 determines that the response received by the response reception unit 130 is a digest authentication request, the response based on the digest authentication method (hereinafter referred to as “digest authentication response”). Is transmitted to the server device 2.
The authentication status notification unit 160 notifies the user of information related to the authentication status in the server device 2 based on the determination history of the determination unit 140.

  These components are the hardware of a computer (not shown) mounted on the communication device 10 by installing a computer program in a computer having a CPU (Central Processing Unit), a memory, and an interface. Resources and software are realized in cooperation.

  Next, the notification operation of the authentication result of the communication apparatus 10 according to the present embodiment will be described with reference to the flowchart shown in FIG.

In order for the communication apparatus 10 to operate as a client terminal of the server apparatus 2, the server apparatus 2 is requested to register. At this time, the communication device 10 determines whether or not authentication information (user ID and password) used in the authentication processing by the digest authentication method performed at the time of registration in the server device 2 is set (S10).
If it is not set (“NO” in S10), after the user ID and password are set (S11), the authentication request transmission unit 120 transmits a request (authentication request) requesting authentication to the server device 2. (S12).
If it is set correctly (“YES” in S10 of FIG. 2), the authentication request transmission unit 120 transmits an authentication request to the server device 2 (S12).

The response receiving unit 130 receives a response transmitted from the server device 2 in response to the authentication request transmitted by the authentication request transmitting unit 120 (S13).
The determination unit 140 determines whether the received response is a digest authentication request or an authentication completion response (S14). If the request is a digest authentication request (“digest authentication request” in S14), the digest authentication response transmission unit 150 transmits a response based on the digest authentication method (digest authentication response) to the server device 2 (S15).

Here, the digest authentication response will be described.
The digest authentication request signal received by the response receiving unit 130 includes encryption key data, and the digest authentication response transmission unit 150 extracts the encryption key data and extracts the set user ID and password. The encryption authentication data composed of the encrypted key data is generated. The digest authentication response transmission unit 150 transmits an authentication request (digest authentication response) including the encryption authentication data to the server device 2, and the server device 2 performs authentication based on the encryption authentication data included in the digest authentication response. Made. When the authentication is completed in the server device 2, a response that is an authentication completion response is transmitted.

When the response reception unit 130 receives the authentication completion response from the server device 2 (“authentication registration completed” or S16 in S14), the authentication status notification unit 160 determines the authentication status in the server device 2 based on the determination history of the determination unit 140. Information about the response is notified, and the determination history of the response in the determination unit 140 is deleted (S17).
Here, notification of information related to the authentication status based on the determination history of the determination unit 140 will be described. When digest authentication is performed on the authentication request from the communication device 10, that is, when the determination unit 140 determines whether the authentication completion response is received after the digest authentication request is received, the authentication ends normally. Information indicating that this has been done is notified. On the other hand, when the authentication is completed without performing the digest authentication, that is, when the determination unit 140 determines that the digest authentication request is not received and the authentication completion response is received, it indicates that the authentication is not performed. Notify information. For example, the above information may be notified using a display device (not shown) or a voice output device (not shown) of the communication device 10.
When the predetermined time has elapsed (S18), the authentication request transmission unit 120 transmits the authentication request to the server device 2 again, and executes the above-described operation (S12 to S17).

Next, operations of communication apparatus 10 and server apparatus 2 according to the present embodiment will be described with reference to a sequence diagram shown in FIG.
As shown in FIG. 3, the server device 2 has an effective authentication function, and stores a user ID and a password that are authentication information corresponding to the account “abcd”. When requesting authentication as an account “abcd” from the communication device 10 to the server device 2, a user ID and password corresponding to the account “abcd” are set (S101), and an authentication request is transmitted to the server device 2 (S101). S102).

When the server apparatus 2 receives the authentication request transmitted from the communication apparatus 10, the authentication function of the server apparatus 2 is valid, and thus digest authentication processing is executed. First, a response that is a digest authentication request corresponding to the authentication request from the communication device 10 is transmitted to the communication device 10 (S103).
Upon receiving the response from the server device 2, the communication device 10 determines whether this response is a digest authentication request or an authentication completion response (S104). Here, since the received response is a digest authentication request, the communication device 10 transmits a digest authentication response based on the digest authentication method to the server device 2 (S105).

When the server apparatus 2 receives the digest authentication response transmitted from the communication apparatus 10, the server apparatus 2 performs an authentication process using the encryption authentication data added to the digest authentication response, and communicates a response that is an authentication completion response when the process is completed. It transmits to the apparatus 10 (S106).
The communication device 10 determines the received response (S107). Since the response received here is an authentication completion response, the communication device 10 notifies the information that the authentication in the server device 2 is normally performed based on the received response determination history, and deletes the determination history. (S108).
For example, a message such as “Normal authentication has been successfully performed” is displayed on a display device (not shown) of the communication device 10 and a voice guidance such as “Normal authentication has been successfully performed” is simultaneously displayed on a voice output device (not shown) of the communication device 10. Or you may notify to a user by outputting separately.
After the notification of the authentication status, the communication device 10 deletes the response determination history and prepares for the next authentication operation.

When the authentication update confirmation time has elapsed (S109), the communication device 10 transmits an authentication request to the server device 2 again for authentication update (S110).
At this time, as shown in FIG. 3, in the server device 2, the authentication function of the server device 2 is invalid due to human error or the like, and the server device 2 authenticates any authentication request. At the same time, a response that is an authentication completion response is transmitted in response to this authentication request (S111).

When receiving the response transmitted from the server device 2, the communication device 10 determines the received response (S112). Since the response received here is an authentication completion response, the communication device 10 notifies information related to the authentication status in the server device 2 based on the received response determination history, and deletes the determination history (S113). Here, since the authentication completion response reception determination is made without performing the digest authentication request reception determination with respect to the authentication request of the communication device 10, the communication device 10 is in a situation where the server device 2 is not authenticated. Notify that there is some information.
For example, a message such as “No authentication has been performed” is displayed on a display device (not shown) of the communication device 10, or voice guidance having the same content is simultaneously or individually output to a voice output device (not shown) of the communication device 10. May be notified to the user. Furthermore, since the authentication function of the server device 2 is disabled, the security of the communication device 10 is not ensured, and there is a possibility of unauthorized access from the outside. The user may be notified using a display such as “There is a possibility of unauthorized access from the outside” or voice guidance indicating such a situation.

In this way, when a communication device serving as a client terminal makes an authentication request to the server device, the communication device notifies the authentication result based on the presence / absence of execution of digest authentication according to the authentication request, whereby the client terminal side It is possible to confirm whether or not a regular authentication operation has been executed.
Therefore, whether or not the authentication function of the server device is valid, that is, the security state of the communication system to which the communication device is connected can be recognized on the communication device side. As a result, it is possible to quickly confirm the problem of the security state of the communication system on the client terminal side.

[Second Embodiment]
Next, a communication apparatus according to the second embodiment of the present invention will be described.
In addition, about the component of the communication apparatus which concerns on this Embodiment, the same code | symbol is attached | subjected to what has the same structure and function as the component demonstrated in 1st Embodiment, and detailed description is abbreviate | omitted To do.
FIG. 4 is a block diagram illustrating a configuration of the communication device 20 according to the second embodiment. The communication apparatus according to the present embodiment operates as a client terminal of the server apparatus 2 via the communication network 1 and performs packet communication between the server apparatus 2 and the administrator 3, and in particular, the server apparatus 2 When registering as a client terminal, authentication registration is performed using the digest authentication method.

As shown in FIG. 4, the communication device 20 according to the present embodiment includes a network interface 110, an authentication request transmission unit 120, a response reception unit 130, a determination unit 140, a digest authentication response transmission unit 150, and an authentication. And a status notification unit 260.
The authentication status notification unit 260 notifies information related to the authentication status in the server device 2 based on the determination history of the determination unit 140 and sends information related to the authentication status in the server device 2 to the communication network 1.
These components are the hardware of a computer (not shown) installed in the communication device 20 by installing a computer program in a computer having a CPU (Central Processing Unit), a memory, and an interface. Resources and software are realized in cooperation.

Next, the notification operation of the authentication result of the communication device 20 according to the present embodiment will be described with reference to the flowchart shown in FIG.
When the communication device 20 transmits an authentication request to the server device 2, as described in the first embodiment, a response corresponding to the authentication request is transmitted from the server device 2, and this response is received by the communication device 20 as a response. The unit 130 receives (S20).

The determination unit 140 determines the received response (S21). When this response is an authentication completion response (“authentication completion response” in S21), the authentication status notification unit 260 transmits information on the authentication status in the server device 2 based on the determination history of the determination unit 140 via the network interface 110. To the communication network 1 (S22). Here, since there is no reception determination of the digest authentication request and reception determination of the authentication completion response is made, the authentication status notification unit 260 sends information indicating that the server device 2 is not authenticated to the communication network 1. .
For example, the authentication status notification unit 260 may send information related to the authentication status in the server device 2 to the communication network 1 so that the administrator 3 of the communication system including the communication device 20 and the server device 2 can receive the information. .
The authentication status notification unit 260 sends information related to the authentication status to the communication network 1 and then notifies the information related to the authentication status in the server device 2, that is, the status where the authentication is not executed. The response determination history is deleted (S23).

  On the other hand, if the result of determining the response by the determination unit 140 is a digest authentication request (“digest authentication request” in S21), the communication device 20 transmits a digest authentication response to the server device 2, and the server device 2 When the authentication is completed, a response which is an authentication completion response from the server device 2 is received, information indicating that the authentication operation has been normally performed is notified, and the determination history of the determination unit 140 is deleted (S24).

  When a predetermined time elapses after the authentication status notification unit 260 notifies the authentication status information (S25), the communication device 20 transmits an authentication request to the server device 2 again and executes the above-described operation. (S20-S24).

Next, operations of the communication device 20, the server device 2, and the administrator 3 according to the present embodiment will be described with reference to a sequence diagram shown in FIG. In FIG. 6, it is assumed that the authentication function of the server device 2 is invalid.
As shown in FIG. 6, the server apparatus 2 stores a user ID and a password that are authentication information corresponding to the account “abcd”. When requesting authentication from the communication device 20 to the server device 2 as the account “abcd”, the user ID and password corresponding to the account “abcd” are set (S201), and an authentication request is transmitted to the server device 2 (S201). S202).

Since the authentication function of the server apparatus 2 is disabled, the server apparatus 2 transmits a response that is an authentication completion response to any authentication request (S203).
The communication device 20 receives the response transmitted from the server device 2, and determines this response (S204). Since the response received here is an authentication completion response, the communication device 20 indicates that the information regarding the authentication status in the server device 2 based on the response determination history, that is, the status where the authentication is not executed in the server device 2. The indicated information is sent to the communication network 1 (S205). Here, information related to the authentication status in the server device 2 is transmitted to the server device 2 and the manager 3 that are connected to the communication network 1 and perform packet communication with the communication device 20.
Based on this information, the server device 2 and the administrator 3 that have received the information related to the authentication status in the server device 2 transmitted from the communication device 20 indicate that the authentication function of the server device 2 is invalid or the communication device 20 authenticates. A warning notification operation may be performed by notifying that the state is not performed (S206).

  After transmitting information related to the authentication status in the server device 2, the communication device 20 notifies the information indicating that the authentication in the server device 2 is not performed in the own device, and deletes the determination history (S207). .

  In this way, by sending information indicating that the authentication function of the server device is invalid to the communication network, it is possible to quickly notify the administrator of the system connected via the communication network, It becomes possible to prevent unauthorized access to the system from the outside.

[Third Embodiment]
Next, a communication apparatus according to the third embodiment of the present invention will be described.
In addition, about the component of the communication apparatus which concerns on this Embodiment, the same code | symbol is attached | subjected to what has the same structure and function as the component demonstrated in 1st Embodiment, and detailed description is abbreviate | omitted To do.
FIG. 7 is a block diagram illustrating a configuration of the communication device 30 according to the third embodiment. The communication device according to the present embodiment operates as a client terminal of the server device 2 via the communication network 1 and operates a common application with the server device 2 to perform packet communication. When registering as a client terminal of the server device 2, authentication registration is performed using the digest authentication method.

  As illustrated in FIG. 7, the communication device 30 according to the present embodiment includes a network interface 110, an authentication request transmission unit 120, a response reception unit 130, a determination unit 140, a digest authentication response transmission unit 150, and an authentication. The status notification unit 360 and the application control unit 370 are configured.

Based on the determination history of the determination unit 140, the authentication state notification unit 360 notifies the information regarding the authentication state in the server device 2 and the operation state information of the application operated in the communication device 30 together.
The application control unit 370 controls the operation of this application based on the information on the authentication status in the server device 2 notified by the authentication status notification unit 360 and the operation status information of the application.
These components are the hardware of a computer (not shown) installed in the communication device 20 by installing a computer program in a computer having a CPU (Central Processing Unit), a memory, and an interface. Resources and software are realized in cooperation.

Next, the notification operation of the authentication result of the communication device 30 according to the present embodiment will be described with reference to the flowchart shown in FIG.
When the communication device 30 transmits an authentication request to the server device 2, as described in the first embodiment, a response corresponding to the authentication request is transmitted from the server device 2, and this response is received by the communication device 30 as a response. The unit 130 receives (S30).

The determination unit 140 determines the received response (S31). If this response is an authentication completion response (“authentication completion response” in S31), the authentication status notification unit 360 uses the information regarding the authentication status in the server device 2 based on the determination history of the determination unit 140, and the communication device 30. The operation history information of the running application is also notified, and the determination history is deleted (S33).
Here, since there is no reception determination of the digest authentication request and reception determination of the authentication completion response is made, the authentication status notification unit 360 is not authenticated with information indicating that the server device 2 is not authenticated. Information indicating that the application is being executed in the situation is also notified.
The application control unit 370 controls the operation of the application such as automatically terminating the application running on the communication device 30 based on the information related to the authentication status (S34).

  On the other hand, if the determination unit 140 determines that the response is a digest authentication request (“digest authentication request” in S31), the communication device 30 transmits a digest authentication response to the server device 2, and the server device 2 When the authentication is completed, a response that is an authentication completion response from the server device 2 is received, information indicating that the authentication operation has been normally performed is notified, and the determination history of the determination unit 140 is deleted (S32).

  When the predetermined time has elapsed (S35), the communication device 30 transmits an authentication request to the server device 2 again, and executes the above-described operation (S30 to S34).

Next, operations of communication device 30 and server device 2 according to the present embodiment will be described with reference to a sequence diagram shown in FIG. In FIG. 9, it is assumed that the authentication function of the server device 2 is invalid.
As shown in FIG. 9, the server apparatus 2 stores a user ID and a password that are authentication information corresponding to the account “abcd”. When requesting authentication from the communication device 30 to the server device 2 as the account “abcd”, a user ID and password corresponding to the account “abcd” are set (S301), and an authentication request is transmitted to the server device 2 (S301). S302). Since the authentication function of the server device 2 is disabled, the server device 2 transmits a response that is an authentication completion response to any authentication request (S303).

The communication device 30 receives the response transmitted from the server device 2, and determines this response (S304). Since the response received here is an authentication completion response, the communication device 30 indicates that the information regarding the authentication status in the server device 2 based on the response determination history, that is, the status where the authentication is not executed in the server device 2. And the information indicating the operating state of the application operating in the communication device 30 are notified together, and the determination history is deleted (S305).
For example, a display such as “Authentication has not been performed. There is a possibility of unauthorized access, and the running application is automatically terminated” or an illustration of the communication device 30 is displayed. The user may be notified by, for example, outputting voice guidance having the same content to the voice output device not or simultaneously or individually.

The communication device 30 performs operation control such as automatically terminating the application after notifying the information about the authentication status. Here, the application operating in the communication device 30 is an application that registers and operates an account used in the server device 2 after authentication. In order to automatically terminate this application, the account in the server device 2 is used. Registration of must be deleted.
The communication device 30 transmits an account registration deletion request to the server device (S306), and a response that is a registration deletion response is transmitted by the server device 2 that has received the registration deletion request (S307).
The communication device 30 receives the response from the server device 2 and automatically terminates the application (S308).

  In this way, information indicating that the authentication function of the server device is invalid and the operation status information of the application are notified together, and the operation of the application is controlled, so that communication can be performed without depending on the direct operation of the user. The security of the device can be ensured, and the unauthorized access can be prevented promptly.

  It can be used for communication devices such as IP telephones using SIP and telephone applications using software.

  DESCRIPTION OF SYMBOLS 1 ... Communication network, 2 ... Server apparatus, 3 ... Manager, 10, 20, 30 ... Communication apparatus, 110 ... Network interface, 120 ... Authentication request transmission part, 130 ... Response reception part, 140 ... Determination part, 150 ... Digest Authentication response transmission unit, 160, 260, 360... Authentication status notification unit, 370... Application control unit.

Claims (5)

An authentication request transmitter for transmitting an authentication request to a server device connected to a communication network;
A response receiving unit that receives a response from the server device to the authentication request;
Before sharp Suponsu determination section whether the authentication completion response or a digest authentication request,
A digest authentication response transmitter for transmitting a response based on a digest authentication method to the server device when the response is a digest authentication request ;
And a authentication status notification section for notifying information about the authentication status before Symbol server device,
When the authentication status notification unit receives an authentication completion response without receiving a digest authentication request from the server device in response to the authentication request, normal authentication is performed as information on the authentication status in the server device. A communication device characterized by notifying information indicating that no communication has been performed . The communication device according to claim 1,
The communication apparatus characterized in that the authentication status notification unit sends information related to the authentication status to the server apparatus to the communication network. The communication apparatus according to claim 1, further comprising an application control unit that controls operation of an application based on information related to an authentication status notified by the authentication status notification unit. A control method of a communication device that transmits a request to a server device connected to a communication network and receives a response according to the request,
Transmitting an authentication request to the server device;
Receiving a response from the server device to the authentication request ;
Determining whether the received response is a digest authentication request or an authentication completion response ;
When the response is a digest authentication request, transmitting a response based on a digest authentication method to the server device ;
Informing the information indicating that normal authentication is not performed when receiving an authentication completion response without receiving a digest authentication request from the server device in response to the authentication request, Communication device authentication notification method. 5. A communication device authentication notification program for causing a computer to execute the communication device authentication notification method according to claim 4.

Images