KR101471880B1 - System for authenticating clients - Google Patents

Abstract

A client authentication system is provided. A client authentication system according to an embodiment of the present invention includes a client for transmitting an access request, a plurality of authentication servers for performing authentication of the client, a higher authentication server for registering and managing the plurality of authentication servers, And a network for transmitting the access request to a first authentication server closest to the client among the authentication servers, wherein when the first authentication server does not respond, the access request is transmitted to the first authentication server among the plurality of authentication servers To the second authentication server close to the second authentication server.

Description

Client Authentication System {SYSTEM FOR AUTHENTICATING CLIENTS}

The present invention relates to a client authentication system, and more particularly, to a client authentication system that does not require a relay server for performing authentication with a plurality of authentication servers and distributing authentication requests to a plurality of authentication servers.

The data center can provide services to store and manage large data (Big Data). Moving away from the existing way of allowing a client to allocate a given physical machine to each client so that the client can freely store, retrieve, and delete data on that physical machine, recent data center operations create multiple virtual machines on a physical machine And allocates each virtual machine to a client, thereby providing a more efficient data management service.

&Quot; Authentication intermediary server and programs therefor "European Patent Publication EP 2194482 (published on June 6, 2010)

Typical data management services provide an authentication system that can be accessed only by authenticated users to achieve data security. The existing authentication system receives the user's authentication request and performs authentication in various areas through an intermediary server that delivers the authentication request to the authentication server located in the appropriate data center according to the location of the user .

However, if the user is in Asia and the relay server is in Europe, the authentication request of the user is transmitted to the relay server (Europe) And then to the authentication server (Asia) close to the user's location.

In addition, if a failure occurs in the relay server, all service-related authentication can not be performed. If a separate security device is not added to the authentication system, abnormal data access can be attempted by sending a request directly to the authentication server without going through the relay server.

SUMMARY OF THE INVENTION The present invention has been made in view of the above problems, and it is an object of the present invention to provide a client authentication system capable of transmitting a direct access request to an authentication server closest to a client.

Another object of the present invention is to provide a client authentication system capable of performing authentication using an authentication server in another region when a failure occurs in an authentication server closest to the client by operating a plurality of authentication servers .

Another object of the present invention is to provide a client authentication system capable of performing authentication between a plurality of authentication servers authenticated through an upper authentication server managing a plurality of authentication servers.

The technical objects of the present invention are not limited to the above-mentioned technical problems, and other technical subjects not mentioned can be clearly understood by those skilled in the art from the following description.

According to an aspect of the present invention, there is provided a client authentication system including a client for transmitting an access request, a plurality of authentication servers for performing authentication of the client, And a network for transmitting the access request to a first authentication server closest to the client among the plurality of authentication servers, wherein when the first authentication server does not respond, And is transmitted to a second authentication server which is close to the first authentication server among the plurality of authentication servers.

According to another aspect of the present invention, there is provided a client authentication system including a client for transmitting an access request, a plurality of authentication servers for performing authentication of the client and managing one or more entities, And a network for transmitting the access request to a first entity of a first authentication server closest to the client among the plurality of authentication servers, wherein the first authentication server If not, the first entity forwards the access request to the second entity of the second authentication server, which is close to the first authentication server among the plurality of authentication servers.

According to another aspect of the present invention, there is provided a client authentication system including a client for transmitting an access request, a plurality of authentication servers for performing authentication of the client and managing one or more entities, A higher authentication server for registering and managing a plurality of authentication servers and a network for transmitting the access request to a first entity of a first authentication server closest to the client among the plurality of authentication servers, And then the second entity of the second authentication server is allocated.

According to the present invention, since the authentication request and / or the connection request are transmitted directly to the authentication server closest to the user's location, the authentication time can be shortened by the time passing through the relay server for each authentication.

In addition, if a client uses an initial certificate, it can be authenticated through all the authentication servers distributed in the data center. Even if one of the authentication servers fails, authentication can be performed using an authentication server in another region.

Also, since each authentication server operates in a mutually authenticated state by an upper authentication server, an unauthorized third party can not intervene in the authentication process and can prevent unauthorized intrusion.

1 is a block diagram of a client authentication system according to an embodiment of the present invention.
FIGS. 2 to 5 are views for sequentially illustrating an authentication process according to the client authentication system of FIG.
6 is a diagram showing the configuration of an authentication server constituting the client authentication system of FIG.
7 is a diagram illustrating a client authentication system according to another embodiment of the present invention.
8 to 13 sequentially illustrate the authentication process according to the client authentication system of FIG.
14 is a diagram illustrating a client authentication system according to another embodiment of the present invention.
15 and 16 are diagrams for explaining an authentication and assignment process according to the client authentication system of FIG.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS The advantages and features of the present invention and the manner of achieving them will become apparent with reference to the embodiments described in detail below with reference to the accompanying drawings. The present invention may, however, be embodied in many different forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the invention to those skilled in the art. Is provided to fully convey the scope of the invention to those skilled in the art, and the invention is only defined by the scope of the claims. Like reference numerals refer to like elements throughout the specification.

Unless defined otherwise, all terms (including technical and scientific terms) used herein may be used in a sense commonly understood by one of ordinary skill in the art to which this invention belongs. Also, commonly used predefined terms are not ideally or excessively interpreted unless explicitly defined otherwise.

The terminology used herein is for the purpose of illustrating embodiments and is not intended to be limiting of the present invention. In the present specification, the singular form includes plural forms unless otherwise specified in the specification. The terms " comprises "and / or" comprising "used in the specification do not exclude the presence or addition of one or more other elements in addition to the stated element.

Hereinafter, the present invention will be described with reference to embodiments of the present invention. At this point, it will be appreciated that the combinations of blocks and flowchart illustrations in the process flow diagrams may be performed by computer program instructions. These computer program instructions may be loaded into a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus, so that those instructions, which are executed through a processor of a computer or other programmable data processing apparatus, Thereby creating means for performing functions. These computer program instructions may also be stored in a computer usable or computer readable memory capable of directing a computer or other programmable data processing apparatus to implement the functionality in a particular manner so that the computer usable or computer readable memory The instructions stored in the block diagram (s) are also capable of producing manufacturing items containing instruction means for performing the functions described in the flowchart block (s). Computer program instructions may also be stored on a computer or other programmable data processing equipment so that a series of operating steps may be performed on a computer or other programmable data processing equipment to create a computer- It is also possible for the instructions to perform the processing equipment to provide steps for executing the functions described in the flowchart block (s).

The term "sub" or "module" as used herein refers to a hardware component such as software or an FPGA or ASIC, and the term "sub" or "module" performs certain roles. However, " part " or " module " is not meant to be limited to software or hardware. The term " part " or " module " may be configured to reside on an addressable storage medium and configured to play one or more processors. Thus, by way of example, 'a' or 'module' is intended to be broadly interpreted as encompassing any type of process, including features such as software components, object-oriented software components, class components and task components, Microcode, circuitry, data, databases, data structures, tables, arrays, and variables, as used herein, Or " modules " or " modules " or " modules " or " modules " Can be further separated.

Hereinafter, a configuration of a client authentication system according to embodiments of the present invention will be described with reference to the drawings.

FIG. 1 is a diagram illustrating a client authentication system according to an embodiment of the present invention. FIGS. 2 to 5 are views for sequentially illustrating an authentication process according to the client authentication system of FIG. 1, 1 is a diagram showing a configuration of an authentication server constituting a client authentication system; FIG.

The client authentication system according to the present embodiment includes a client 100 that transmits an access request, a plurality of authentication servers 200 that perform authentication of the client 100, And a network (400) for transmitting the access request to a first authentication server (210) closest to the client (100) among the plurality of authentication servers (200) 1 authentication server 210 is in an unauthorized state, the access request is transmitted to the second authentication server 220 close to the first authentication server 210 among the plurality of authentication servers 200.

That is, according to the present embodiment, the client authentication system is composed of one or more clients 100, one or more authentication servers 200, an upper authentication server 300, and a network 400.

The client 100 may be, for example, a device including a wired or wireless communication module, and may be a device connected to the authentication server 200 through the network 400 to perform a predetermined operation.

There is no limitation on the type of the client 100. For example, the client 100 may be a general desktop PC, a cellular phone capable of communicating with a cloud server that can carry the cloud environment 200 via a wireless Internet or a portable Internet, (PCS) phone, and a synchronous / asynchronous IMT-2000 (International Mobile Telecommunication-2000) mobile terminal. In addition, a Palm Personal Computer, a Personal Digital Assistant (PDA) A smart phone, a wireless application protocol phone (WAP phone), a mobile play-station device, or a laptop computer, a tablet computer, a navigation system, and the like.

The authentication server 200 performs authentication according to a request from the client 100, verifies the validity of the existing certificate if there is an existing certificate, and issues a certificate in the case of a new client without a certificate. In addition, the authentication process for the client 100, which has performed a process related to the certificate or the authentication, may be stored and managed, thereby shortening the authentication process when the same client 100 reconnects. The authentication information of the client 100 may be shared or referred to all the authentication servers 200. [

A plurality of authentication servers 200 may be provided, and each of the authentication servers 200 may be disposed at a geographically or physically separated location, and all or part of the respective authentication servers 200 may have different authentication policies Authentication can be performed accordingly.

For example, the first authentication server 210 may be located in the home country, and the second authentication server 220 may be located in a foreign country. Also, the first authentication server 210 permits authentication and connection of a client having an administrator authority, for example, the first client 110 among the clients 100, while allowing a client having general user authority, for example, The authentication and connection of the authentication server 120 may be blocked or denied.

On the other hand, the second authentication server 220 can allow authentication and connection of a client having a general user right, for example, the second client 120, among the clients 100, 1 < / RTI > client 110 may be blocked or denied.

Therefore, even if the client 100 is the same client, the authentication result may be different according to the type of the authentication server 200 connected to the client 100 and the authentication policy. A more specific configuration of the authentication server 200 will be described in detail with reference to FIG.

The network 400 connecting the client 100 and the authentication server 200 may be a wired or wireless Internet or may be a core network integrated with a wired public network, a wireless mobile communication network, or a portable Internet, or may be a TCP / An open computer network structure providing various services in the upper layer such as HTTP (Hyper Text Transfer Protocol), Telnet, FTP (File Transfer Protocol), DNS (Domain Name System), SMTP (Simple Mail Transfer Protocol) It can mean.

The network 400 may transmit the access request to the authentication server closest to the client 100 requesting authentication among the plurality of authentication servers 200. [ The authentication server closest to this specification may mean an authentication server having the shortest geographical or physical distance or an authentication server having the shortest time required for returning a response packet after a predetermined packet transmission, State, or network status of the authentication server.

When the client 100 tries to access the authentication server 200 through the network 400, the authentication of the client 100 through the router or distributor of the service provider (ISP) It sends an access request to the server. For example, when the client 100 is located in the country, the first authentication server 210 is located in the domestic, and the second authentication server 220 is located in the United States, the network 400 may request the access of the client 100 To the first authentication server 210. When the client 100 moves to the United States and then transmits an access request through the network 400 in the US, the network 400 transmits an access request of the client 100 to the second authentication server 220 .

However, if the authentication server 200 located in the same area as the client 100 has an unauthenticable state, for example, a connection failure, a server error, an authentication error, or the like, the authentication server 200 Or an access request is transmitted through another authentication server 200 adjacent to the client 100, and another authentication server 200 can perform an authentication operation for the access request.

The upper authentication server 300 can manage a plurality of authentication servers 200. [ That is, the upper authentication server 200 stores information about a plurality of authentication servers 200 that it manages in advance by a manual operation by a manager or the like, a batch program, a setting program, and the like. In order to authenticate the authentication server 200 A separate certificate or encryption key, and so on.

The upper authentication server 300 can verify the integrity or validity of the authentication server 200. When one authentication server 200 queries whether it is valid for another authentication server 200, And transmits the resultant value to the inquired authentication server 200 so that data can be exchanged only between the authorized authentication servers 200. [

Hereinafter, the authentication process according to the client authentication system will be sequentially described with reference to FIGS. 2 to 5. FIG.

Referring to FIG. 2, a first client 110 among a plurality of clients 100 transmits an access request through the network 400. The platform service providing the network 400 or the network 400 receiving the access request may distribute the access request to the second authentication server 220 which is the proximity authentication server. At this time, the second authentication server 220 may be an authentication server located closest to the first client 110.

Referring to FIG. 3, the first client 110 may attempt to authenticate through the second authentication server 220. If the authentication is successfully completed, the authentication success message may be received. However, the authentication server 200 The access request may be transmitted to the first authentication server 210 adjacent to the second authentication server 220. [ In this case, the first authentication server 210 may be physically or geographically adjacent to the second authentication server 220, for example, an authentication server provided in the same area, but the present invention is not limited thereto, Or may be the second closest authentication server to the client 110.

4, the first authentication server 210 receiving the access request from the second authentication server 220 receives the access request from the upper authentication server 300 to check whether the second authentication server 210 is a valid authentication server, The second authentication server 220 transmits the access request to the second authentication server 220. That is, the second authentication server 220 receiving the direct access request from the first client 110 can perform the direct authentication, while the first authentication server 220 receiving the access request from the second authentication server 220 210 can confirm that the second authentication server 220 is the registered authentication server.

In some other embodiments, all of the authentication servers 200 may store information about each other, in which case the authentication process for the authentication server with the upper authentication server 300 may be omitted.

The upper authentication server 300 checks the authority and validity of the second authentication server 220 requested by the first authentication server 210 based on the data about the authentication server stored in the upper authentication server 300, To the first authentication server 210.

Referring to FIG. 5, when the second authentication server 220 is determined to be a valid authentication server, the first authentication server 210 may process the access request received from the second authentication server 220. [ For example, if the first client 110 is a first-time client, the certificate issuing process can be performed after confirming that the user is a legitimate user based on the information of the first client 110 and the identification data. When the certificate is issued, the first client 110 may proceed to the authentication process for the access request based on the certificate after the second connection. The authentication process of the specific first client 110 can be performed by various known authentication protocols or algorithms, and a specific method for the authentication process is not limited.

When the authentication process is completed, the first authentication server 210 may pass the authentication request for the access request to the first client 110 via the second authentication server 220 that has transmitted the access request.

When the authentication is successfully performed, the first client 110 can be given a predetermined access right or management authority from the authentication server 200.

Referring to FIG. 6, a specific configuration of the first authentication server 210 that processes the authentication process is disclosed. In addition to the first authentication server 210, the other authentication server 200 may have the same structure as the first authentication server 210.

The request processing module 210a may forward the access request received from the first client 110 to the authentication execution module 210c and send a response to the request execution. A unit for transmitting and receiving data by wire or wireless may be included.

The authentication policy storage module 210b may store an authentication policy for the client 100 that may differ from each other depending on the location or area of the authentication server 200. [ As described above, for example, the domestic branch office of a predetermined company can browse all the information about the domestic branch office, but not all the information in the US. In this case, the branch office (first client 110) Authentication is successfully performed when the authentication server 210 accesses the corresponding authentication server 210 in Korea, whereas authentication may be blocked or failed when accessing the authentication server 210 in the United States. The authentication policy storage module 210b stores various authentication policies including the specific service-specific privileges as described above, so that the authentication policy storage module 210b can perform authentication based on the type of the client 100, connection location, or the like, and grant different rights.

The authentication performing module 210c can perform authentication using other authentication information identified or authorized by the authentication server information management module 210e and identification information included in an access request sent by the client 100. [ There is no restriction on the authentication method used, and it is not limited to a specific authentication protocol or algorithm.

The authentication information storage module 210d may store essential information necessary for authentication of the client 100, for example, an identifier of the client 100, an RSA public key, a password, a current authentication status, an authentication expiration time, and the like. The content of the authentication information may vary depending on the authentication protocol or algorithm.

The authentication server information management module 210e can manage the authorized authentication server list. If the identifier of the authentication server that is queried by the authentication performing module 210c does not exist, the authentication server information management module 210e updates the identifier It is possible to inquire whether it is the added authentication server 200 or not.

The authentication permission information storage module 210f may store the authentication information of the authorized (legitimate) authentication server 200 authenticated by the upper authentication server 300. [ An unauthorized third party that is not stored in the authentication permission information storage module 210f may not communicate with the authentication server 200 So that the security can be maintained.

That is, when the access request is received from the authentication server stored in the authentication permission information storage module 210f, the authentication process can be performed without accessing the upper authentication server 300 separately. However, in the authentication permission information storage module 210f When the access request is received from the unauthenticated authentication server, the validity of the authentication server is verified by the upper authentication server 300, and the remaining authentication process can be performed only when there is no abnormality.

Hereinafter, a client authentication system according to another embodiment of the present invention will be described with reference to FIGS. 7 to 13. FIG. FIG. 7 is a view showing a client authentication system according to another embodiment of the present invention, and FIGS. 8 to 13 sequentially illustrate an authentication process according to the client authentication system of FIG.

The client authentication system according to the present embodiment includes a client 100 that transmits an access request, a plurality of authentication servers 200 that perform authentication of the client 100 and manage one or more entities, (200) and a first entity (211) of a first authentication server (210) closest to the client (100) among the plurality of authentication servers (200) Wherein the first entity (211) transmits the access request to the authentication server (200) of the plurality of authentication servers (200) when the first authentication server (210) 1 to the second entity 222 of the second authentication server 220 close to the first authentication server 210.

Specifically, each of the authentication servers 210, 220 and 230 manages a plurality of entities, and an access request is transmitted from the client 100 to the authentication server 200. In this case, But is transmitted to one or more of the entities managed by the authentication server 200. [ The rest of the configuration is the same as that of the previous embodiment, and redundant description is omitted.

When the network 400 receives the access request from the first client 110, the network 400 accesses the predetermined entity 213 of the first authentication server 210 closest to the first client 110 among the plurality of the authentication servers 200 An access request can be transmitted.

In this specification, the entity may be a virtual machine that operates as a virtual instance using the resources of the authentication server 200 or using the resources of the physical machine managed by the authentication server 200, Lt; / RTI > or physical machine itself.

That is, the authentication server and the entity may be a configuration implemented in a physically different apparatus, or a configuration implemented in the same apparatus.

Referring to FIG. 8, when the first client 110 transmits an access request through the network 400, the network 400 receives a first authentication request from the plurality of authentication servers 200, And may forward the access request to the third entity 213 of the server 210.

9, the third entity 213 of the first authentication server 210 may forward the access request of the received first client 110 to the first authentication server 210 connected thereto. When the first authentication server 210 can process the authentication for the access request, the authentication operation is performed and the authentication result is transmitted to the first client 110. [

10, when the first authentication server 210 is in the authentication disabled state, the third entity 213 of the first authentication server 210 transmits the access request of the first client 110, which is received, To the entity 223. The second authentication server 220 may be the authentication server closest to the first authentication server 210 or may be the authentication server second closest to the first client 110.

As described above, a plurality of entities may be virtual machines managed by a plurality of authentication servers, and may be located in the same or different apparatus as the authentication server.

Referring to FIG. 11, the third entity 223 of the second authentication server 220 may transmit the received access request and predetermined data included therein to the second authentication server 220.

Referring to FIG. 12, the second authentication server 220 can analyze the received access request. In this process, it is possible to verify whether the first authentication server 210 as a forwarder is eligible or not, If the first authentication server 210 is not included in the list of the servers, the first authentication server 210 and / or the third entity 213 of the first authentication server 210 are notified via the upper authentication server 300 The authentication process can be performed.

Referring to FIG. 13, the authentication result may be transmitted from the second authentication server 220 to the first client 110 after the authentication operation is performed.

As described in the foregoing embodiment, the first and second authentication servers 210 and 220 are physically separated from each other. Part or all of the plurality of authentication servers 200 can perform authentication according to different authentication policies have.

Hereinafter, a client authentication system according to another embodiment of the present invention will be described with reference to FIG. 14 to FIG. FIG. 14 is a diagram illustrating a client authentication system according to another embodiment of the present invention, and FIGS. 15 and 16 are views for explaining an authentication and assignment process according to the client authentication system of FIG.

The client authentication system according to the present embodiment includes a client 100 that transmits an access request, a plurality of authentication servers 200 that perform authentication of the client 100 and manage one or more entities, (200) to the first entity (213) of the first authentication server (210) closest to the client (100) among the plurality of authentication servers (200) The client 100 may be allocated a second entity 232 of the second authentication server 230 after the authentication is completed.

That is, the client authentication system according to the present embodiment may be the same as the client authentication system according to the previous embodiments, and the entity of the authentication server 200 is allocated to the client 100 after the authentication is completed .

As described above, a plurality of entities may be a virtual machine managed by a plurality of authentication servers 200, and an entity that receives the access request and processes the authentication and an entity that is allocated to the client after authentication are different from each other .

For example, as shown in FIG. 14, the first client 110 can perform an authentication process according to an access request through the third entity 213 of the first authentication server 210, The first entity 210 of the first authentication server 210 and the third entity 213 of the first authentication server 210 may be located at a position closest to the first client 110 in the geographical or physical proximity.

The second entity 232 of the third authentication server 230 allocated to the client 100 for the data processing after the authentication process is connected to the third entity 213 of the first authentication server 210, The first authentication server 210 and the third authentication server 230 may have the same configuration.

The second entity 232 of the third authentication server 230 allocated to the first client 110 using the data system or the like after the authentication process can be determined in consideration of resource allocation of the entire data system, 110). ≪ / RTI >

Referring to FIG. 15, in the same manner as in the previous embodiment, an access request is sent to the authentication server 210 based on the geographical or physical distance based on the connection position of the first client 110 via the network 400 Entity 213 and the third entity 213 as a predetermined entity transmits an access request to the first authentication server 210 so that the authentication process can be performed in the first authentication server 210. [ In this process, if the first authentication server 210 is in an authentication disabled state, the authentication process may be performed in another authentication server.

Referring to FIG. 16, after the authentication is completed, an entity may be allocated to perform data storage or processing by a data system manager or the like. In the illustrated example, the third entity 213 of the first authentication server 210, The second entity 232 of the third authentication server 230 is assigned to the first client 110 after the authentication is started. However, the present invention is not limited to this, The same or different entities of the authentication server 210 may be assigned to the first client 110. [

While the present invention has been described in connection with what is presently considered to be practical exemplary embodiments, it is to be understood that the invention is not limited to the disclosed embodiments, but, on the contrary, You will understand. It is therefore to be understood that the above-described embodiments are illustrative in all aspects and not restrictive.

100: Client
200: authentication server
300: upper authentication server
400: Network

Claims (18)

A client transmitting an access request;
A plurality of authentication servers for performing authentication of the client;
An upper authentication server for managing the plurality of authentication servers; And
And a network for transmitting the access request to a first authentication server closest to the client among the plurality of authentication servers,
When the first authentication server is in an authentication disabled state, the access request is transmitted to a second authentication server of the plurality of authentication servers close to the first authentication server,
And the second authentication server receives an authentication confirmation of the first authentication server from the upper authentication server when receiving the access request transmitted from the first authentication server. The method according to claim 1,
Wherein the upper authentication server authenticates whether the first authentication server and the second authentication server are registered authentication servers. delete The method according to claim 1,
Wherein the network distributes the access request based on geographical or physical distance based on a connection location of the client. The method according to claim 1,
Wherein the first and second authentication servers are physically spaced apart,
Wherein the first authentication server and the second authentication server perform authentication according to different authentication policies. A client transmitting an access request;
A plurality of authentication servers for performing authentication of the client and managing one or more entities;
An upper authentication server for managing the plurality of authentication servers; And
And a network for transmitting the access request to a first entity of a first authentication server closest to the client among the plurality of authentication servers,
The first entity forwards the access request to the second entity of the second authentication server, which is close to the first authentication server among the plurality of authentication servers,
And the second authentication server receives an authentication confirmation of the first authentication server from the upper authentication server when the second entity receives the access request forwarded from the first entity. The method according to claim 6,
The first entity forwards the access request to the second entity. The method according to claim 6,
Wherein the first entity and the second entity are both managed by the first authentication server and managed by the second authentication server. The method according to claim 6,
Wherein the upper authentication server authenticates whether the first authentication server and the second authentication server are registered authentication servers. delete The method according to claim 6,
Wherein the network distributes the access request to the first entity and the second entity based on a physical distance based on a connection location of the client. The method according to claim 6,
Wherein the first and second authentication servers are physically spaced apart,
Wherein the first authentication server and the second authentication server perform authentication according to different authentication policies. A client transmitting an access request;
A plurality of authentication servers for performing authentication of the client and managing one or more entities;
An upper authentication server for managing the plurality of authentication servers; And
And a network for transmitting the access request to a first entity of a first authentication server closest to the client among the plurality of authentication servers,
Wherein the client is assigned a second entity of a second authentication server after authentication is completed. 14. The method of claim 13,
Wherein the first entity and the second entity are different from each other. 14. The method of claim 13,
Wherein the first entity and the second entity are both managed by the first authentication server and managed by the second authentication server. 14. The method of claim 13,
Wherein the network distributes the access request to the first entity based on a physical distance based on a connection location of the client. 14. The method of claim 13,
Wherein the first and second authentication servers are physically spaced apart,
Wherein the first authentication server and the second authentication server perform authentication according to different authentication policies. 18. The method of claim 17,
Wherein the authentication policy differentially grants rights to the second entity of the client.

Images