RU104339U1 - ACCESS CONTROL SYSTEM FOR LOCAL COMPUTER NETWORKS USING AN ELECTRONIC IDENTIFIER - Google Patents

Abstract

 An access control system for local area networks using an electronic identifier, comprising a card reader, a computer, characterized in that the device comprises an access server, an authentication service, an authorization service, a network access control service, a network resource access control service, a traffic management service, an active network equipment through which communication with local area networks is established and a control device for active network equipment.

Description

The utility model relates to the field of computer network management and is intended to control access to local area networks using a universal identifier.

A well-known automated system for the provision of telecommunication services using a ticket of the Moscow metro with a magnetic strip (see RF application 99117300/09, 2000). However, this system does not contain information about the user on the card itself and does not imply the reuse of services from one card.

The closest in technical essence is the system of providing access to the Internet (see patent RU 98834 06/16/2010), in which, when using a smart card, a request is made to the user in the database, and when a positive response is received, an automatic connection to the network occurs Internet, on a pre-selected computer.

The disadvantage of this system is the inability to provide access to the resources of the local computer network and establish the appropriate traffic parameters based on the access rights the user has a personal identifier (smart card), the system is intended only to provide information to the user by establishing a connection to the Internet on a personal computer upon card activation, if there is an employee record in the database.

The technical task is to create a device that allows the user to provide a personal identifier (smart card) to the resources of several local area networks and set traffic parameters between the user's computer and selected networks based on user access rights.

EFFECT: increased security level of work in local area networks, simplified administration of local area networks, the ability to control user access to resources of local area networks based on a personal identifier.

It is achieved by the fact that the proposed device comprises a computer connected to an access server, an authentication service, an authorization service, a network access control service, a network resource access control service, a traffic management service, a card reader connected to a computer, an active network equipment control device, an active network equipment through which communication with local area networks is established.

The system is shown in the figure (functional diagram).

It contains a card reader 1, computer 2 with installed software, managed active network equipment 3, 4, 5, authentication service 7, authorization service 8, database management system (DBMS) 9, network access service 10, access service to network resources 11 , traffic management service 12, active network equipment control device 13. Card reader 1 is connected to computer 2, computer 2 is connected to access server 6. Access server 6 is connected to authentication service 7, authorization service 8, network access service 10, service access to network resources 11, traffic control service 12 and DBMS 9. Network access control service 10, network resource access control service 11, traffic control service 12 are connected to the active network equipment control device 13. The active network equipment control device 13 is connected to active network equipment 3, 4, 5.

The system operates as follows. Card reader 1 is connected to computer 2. Software is installed on computer 2. Computer 2 is connected to several networks (wired and wireless) through active network devices 3, 4, 5. The equipment in networks 1, n-1, n is configured in such a way as to constantly ensure the interaction of computer 2 with access server 6.

Card reader 1 contains the user's smart card. Computer 2 reads the user ID from the card reader 1. After reading the identifier, computer 2 passes it to the access server 6. After the user ID is received by the access server 6, the access server 6 sends the user ID to the authentication service 7. The authentication service 7 sends a request to search for the subscriber by the ID in DBMS 9. DBMS 9 searches for a subscriber in its database and returns the search result to access server 6. If the result is empty, i.e. failed to establish the identity of the subscriber, then the authentication service 7 returns the corresponding error code to the access service 6. Access service 6 informs computer 2 of the authentication error, and the user sees on the monitor screen of computer 2 an access denied message. If the search returned a non-zero result, then the authentication service 7 returns the data of the subscriber to the access server 6. After that, the access server 6 sends a request for a list of access rights of this subscriber to the authorization service 8. The authorization service 8 sends a request to search for access rights to the DBMS 9. DBMS 9 searches for access rights in its database. The DBMS 9 search result returns to the authorization service 8. If the result is empty, i.e. if it was not possible to obtain access rights for this subscriber, then authorization service 8 returns the corresponding error code to access server 6. Access server 6 informs computer 2 about the authorization error, and the user sees on the computer 2 monitor screen a message about denied access. If the search returned a non-zero result, then the authorization service 8 returns the subscriber’s access rights to the access server 6. After that, the access server 6 sends a request to the network access control service 10 for granting access to the networks to the subscriber, according to the access rights received from the authorization service 8. Next, the service network access control 10 transmits a request to configure the active network equipment 3, 4, 5 to the active network equipment control device 13. The active network equipment control device 13 produces us Roic active network equipment 3, 4, 5 to provide the user access to the network 1, n-1, n, in accordance with its access rights. After that, the network access control service 10 returns an access result message 6 to the access server 6. If granting access to the networks was successful, then the access server 6 sends a request to the network access control service 11 for granting the user access to the network resources to the active network equipment control device 13, according to the access rights received from the authorization service 8. Active network equipment control device 13 configures the active network equipment 3, 4, 5 to provide user access to network resources 1, n-1, n, according to his access rights. After that, the access control system for resources of the network 11 returns to the access server 6 a message about the result of granting access. If the provision of access to network resources was successful, then access server 6 sends a request to the traffic control system 12 for setting traffic parameters between the user and networks 1, n-1, n, according to the access rights received from the authorization service 8. Next, the traffic control system 12 sends a request to configure the active network equipment 3, 4, 5 to the active network equipment control device 13. The active network equipment control device 13 configures the traffic parameters between networks 1, n-1, n, and mpyuterom 2, according to user access rights. After that, the traffic control service 12 returns to the access server 6 a message about the result of setting the traffic parameters. If the setting of the traffic parameters was successful, then the access server 6 sends a message to computer 2 about the successful provision of access to the networks and the user sees an invitation to work on the network on the monitor screen of computer 2. If an error occurred during some operation of providing access to the network, then access server 6 sends an error message to computer 2, cancels all the changes made, and the user sees a message on the access denied on the computer 2 monitor screen.

As soon as computer 2 detects the absence of a smart card in the card reader, computer 2 sends a message to access server 6 about the need to turn off computer 2. Upon receipt of such a message, the access server sends a request to network access control service 10, network access control service 11 and service traffic control 12 to turn off the computer 2. Network access control service 10, the resource access control service of the network 11 and the traffic control service 12 sends a request to the active network management device Computer equipment 13 to disable two of the networks 1, n, n-1. The active network equipment control device 13 configures the active network equipment 3, 4, 5 to disconnect computer 2 from networks 1, n-1, n. After performing these requests, access to computer 2 to all networks will be blocked.

When using a smart card as user authorization, the presented system allows simplifying the administration of local area networks, ensuring confidentiality of access to network resources, increasing the security of a user’s network and protecting network resources from being used by a user without access rights.

The proposed device can improve the level of service and user control and increase the security of work in local area networks.

Claims (1)

An access control system for local area networks using an electronic identifier, comprising a card reader, a computer, characterized in that the device comprises an access server, an authentication service, an authorization service, a network access control service, a network resource access control service, a traffic management service, an active network equipment through which communication with local area networks is established and a control device for active network equipment.