JP7507138B2 - Network system and server device - Google Patents

Description

The present invention relates to a network system and a server device.

Patent Document 1 shows a network system that can more reliably block unauthorized communications. In this network system, a log management server receives an authentication permission log from an authentication server or authentication switch and a DHCP log from a DHCP server, and registers the correspondence between the account ID (MAC address) and IP address that are the subject of authentication permission in a terminal management DB. When the log management server receives an unauthorized communication detection log from an unauthorized communication detection device, it identifies the account ID (MAC address) that corresponds to the IP address that performed the unauthorized communication based on the terminal management DB, and transmits an authentication refusal command targeting the identified account ID to the authentication server.

JP 2017-204697 A

For example, an authentication client with RADIUS (Remote Authentication Dial In User Service) functionality can determine whether to permit or deny a login by making an inquiry to an authentication server in response to a login request from a user to the network via an information terminal. In addition, an authentication client with RADIUS accounting functionality can record the number of octets sent and received to the network, the connection time, etc., for each user permitted to log in.

On the other hand, users may include general users who regularly use the network, and guest users who temporarily use the network. If an authentication client with the aforementioned RADIUS accounting function or an equivalent function, such as a session timeout setting function, is used, it becomes possible to limit the network connection time for each guest user, for example. However, if an authentication client without a RADIUS accounting function is used, it may be difficult to limit the user's connection time to the network.

One of the objectives of the present invention is to provide a network system and server device that can limit the time a user can connect to the network, regardless of the functionality of the authentication client.

The above and other objects and novel features of the present invention will become apparent from the description of this specification and the accompanying drawings.

A brief overview of a representative embodiment of the invention disclosed in this application is as follows:

A network system according to one embodiment has an authentication server that determines whether to permit or deny login to the network from an account in response to a login request from an information terminal that includes the account, an authentication client that determines whether to permit or deny login to the network from the account by querying the authentication server, and a log management server. When login is permitted by the query to the authentication server, the authentication client transmits to the log management server an authentication result log that includes the login account, which is the account that entered a logged-in state as a result of the permission, and the login time. The log management server registers the login account and login time from the authentication client in a log database. The log management server then monitors the elapsed time since the login time of the login account, and when the elapsed time reaches a predetermined time limit, transmits a communication cutoff command to the authentication client to cut off communication to the network from the login account.

The effect of a representative embodiment of the invention disclosed in this application can be briefly explained as making it possible to limit the time a user is connected to a network, regardless of the functionality of the authentication client.

1 is a schematic diagram showing a configuration example and an operation example of a main part in a network system according to a first embodiment of the present invention; 2 is a sequence diagram showing an example of processing contents of a main part of the network system shown in FIG. 1 . 2 is a schematic diagram showing a configuration example of a main part of a log management server appearing in FIG. 1; 10 is a schematic diagram showing a configuration example of a main part of a log management server in a network system according to a second embodiment of the present invention; FIG. 5 is a schematic diagram showing an example of the configuration of a log DB and target determination information in FIG. 4 . 5 is a flowchart showing an example of processing contents of an elapsed time monitoring unit in FIG. 4.

The following describes in detail an embodiment of the present invention with reference to the drawings. In all drawings used to explain the embodiment, the same components are generally designated by the same reference numerals, and repeated explanations will be omitted.

(Embodiment 1)
<Network system overview>
Fig. 1 is a schematic diagram showing an example of the configuration and operation of the main parts of a network system according to a first embodiment of the present invention. The network system shown in Fig. 1 includes a network 10 such as an intranet network, and an authentication switch SW, a wireless LAN controller WLC, a log management server 15, an authentication server 16, a directory server 17, and an application server 18, which are connected to the network 10. The network 10 is, for example, a Layer 3 (L3) network of the OSI reference model, and includes a router, an L3 switch, and the like.

The authentication switch SW and the wireless LAN controller WLC are, for example, authentication client SW/WLC such as a RADIUS client. The authentication switch SW is, for example, an L2 switch that handles relay processing of Layer 2 (L2) of the OSI reference model, and has ports P1, ..., Pn. An information terminal TM10 used by user 11a is connected by wire to port P1, and a management terminal TMm used by the network administrator 12 is connected by wire to port Pn. The wireless LAN controller WLC has the function of a wireless communication access point and the function of an L2 switch. An information terminal TM20 used by user 11b is connected wirelessly to the wireless LAN controller WLC.

The authentication server 16 is, for example, a RADIUS server implemented by a computer device, and determines whether to permit or deny login to the network 10. Specifically, the authentication server 16 has an authentication database (abbreviated as DB) 23 stored in memory 22, and determines whether to permit or deny login based on the authentication DB 23. The authentication DB 23 holds information on whether to permit or deny login for each account ACN. Furthermore, in this example, the authentication DB 23 holds information on the time limit LLT associated with use of the network 10 for each account ACN. Each piece of information in the authentication DB 23 is registered in advance by the network administrator 12.

The account ACN is, for example, a user ID/password corresponding to password authentication, or a MAC address corresponding to MAC address authentication. In the example shown in FIG. 1, the MAC address "MA10" of the information terminal TM10 and the user ID "UID2"/password "PW2" of the user 11b are registered as two account ACNs. Login to the network 10 from both of these account ACNs is permitted.

The time limit LLT indicates the period during which the network 10 can be used and the time when it can be used. In the example shown in FIG. 1, the account ACN "MA10" can be used for up to three hours after login, and the account ACN "UID2" can be used until the time "h3:m3:s3" regardless of the login time. Note that the authentication DB 23 is provided in the authentication server 16 here, but may also be provided in a directory server 17 such as an active directory server or an LDAP (Lightweight Directory Access Protocol) server. In this case, the authentication server 16 determines whether to permit or deny login in cooperation with the directory server 17.

In response to a login request LRQ including an account ACN from an information terminal, the authentication client SW/WLC determines whether to permit or deny login to the network 10 from that account ACN by sending an inquiry to the authentication server 16. As a specific example, in response to a login request LRQ including the account ACN "MA10" from the information terminal TM10, the authentication switch SW sends a login determination request ARQ including "MA10" to the authentication server 16. The authentication server 16 determines whether to permit or deny login for "MA10".

In the example shown in FIG. 1, the authentication server 16 determines that login from "MA10" is permitted based on the registered contents of the authentication DB 23. The authentication switch SW then receives a login determination response ARS from the authentication server 16, which includes the result of the determination of whether the login is permitted/rejected, in this case, the result of the determination of permission. In this case, the information terminal TM10 that is permitted to log in can use the network 10 via the authentication switch SW. As a result, the information terminal TM10 can communicate with, for example, an application server 18 connected to the network 10.

When login is permitted by an inquiry communication to the authentication server 16, the authentication client SW/WLC transmits an authentication result log LG, which includes the login account ACNa, the login time LT, and the authentication client identifier (ID) CID, to the log management server 15. The login account ACNa is the account that is in a logged-in state due to login permission.

The login time LT is determined, for example, based on the time information of the authentication client SW/WLC or the authentication server 16. The authentication client identifier CID is determined, for example, by the source IP address of the authentication result log LG. As a specific example, the authentication switch SW transmits the authentication result log LG, which includes the login account ACNa "MA10" of the information terminal TM10, the login time LT "h1:m1:s1", and the IP address "IPA1" of the authentication switch SW, to the log management server 15.

The log management server (server device) 15 is realized by a computer device, and one of its functions is to collect various logs generated on the network 10, including the authentication result log LG. The logs are, for example, logs notified by syslog or SNMP (Simple Network Management Protocol) Trap. The log management server 15 has a log DB 21 stored in memory 20.

The log DB21 holds the correspondence between the login account ACNa, the login time LT, and the identifier CID of the authentication client that is the sender of the login account ACNa, and also holds the correspondence with the time limit LLT. When the log management server 15 receives an authentication result log LG from the authentication client SW/WLC, it registers the login account ACNa, the login time LT, and the identifier CID of the authentication client contained in the authentication result log LG in the log DB21. In addition, the log management server 15 communicates with the authentication server 16 to obtain the time limit LLT of the login account ACNa from the authentication server 16 and registers it in the log DB21.

In the example shown in FIG. 1, the log management server 15 receives the authentication result log LG from the authentication switch SW, and registers the login account ACNa "MA10", the login time LT "h1:m1:s1", and the IP address "IPA1" of the authentication switch SW in the log DB 21. The log management server 15 also obtains the time limit LLT "3hr" corresponding to "MA10" from the authentication server 16, and registers it in the log DB 21.

The same process is performed when the wireless LAN controller WLC receives a login request LRQ including the user ID "UID2"/password "PW2" from the information terminal TM20. As a result, the log DB21 registers the correspondence between the login account ACNa "UID2", the login time LT "h2:m2:s2", the time limit LLT "h3:m3:s3", and the IP address "IPA2" of the wireless LAN controller WLC.

The log management server 15 monitors the time that has elapsed since the login time LT of each login account ACNa based on the log DB 21, and when the elapsed time reaches a predetermined time limit LLT, transmits a communication cutoff command CB to the authentication client SW/WLC. The communication cutoff command CB is a command to cut off communication from the login account ACNa to the network 10. The authentication client SW/WLC that is the destination of the communication cutoff command CB is determined based on the identifier CID of the authentication client in the log DB 21.

The authentication client SW/WLC receives the communication cutoff command CB and cuts off communication to the network 10 from the login account ACNa included in the communication cutoff command CB. In other words, the authentication client SW/WLC forcibly logs out the login account ACNa.

In the example shown in FIG. 1, the log management server 15 sends a communication cutoff command CB for login account ACNa "MA10" using an IP packet or the like destined for IP address IPA1 when three hours have passed since login time LT "h1:m1:s1". Also, the log management server 15 sends a communication cutoff command CB for login account ACNa "UID2" using an IP packet or the like destined for IP address IPA2 when time "h3:m3:s3" has been reached.

Figure 2 is a sequence diagram showing an example of the processing contents of the main parts of the network system shown in Figure 1. In Figure 2, the information terminal TM transmits a login request LRQ including the account ACN to the authentication client SW/WLC, i.e., the authentication switch SW or the wireless LAN controller WLC (step S101). In response, the authentication client SW/WLC transmits a login determination request ARQ including the account ACN to the authentication server 16 (step S102).

In this example, the authentication server 16 determines, based on the authentication DB 23, that the login from the account ACN included in the login determination request ARQ is permitted, and transmits a login determination response ARS including the result of the permission determination to the authentication client SW/WLC (step S103). As a result, the authentication client SW/WLC permits login to the network 10 from the account ACN, i.e., the login account ACNa (step S104).

Specifically, the authentication client SW/WLC uses a packet filter or the like to allow the relay of frames whose source is the MAC address of the information terminal TM, which is the source of the login account ACNa. As a result, the information terminal TM becomes able to use the network 10 (step S1). At this time, as shown in FIG. 1, if the login account ACNa is the user ID "UID2", the authentication client SW/WLC need only hold in advance in step S101 the correspondence between "UID2" and the MAC address "MA20" of the information terminal TM20.

In addition, in conjunction with the processing of step S104, the authentication client SW/WLC transmits an authentication result log LG to the log management server 15 (step S105). The authentication result log LG includes the login account ACNa, the login time LT, and the identifier CID of the authentication client, for example, an IP address. The log management server 15 registers this information (ACNa, LT, CID) in the log DB 21 (step S106).

Furthermore, the log management server 15 acquires the time limit LLT corresponding to the login account ACNa from the authentication server 16 (step S107) and registers it in the log DB 21 (step S108). Note that in this example, after receiving the login account ACNa in step S105, the log management server 15 acquires the time limit LLT corresponding to the login account ACNa from the authentication server 16.

However, for example, the log management server 15 may periodically obtain the correspondence between the account ACN and the time limit LLT in the authentication DB 23 shown in FIG. 1, and store the correspondence in the memory 20, and determine the time limit LLT to be registered in the log DB 21 based on the correspondence. Also, here, the network administrator 12 registered the time limit LLT for each account ACN in the authentication server 16, but may instead register it in the log management server 15. In this case, the processing of step S107 is unnecessary. However, from the viewpoint of centrally managing information related to authentication, that is, making network management more efficient, it is preferable to register the time limit LLT in the authentication server 16.

After step S108, the log management server 15 monitors the time elapsed from the login time LT for the login account ACNa registered in the log DB 21 (step S109). Then, when the elapsed time reaches the time limit LLT, the log management server 15 sends a communication cutoff command CB for the login account ACNa to the authentication client SW/WLC (step S110).

The authentication client SW/WLC receives the communication cutoff command CB and cuts off communication to the network 10 from the login account ACNa included in the communication cutoff command CB (step S111). Specifically, the authentication client SW/WLC uses a packet filter or the like to target the information terminal TM that is the sender of the login account ACNa and cuts off relay of frames whose sender is the MAC address of the information terminal TM. As a result, the information terminal TM cannot use the network 10 (step S2). In other words, the process returns to step S101, and another login request LRQ is required.

The permission/rejection of the login request LRQ after the processing of step S111 may be determined based on the registration contents of the authentication server 16, for example. Specifically, the authentication server 16 may set restrictions such as permitting login only once, permitting without restrictions, permitting at a specified time, etc. Furthermore, if a logout occurs before the time limit LLT is reached, the log management server 15 receives a log indicating that the user has been logged out. In this case, the logged-out account ACN is excluded from the login accounts ACNa in the log DB 21, and is excluded from the targets for monitoring the time limit LLT.

<Details of the log management server (server device)>
Fig. 3 is a schematic diagram showing an example of the configuration of the main part of the log management server in Fig. 1. The log management server (server device) 15 shown in Fig. 3 includes a log receiving unit 25, a time limit acquiring unit 26, an elapsed time monitoring unit 27, and a communication cutoff command transmitting unit 28, in addition to a memory 20 that holds a log DB 21. The memory 20 is configured, for example, by combining a non-volatile memory such as a hard disk drive (HDD) or a solid state drive (SSD) with a volatile memory such as a dynamic random access memory (DRAM) or a static RAM (SRAM).

The log receiving unit 25, the time limit acquiring unit 26, the elapsed time monitoring unit 27 and the communication cutoff command sending unit 28 are realized, for example, by the processor executing a predetermined program stored in the memory 20. As shown in steps S105 and S106 of FIG. 2, the log receiving unit 25 receives the authentication result log LG from the authentication client SW/WLC and registers the log information in the log DB 21. As shown in steps 107 and S108 of FIG. 2, the time limit acquiring unit 26 acquires the time limit of the login account ACNa from the authentication server 16 and registers it in the log DB 21.

2, the elapsed time monitoring unit 27 monitors the elapsed time from the login time LT for the login account ACNa based on the log DB 21, and determines whether the elapsed time has reached the time limit LLT. As shown in step S110 of FIG. 2, the communication cutoff command sending unit 28 sends a communication cutoff command CB for the login account ACNa that has reached the time limit LLT to the authentication client SW/WLC obtained based on the log DB 21 based on the monitoring result of the elapsed time monitoring unit 27.

<Major Effects of First Embodiment>
As described above, by using the network system and server device of the first embodiment, it becomes possible to limit the connection time of a user to the network 10, regardless of the function of the authentication client SW/WLC. Specifically, even if the authentication client SW/WLC does not have a RADIUS accounting function or a session timeout setting function, the log management server 15 can limit the connection time of a user to the network 10 by monitoring the time limit LLT based on the log DB 21. As a result, there is no need to replace an existing authentication client SW/WLC that does not support a RADIUS accounting function or the like, and therefore an increase in costs can be suppressed.

(Embodiment 2)
<Details of the log management server (server device)>
Fig. 4 is a schematic diagram showing a configuration example of the main part of the log management server in Fig. 1 in a network system according to a second embodiment. The log management server 15a shown in Fig. 4 differs from the configuration example shown in Fig. 3 in the following points. The first difference is that the registered contents of the log DB 21a are different. The second difference is that target discrimination information 30 is added to the memory 20. The third difference is that the processing contents of the elapsed time monitoring unit 27a are slightly different. The fourth difference is that a prior notification transmission unit 31 is added. The prior notification transmission unit 31 is realized, for example, by a processor executing a predetermined program stored in the memory 20.

Figure 5 is a schematic diagram showing an example of the configuration of the log DB and target discrimination information in Figure 4. Compared to the example configuration in Figure 1, the log DB 21a shown in Figure 5 further includes a MAC address MA, an IP address IPA, an email address MLA, and advance notification transmission information 35 for each login account ACNa. For example, the authentication client SW/WLC can obtain the MAC address MA for each login account ACNa in step S101 shown in Figure 2. The authentication client SW/WLC can transmit an authentication result log LG including the MAC address MA in step S105 shown in Figure 2.

As shown in Patent Document 1, for example, the IP address IPA for each login account ACNa can be obtained by the log management server 15a receiving a Dynamic Host Configuration Protocol (DHCP) log that indicates the correspondence between MAC addresses and IP addresses from a DHCP server (not shown) connected to the network 10. The email address MLA for each login account ACNa is often held by a directory server 17, particularly an active directory. In this case, the authentication client SW/WLC receives a login determination response ARS that includes the email address MLA from the authentication server 16, and transmits an authentication result log LG that includes the email address MLA.

The MAC address MA or IP address IPA in the log DB 21a may be transmitted as information equivalent to the login account ACNa to be blocked, for example, when the log management server 15 transmits a communication blocking command CB in step S110 shown in FIG. 2. For example, the authentication client SW/WLC often sets the MAC address MA or IP address IPA in a packet filter or the like when blocking communication. Using a communication blocking command CB that includes the MAC address MA or IP address IPA makes it easy to deal with such cases. The email address MLA and advance notification transmission information 35 are used by the advance notification transmission unit 31, which will be described later.

The target determination information 30 shown in FIG. 5 is information indicating whether the authentication client SW/WLC is a target or non-target for sending a communication cutoff command CB. The target determination information 30 is determined in advance by the network administrator 12. For example, in FIG. 1, it is assumed that the authentication switch SW does not have a RADIUS accounting function, and the wireless LAN controller WLC has a RADIUS accounting function. In this case, the wireless LAN controller WLC may want to use the RADIUS accounting function, etc. to manage the time limit LLT for each login account ACNa.

However, in this case, if the log management server 15 also uses the management of the time limit LLT, duplicate communication cutoff commands may occur in the wireless LAN controller WLC, and a time lag may occur between them, which may result in unintended control. Therefore, target determination information 30 is provided. In the example shown in FIG. 5, target/non-target is determined for each authentication client identifier CID, and the authentication switch SW having IP address IPA1 is determined as a target, and the wireless LAN controller WLC having IP address IPA2 is determined as a non-target.

The log management server 15a, specifically the elapsed time monitoring unit 27a, does not monitor the elapsed time for the authentication client that is not a transmission target, that is, the login account ACNa from the wireless LAN controller WLC in the example shown in FIG. 5, based on the target determination information 30. Accordingly, the log management server 15a, specifically the communication cutoff command sending unit 28, does not send the communication cutoff command CB to the wireless LAN controller WLC that is the authentication client that is not a transmission target.

The advance notification sending unit 31 sends an advance notification indicating that the time limit LLT is approaching to the user who has the target login account ACNa before the time elapsed from the login time LT reaches the time limit LLT. Specifically, for example, the elapsed time monitoring unit 27a monitors not only whether or not there is a login account ACNa that has reached the time limit LLT, but also whether or not there is a login account ACNa that has reached the advance notification time, which is a predetermined time before that.

Based on the monitoring result of the elapsed time monitoring unit 27a, the advance notification sending unit 31 sends an advance notification, for example by email, to the user whose login account ACNa has reached the advance notification time. The email address MLA at this time is determined based on the log DB 21a. Furthermore, when the advance notification sending unit 31 has sent an advance notification, it registers that the advance notification has been sent in the advance notification sending information 35 in the log DB 21a.

Figure 6 is a flow diagram showing an example of the processing contents of the elapsed time monitoring unit in Figure 4. The elapsed time monitoring unit 27a repeatedly executes the processing of Figure 6 at a predetermined control period. First, the elapsed time monitoring unit 27a determines whether or not a login account ACNa registered in the log DB 21a is a monitoring target based on the target determination information 30, and monitors the elapsed time from the login time LT for each login account ACNa to be monitored (step S201). Then, the elapsed time monitoring unit 27a determines whether or not there is a login account ACNa whose elapsed time has reached the advance notification time (step S202).

If there is a login account ACNa that has reached the advance notification time (step S202: Yes), the elapsed time monitoring unit 27a determines whether the elapsed time of the login account ACNa has also reached the time limit LLT (step S203). If the elapsed time has reached the time limit LLT (step S203: Yes), the elapsed time monitoring unit 27a notifies the communication cutoff command sending unit 28 of the login account ACNa that has reached the time limit LLT, and ends the process (step S204).

On the other hand, if there is a login account ACNa for which the advance notification time has been reached but the time limit LLT has not been reached (step S202: Yes, step S203: No), the elapsed time monitoring unit 27a determines whether an advance notification has been sent or not to the login account ACNa based on the log DB 21a (step S205). If an advance notification has not been sent (step S205: Yes), the elapsed time monitoring unit 27a notifies the advance notification sending unit 31 of the login account ACNa for which an advance notification has not been sent, and ends the process (step S206). Note that the elapsed time monitoring unit 27a also ends the process if there is no login account ACNa for which the advance notification time has been reached in step S202 (if "No") or if an advance notification has been sent in step S205 (if "No").

<Major Effects of the Second Embodiment>
As described above, the use of the network system and server device of the second embodiment can provide the same effects as those described in the first embodiment. Furthermore, by providing the target discrimination information 30, the time limit LLT can be managed smoothly in a network system in which authentication client SW/WLCs having a RADIUS accounting function and authentication client SW/WLCs not having a RADIUS accounting function are mixed. Furthermore, by providing the advance notification transmission unit 31, for example, it is possible to prevent a situation in which an unexpected network interruption occurs while a user is using the network 10.

The invention made by the inventor has been specifically described above based on the embodiments, but the present invention is not limited to the above-mentioned embodiments and can be modified in various ways without departing from the gist of the invention. For example, the above-mentioned embodiments have been described in detail to explain the invention in an easy-to-understand manner, and the invention is not necessarily limited to having all of the configurations described. It is also possible to replace part of the configuration of one embodiment with the configuration of another embodiment, and it is also possible to add the configuration of another embodiment to the configuration of one embodiment. It is also possible to add, delete, or replace part of the configuration of each embodiment with other configurations.

For example, the various programs described above can be stored in a non-transitory, tangible, computer-readable recording medium and then supplied to a computer device. Examples of such recording media include magnetic recording media such as hard disk drives, optical recording media such as DVDs (Digital Versatile Discs) and Blu-ray discs, and semiconductor memories such as flash memories.

10...Network, 11a, 11b...User, 12...Network administrator, 15, 15a...Log management server, 16...Authentication server, 17...Directory server, 18...Application server, 20, 22...Memory, 21, 21a...Log DB, 23...Authentication DB, 25...Log receiving unit, 26...Time limit acquisition unit, 27, 27a...Elapsed time monitoring unit, 28...Communication cutoff command transmission unit, 30...Target discrimination information, 31...Advance notification transmission unit, 35...Advance notification transmission information, ACN...Account , ACNa...login account, ARQ...login judgment request, ARS...login judgment response, CB...communication cutoff command, CID...authentication client identifier, IPA...IP address, LG...authentication result log, LLT...time limit, LRQ...login request, LT...login time, MA...MAC address, MLA...email address, P1-Pn...port, SW...authentication switch, TM, TM10, TM20...information terminal, TMm...management terminal, WLC...wireless LAN controller

Claims (10)

an authentication server that determines whether or not to permit login to the network;
an authentication client that, in response to a login request including an account from an information terminal, determines whether to permit or deny login to the network from the account by communicating an inquiry to the authentication server;
a log management server having a log database;
A network system having:
when the login is permitted by the inquiry communication to the authentication server, the authentication client transmits to the log management server an authentication result log including a login account, which is the account that has entered a logged-in state by the permission, and a login time;
The log management server includes:
registering the login account and the login time from the authentication client in the log database;
monitoring an elapsed time from the login time of the login account, and when the elapsed time reaches a predetermined time limit, transmitting a communication cutoff command to the authentication client for cutting off communication from the login account to the network;
Network system. 2. The network system according to claim 1,
the log database holds a correspondence relationship between the login account, the login time, and an identifier of the authenticated client that is a transmission source of the login account;
the log management server transmits the communication cutoff command for the login account to the authentication client determined based on the log database;
Network system. 3. The network system according to claim 2,
The authentication server holds information on the time limit of the login account that is set in advance,
the log database holds a correspondence relationship between the login account, the login time, the identifier of the authenticated client, and the time limit;
the log management server communicates with the authentication server to obtain the time limit of the login account from the authentication server and register the time limit in the log database;
Network system. 2. The network system according to claim 1,
the log management server holds in advance target determination information indicating whether the authenticated client is a target or a non-target of the communication cutoff command, and does not transmit the communication cutoff command to the authenticated client that is not a target of the communication cutoff command;
Network system. 2. The network system according to claim 1,
the log management server transmits a prior notification to the user having the login account, before the elapsed time reaches the time limit, indicating that the time limit is approaching.
Network system. A server device having a log database connected to an authentication server which determines whether to permit/reject login to a network, and an authentication client which, in response to a login request including an account from an information terminal, determines whether to permit/reject login to the network from the account by communicating an inquiry to the authentication server, the server device comprising:
when the login is permitted by the inquiry communication to the authentication server, the authentication client transmits to the server device an authentication result log including a login account, which is the account that has been permitted to be in a logged-in state, and a login time;
The server device includes:
registering the login account and the login time from the authentication client in the log database;
monitoring an elapsed time from the login time of the login account, and when the elapsed time reaches a predetermined time limit, transmitting a communication cutoff command to the authentication client for cutting off communication from the login account to the network;
Server device. 7. The server device according to claim 6,
the log database holds a correspondence relationship between the login account, the login time, and an identifier of the authenticated client that is a transmission source of the login account;
the server device transmits the communication cutoff command for the login account to the authentication client determined based on the log database;
Server device. 8. The server device according to claim 7,
The authentication server holds information on the time limit of the login account that is set in advance,
the log database holds a correspondence relationship between the login account, the login time, the identifier of the authenticated client, and the time limit;
the server device communicates with the authentication server to obtain the time limit of the login account from the authentication server and registers the time limit in the log database;
Server device. 7. The server device according to claim 6,
storing in advance target determination information indicating whether the authenticated client is a target or a non-target of the communication cutoff command, and not transmitting the communication cutoff command to the authenticated client that is not a target of the communication cutoff command;
Server device. 7. The server device according to claim 6,
sending a prior notification indicating that the time limit is approaching to a user having the login account before the elapsed time reaches the time limit;
Server device.

Images