JP7087515B2 - Authentication system, authentication method and program - Google Patents

Description

The present invention relates to an authentication system, an authentication method and a program.

Change connection information such as SSID (Service Set Identifier) / PSK (Pre Shared Key) of a wireless LAN access point that mediates wireless LAN (Local Area Network) communication of a communication terminal, triggered by the passage of time or an administrator's operation. Therefore, a technique for forcibly disconnecting the network to which the communication terminal is connected is known.

Further, there is known a technique of automatically disconnecting a network to which a communication terminal is connected after a certain period of time elapses by including an expiration date in authentication information such as a Wi-Fi profile that can be installed on the communication terminal. By using such a technique, it is possible to realize a timed network system in which a communication terminal can be connected to a network only for a limited time.

For example, in Patent Document 1, when the authentication information is changed in the authentication server, when the wireless LAN terminal connects using the existing authentication information, the wireless LAN terminal acquires the new authentication information from the authentication server and uses the new authentication information. By performing the authentication process again, the content of automatically updating the authentication information is disclosed.

However, in the case of the above method, it is necessary to instruct the change of the authentication information from an external application, and it is necessary to install a dedicated application also on the wireless LAN terminal (for example, a communication terminal). Therefore, there is a problem that it is difficult to connect and disconnect the intended network without depending on the functions of the communication terminal and the intermediary device that mediates the communication of the communication terminal.

The authentication system according to the present invention is an authentication system that performs authentication processing of a communication terminal via a network, and is an acquisition means for acquiring authentication information used for the authentication processing transmitted by an intermediary device that mediates communication of the communication terminal. And, whether or not the storage means for storing the authentication information whose availability is changed according to a predetermined condition including the condition regarding the time zone in which the authentication information can be used and the authentication information that can be used for the storage means exist. Or, when it is determined that the authentication information is valid at the current time and the acquired authentication information is present in the storage means and is valid at the current time. When the authentication result indicating the success of the authentication is transmitted so as to be received by the intermediary device and it is determined that the acquired authentication information does not exist in the storage means, or the acquired authentication information is sent to the storage means. It is provided with a transmission means for transmitting an authentication result indicating an authentication failure so that the intermediary device can receive the authentication result, which is present but is determined not to be valid at the current time.

According to the present invention, the intended network connection and disconnection can be performed without depending on the functions of the communication terminal and the intermediary device.

It is a figure which shows an example of the system configuration of the network system which concerns on 1st Embodiment. It is a figure which shows an example of the hardware composition of the computer which concerns on 1st Embodiment. It is a figure which shows an example of the functional structure of the network system which concerns on 1st Embodiment. It is a figure which shows an example of the terminal information management table which concerns on 1st Embodiment. It is a figure which shows an example of the authentication information management table which concerns on 1st Embodiment. It is a figure which shows an example of the time information management table which concerns on 1st Embodiment. It is a sequence diagram which shows an example of the registration process of the authentication information in the network system which concerns on 1st Embodiment. It is a sequence diagram which shows an example of the authentication process of the communication terminal in the network system which concerns on 1st Embodiment. It is a sequence diagram which shows an example of the re-authentication processing for the connected communication terminal in the network system which concerns on 1st Embodiment. It is a flowchart which shows an example of the update process of the authentication information management table in the authentication system which concerns on 1st Embodiment. It is a sequence diagram which shows an example of the re-authentication processing of the connected communication terminal in the network system which concerns on 1st Embodiment. It is a figure which shows an example of the time information management table which concerns on the modification of 1st Embodiment. It is a flowchart which shows an example of the update process of the authentication information management table in the authentication system which concerns on the modification of 1st Embodiment. It is a figure which shows an example of the authentication information management table which concerns on 2nd Embodiment. It is a sequence diagram which shows an example of the re-authentication processing for the connected communication terminal in the network system which concerns on 2nd Embodiment. It is a sequence diagram which shows an example of the re-authentication processing for the connected communication terminal in the network system which concerns on 3rd Embodiment.

Hereinafter, embodiments for carrying out the invention will be described with reference to the drawings. In the description of the drawings, the same elements are designated by the same reference numerals, and duplicate description will be omitted.

● First embodiment ●
● System Configuration FIG. 1 is a diagram showing an example of a system configuration of a network system according to the first embodiment. The network system 1 is a system capable of executing an intended network connection and disconnection without depending on the functions of a communication terminal and an intermediary device. The network system 1 realizes wireless LAN communication of the communication terminal 70 authenticated by the authentication system 5 via the wireless LAN access point 50.

The network system 1 includes an authentication server 10, a database server 30, a wireless LAN access point 50 (50a, 50b, hereinafter referred to as a wireless LAN access point 50 when it is not necessary to distinguish them), a communication terminal 70 (70a, 70aa). , 70b, hereinafter, when it is not necessary to distinguish, it is referred to as a communication terminal 70) and an administrator terminal 90.

The authentication server 10 and the database server 30 configure an authentication system 5 that executes an authentication process for the communication terminal 70 to connect to the wireless LAN access point 50. The authentication system 5 uses, for example, an authentication method based on WPA-EAP (Wi-Fi Protected Access --Extensible Authentication Protocol) / WPA2-EAP (Wi-Fi Protected Access 2-Extensible Authentication Protocol) (PEAP (Protected Extensible Authentication Protocol)). It is used to perform authentication processing of the communication terminal 70.

The authentication server 10 is a server device that performs authentication processing of the communication terminal 70. In response to the connection request from the communication terminal 70, the authentication server 10 inquires the database server 30 whether or not the authentication information used for the authentication process of the communication terminal 70 exists. The authentication server 10 is, for example, a RADIUS (Remote Authentication Dial-In User Service) server.

The database server 30 is a server device that manages authentication information used for authentication processing of the communication terminal 70. The database server 30 has a function as an application server. The database server 30 stores the authentication information used for the authentication process of the communication terminal 70 in the authentication information management table 300 in advance. The database server 30 is, for example, an LDAP (Lightweight Directory Access Protocol) server.

Although FIG. 1 describes a configuration in which the authentication server 10 and the database server 30 are provided as separate devices, the configuration is such that the functions of the authentication server 10 and the database server 30 are realized by one server device. You may. Further, FIG. 1 describes an example in which the EAP-PEAP method is used as the authentication method in the authentication system 5, but EAP-TTLS (Extensible Authentication Protocol --Tunneled Transport Layer Security), which also performs authentication processing using an ID and a password, will be described. A method or an EAP-TLS (Extensible Authentication Protocol-Transport Layer Security) method for authenticating using an electronic certificate may be used.

The wireless LAN access point 50a, the communication terminal 70a, and the communication terminal 70aa constitute a local network system 3a. Similarly, the wireless LAN access point 50b and the communication terminal 70b constitute a local network system 3b. Hereinafter, when it is not necessary to distinguish, the local network system 3 is used. The local network 3 is a network formed for each specific closed area such as a school classroom or a conference room.

The wireless LAN access point 50 is an access point for mediating the wireless LAN communication of the communication terminal 70. The wireless LAN access point 50 generates connection information for the communication terminal 70 to perform wireless LAN communication. The connection information is, for example, an SSID (Service Set Identifier), a password, an encryption key (encryption key), or the like.

Further, the wireless LAN access point 50 requests the authentication system 5 to authenticate the communication terminal 70. The wireless LAN access point 50 establishes a wireless LAN connection with the communication terminal 70 authenticated by the authentication system 5. The wireless LAN access point 50 may be, for example, a control device having a switching and a controller function. The wireless LAN access point 50 is an example of an intermediary device.

The communication terminal 70 performs wireless LAN communication with another communication terminal via the wireless LAN access point 50. The communication terminal 70 is, for example, a communication device such as a notebook PC (Personal Computer) or a smartphone. The communication terminal 70 includes an MFP (Multifunction Peripheral) printer having an image processing function, a PJ (Projector: projector), an IWB (Interactive White Board: a white board having an electronic blackboard function capable of mutual communication), and a digital device. For output devices such as signage, HUD (Head Up Display) devices, acoustic output devices such as speakers, industrial machines, image pickup devices, sound collectors, medical devices, network home appliances, mobile phones, tablet terminals, wearable PCs or desktop PCs, etc. There may be.

The number of communication terminals 70 constituting the local network system 3 is not limited to this. Further, the number of local network systems 3 included in the network system 1 is not limited to this.

The administrator terminal 90 is a terminal used by the administrator of the network system 1. The administrator terminal 90 sets or changes the authentication information managed by the database server 30, for example, based on the input operation of the administrator. The administrator terminal 90 may be connected to the network 2 in the same manner as the database server 30, or may be connected via the wireless LAN access point 50. The administrator terminal 90 is, for example, a communication device such as a notebook PC (Personal Computer). The administrator terminal 90 may be a mobile phone, a smartphone, a tablet terminal, a wearable PC, a desktop PC, or the like.

● Hardware Configuration Next, the hardware configuration of each device according to the first embodiment will be described. The hardware configuration of each device according to the first embodiment has a general computer configuration. Here, a general computer hardware configuration example will be described. In the hardware configuration of each device according to the embodiment, components may be added or deleted as necessary.

FIG. 2 is a diagram showing an example of the hardware configuration of the computer according to the first embodiment. The computer 1000 includes a CPU (Central Processing Unit) 1001, a ROM (Read Only Memory) 1002, a RAM (Random Access Memory) 1003, a storage 1004, a keyboard 1005, a display interface (I / F) 1006, and a media interface (I / F). It includes 1007, a network interface (I / F) 1008 and a bus 1009.

The CPU 1001 is an arithmetic unit that realizes each function of the computer 1000 by reading the program or data according to the present invention stored in the ROM 1002 or the storage 1004 onto the RAM 1003 and executing the processing. For example, the authentication system 5 realizes the authentication method according to the present invention by executing the program according to the present invention.

The ROM 1002 is a non-volatile memory that can hold a program or data even when the power is turned off. The ROM 1002 is composed of, for example, a flash ROM or the like. The ROM 1002 has applications such as SDK (Software Development Kit) and API (Application Programming Interface) installed, and it is possible to realize the functions of the computer 1000 or the network connection by using the installed applications.

The RAM 1003 is a volatile memory used as a work area or the like of the CPU 1001. The storage 1004 is, for example, a storage device such as an HDD (Hard Disk Drive) or an SSD (Solid State Drive). The storage 1004 stores, for example, an OS (Operation System), an application program, various data, and the like.

The keyboard 1005 is a kind of input means including a plurality of keys for inputting characters, numerical values, various instructions, and the like. The input means is not limited to the keyboard 1005, but may be, for example, a mouse, a touch panel, a voice input device, or the like. The display interface (I / F) 1006 controls the display of various information such as a cursor, a menu, a window, characters, or an image on the display 1006a such as an LCD (Liquid Crystal Display). The display 1006a may be a touch panel display provided with input means.

The media interface (I / F) 1007 controls reading or writing (storage) of data to a recording medium 1007a such as a USB (Universal Serial Bus) memory, a memory card, an optical disk, or a flash memory.

The network interface (I / F) 1008 is an interface for connecting a computer 1000 to a network and transmitting / receiving data to / from another computer, an electronic device, or the like. The network interface (I / F) 1008 is, for example, a communication interface such as a wired or wireless LAN (Local Area Network). The network interface (I / F) 1008 includes 3G (3rd Generation), LTE (Long Term Evolution), 4G (4rd Generation), 5G (5rd Generation), Zigbee (registered trademark), and BLE (Bluetooth (registered trademark)). It may be provided with a communication interface for Low Energy) and millimeter-wave wireless communication.

The bus 1009 is commonly connected to each of the above components and transmits an address signal, a data signal, various control signals, and the like. The CPU 1001, ROM 1002, RAM 1003, storage 1004, keyboard 1005, display interface (I / F) 1006, media interface (I / F) 1007 and network interface (I / F) are connected to each other via a bus 1009. ..

● Functional configuration FIG. 3 is a diagram showing an example of the functional configuration of the network system according to the first embodiment. The authentication server 10 shown in FIG. 3 includes a transmission / reception unit 11, an authentication processing unit 12, a timer processing unit 13, a storage / reading unit 14a, and a storage unit 14b.

The transmission / reception unit 11 is a function for exchanging data (packet information) with the wireless LAN access point 50 or the database server 30. The transmission / reception unit 11 receives, for example, an authentication request transmitted from the wireless LAN access point 50 via the network 2 requesting the authentication process of the communication terminal 70. Further, the transmission / reception unit 11 inquires to the database server 30 whether or not the authentication information included in the received authentication request information exists in the authentication information management table 300 described later. Further, the transmission / reception unit 11 transmits the authentication result by the authentication processing unit 12 to the wireless LAN access point 50. The transmission / reception unit 11 is realized by, for example, a program executed by the network interface (I / F) 1008 and the CPU 1001 shown in FIG. The transmission / reception unit 11 is an example of an acquisition means and a transmission means.

The authentication processing unit 12 is a function of executing the authentication processing of the communication terminal 70 based on the determination result of whether or not it exists in the authentication information management table 300 received from the database server 30. When the database server 30 receives the determination result that the authentication information included in the authentication request received by the transmission / reception unit 11 exists in the authentication information management table 300, the authentication processing unit 12 performs the authentication processing of the communication terminal 70. Run. Then, the authentication server 10 transmits the authentication result indicating the success of the authentication to the wireless LAN access point 50.

On the other hand, when the database server 30 receives the determination result that the authentication information included in the authentication request received by the transmission / reception unit 11 does not exist in the authentication information management table 300, the authentication processing unit 12 receives the determination result of the communication terminal 70. No authentication process is performed. Then, the authentication server 10 transmits an authentication result indicating an authentication failure to the wireless LAN access point 50. The authentication processing unit 12 is realized by, for example, a program executed by the CPU 1001 shown in FIG.

The timer processing unit 13 is a function of measuring the timing of inquiring the database server 30 whether or not the authentication information exists. The authentication server 10 transmits, for example, an authentication information confirmation request for collating the authentication information included in the terminal information management table 100 to the database server 30 at predetermined times measured by the timer processing unit 13. The timer processing unit 13 is realized by, for example, a program executed by the CPU 1001 shown in FIG.

The storage / reading unit 14a is a function of storing various data in the storage unit 14b and reading various data from the storage unit 14b. The storage / reading unit 14a and the storage unit 14b are realized by, for example, a program executed by the ROM 1002, the storage 1004, and the CPU 1001 shown in FIG. Further, the storage unit 14b stores the terminal information management table 100.

○ Terminal information management table Here, the terminal information management table 100 will be described with reference to FIG. FIG. 4 is a diagram showing an example of a terminal information management table according to the first embodiment. The terminal information management table 100 manages the terminal information and the authentication information of the communication terminal 70 authenticated by the authentication system 5.

The terminal information management table 100 stores the MAC (Media Access Controller) address, ID (identification), and password of the communication terminal 70 authenticated by the authentication system 5 in association with each other. The MAC address is an example of terminal information uniquely assigned to each terminal for identifying the communication terminal 70. The MAC address may be a serial number (serial number) or the like. The ID and password are examples of authentication information used in the authentication process of the communication terminal 70. The authentication information may be, for example, a user ID and password defined for each user, or may be a terminal ID and password defined for each communication terminal 70.

The authentication server 10 adds the terminal information of the communication terminal 70 for which the authentication process is successful to the terminal information management table 100. Further, the authentication server 10 may delete the terminal information of the communication terminal 70 whose authentication process has failed from the terminal information management table 100.

Returning to FIG. 3, the description of the functional configuration of the network system 1 will be continued. The database server 30 shown in FIG. 3 includes a transmission / reception unit 31, a timer processing unit 32, an authentication information management unit 33, a storage / reading unit 34a, a storage unit 34b, and an application unit 35.

The transmission / reception unit 31 is a function for exchanging data (packet information) with the authentication server 10. The transmission / reception unit 31 receives an authentication information confirmation request, which is an inquiry as to whether or not the authentication information exists in the authentication information management table 300, from the authentication server 10. Further, the transmission / reception unit 31 transmits the determination result of whether or not the authentication information included in the received authentication information confirmation request exists in the authentication information management table 300 to the authentication server 10. The transmission / reception unit 31 is realized by, for example, a program executed by the network interface (I / F) 1008 and the CPU 1001 shown in FIG.

The timer processing unit 32 is a function of measuring the connection time of the communication terminal 70 authenticated by the authentication server 10 to the wireless LAN access point 50. The timer processing unit 32 refers to the time information management table 350 stored in the storage unit 34b at predetermined time intervals, and determines whether or not the authentication information for which the valid time has elapsed exists. Further, when the timer processing unit 32 determines that the authentication information whose valid time has passed exists among the authentication information stored in the time information management table 350, the timer processing unit 32 outputs the determination result to the authentication information management unit 33. The timer processing unit 32 is realized by, for example, a program executed by the CPU 1001 shown in FIG.

The authentication information management unit 33 is a function of managing the authentication information management table 300 and the time information management table 350 stored in the storage unit 34b. The authentication information management unit 33 determines, for example, whether or not the authentication information included in the authentication information confirmation request transmitted from the authentication server 10 exists in the authentication information management table 300. Further, when the authentication information management unit 33 detects, for example, from the timer processing unit 32 that the authentication information whose valid time has passed exists, the authentication information management unit 33 deletes the corresponding authentication information from the authentication information management table 300. The authentication information management unit 33 is realized by, for example, a program executed by the CPU 1001 shown in FIG. The authentication information management unit 33 is an example of the determination means.

The storage / reading unit 34a is a function of storing various data in the storage unit 34b and reading various data from the storage unit 34b. The storage / reading unit 34a and the storage unit 34b are realized by, for example, a program executed by the ROM 1002, the storage 1004, and the CPU 1001 shown in FIG. The storage unit 34b is an example of a storage means. Further, the storage unit 34b stores the authentication information management table 300 and the time information management table 350.

-Authentication information management table Next, the authentication information management table 300 will be described with reference to FIG. FIG. 5 is a diagram showing an example of the authentication information management table according to the first embodiment. The authentication information management table 300 manages the authentication information of the network system 1. The authentication information management table 300 stores (associates and associates) an ID and a password for each data number (No.). The ID and password are examples of authentication information used in the authentication process of the communication terminal 70. The authentication information may be, for example, a user ID and password defined for each user, or may be a terminal ID and password defined for each communication terminal 70.

The authentication information included in the authentication information management table 30 is registered by the administrator of the network system 1 using the administrator terminal 90. For example, when the network system 1 has a predetermined usage time for each communication terminal 70 by a timetable or a reserved time, such as in a classroom or a conference room of a school, the administrator of the network system 1 uses the administrator terminal 90. Then, the authentication information required by the user's start time of use is registered in the authentication information management table 300.

When the authentication server 10 receives the authentication request of the communication terminal 70 transmitted from the wireless LAN access point 50, the authentication server 10 executes the authentication process using the authentication information management table 300 stored in the database server 30. When the authentication information included in the received authentication request exists in the authentication information management table 300, the authentication server 10 transmits an authentication result indicating successful authentication to the wireless LAN access point 50. On the other hand, when the authentication information included in the received authentication request does not exist in the authentication information management table 300, the authentication server 10 transmits an authentication result indicating an authentication failure to the wireless LAN access point 50.

○ Time information management table Next, the time information management table 350 will be described with reference to FIG. FIG. 6 is a diagram showing an example of a time information management table according to the first embodiment. The time information management table 350 manages time information regarding the time when the communication terminal 70 authenticated by the authentication system 5 is connected to the wireless LAN access point 50. The time information management table 350 stores (associates and associates) the connection start time of the communication terminal 70 and the valid time of the authentication information for each data number (No.). The data number (No.) of the time information management table 350 corresponds to the data number (No.) of the authentication information management table 300. The time information management table 350 stores the same data number (No.) as the authentication information management table 300 in association with the connection start time and valid time of the corresponding authentication information. The time information indicating the connection start time and the effective time included in the time information management table 350 is an example of a predetermined condition.

The "connection start time" is time information indicating the date and time when the communication terminal 70 is connected to the wireless LAN access point 50. When the database server 30 receives an authentication result indicating authentication success from the authentication server 10, the database server 30 stores the connection start time in association with the corresponding data number (NO.) In the time information management table 350.

The "valid time" is time information indicating the time during which the communication terminal 70 can be connected from the time when the communication terminal 70 is connected to the wireless LAN access point 50. The "valid time" is registered together with the registration of the authentication information in the authentication information management table 300 by the administrator terminal 90. The authentication information management unit 33 deletes the authentication information contained in the time information management table 350 for which the valid time has passed from the authentication information management table 300. The authentication information (ID and password) included in the authentication information management table 300 is an example of authentication information whose availability is changed according to a predetermined condition.

In the time information management table 350, for example, the connection start time of the communication terminal 70 connected by using the authentication information of the data number No. 1 is "2017/01/01 10:00:00", and the effective time is It is "60 min". Further, the connection start time of the communication terminal 70 connected by using the authentication information of the data number No. 2 is "2017/01/01 10:10:30", and the effective time is "90 min".

The "connection start time" is not limited to the date and time when the communication terminal 70 is connected to the wireless LAN access point 50, and may be the date and time when the communication terminal 70 is authenticated by the authentication server 10. Further, the authentication information management table 300 and the time information management table 350 may be configured as one table.

Returning to FIG. 5, the description of the functional configuration of the network system 1 will be continued. The application unit 35 is a function as an application server that executes a predetermined application. The application unit 35 accepts an operation for setting or changing the authentication information management table 300 and the time information management table 350 from the outside. The application unit 35 receives, for example, a request for registration of authentication information from the administrator terminal 90. Further, the application unit 35 receives, for example, a disconnection request for the communication terminal 70 from the administrator terminal 90. The application unit 35 is realized by, for example, a program executed by the CPU 1001 shown in FIG.

Subsequently, the functional configuration of the administrator terminal 90 will be described. The functions realized by the administrator terminal 90 shown in FIG. 5 include an application unit 91, a reception unit 92, and a display control unit 93.

The application unit 91 is a function for setting or changing various information stored in the database server 30. The application unit 91 receives, for example, a setting or change operation of the authentication information management table 300 or the time information management table 350 via the operation screen on the WEB browser displayed on the display 1006a of the administrator terminal 90. Further, the application unit 91 accepts a setting or changing operation of the authentication information management table 300 or the time information management table 350 by, for example, executing a predetermined application having an API. The application unit 91 is realized by, for example, a program executed by the CPU 1001 shown in FIG.

The reception unit 92 is a function of receiving input from the administrator by using an input means such as the keyboard 1005 shown in FIG. The reception unit 92 receives a registration request for authentication information input by using an input means such as a keyboard 1005. Further, the reception unit 92 receives an update request for the time information management table 350, which is input by using an input means such as a keyboard 1005. The reception unit 92 is realized by a program or the like executed by the CPU 1001 shown in FIG.

The display control unit 93 is a function of displaying an operation screen or the like for accepting an input operation by an administrator on the display 1006a shown in FIG. The display control unit 93 displays, for example, a Web page created by HTML (HyperText Markup Language) or the like on the display 1006a using a WEB browser. The display control unit 93 is realized by, for example, a program executed by the display interface (I / F) 1006 and the CPU 1001 shown in FIG.

The authentication system 5 may be configured to communicate with a plurality of local networks 3.

● Authentication process of communication terminal ○ Registration process of authentication information Next, the authentication process of the communication terminal 70 in the network system according to the first embodiment will be described. FIG. 7 is a sequence diagram showing an example of authentication information registration processing in the network system according to the first embodiment. FIG. 7 describes an example of registering authentication information in the database server 30 by using the administrator terminal 90 used by the administrator of the network system 1. For example, when the network system 1 has a predetermined usage time according to a timetable, a reserved time, or the like, such as in a school classroom or a conference room, the administrator of the network system 1 uses the administrator terminal 90 to use the user. The authentication information required by the start time of use of is registered in the database server 30.

In step S101, the reception unit 92 of the administrator terminal 90 receives a request for registration of authentication information by the administrator of the network system 1. In step S102, the application unit 91 of the administrator terminal 90 outputs a registration request for authentication information output from the reception unit 92.

In step S103, the application unit 91 of the administrator terminal 90 transmits a registration request for authentication information to the database server 30. In step S104, the application unit 35 of the database server 30 outputs the received authentication information to the authentication information management unit 33.

In step S105, the authentication information management unit 33 of the database server 30 registers the output authentication information in the authentication information management table 300 stored in the storage unit 34b. As a result, the network system 1 can make the database server 30 register the authentication information used for the authentication process of the communication terminal 70.

-Authentication processing of the communication terminal Next, the authentication processing of the communication terminal 70 will be described. FIG. 8 is a sequence diagram showing an example of authentication processing of a communication terminal in the network system according to the first embodiment. FIG. 8 describes the authentication process of the communication terminal 70 when the authentication method by WPA-EAP / WPA2-EAP (PPEP) is used. Note that FIG. 8 describes the authentication information transmitted from the communication terminal 70 as being registered in the authentication information management table 300 in advance. In FIG. 8, the authentication information transmitted from the communication terminal 70 is the data number No. of the authentication information management table 300 shown in FIG. It is assumed to be 1 (ID "id_001" and password "abcd").

In step S201, the communication terminal 70 transmits a connection request for wireless LAN communication to the wireless LAN access point 50. Specifically, when the communication terminal 70 receives the connection request by the input operation of the user, the communication terminal 70 specifies the SSID of the wireless LAN access point 50 to be connected and transmits the connection request. In step S202, the wireless LAN access point 50 transmits information indicating the authentication method to the communication terminal 70. For example, when the wireless LAN access point 50 uses the authentication method by WPA-EAP / WPA2-EAP (PPEP), the wireless LAN access point 50 transmits information indicating the authentication method to the communication terminal 70.

In step S203, the communication terminal 70 transmits the authentication information received by the user's input operation to the wireless LAN access point 50. The communication terminal 70 may store authentication information in advance, and may be configured to transmit the stored authentication information by using a user input operation as a trigger.

In step S204, the wireless LAN access point 50 transmits the received authentication information to the authentication server 10 (an example of the acquisition step). In step S205, when the transmission / reception unit 11 of the authentication server 10 receives the authentication information transmitted from the wireless LAN access point 50, whether or not the received authentication information exists in the authentication information management table 300 to the database server 30. Send the authentication information confirmation request that is the inquiry of. The authentication information confirmation request includes the authentication information transmitted from the wireless LAN access point 50. In step S206, the transmission / reception unit 31 of the database server 30 outputs the received authentication information confirmation request to the authentication information management unit 33.

In step S207, when the authentication information management unit 33 detects the authentication information confirmation request, the authentication information management table 300 stored in the storage unit 34b is read out. Specifically, the authentication information management unit 33 outputs a read request of the authentication information management table 300 to the storage / reading unit 34a. Then, when the storage / reading unit 34a detects the output reading request, the storage / reading unit 34a reads out the authentication information management table 300 stored in the storage unit 34b.

In step S208, the storage unit 34b outputs the authentication information management table 300 to the authentication information management unit 33. Specifically, the storage unit 34b outputs the authentication information management table 300 to the storage / reading unit 34a. Then, the storage / reading unit 34a outputs the output authentication information management table 300 to the authentication information management unit 33.

In step S209, the authentication information management unit 33 determines whether or not the authentication information included in the authentication information confirmation request exists in the authentication information management table 300 (an example of the determination step). In this case, since the authentication information ID "id_001" and the password "abcd" are included in the authentication information management table 300 shown in FIG. 5, the authentication information management unit 33 determines that the authentication information exists.

In step S210, the authentication information management unit 33 outputs the determination result that the authentication information included in the authentication information confirmation request exists to the transmission / reception unit 31. In step S211 the transmission / reception unit 31 of the database server 30 transmits the output determination result to the authentication server 10. In step S212, the transmission / reception unit 11 of the authentication server 10 outputs the received determination result to the authentication processing unit 12.

In step S213, the authentication processing unit 12 executes the authentication processing of the communication terminal 70 based on the output determination result. In this case, since the output determination result is the determination result that the authentication information included in the authentication information confirmation request exists, the authentication processing unit 12 executes the authentication process for the communication terminal 70 that has sent the connection request. .. In step S214, the authentication processing unit 12 outputs an authentication result indicating successful authentication to the transmission / reception unit 11.

In step S215, the transmission / reception unit 11 of the authentication server 10 transmits the output authentication result to the database server 30. In this case, the authentication result to be transmitted includes the time information of the connection start time indicating the time when the communication terminal 70 is connected to the wireless LAN access point 50. The time information included in the authentication result is not limited to the time when the communication terminal 70 is connected to the wireless LAN access point 50, and may be the time when the authentication process is performed by the authentication server 10. In step S216, the transmission / reception unit 31 of the database server 30 outputs the received authentication result to the authentication information management unit 33.

In step S217, the authentication information management unit 33 registers the time information included in the output authentication result in the time information management table 350 stored in the storage unit 34b. Specifically, the authentication information management unit 33 associates the connection start time, which indicates the time when the communication terminal 70 is connected to the wireless LAN access point 50, with the authentication information used in the authentication process of the communication terminal 70 (correspondence). Attach and link) and register in the time information management table 350. Further, in step S218, the authentication processing unit 12 registers the terminal information and the authentication information of the communication terminal 70 for which the authentication processing is successful in the terminal information management table 100 stored in the storage unit 14b.

Here, in the process of step S218, the terminal information management table 100 may be configured to also store the time information of the connection start time of the communication terminal 70. In this case, the authentication server 10 may transmit an authentication result including time information at predetermined times measured by the timer processing unit 13. The network system 1 can reduce the communication frequency and the communication cost as compared with the configuration in which the communication terminal 70 transmits the authentication result each time the authentication server 10 authenticates.

Further, the authentication server 10 may transmit an authentication result including time information to the database server 30 according to a condition such as the amount of data stored in the terminal information management table 100 exceeds a predetermined threshold value. .. In this case, the network system 1 can reduce the communication frequency and the communication cost as compared with the configuration in which the authentication result is transmitted regardless of the amount of data stored in the terminal information management table 100.

In step S219, the transmission / reception unit 11 of the authentication server 10 transmits the authentication result output from the authentication processing unit 12 indicating the success of authentication to the wireless LAN access point 50 (an example of the transmission step). In step S220, when the wireless LAN access point 50 receives the authentication result indicating the successful authentication transmitted from the authentication server 10, the wireless LAN access point 50 transmits an encryption key for connecting to the wireless LAN access point 50 to the communication terminal 70. do. The encryption key for connecting to the wireless LAN access point 50 is, for example, a wireless LAN encryption key (encryption key).

The order of the processes of steps S214 to S217, the process of step S218, and the processes of steps S219 to S220 may be changed back and forth, or may be performed in parallel.

○ Re-authentication processing of the communication terminal Next, in the processing shown in FIG. 8, the re-authentication processing of the communication terminal 70 connected to the wireless LAN access point 50 will be described with reference to FIGS. 9 to 11. FIG. 9 is a sequence diagram showing an example of a re-authentication process for a connected communication terminal in the network system according to the first embodiment. FIG. 9 describes a re-authentication process of the communication terminal 70 authenticated by using the authentication information of the ID “id_001” and the password “abcd” in the process shown in FIG.

In step S301, the wireless LAN access point 50 transmits a re-authentication request for the communication terminal 70 to the authentication server 10 (an example of the acquisition step). The re-authentication request transmitted by the wireless LAN access point 50 includes the authentication information used for the authentication process of the communication terminal 70. The information included in the re-authentication request may be, for example, the same as the authentication request in the process of step S204 of FIG. 7. The wireless LAN access point 50 periodically transmits a re-authentication request of the connected communication terminal 70 to the authentication server 10.

In step S302, when the transmission / reception unit 11 of the authentication server 10 receives the re-authentication request transmitted from the wireless LAN access point 50, whether or not the authentication information exists in the authentication information management table 300 to the database server 30. Send the authentication information confirmation request that is the inquiry. In step S303, the transmission / reception unit 31 of the database server 30 outputs the received authentication information confirmation request to the authentication information management unit 33.

In step S304, when the authentication information management unit 33 detects the authentication information confirmation request, the authentication information management table 300 stored in the storage unit 34b is read out. Specifically, the authentication information management unit 33 outputs a read request of the authentication information management table 300 to the storage / reading unit 34a. Then, when the storage / reading unit 34a detects the output reading request, the storage / reading unit 34a reads out the authentication information management table 300 stored in the storage unit 34b.

In step S305, the storage unit 34b outputs the authentication information management table 300 to the authentication information management unit 33. Specifically, the storage unit 34b outputs the authentication information management table 300 to the storage / reading unit 34a. Then, the storage / reading unit 34a outputs the output authentication information management table 300 to the authentication information management unit 33.

In step S306, the authentication information management unit 33 determines whether or not the authentication information included in the authentication information confirmation request exists in the authentication information management table 300 (an example of the determination step). In this case, since the authentication information ID "id_001" and the password "abcd" are included in the authentication information management table 300 shown in FIG. 5, the authentication information management unit 33 determines that the authentication information exists.

In step S307, the authentication information management unit 33 outputs the determination result that the authentication information included in the authentication information confirmation request exists to the transmission / reception unit 31. In step S308, the transmission / reception unit 31 of the database server 30 transmits the output determination result to the authentication server 10. In step S309, the transmission / reception unit 11 of the authentication server 10 outputs the received determination result to the authentication processing unit 12.

In step S310, the authentication processing unit 12 executes the authentication processing of the communication terminal 70 based on the output determination result. In this case, since the output determination result is the determination result that the authentication information included in the authentication information confirmation request exists, the authentication processing unit 12 executes the authentication process for the communication terminal 70 that has sent the connection request. .. In step S311, the authentication processing unit 12 outputs an authentication result indicating successful authentication to the transmission / reception unit 11. In step S312, the transmission / reception unit 11 of the authentication server 10 transmits an authentication result indicating successful authentication to the database server 30. The network system 1 periodically transmits a re-authentication request from the wireless LAN access point 50 to repeatedly execute the re-authentication process of the communication terminal 70 shown in FIG.

Next, a process of deleting the authentication information stored in the authentication information management table 300 will be described. FIG. 10 is a flowchart showing an example of the update process of the authentication information management table in the authentication system according to the first embodiment. FIG. 10 shows the data number No. in the authentication information management table 300 shown in FIG. An example in which the authentication information (ID "id001" and password "abcd") associated with 1 is deleted will be described.

In step S401, the timer processing unit 32 of the database server 30 shifts the processing to step S402 when the authentication information for which a predetermined time has elapsed from the connection start time included in the time information management table 350 exists. For example, when 60 minutes, which is an effective time, has elapsed from the connection start time of the data number No. 1 included in the time information management table 350, the timer processing unit 32 shifts the processing to step S402. On the other hand, the timer processing unit 32 repeats the process of step S401 when there is no authentication information for which a predetermined time has elapsed from the connection start time included in the time information management table 350.

In step S402, the timer processing unit 32 outputs a deletion request for the corresponding authentication information to the authentication information management unit 33. In this case, the timer processing unit 32 has the data number No. 1 included in the authentication information management table 300. The request for deleting the authentication information of 1 is output to the authentication information management unit 33. In step S403, the authentication information management unit 33 deletes the authentication information corresponding to the output deletion request from the authentication information management table 300 stored in the storage unit 34b.

In step S404, the storage unit 34b updates the authentication information management table 300 and the time information management table 350 when the authentication information is deleted by the authentication information management unit 33. Specifically, the storage unit 34b has the same data number No. as the authentication information deleted from the authentication information management table 300. The time information associated with 1 is deleted from the time information management table 350. When the authentication information and the time information are deleted, the storage unit 34b may be configured to move up the data numbers (No.) of the authentication information management table 300 and the time information management table 350. As a result, the database server 30 can delete the authentication information whose valid time has passed, which is included in the authentication information management table 300, at any time.

Subsequently, by the process shown in FIG. 10, the data number No. 1 is obtained from the authentication information management table 300. The re-authentication process of the communication terminal 70 when the authentication information (ID "id_001", password "abcd") of 1 is deleted will be described. FIG. 11 is a sequence diagram showing an example of re-authentication processing of the connected communication terminal in the network system according to the first embodiment. Note that the process shown in FIG. 11 is a re-authentication process of the communication terminal 70 connected by using the authentication information of the ID “id_001” and the password “abcd”, similarly to the process shown in FIG. Further, since the processing of steps S501 to S505 is the same as the processing of steps S301 to S305 shown in FIG. 9, the description thereof will be omitted.

In step S506, the authentication information management unit 33 determines whether or not the authentication information included in the authentication information confirmation request exists in the authentication information management table 300 (an example of the determination step). In the process shown in FIG. 10, the data number No. of the authentication information management table 300 shown in FIG. 5 is shown. The authentication information of 1 has been deleted. That is, the authentication information (ID "id_001" and password "abcd") included in the authentication information confirmation request does not exist in the authentication information management table 300. Therefore, the authentication information management unit 33 outputs the determination result that the authentication information included in the authentication information confirmation request does not exist to the transmission / reception unit 31.

In step S508, the transmission / reception unit 31 of the database server 30 transmits the output determination result to the authentication server 10. In step S509, the transmission / reception unit 11 of the authentication server 10 outputs the received determination result to the authentication processing unit 12. In step S510, the authentication processing unit 12 executes the authentication processing of the communication terminal 70 based on the output determination result. In this case, since the determination result in the database server 30 is the determination result that the authentication information included in the authentication information confirmation request does not exist, the authentication processing unit 12 does not perform the authentication processing of the communication terminal 70.

In step S511, the authentication processing unit 12 outputs an authentication result indicating an authentication failure to the transmission / reception unit 11. In step S512, the transmission / reception unit 11 of the authentication server 10 transmits the output authentication result indicating the authentication failure to the wireless LAN access point 50 (an example of the transmission step).

In step S513, the communication terminal 70 performs arbitrary communication with the wireless LAN access point 50. In step S514, the wireless LAN access point 50 transmits an error message (Packet of Disconnect) indicating a connection error as a response to arbitrary communication from the communication terminal 70.

As a result, the network system 1 performs the wireless LAN communication of the communication terminal 70 connected to the wireless LAN access point 50 by using the authentication information deleted from the authentication information management table 300, and the communication terminal 70 and the wireless LAN access point 50. It can be disconnected intentionally regardless of the function. When the wireless LAN access point 50 receives the authentication result indicating the authentication failure from the authentication server 10, the wireless LAN access point 50 may immediately send an error message to the communication terminal 70.

● Effects of the First Embodiment As described above, the network system according to the first embodiment stores the authentication server 10 that performs the authentication process of the communication terminal 70 and the authentication information used for the authentication process of the communication terminal 70. It has an authentication system 5 including a database server 30 to be used. When the authentication system 5 acquires the authentication information from the communication terminal 70, the authentication system 5 determines whether or not the authentication information exists in the database server 30. Then, when it is determined that the acquired authentication information does not exist in the database server 30, the authentication system 5 transmits an authentication result indicating successful authentication to the wireless LAN access point 50, and the acquired authentication information is the database server 30. If it is determined that it does not exist in, the authentication result indicating the authentication failure is transmitted to the wireless LAN access point 50.

Further, the authentication system 5 deletes the authentication information stored in the database server 30 when a predetermined time has elapsed since the communication terminal 70 was connected to the wireless LAN access point 50. Therefore, the network system 1 does not require a dedicated application for the communication terminal 70 or the wireless LAN access point 50, and can execute the intended connection and disconnection of the communication terminal 70.

● Modification example of the first embodiment ●
Next, the network system according to the modified example of the first embodiment will be described. The same configurations and the same functions as those of the first embodiment are designated by the same reference numerals, and the description thereof will be omitted. The network system 1a according to the modification of the first embodiment includes information indicating the validity of the authentication information for each time zone in the time information management table 350a. As a result, the network system 1a can connect and disconnect the communication terminal 70 and the wireless LAN access point 50 without deleting the authentication information based on the valid time by referring to the validity of the authentication information at the current time. It can be carried out.

FIG. 12 is a diagram showing an example of a time information management table according to the first modification of the first embodiment. The time information management table 350a manages time information regarding a time zone in which the authentication information can be used. The time information management table 350a manages information indicating the validity of the authentication information for each time zone. The data number (No.) included in the time information management table 350a corresponds to the data number (No.) of the authentication information management table 300, similarly to the time information management table 350 shown in FIG. The time information management table 350a stores the same data number (No.) as the authentication information management table 300 in association with the validity of the corresponding authentication information for each time zone. The time zone and the time information indicating the effectiveness included in the time information management table 350a are examples of predetermined conditions.

The time information management table 350a corresponds to the timetable, assuming that the local network system 3 is used in the classroom of the school, for example. Data number No. The authentication information of 1 becomes valid when the current time becomes the start time (9:00), and the network system 1a has the first period (9:00 to 10:30) and the second period (10:30). ~ 12:10), the data number No. The connection between the communication terminal 70 authenticated using the authentication information of 1 and the wireless LAN access point 50 is maintained. In addition, the data number No. The authentication information of 1 becomes invalid when the current time is in the time zone of lunch break (12:10 to 13:00). Then, the network system 1a has the data number No. The connection between the communication terminal 70 using the authentication information of 1 and the wireless LAN access point 50 is disconnected.

Next, the data number No. The authentication information of 1 becomes valid when the current time reaches the start time of the third period (13:00 to 14:30). Then, the network system 1a has the data number No. The communication terminal 70 authenticated using the authentication information of 1 is connected to the wireless LAN access point 50. Finally, the data number No. The authentication information of 1 becomes invalid when the end time of the fourth period (14:30 to 16:00) of the current time has elapsed. Then, the network system 1a has the data number No. The connection between the communication terminal 70 authenticated using the authentication information of 1 and the wireless LAN access point 50 is disconnected, and the lesson of the day is completed.

On the other hand, for example, the data number No. The authentication information of 2 will continue to be valid during the daytime hours (9:00 to 16:00) when classes are held. In this case, the network system 1a has the data number No. 1 only during the daytime. It is also possible to configure the communication terminal 70 authenticated using the authentication information of 2 to be connected to the wireless LAN access point 50. In this way, the network system 1a can set the validity of the authentication information according to, for example, the school timetable.

The validity of the authentication information for each time zone included in the time information management table 350a shown in FIG. 12 is an example, and depends on the installation location of the local network system 3, the type of the communication terminal 70, the operation method of the system, and the like. Can be set or changed as appropriate. In this case, the network system 1a sets or changes the time information management table 350a on the administrator terminal 90.

FIG. 13 is a flowchart showing an example of the update processing of the authentication information management table in the authentication system according to the modified example of the first embodiment. In step S601, when the database server 30 receives the authentication information confirmation request by the transmission / reception unit 31, the database server 30 shifts the process to step S602. On the other hand, if the database server 30 has not received the authentication information confirmation request by the transmission / reception unit 31, the database server 30 repeats the process of step S601.

In step S602, the authentication information management unit 33 of the database server 30 reads out the authentication information management table 300 and the time information management table 350a. Specifically, the authentication information management unit 33 outputs a read request for the authentication information management table 300 and the time information management table 350a to the storage / reading unit 34a. When the storage / reading unit 34a detects the output read request, the storage / reading unit 34a reads out the authentication information management table 300 and the time information management table 350a stored in the storage unit 34b. Then, the storage unit 34b outputs the authentication information management table 300 and the time information management table 350a to the storage / reading unit 34a. The storage / reading unit 34a outputs the output authentication information management table 300 and time information management table 350a to the authentication information management unit 33.

In step S603, the authentication information management unit 33 of the database server 30 shifts the process to step S604 when the authentication information included in the received authentication information confirmation request exists in the read authentication information management table 300. On the other hand, the authentication information management unit 33 shifts the process to step S606 when the authentication information included in the received authentication information confirmation request does not exist in the read authentication information management table 300.

In step S604, if the authentication information included in the received authentication information confirmation request is valid at the current time measured by the timer processing unit 32, the authentication information management unit 33 of the database server 30 processes the process to step S605. Migrate. On the other hand, if the authentication information included in the received authentication information confirmation request is invalid at the current time measured by the timer processing unit 32, the authentication information management unit 33 shifts the processing to step S606.

In step S605, the transmission / reception unit 31 of the database server 30 transmits the determination result that the authentication information is valid to the authentication server 10. In step S606, the transmission / reception unit 31 of the database server 30 transmits the determination result that the authentication information does not exist to the authentication server 10.

By the above processing, the network system 1a does not delete the authentication information based on the valid time, but connects and disconnects the communication terminal 70 and the wireless LAN access point 50 based on the validity of the authentication information at the current time. be able to.

● Second embodiment ●
Next, the network system according to the second embodiment will be described. The same configurations and the same functions as those of the first embodiment are designated by the same reference numerals, and the description thereof will be omitted. The network system 1b according to the second embodiment deletes the authentication information by operating the database server 30 by using the administrator terminal 90 used by the system administrator. In the network system 1b, the database server 30 deletes the corresponding authentication information in response to the disconnection request between the communication terminal 70 and the wireless LAN access point 50 received from the administrator terminal 90. As a result, the network system 1b can disconnect the connection with the communication terminal 70 at an arbitrary timing by deleting the authentication information from the database server 30 regardless of the passage of time.

FIG. 14 is a diagram showing an example of the authentication information management table according to the second embodiment. In the authentication information management table 300a, in addition to the data included in the authentication information management table 300 shown in FIG. 5, a MAC address is associated with each data number (No.). The MAC address included in the authentication information management table 300a is an example of terminal information uniquely assigned to each terminal for identifying the communication terminal 70. The MAC address may be a serial number (serial number) or the like. Thereby, the database server 30 can confirm the combination of the authentication information and the communication terminal 70 for which the authentication process is performed using the authentication information by referring to the authentication information management table 300a. The terminal information may be transmitted from the authentication server 10 when the authentication process of the communication terminal 70 is performed, or may be registered by the administrator terminal 90 together with the authentication information.

FIG. 15 is a sequence diagram showing an example of a re-authentication process for a connected communication terminal in the network system according to the second embodiment. The process shown in FIG. 15 is a re-authentication process of the communication terminal 70 connected by using the authentication information having the ID “id_001” and the password “abcd”, similarly to the process shown in FIG. Further, FIG. 15 describes a case where a disconnection request of the communication terminal 70 connected by using the authentication information having the ID “id_001” and the password “abcd” is transmitted from the administrator terminal 90.

In step S701, the administrator terminal 90 transmits a disconnection request for the communication terminal 70 to the database server 30. Specifically, the application unit 91 of the administrator terminal 90 executes a predetermined application provided by the database server 30. Then, the application unit 91 transmits the disconnection request received by the reception unit 92 to the database server 30. The disconnection request includes terminal information for identifying the communication terminal 70, such as a MAC address.

In step S702, the application unit 35 of the database server 30 outputs the received disconnection request of the communication terminal 70 to the authentication information management unit 33. In step S703, the authentication information management unit 33 deletes the authentication information associated with the terminal information of the communication terminal 70 corresponding to the output disconnection request from the data of the authentication information management table 300a stored in the storage unit 34b. .. The fact that the database server 30 receives the disconnection request transmitted from the administrator terminal 90 is an example of a predetermined condition.

Since the processing of steps S704 to S717 is the same as the processing of steps S501 to S514 shown in FIG. 11, the description thereof will be omitted. By the process shown in FIG. 15, the wireless LAN access point 50 transmits an error message (Packet of Disconnect) indicating a connection error to the communication terminal 70.

● Effects of the Second Embodiment As described above, in the network system according to the second embodiment, the database server 30 requests disconnection between the communication terminal 70 and the wireless LAN access point 50 received from the administrator terminal 90. The corresponding authentication information is deleted from the authentication information management table 300 according to the above. Therefore, the network system 1b has access to the communication terminal 70 and the wireless LAN by the administrator deleting the authentication information at an arbitrary timing regardless of the passage of time since the communication terminal 70 is connected to the wireless LAN access point 50. The connection with the point 50 can be disconnected.

● Third embodiment ●
Next, the network system according to the third embodiment will be described. The same configurations and the same functions as those of the first embodiment and the second embodiment are designated by the same reference numerals, and the description thereof will be omitted. In the network system 1c according to the third embodiment, the authentication server 10 periodically inquires of the database server 30 for authentication information. In this case, the network system 1c does not require a re-authentication request from the wireless LAN access point 50.

FIG. 16 is a sequence diagram showing an example of a re-authentication process for a connected communication terminal in the network system according to the third embodiment. Since the processing of steps S801 to S803 is the same as the processing of steps S701 to S703 shown in FIG. 15, the description thereof will be omitted. In the processes of steps S801 to S803, as shown in the first embodiment, the authentication information is deleted when a predetermined time has elapsed from the time when the communication terminal 70 is connected to the wireless LAN access point 50. It may be configured.

In step S804, the transmission / reception unit 11 of the authentication server 10 transmits an authentication information confirmation request to the database server 30 at predetermined times measured by the timer processing unit 13.

Since the processing of steps S805 to S816 is the same as the processing of steps S503 to S514 shown in FIG. 11, the description thereof will be omitted. By the process shown in FIG. 16, the wireless LAN access point 50 transmits an error message (Packet of Disconnect) indicating a connection error to the communication terminal 70.

● Effect of the Third Embodiment As described above, in the network system according to the third embodiment, the authentication server 10 periodically sends an authentication information confirmation request to the database server 30. Then, the authentication server 10 transmits an error message to the wireless LAN access point when the requested authentication information does not exist in the authentication information management table 300 stored in the database server 30. As a result, the network system 1c detects the deletion or invalidation of the authentication information even when the wireless LAN access point 50 does not have the function of transmitting the re-authentication request to the authentication server 10, and wirelessly communicates with the communication terminal 70. The connection with the LAN access point 50 can be disconnected.

● Summary ●
As described above, the authentication system according to the embodiment of the present invention is the authentication system 5 that performs the authentication process of the communication terminal 70 via the network, and communicates the authentication information used for the authentication process of the communication terminal 70. Obtained from a wireless LAN access point 50 (an example of an intermediary device) connected to a terminal. Further, the authentication system 5 has a storage unit 14b (an example of storage means) for storing authentication information whose availability is changed according to a predetermined condition, and whether or not the storage unit 14b has usable authentication information. It is provided with an authentication information management unit 33 (an example of a determination means) for determining. Then, when the authentication system 5 determines that the acquired authentication information exists in the storage unit 14b, the authentication system 5 transmits an authentication result indicating successful authentication to the wireless LAN access point 50, and the acquired authentication information is transmitted to the storage unit 14b. If it is determined that it does not exist, the authentication result indicating the authentication failure is transmitted to the wireless LAN access point 50. Therefore, the authentication system 5 can execute the intended network connection and disconnection without depending on the function of the communication terminal 70 or the wireless LAN access point 50.

Further, the authentication system according to the embodiment of the present invention stores time information (an example of the time information management table 350) regarding the time when the communication terminal 70 is connected to the wireless LAN access point 50 (an example of an intermediary device). When a predetermined time has elapsed since the communication terminal 70 was connected to the wireless LAN access point 50, the stored authentication information is deleted. Therefore, since the authentication system 5 can delete the authentication information used for the authentication process of the communication terminal 70 after a certain period of time, the connection between the communication terminal 70 and the wireless LAN access point 50 can be disconnected.

Further, the authentication system according to the embodiment of the present invention stores time information (an example of the time information management table 350a) regarding a time zone in which the authentication information can be used, and when the current time is not the time zone in which the authentication information can be used. It is determined that the acquired authentication information does not exist in the storage unit 14b (an example of the storage means). Therefore, the authentication system 5 can connect and disconnect the communication terminal 70 and the wireless LAN access point 50 based on the validity of the authentication information at the current time of the authentication information used for the authentication process of the communication terminal 70. ..

Further, the authentication system according to the embodiment of the present invention includes an authentication server 10 that executes the authentication process of the communication terminal 70, and a database server 30 that stores the authentication information used for the authentication process. A confirmation request as to whether or not the authentication information exists in the storage unit 14b (an example of the storage means) is transmitted to the database server 30, and the database server 30 has the authentication information included in the received confirmation request in the storage unit 14b. Judge whether or not. Therefore, the authentication system 5 can realize the connection and disconnection between the communication terminal 70 and the wireless LAN access point 50 by using the application of the database server 30 in which the authentication information is stored.

Further, in the authentication system according to the embodiment of the present invention, the authentication server 10 transmits a confirmation request for authentication information to the database server 30 at predetermined intervals. Therefore, the authentication system 5 detects the deletion or invalidation of the authentication information even when the wireless LAN access point 50 (an example of the intermediary device) does not have the function of transmitting the re-authentication request to the authentication server 10. The connection between the communication terminal 70 and the wireless LAN access point 50 can be disconnected.

Further, the authentication system according to the embodiment of the present invention stores a terminal information management table 100 (an example of time information) indicating the time when the communication terminal 70 authenticated by the authentication server 10 is connected to the wireless LAN access point 50. Then, the time information included in the terminal information management table 100 stored at predetermined intervals is transmitted to the database server 30, and the time information received by the database server 30 is stored in association with the authentication information. Therefore, the authentication system 5 can reduce the communication frequency and the communication cost as compared with the configuration in which the authentication result is transmitted each time the communication terminal 70 is connected to the wireless LAN access point 50.

Further, in the authentication system according to the embodiment of the present invention, the authentication server 10 uses a terminal information management table 100 (an example of time information) indicating the time when the authenticated communication terminal 70 is connected to the wireless LAN access point 50. When the stored terminal information management table 100 exceeds a predetermined amount of data, the time information included in the terminal information management table 100 is transmitted to the database server 30, and the database server 30 authenticates the received time information. Memorize in relation to information. Therefore, the authentication system 5 can reduce the communication frequency and the communication cost as compared with the configuration in which the authentication result is transmitted regardless of the amount of data stored in the terminal information management table 100.

Further, in the authentication system according to the embodiment of the present invention, when a request for disconnecting the connection of the communication terminal 70 to the wireless LAN access point 50 is received from the administrator terminal 90, the authentication information used for the authentication process of the communication terminal 70 is received. To delete. Therefore, in the authentication system 5, the wireless LAN access of the communication terminal 70 is performed by the administrator deleting the authentication information at an arbitrary timing regardless of the passage of time since the communication terminal 70 is connected to the wireless LAN access point 50. The connection to point 50 can be disconnected.

Further, the authentication method according to the embodiment of the present invention is an authentication method executed by the authentication system 5 that performs the authentication process of the communication terminal 70 via the network, and the authentication system 5 is used according to a predetermined condition. A storage unit 14b (an example of a storage means) for storing authentication information whose availability is changed is provided, and authentication information used for authentication processing is acquired from a wireless LAN access point 50 (an example of an intermediary device) connected to a communication terminal 70. The acquisition step, the determination step of determining whether or not the authentication information that can be used exists in the storage unit 14b, and the determination step that the acquired authentication information exists in the storage unit 14b, the wireless LAN access point 50 is reached. When the authentication result indicating the authentication success is transmitted and it is determined that the acquired authentication information does not exist in the storage unit 14b, the transmission step of transmitting the authentication result indicating the authentication failure to the wireless LAN access point 50 is executed. .. Therefore, the authentication method according to the embodiment of the present invention can connect and disconnect the intended network without depending on the function of the communication terminal 70 or the wireless LAN access point 50.

● Supplement ●
The functions of each embodiment can be realized by a computer-executable program described in a legacy programming language such as an assembler, C, C ++, C #, Java (registered trademark), an object-oriented programming language, or the like, and each embodiment can be realized. Programs for performing the functions of can be distributed through telecommunications lines.

The programs for executing the functions of each embodiment are ROM, EEPROM (Electrically Erasable Programmable Read-Only Memory), EPROM (Erasable Programmable Read-Only Memory), flash memory, flexible disc, and CD (Compact Disc). Store and distribute in a device-readable recording medium such as ROM, CD-RW (Re-Writable), DVD-ROM, DVD-RAM, DVD-RW, Blu-ray disc, SD card, MO (Magneto-Optical disc). You can also.

Further, some or all of the functions of each embodiment can be implemented on a programmable device (PD) such as an FPGA (Field Programmable Gate Array) or as an ASIC, and each embodiment can be implemented. Circuit configuration data (bit stream data) downloaded to PD to realize the functions of PD, HDL (Hardware Description Language) for generating circuit configuration data, VHDL (Very High Speed Integrated Circuits Hardware Description Language), It can be distributed by a recording medium as data described by Verilog-HDL or the like.

Although the authentication system, the authentication method, and the program according to one embodiment of the present invention have been described so far, the present invention is not limited to the above-described embodiment, and additions, changes, deletions, etc. of other embodiments are made. , It can be changed within the range that can be conceived by those skilled in the art, and it is included in the scope of the present invention as long as the action / effect of the present invention is exhibited in any of the embodiments.

1, 1a, 1b, 1c Network system 5 Authentication system 10 Authentication server 11 Transmission / reception unit (example of acquisition means and transmission means)
30 Database server 33 Authentication information management unit (example of judgment means)
34b Storage unit (an example of storage means)
50 Wireless LAN access point (an example of an intermediary device)
70 Communication terminal 90 Administrator terminal

Japanese Unexamined Patent Publication No. 2008-97264

Claims (11)

An authentication system that performs authentication processing for communication terminals via a network.
An acquisition means for acquiring authentication information used for the authentication process transmitted by an intermediary device that mediates communication of the communication terminal, and an acquisition means.
A storage means for storing authentication information whose availability is changed according to a predetermined condition including a condition regarding a time zone in which the authentication information can be used, and a storage means.
A determination means for determining whether or not the authentication information that can be used in the storage means exists , and whether or not the authentication information is valid at the current time .
When the acquired authentication information exists in the storage means and is determined to be valid at the current time, the authentication result indicating the success of the authentication is transmitted so that the intermediary device receives the acquired authentication. If it is determined that the information does not exist in the storage means, or if it is determined that the acquired authentication information exists in the storage means but is not valid at the current time, an authentication result indicating an authentication failure is obtained. A transmission means for transmitting to be received by the intermediary device , and
Authentication system with. The first aspect of claim 1, wherein when the communication terminal communicates with the intermediary device after the authentication result indicating the authentication failure is transmitted, the intermediary device transmits an error message (Packet of Disconnect) indicating a connection error. Authentication system. The authentication system according to claim 1 or 2 , wherein the determination means determines that the acquired authentication information does not exist in the storage means when the current time is not in the time zone. The authentication system according to any one of claims 1 to 3, wherein the time zone in which the authentication information can be used includes a timetable in a school and a reservation time in a conference room. The authentication system according to any one of claims 1 to 4 , and further.
It includes an authentication server that executes the authentication process and a database server that stores authentication information used for the authentication process.
The authentication server sends a confirmation request as to whether or not the authentication information exists in the storage means to the database server.
The database server is an authentication system that determines whether or not the authentication information included in the received confirmation request exists in the storage means. The authentication system according to claim 5 , wherein the authentication server transmits the confirmation request to the database server at predetermined intervals. The authentication server stores time information regarding the time when the authenticated communication terminal is connected to the intermediary device, and transmits the stored time information to the database server at predetermined intervals.
The authentication system according to claim 5 or 6 , wherein the database server stores the time information in association with the authentication information. The authentication server stores time information regarding the time when the authenticated communication terminal is connected to the intermediary device, and when the stored time information exceeds a predetermined amount of data, the time information is transmitted to the database server. death,
The authentication system according to claim 5 or 6 , wherein the database server stores the time information in association with the authentication information. The condition includes a condition indicating that the communication terminal has received a disconnection request from the administrator terminal with the intermediary device to which the communication terminal is connected.
The authentication system according to any one of claims 1 to 8 , wherein when the disconnection request is received, the authentication information used in the authentication process is deleted. It is an authentication method executed by an authentication system that performs authentication processing of communication terminals via a network.
The authentication system includes a storage means for storing authentication information whose availability is changed according to a predetermined condition including a condition regarding a time zone in which the authentication information can be used.
The acquisition step of acquiring the authentication information used for the authentication process transmitted by the intermediary device that mediates the communication of the communication terminal, and the acquisition step.
A determination step for determining whether or not the authentication information that can be used in the storage means exists, and whether or not the authentication information is valid at the current time .
When the acquired authentication information exists in the storage means and is determined to be valid at the current time, the authentication result indicating the success of the authentication is transmitted so that the intermediary device receives the acquired authentication. If it is determined that the information does not exist in the storage means, or if it is determined that the acquired authentication information exists in the storage means but is not valid at the current time, an authentication result indicating an authentication failure is obtained. A transmission step of transmitting to be received by the intermediary device , and
Authentication method to perform. A program that causes a computer to execute the authentication method according to claim 10 .

Images