JP2000132474A - Dynamic ciphered communication system, authentication server for dynamic ciphered communication, and gateway device - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a dynamic ciphered communication system which is capable of ciphered communication while effectively utilizing the administration address of a remote access server(RAS). SOLUTION: The dynamic ciphered communication system includes the RAS 50 which receives a request to access other networks through the Internet 20, an authentication server 40 which authenticates a user in response to an inquiry from the RAS 50 and dynamically gives a network address, and a gateway 36 which repeats the communication between the RAS 50 and Internet 20. The authentication server 40 requests a ciphered communication with a network which can be connected of the gateway 36 by network addresses given to users and the gateway 36 conducts a ciphered communication between the network address given to the user and the network address to which the user can be connected at the request.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a system for encrypted communication by a user who wants to connect to a specific network via a network.
The present invention relates to an encrypted communication system that enables encrypted communication when a user dynamically moves from one place to another and accesses a specific network from a remote access server (RAS) located in various places.

[0002]

2. Description of the Related Art With the recent development of communication technology, networking within a company has rapidly progressed. In addition, with the development of social infrastructure for communication, inter-network connections for connecting such enterprise-based networks have become widespread.
A typical example is the so-called Internet.

Normally, employees of a company use computers that are constantly connected to the network of the company. However, employees sometimes go out of the company network due to business trips or the like. In recent circumstances, even in such a case, the employee often needs to access the network of the company to which the employee belongs. In such a case, the employee usually connects to the company network to which the employee belongs as follows.

Referring to FIG. 7, for example, a company A network 24 connected to the Internet 20,
A remote access server 50 for accepting connection requests to the company B network 28 and the company C network 32 from the users 52, 54, 56,... Is connected to the Internet 20 via the gateway 150 and the router 34. Company A network 24, Company B network 28,
It is assumed that the company C network 32 is connected to the Internet 20 via the gateway 22, the gateway 26, and the gateway 30, respectively.

When a user 52 connects to the Internet 20 via a remote access server 50, for example,
The user 52 first accesses the remote access server 50 via a public communication network 58 such as a public telephone line or ISDN (Integrated Services Digital Network) to perform authentication. At this time, communication between the user 52 and the remote access server 50 is performed by using PPP (Point to Point Pr).
For example, a communication protocol called “autocol” is used. In the communication 62 according to the PPP protocol, information (communication address and the like) necessary for the remote access server 50 and the user 52 to start communication is transmitted and received.

The remote access server 50 has a user 52
Must authenticate whether is a legitimate user. Generally, since there are many remote access servers, each remote access server does not have user information necessary for authentication (hereinafter, referred to as “authentication information”), and collectively manages authentication information called an authentication server 152. Request authentication to the server. The communication protocol used at this time is RADIUS (Remote Authentication).
Cation Dial In User Service
ce) is used.

[0007] When the user is authenticated, the authentication server 152 further allocates a network address to be given to the user from a network address group 38 managed by the remote access server 50 and notifies the remote access server 50 of the information. . Since network addresses in the network address group 38 managed by the remote access server 50 are limited, each time a user connects, one of the available network addresses (not used by other users) is added. One is assigned to the user. Therefore, from the viewpoint of each user, the network address used by the user changes every time the user accesses the remote access server.

On the other hand, as described above, with the spread of the Internet, opportunities for users to access a network of a company to which the user belongs from the outside are increasing. However, if anyone is allowed to freely access the company's network from the outside, or if the contents of communication can be freely viewed on the way of communication, unauthorized networks will be allowed or the contents of communication will be known to people. This is dangerous. Therefore, access by a legitimate user can be performed without hindrance, but in order to protect the network from unauthorized access, encrypted communication is performed between the legitimate user and the network (network address group), and communication is thereby performed. There is a growing demand for ensuring the safety of people.

[0009] As a method for performing encrypted communication, it is common to use an encryption gateway. Also in the example shown in FIG. 7, the gateways 22, 26, 30, 150
Can be such an encryption gateway. When the encryption gateway is used and the processing speed is prioritized, it is necessary to register the network addresses of both for performing communication in the encryption gateway in advance.

[0010]

However, when the encryption gateway is used as described above, the following problems occur. In the example shown in FIG. 7, it is assumed that the user 52 is an employee of company A and tries to access the company A network 24 via the remote access server 50 by encrypted communication. Prior to this, the remote access server 5
It is necessary to register the network address group 38 managed by O.0 and the network address group of the company A network 24 in the gateway 150 and to set the encryption communication. When the user 52 accesses the remote access server 50, authentication is performed by the authentication server 152, and one unused network address from the network address group 38 managed by the remote access server 50 is allocated to the user 52. Since this network address is registered in the gateway 150 in advance, encrypted communication with the company A network 24 can be performed.

However, it is assumed that the user 54 is, for example, an employee of the company B. Also in this case, when the user 54 accesses the remote access server 50, the authentication server 15
2, the authentication is performed. As a result, one network address in the network address group 38 managed by the remote access server 50 is allocated to the user 54.
This network address is also registered in the gateway 150 as one that allows encrypted communication with the company A network 24. Therefore, the user 54 who is an employee of the company B can perform encrypted communication with the network 24 of the company A. This is a big problem.

In order to avoid such a problem, the following measures can be considered. The network address group 38 managed by the remote access server 50 is set for company A, company B,
Divide for company C. The divided network address group for company A and the network address group for company A are registered in gateway 150. Similarly, the network addresses for company B and company C are registered in the gateway 150. When a user 52 (employee of Company A) connects to the remote access server 50, the authentication server 15
2 assigns one unused network address to the user 52 from the group of network addresses assigned to Company A. When the user 54 (supposed to be an employee of Company B) accesses, the authentication server 152 allocates one unused network address among the network addresses for Company B to the user 54. In this way, the above problem can be avoided by allocating the network address for the company A to the employee of the company A and the company B for the employee of the company B.

However, in this case, if an employee of Company A requests an access while all of the network addresses for Company A are in use, some of the network addresses for Company B are not used. However, it cannot be allocated to the employees of Company A. Therefore, there arises a problem that the network address group 38 managed by the remote access server 50 cannot be used effectively.

After all, in the encryption gateway, although communication is performed, the network address must be specified in advance and the encryption setting must be performed. However, the location is dynamically moved and the remote access server from which to access is not known in advance. Since a fixed network address is not assigned to a non-user, it is impossible to set the encryption gateway in advance, thus causing such a problem.

Furthermore, if the same encryption method is used for all users, communication security cannot be sufficiently ensured if the encryption strength of the encryption method used is low. Conversely, if the encryption strength is high, that is the case. The load on the encryption gateway increases. Therefore, there is a problem that it is difficult to determine an optimal encryption method in consideration of the strength of the encrypted communication and the load on the encryption gateway. Further, in the case of performing the encrypted communication by devising a method for solving the above-described problem, there is a problem in how to manage the billing information.

Accordingly, an object of the present invention is to provide a dynamic encryption system capable of performing encrypted communication while effectively utilizing a network address managed by a remote access server even when a network address of a user is dynamically allocated. It is an object of the present invention to provide an encrypted communication system, an authentication server and a gateway device for dynamic encrypted communication therefor.

Another object of the present invention is to enable encrypted communication while effectively utilizing a network address managed by a remote access server even when a network address of a user is dynamically allocated. An object of the present invention is to provide a secure dynamic encryption communication system that optimizes communication security and system load, and an authentication server and a gateway device for the dynamic encryption communication therefor.

Still another object of the present invention is to perform encrypted communication and charge management while effectively utilizing a network address managed by a remote access server even when a network address of a user is dynamically allocated. It is an object of the present invention to provide a secure dynamic encryption communication system capable of optimizing the security of the encrypted communication and the load on the system, and an authentication server for the dynamic encrypted communication therefor.

[0019]

According to the first aspect of the present invention, there is provided a dynamic encryption communication system, comprising: a remote access server for receiving a request to access another network via a network between networks from a user; And an authentication server for performing user authentication in response to an inquiry from the remote access server, dynamically assigning a network address to each authenticated user and notifying the remote access server, and a remote access server. Connected between the server and the internetwork,
A gateway device for relaying communication from the remote access server to the inter-network, and the authentication server performs, for each network address given to each user, encrypted communication with a network to which connection is permitted. In response to a request for encrypted communication from the authentication server, the gateway device transmits a request between the network address given to the user and the network address permitted to connect to the user. Means for performing encrypted communication.

According to the above configuration, when the user issues an access request to the remote access server, the remote access server makes an inquiry about authentication to the authentication server. If authenticated, the authentication server further performs, for each network address assigned to the user,
The gateway device requests the gateway device for encrypted communication with the network to which connection is permitted, and the gateway device responds to the request with the network address assigned to the user and the encrypted communication to the user. Perform encrypted communication with possible network addresses. Only encrypted communication can be performed between the network address given to the authenticated user and the network address that can be encrypted by the user. Encrypted communication cannot be performed with a network address other than the network address set to enable encrypted communication. Further, the network address given to the user may be any address that is not used among the addresses managed by the remote access server,
It is not necessary to divide the address group in advance according to the number of networks to be connected. Therefore, the network address managed by the remote access server can be effectively used.

According to a second aspect of the present invention, in the dynamic encryption communication system according to the first aspect of the present invention, in addition to the configuration of the first aspect, the authentication server includes a user, a network address to which the user is permitted to connect, and Has information specifying the encryption method used for the combination of the above, and notifies the gateway apparatus of the information, and the gateway apparatus encrypts communication of the user by the encryption method notified from the authentication server. Do.

Since the encryption method used can be changed for each user, for example, when information to be handled is important, such as a company officer, an encryption method with a high encryption strength is set and communication is performed. Safety can be ensured.
In addition, for employees whose role is relatively unimportant, by setting an encryption method with a relatively low encryption strength,
The load on a gateway device or the like that performs encrypted communication can be reduced.

According to a third aspect of the present invention, in the dynamic encryption communication system, in addition to the configuration of the first or second aspect, the gateway device further includes a log of the encrypted communication. Including means. The authentication server further
Including means for collecting logs from the gateway device.

[0024] By taking a log of the encrypted communication by the gateway device and collecting the log by the authentication server, the billing for the encrypted communication can be easily managed.

The authentication server for dynamic encrypted communication according to the invention of claim 4 is an authentication server capable of communicating with a gateway device supporting encrypted communication, and is required for user authentication. A storage unit for storing information and information for specifying a network address with which each user performs encrypted communication; and, in response to a request from the remote access server, one of the network addresses managed by the remote access server. Means for dynamically assigning a user requesting connection to a remote access server, a network address assigned to the user, and a network address set by the user for encrypted communication. And an encryption notifying unit for notifying the gateway device of the password.

According to the above configuration, the remote access server makes an inquiry to the authentication server for authentication of a certain user, and when the authentication is successful, connection is permitted for each network address assigned to the user. Requests encrypted communication with the network from the gateway device. The gateway device can perform encrypted communication between the network address given to the user in response to the request and a network address that allows encrypted communication to the user. Only encrypted communication can be performed between the network address given to the authenticated user and the network address that can be encrypted by the user. Encrypted communication cannot be performed with a network address other than the network address set to enable encrypted communication. The network address given to the user is
Any address which is not used among addresses managed by the remote access server may be used, and there is no need to divide the address group in advance according to the number of networks to which the connection is made. Therefore, the network address managed by the remote access server can be effectively used.

According to a fifth aspect of the present invention, in the authentication server for dynamic encrypted communication, in addition to the configuration of the fourth aspect of the invention, the gateway device is configured to perform encryption using a designated encryption method. Communication means, wherein the storage means further stores information for specifying an encryption method used for communication between the user and a network address with which each user performs encrypted communication, The authentication server further includes means for notifying the gateway device of the encryption method.

Since an encryption method to be used can be set for each authenticated user, an encryption method having a high encryption strength is selected when the information to be handled is important, for example, a company officer. By doing so, communication security can be ensured. Further, for an employee whose role is relatively unimportant, by selecting an encryption method with a relatively low encryption strength, the load on a gateway server or the like that performs encrypted communication can be suppressed.

According to a sixth aspect of the present invention, in the authentication server for dynamic encrypted communication, in addition to the configuration of the fourth or fifth aspect of the invention, the gateway device further includes a log of the encrypted communication. Including means for recording, the authentication server further includes means for collecting logs from the gateway device.

[0030] By taking a log of the encrypted communication at the gateway device and collecting it at the authentication server, the billing for the encrypted communication can be easily managed.

A gateway device according to a seventh aspect of the present invention is a gateway device connected between a remote access server and an inter-network.
Means for receiving a request for encrypted communication from an authentication server capable of communicating with the remote access server, and a cipher for encrypting communication between network addresses included in a notification from the authentication server in response to the request; Communication means.

According to the above configuration, for each network address given to the authenticated user, a notification requesting that the encrypted communication with the network to which connection is permitted is enabled is sent to the gateway device. It is done. In response to this request, the gateway device can make settings for performing encrypted communication between the network addresses included in the notification. Since only encrypted communication can be performed between network addresses for which encrypted communication has been enabled on the authentication server, users with other settings on the authentication server must use networks other than the network address set on the authentication server. Cannot perform encrypted communication. The network address given to the user by the authentication server may be any unused address managed by the remote access server,
It is not necessary to divide the address group in advance according to the number of networks to be connected. Therefore, the network address managed by the remote access server can be effectively used.

In the gateway device according to the present invention, in addition to the configuration of the invention described in the seventh aspect, the request for encrypted communication further includes information for specifying a communication encryption method. The gateway device further selects a scheme of the encrypted communication performed by the encrypted communication unit based on the information for specifying the encryption scheme.

In response to a request from the authentication server, the gateway device can change the encryption method for each network address notified from the authentication server. Therefore, by appropriately combining a method with a high encryption strength and a method with a low encryption strength, it is possible to suppress the load on the gateway device and the like while ensuring communication security.

[0035]

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Referring to FIG. 1, a dynamic encryption communication system according to an embodiment of the present invention replaces authentication server 152 shown in FIG. 7 in addition to authentication information for each user. It includes an authentication server 40 that holds an authentication information database 72 that includes information for specifying a group of network addresses for which each user is permitted to perform encrypted communication. The authentication server 40 authenticates the user in response to a request from the remote access server 50, similarly to the authentication server 152, and provides the remote access server 50
Has a function of allocating one unused network address in the network address group 38 managed by the group.

The system further receives a request for encrypted communication from the authentication server 40. In response to this, the network address allocated to a user notified by the authentication server 40, the network address and the encryption It includes a gateway 36 for setting a group of network addresses permitted to perform communication, permitting encrypted communication between them, and notifying the authentication server 40.
In this embodiment, the gateway 36 also performs encrypted communication between the thus registered network addresses. Further, the gateway 36 has a function of recording a communication log 70 of the encrypted communication performed through the gateway 36. A conventional general method can be applied to the function itself for taking the communication log 70. The communication log 70 recorded in this manner is periodically collected by the authentication server 40 as described later, and is used for calculating billing information for each user.

In the system shown in FIG. 1, the same or similar elements as those of the conventional system shown in FIG. 7 are denoted by the same reference numerals. Their functions and names are also the same. Therefore, detailed description thereof will not be repeated here.

Referring to FIG. 2, authentication information database 7
Various configurations are conceivable as the configuration 2; in this example, the user name and the user authentication information (user identifier (user ID)
And password), the company to which it belongs (and thus the information identifying the network to which the user is allowed to perform encrypted communication), and the encryption used in the encrypted communication between the user and the other network address (es). And information for specifying the method. If the encryption method is the same for all users, information for specifying the encryption method is unnecessary.

The gateway 36 shown in FIG.
In order to clarify the functions of the authentication server 40 and the remote access server 50, the processing executed by these will be described with reference to the flowcharts of FIGS.
The operation of the entire system will be described later. In the following description, only processing for user authentication and setting of encrypted communication will be described in detail.
The other processes will not be described in detail, but it will be apparent to those skilled in the art that general processes for supporting communication are performed in each unit. In the following description and the flowcharts of FIGS. 3 to 6, processing for user authentication and setting of encrypted communication is described as being realized in a series of steps for the sake of convenience. It is performed in a multiplexed manner with the communication, so that the processing executed by each server and gateway does not follow such a sequence.

Prior to actual communication, each of the gateways 22, 26 and 30 performs encryption between all of the network address groups 38 managed by the remote access server 50 and their own network address groups. It is assumed that an address is registered and encrypted communication is set so as to perform communication. No settings are made in advance for the gateway 36 to enable encrypted communication.

Referring to FIG. 3, remote access server 50 performs the following processing. First, in step 80, communication from another is received. It is determined whether or not this is a connection request from the user (step 82). If it is not a connection request from the user, in step 90, a process corresponding to the received message is executed, and control is returned to step 80. If the request is a connection request from a user, the authentication server 40 is queried for authentication of the user (step 84). When the user is authenticated after performing the processing described with reference to FIG. 4, the authentication server 40 transmits information necessary for communication such as the network address allocated to the user to the remote server. The access server 50 is notified. The remote access server 50 receives the information from the authentication server 40 (Step 86), transmits the information to the user (Step 88), and returns the control to Step 80.

On the other hand, the authentication server 40 performs the following operation at the time of user authentication with reference to FIG. First, communication is received from any remote access server or gateway 36 (step 100). It is determined whether the received content is an authentication request from the remote access server (step 102). If not an authentication request, step 11
In step 2, processing is performed according to the received content, and control is performed again in step 1.
Return to 00.

If the result of determination in step 102 is that the received content is, for example, an authentication request from the remote access server 50, user authentication is performed with reference to the authentication information database 72 in step 104. Step 1 if authentication fails
At 16, the remote access server is notified that the authentication has failed, and the control returns to step 100.

If the authentication is successful, at step 106, one unused network address is selected from the network address group 38 managed by the remote access server 50. Then, information about which encryption method is to be used for the user is extracted from the authentication information database 72, and a notification that the user wants to enable encrypted communication between the user and the network of the organization to which the user belongs is extracted. Is performed on the gateway 36 (step 108).

The gateway 36 performs a process described later on the notification, and sends a notification that the encrypted communication is possible to the authentication server 40. Upon receiving the notification from the gateway 36 (step 110), the authentication server 40 notifies the remote access server of all information necessary for user communication. The information received by the remote access server 50 in step 86 of FIG. 3 is this information. After that, the authentication server 40 returns the control to step 100, and executes a process according to the next received content.

Further, the authentication server 40 has a function of periodically collecting logs recorded by the gateway 36. FIG. 5 shows a simple flowchart. In the example shown in FIG. 5, a process of collecting the communication log 70 from the gateway 36 is started at a regular time by using a timer function provided by an operating system of a computer constituting the server (step 120). In this process, the communication logs 70 of all the gateways 36 associated with the authentication server 40 are collected. This information is thereafter used by the authentication server 40 for managing the accounting information for the encrypted communication.

Referring to FIG. 6, gateway 36 performs the following processing. First, in step 130, the gateway 3
6 is received. The received content is a notification from the authentication server 40 (the authentication server 4 in step 108 of FIG. 4).
0 is issued) (step 132). If the notification is not from the authentication server 40, a process according to the received content is performed in step 142, and the control returns to step 130.

If the notification is from the authentication server 40, the control advances to step 134, where the network address notified from the authentication server 40 and the network to which the user belongs (the network to which the user is permitted to perform the encrypted communication) are displayed. It is set so that encrypted communication with the network address (group) can be performed. Then, a notification that the encrypted communication is possible is sent to the authentication server 40 (step 136). Thereafter, control returns to step 130, and the above-described processing is repeated.

Now that the individual functions have been described, the overall operation flow will be described. With reference to FIG. 1, as already mentioned, for the gateways 22, 26, 30
It is assumed that settings are made to enable encrypted communication between the network address group 38 managed by the remote access server 50 and the address group of each network. No settings are made in advance for the encrypted communication in the gateway 36.

For example, assume that the user 52 accesses the remote access server 50 via the communication 62 using the PPP protocol. Remote access server 50
Requests the authentication server 40 to authenticate the user 52 through the communication 60 by RADIUS. Authentication server 40
Performs authentication based on the authentication information for the user 52 stored in the authentication information database 72 in response to this request. If not authenticated, a notification to that effect is sent to the remote access server 50. When the user is authenticated, one unused network address in the network address group 38 managed by the remote access server 50 is allocated to the user 52. Thereafter, processing for encrypted communication with the user 52 is performed as follows.

The authentication server 40 checks a network address (group) at which the user 52 can perform the encrypted communication based on the information on the user 52 in the authentication information database 72, and finds out the network address assigned to the user 52,
A notification to the effect that the user 52 wants to be able to perform encrypted communication with a network of a company to which the user 52 can perform encrypted communication (for example, the company A network 24) is sent to the gateway 36.

The gateway 36 responds to this notification by
Only the notified network address is the notified company network (in this example, company A network 24).
Is set to enable encrypted communication. At this time,
It is assumed that the encryption method used is recorded in the authentication information database 72. Thereafter, the gateway 36 notifies the authentication server 40 that the encrypted communication is possible.
In response to the notification, the authentication server 40 notifies the remote access server 50 of all information necessary for the communication of the user 52. The remote access server 50 notifies this information to the user 52.

Thereafter, the user 52 and the company A network 24
Is performed via a route of the remote access server 50, the gateway 36, the router 34, the Internet 20, and the gateway 22. At this time, the gateway 36 encrypts the communication by an encryption method based on the notification from the authentication server 40. Since the gateway 22 is originally set to enable encrypted communication with the network address group 38 managed by the remote access server 50, the user 52 and the A
Encrypted communication with the company network 24 can be relayed.

According to this method, for example, the user 5 who has set in the authentication information database 72 such that only encrypted communication with the company B network 28 is possible is performed.
4 cannot communicate with the company A network 24 by encrypted communication. This is because, for the user 54, a network address group capable of performing encrypted communication in the same procedure as the user 52 is set by the gateway 36, but it is not the company A network 24 but the company B network 28. 24 is because encrypted communication cannot be performed.

Further, in the case of such a method, it is not necessary to classify the network address group 38 managed by the remote access server 50 into a company A, a company B, a company C, or the like in advance. Each time a new connection request is issued from a user, an unused one of the network address groups 38 managed by the remote access server 50 may be allocated to the user regardless of the user's affiliation. Therefore, there is an effect that all the network address groups 38 managed by the remote access server 50 can be used effectively.

The embodiments disclosed this time are to be considered in all respects as illustrative and not restrictive. The scope of the present invention is defined by the terms of the claims, rather than the description above, and is intended to include any modifications within the scope and meaning equivalent to the terms of the claims.

[Brief description of the drawings]

FIG. 1 is a block diagram showing an encryption communication system according to an embodiment of the present invention.

FIG. 2 is a diagram schematically illustrating an example of authentication information held by an authentication server according to the embodiment of the present invention.

FIG. 3 is a flowchart of a process performed by a remote access server of the system according to the embodiment of the present invention.

FIG. 4 is a flowchart of a process performed by an authentication server of the system according to the embodiment of the present invention.

FIG. 5 is a flowchart of log collection performed by the authentication server of the system according to the embodiment of the present invention.

FIG. 6 is a flowchart of a process performed by a gateway of the system according to the embodiment of the present invention.

FIG. 7 is a block diagram showing a conventional encrypted communication system.

[Explanation of symbols]

 22, 26, 30, 36, 150 Gateway 24, 28, 32 Network 40, 152 Authentication server 50 Remote access server 52, 54, 56 User 70 Communication log 72 Authentication information database

 ──────────────────────────────────────────────────続 き Continued on the front page F-term (reference) DB12 DB14 DB19

Claims (8)

[Claims] A remote access server that receives a request from a user to access another network via an inter-network, manages user information, performs user authentication in response to an inquiry from the remote access server, and performs authentication. An authentication server for dynamically assigning a network address to each of said users to notify the remote access server, and an authentication server connected between the remote access server and the internetwork; A gateway device that relays communication from the access server to the inter-network connection network, wherein the authentication server performs, for each network address assigned to each user, encrypted communication with a network to which connection is permitted. Requesting from the gateway device, The gateway device, in response to a request for encrypted communication from the authentication server, performs encrypted communication between the network address given to the user and a network address permitted to connect to the user. A dynamic encryption communication system including means. 2. The authentication server has information for specifying an encryption method used for a combination of a user and a network address to which the user is permitted to connect, and transmits the information to the gateway device. The dynamic encryption communication system according to claim 1, wherein the gateway device performs communication, and the gateway device encrypts communication by the user according to the encryption method notified from the authentication server. 3. The gateway device includes a unit for recording a log of encrypted communication, and the authentication server further includes a unit for collecting the log from the gateway device.
3. The dynamic encryption communication system according to claim 1. 4. An authentication server that can communicate with a gateway device that supports encrypted communication, and stores information necessary for user authentication and information specifying a network address for each user to perform encrypted communication. Storage means for storing, in response to a request from the remote access server, one of the network addresses managed by the remote access server to a user requesting connection to the remote access server. And an encryption notifying unit for notifying the gateway device of a network address assigned to the user and a network address set by the user to perform encrypted communication. Authentication server for dynamic encrypted communication. 5. The gateway device includes means for performing encrypted communication using a designated encryption method. The storage means further stores a user and a network address with which each user performs encrypted communication. The method according to claim 4, wherein information for specifying an encryption method used for communication between the devices is stored, and the authentication server further includes means for notifying the gateway device of the encryption method. Server for dynamic encrypted communication. 6. The gateway device includes a unit for recording a log of encrypted communication, and the authentication server further includes a unit for collecting the log from the gateway device.
An authentication server for dynamic encrypted communication according to item 1. 7. A gateway device connected between a remote access server and an internetwork, wherein the gateway device receives a request for encrypted communication from an authentication server capable of communicating with the remote access server. A gateway device including, in response to the request, encryption communication means for encrypting communication between network addresses included in the notification from the authentication server. 8. The request for encrypted communication further includes information for specifying an encryption method of communication, and the gateway device further includes: the information for specifying the encryption method based on the information for specifying the encryption method. The gateway device according to claim 7, wherein a method of encrypted communication performed by the encrypted communication means is selected.