JP2009193326A - Authentication system, authentication method and server - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an authentication system capable of also coping with terminal authentication of a radio LAN without depending on a sort of a tunneling communication system, having high user's operability and capable of improving security strength. <P>SOLUTION: The authentication system includes: a call control means; an authentication permission information provision means for call-connecting with a telephone terminal operated by a registered user by call control of the call control means, receiving a request from the telephone terminal, generating authentication permission information necessary for the authentication of an access destination, and providing the generated authentication permission information to the telephone terminal and an access control means; the access control means for determining whether authentication permission information acquired from a user terminal requesting connection to the access destination coincides with the generated authentication permission information or not; and an authentication means for authenticating the access destination by the user terminal. The telephone terminal inputs the authentication permission information to the user terminal as sound information, and the user terminal provides the authentication permission information input from the telephone terminal as the sound information to the access control means. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

  The present invention relates to an authentication system, an authentication method, and a server, and can be applied to an authentication system that performs secure communication from a remote location to a corporate network via, for example, a packet network.

  Conventionally, in order to connect to a corporate network from a remote location, for example, a method of performing user authentication using a one-time password generation device or the like and then connecting, for example, SSL-VPN or the like is common.

  In this user authentication, Non-Patent Document 1 describes that when a user logs in from a terminal, the authentication server performs authentication by calling back to the user's registered mobile phone via the telephone line network. A method of permitting use of a corporate network system only when authentication with a terminal and a mobile phone is successful is disclosed.

  In addition, in Non-Patent Document 1, as an application, a mobile phone that has already been registered by transmitting from the mobile phone registered in the authentication server to the authentication server and inputting a password simultaneously with user terminal authentication from the terminal It also shows how to authenticate by matching the calling number and password. In this case, it is necessary to store three combinations of a user ID and password input at the user terminal and a password input from the mobile phone.

  In Patent Documents 1 and 2, a user load for storing a password at the time of login by installing a password issuing server on the corporate network side, connecting to the password issuing server from a mobile phone, and inputting the acquired one-time password into the user terminal Shows a user authentication method for reducing the problem.

JP 2007-102777 A JP 2007-102778 A “Products Information Mobile Phone Authentication Service“ Secure Call ””, Third Networks Co., Ltd., December 17, 2007 search, Internet, URL: http://www.thirednetworks.co.jp/sc/03ser02.html

  However, the above-described conventional technology can cause the following problems.

  In the technology described in Non-Patent Document 1, the communication path connecting between a remote place and the corporate network depends on the software on the user terminal and the method of the VPN control device in the corporate network. Generally, a wireless LAN terminal that requires authentication at a remote place cannot be installed depending on SSL-VPN or the like.

  Further, in the technique described in Non-Patent Document 1, the telephone terminal used for user authentication is only a terminal in which a telephone number is registered in advance, and is limited to a terminal that can send a calling number from a public telephone network. It cannot be used for PBX extension calls or roaming from overseas.

  Furthermore, in the technique described in Non-Patent Document 1, authentication control is only control at the time of opening a communication path between a remote place and a corporate network, and a user terminal once opened cannot be disconnected from the remote place.

  In the technologies described in Patent Documents 1 and 2, the load on the user is reduced for the three input elements (user ID and password input from the user terminal and password input from the mobile phone), which are essential requirements in the technology of Non-Patent Document 1. is doing. However, a screen display such as a mobile phone is indispensable for a telephone terminal for user authentication, and the terminals that can be used are limited. In addition, the password obtained with the mobile phone must be manually input to the user terminal, which may cause an input error.

  All of the techniques of Non-Patent Document 1, Patent Document 1 and Patent Document 2 authenticate a user when accessing a corporate network system from a remote user terminal, and use a terminal or a user network (such as a wireless LAN). ) Is not limited. Therefore, if the terminal or network used by the user is vulnerable, the security strength is weakened.

  Therefore, it is possible to cope with terminal authentication of a wireless LAN without depending on the type of a communication method for tunneling over a network such as SSL-VPN, and an authentication system and authentication method with high user-friendliness and high security strength. And a server is sought.

  In order to solve this problem, an authentication system according to a first aspect of the present invention includes (1) call control means for performing call connection in response to a call connection request received through a voice communication network, and (2) a call of the call control means. Under control, a call connection is made with a telephone terminal operated by a registered user registered in advance, and upon receipt of a request for obtaining authentication permission information from the telephone terminal, authentication permission information necessary for authentication of the access destination is generated and the authentication is performed. Authentication permission information providing means for giving permission information as sound information to the telephone terminal and the access control means; and (3) a user terminal that performs access control to the access destination through the network and has made a connection request to the access destination. Authentication permission information required for authentication to the access destination, and the authentication permission information acquired from the user terminal is received Access control means for determining whether or not they match, and (4) when the authentication permission information from the user terminal is valid by the access control means, the user identification information registered in advance and the user identification information from the user terminal And (5) the telephone terminal inputs the authentication permission information acquired from the authentication permission information providing means to the user terminal as sound information, and (6) the user. The terminal is characterized in that the authentication permission information input as sound information from the telephone terminal is given to the access control means.

  An authentication method according to a second aspect of the present invention is an authentication method for authenticating a user who makes a connection request to an access destination. (1) A call control means receives a call from a user's telephone terminal received through a voice communication network. A call control step for performing a call connection in response to a connection request, and (2) an authentication permission information providing unit performs a call connection with a telephone terminal operated by a registered user registered in advance by call control of the call control unit, Upon receiving a request for acquiring authentication permission information from the telephone terminal, an authentication permission information providing step for generating authentication permission information necessary for authentication of the access destination and giving the authentication permission information to the telephone terminal and the access control means as sound information; (3) The access control means controls access to the access destination through the network, and authenticates the access destination for the user terminal that has made a connection request to the access destination. An access control step for requesting necessary authentication permission information and determining whether or not the authentication permission information acquired from the user terminal matches the authentication permission information received from the authentication permission information providing unit; and (4) the authentication unit includes: If the authentication permission information from the user terminal is valid by the access control means, the authentication step for performing authentication to the access destination based on the user identification information registered in advance and the user identification information from the user terminal, (5) The telephone terminal inputs the authentication permission information acquired from the authentication permission information providing means to the user terminal as sound information, and (6) the user terminal performs access control on the authentication permission information input as sound information from the telephone terminal. It is characterized by giving to a means.

  A server according to a third aspect of the present invention is a server for providing authentication permission information necessary for authentication processing of an access destination to a user's telephone terminal by an access control means when making a connection request to the access destination through a network, (1) When a call connection is made with a telephone terminal operated by a registered user registered in advance by call control of the call control means through a voice communication network, and an acquisition request for authentication permission information is received from the telephone terminal, An authentication permission information providing unit that generates authentication permission information necessary for authentication and gives the authentication permission information to the telephone terminal and the access control unit as sound information is provided.

  According to the present invention, it is possible to cope with terminal authentication of a wireless LAN without depending on the type of the tunneling communication method, and it is possible to improve the user's operability and increase the security strength.

(A) 1st Embodiment Below, the 1st Embodiment of the authentication system of this invention, a method, and a server is described with reference to drawings.

  In the first embodiment, the present invention uses various types of tunneling between a remote location and a corporate network using user authentication and terminal authentication used in the enterprise. In addition, this makes it possible to connect a wireless LAN access point or the like installed at a remote location using the same authentication server as in the company.

  In the configuration of the first embodiment, when user authentication is performed, a telephone terminal is used to identify whether the user is indeed a user authorized by a company. However, it is assumed that the user authentication operation is performed by a voice message using the PBX and the voice mail device in the corporate network so that it does not depend on the function and model of the telephone terminal to be used.

  Furthermore, focusing on the fact that recent PCs have a voice input function, it is possible to reduce input errors by directly inputting voice messages acquired by telephone terminals to a PC that is a user terminal.

(A-1) Configuration of First Embodiment FIG. 1 is a configuration diagram illustrating an overall configuration of a communication system 100 according to the first embodiment. In FIG. 1, a communication system 100 according to the first embodiment includes a user terminal 1, a packet network (PNW) 2, a VPN device 3, an authentication server 4, a corporate network 5, a PBX 6, a voice mail (VM) device 7, and a telephone network. 8. At least a telephone terminal 9 is provided.

  The user terminal 1 is connected to the VPN apparatus 3 via the packet network 2 and is connected to a system in the corporate network 5 when authentication by the authentication server 4 is successful. The user terminal 1 is a user terminal having a communication function, and for example, a personal computer (a concept including both a node type and a desktop type) can be applied.

  FIG. 2 is a configuration diagram illustrating a main internal configuration of the user terminal 1. In FIG. 2, the user terminal 1 has at least a VPN execution function unit 11 and a voice input unit 2.

  The VPN execution function unit 11 forms a tunneling path with the VPN apparatus 3 via the packet network 2 to realize secure communication. As the VPN execution function unit 11, a unit corresponding to the tunneling method employed by the VPN apparatus 3 can be employed.

  The voice input unit 12 can apply an existing microphone or the like included in the user terminal 1. As will be described later, the voice input unit 12 captures a user password generated by the telephone terminal 1 and provides the captured user password to the VPN execution function unit 11.

  The packet network 2 is a packet communication network represented by the Internet, for example. In the first embodiment, it is assumed that an IP (Internet Protocol) is adopted as a communication protocol, but the communication protocol is not particularly limited and can be widely applied. The packet network 2 may be a public network or a dedicated network. The packet network 2 is assumed to be a wired communication network, but may be a wireless communication network or a communication network in which the wired communication network and the wireless communication network are combined.

  The VPN apparatus 3 performs virtual communication processing with the user terminal 1 accessing the corporate network 5 via the packet network 2.

  FIG. 3 is a functional block diagram illustrating main internal functions of the VPN apparatus 3 according to the first embodiment. In FIG. 3, the VPN apparatus 3 includes at least a tunnel path connection processing unit 31 and an authentication notification unit 32.

  The tunnel path connection processing unit 31 forms a tunneling path with the user terminal 1 via the packet network 2 and performs secure communication through the tunneling path.

  The main functions of the tunneling connection processing unit 31 include at least a connection execution unit 311 and a password confirmation unit 312.

  The connection execution unit 311 executes tunneling connection setting with the user terminal 1. The connection execution unit 311 performs processing such as starting and continuing VPN communication of the user terminal 1 when the user ID acquired from the PBX 6 and the user terminal 1 by the password confirmation unit 312 and the user password required for user authentication match. Is. A detailed description of this process will be described in detail in the operation section.

  The password confirmation unit 312 confirms whether or not the user ID and user password received from the PBX 6 match the user ID and user password received from the user terminal 1.

  Here, the communication method by the tunneling path connection processing unit 31 is not particularly limited. For example, SSL- which performs virtual communication using SSL (Secure Sockets Layer) for performing encryption and server / client authentication is performed. Various methods such as the VPN method can be applied.

  The authentication notification unit 32 notifies the user terminal 1 of a notification necessary for authentication of the user terminal 1 in the processing by the tunneling connection processing unit 31.

  The authentication server 4 authenticates whether or not the terminal is accessible to the corporate network 5 or whether or not the user 10 using the user terminal 1 is an authorized user. The authentication server 4 holds in advance registration information of a user ID and a user terminal ID (for example, a MAC address) that are permitted to access the corporate network 5, and the user ID and user terminal ID of the user to be authenticated are stored in the VPN device. 3 to authenticate the user to be authenticated.

  The company network 5 is an in-house network operated by a company, and is a network that performs communication connection via the VPN device 3 with the user terminal 1 permitted to be accessed by the authentication server 4.

  In the first embodiment, the case where the access destination of the user terminal 1 is the corporate network 5 is illustrated for convenience of explanation, but the access destination is not limited to the corporate network, and communication is performed via the VPN device 3. It can be widely applied as long as it is connected.

  The PBX 6 is connected to the telephone network 8 and performs processing such as connection processing between telephone terminals. When the PBX 6 receives a call request addressed to the voice mail (VM) device 7 from the telephone terminal 9 that has been operated by the user 10, the PBX 6 connects to the voice mail (VM) device 7.

  The voice mail (VM) device 7 makes a call connection with the telephone terminal 9 of the user 10 by the connection process of the PBX 6 and transmits a predetermined voice message as to whether or not to connect to the corporate network 5 to the telephone terminal 9. It is.

  FIG. 4 is a functional block diagram showing internal functions of the voice mail (VM) apparatus 7 according to the first embodiment. In FIG. 4, the voice mail (VM) device 7 includes at least a session processing unit 71, a voice message transmission unit 72, a password management unit 73, and a communication unit 74.

  The session processing unit 71 performs session processing related to voice communication. When receiving a call request from the PBX 6 to the telephone terminal 9, the session processing unit 71 sends back a response to the call request and sends a voice to the telephone terminal 9. Communication is realized.

  The voice message sending unit 72 sends a preset voice message to the telephone terminal 9 when a call connection with the telephone terminal 9 is established.

  An example of the voice message at this time is a guidance message for VPN connection. For example, as an example of a voice message of a VPN connection guidance message, “Please press“ 1 ”to make a VPN connection, press“ 2 ”to make a continuous connection, or press“ 3 ”to disconnect.” ” Voice messages can be applied.

  The password management unit 73 holds a user ID and a voice mail (VM) 7 password. The password management unit 73 determines the validity of the user ID input from the telephone terminal 9 and the password of the voice mail (VM) 7, and generates a user password necessary for user authentication if the password is valid.

  The password management unit 73 transmits a VPN connection registration notification including the generated user password and user ID to the VPN apparatus 3 and transmits the user password to the telephone terminal 9 by a voice message or a PB signal. .

  Here, the user password required for user authentication is a password generated by the voice mail (VM) device 7, and the generation method is not particularly limited, and various methods can be widely applied. For example, the password management unit 73 may have a once-time password generation function, and a password generated by the once-time password generation function may be applied. For example, the password management unit 73 registers a password for each user in advance. In addition, the registered password may be applied.

  When the password management unit 73 receives a response from the user's telephone terminal 9 to continue the VPN connection, the password management unit 73 acquires the user ID and the user password from the telephone terminal 9, and obtains the user ID and the user password. A VPN connection continuation notification is transmitted to the VPN apparatus 3 and a user password is transmitted to the telephone terminal 9 by a voice message or PB signal.

  Further, when receiving a response for disconnecting the VPN connection from the user's telephone terminal 9, the password management unit 73 acquires the user ID and user password from the telephone terminal 9, and obtains the user ID and user password. The VPN connection disconnection notification is transmitted to the VPN apparatus 3.

  The communication unit 74 communicates with the PBX 6 or the VPN device 3.

  The telephone network 8 is a telephone line network, and a public telephone line or an extension network can be applied.

  The telephone terminal 9 is a telephone terminal possessed by the user 10, and includes, for example, a cellular phone, a PHS terminal, a telephone function of an information terminal (for example, a PDA), a telephone function installed in a PC, a telephone with no display, Etc. can be applied.

  The telephone terminal 9 makes a call request to the voice mail (VM) device 7 to the PBX 6 in order for the user 10 to perform authentication necessary for access to the corporate network 5. The telephone terminal 9 acquires a user password from the voice mail (VM) device 7 by a voice message or a PB signal. Further, the telephone terminal 9 is connected to the microphone of the user terminal 1 and inputs a voice message or PB signal of the user password.

  Thus, since the password (voice message or PB signal) can be input from the telephone terminal 9 to the microphone of the user terminal 1, password input operations and input errors can be eliminated.

  At this time, the telephone terminal 9 may pronounce the password acquired from the voice mail (VM) device 7 as it is, or temporarily store the password in the storage means of the telephone terminal 9 and store it in the storage means. The password may be played back.

(A-2) Operation of the First Embodiment Next, the user authentication processing operation of the first embodiment will be described in detail with reference to the drawings.

  The following is a user authentication process required when accessing the corporate network 5 from a user terminal 1 located at a remote location. In order to explain this user authentication process in detail, the connection is continued when the connection to the corporate network 5 is started. The case will be described separately at the time of cutting.

(A-2-1) At Start of Connection to Corporate Network 5 FIG. 5 is a sequence showing user authentication processing at the start of connection to corporate network 5.

  First, when the user 10 requests access to the corporate network 5, the user 10 operates the telephone terminal 9 to make a call to the voice mail (VM) device 7 (S101).

  When a connection request addressed to the voice mail (VM) device 7 is given from the telephone terminal 9 to the PBX 6 via the telephone network 8, a connection request related to this call is given to the voice mail (VM) 7 by the PBX 6 (S102). ) Receives a response from the voice mail (VM) device 7 (S103), and makes a call connection between the telephone terminal 9 and the voice mail (VM) device 7.

  The voice mail (VM) 7 connected to the telephone terminal 9 notifies the telephone terminal 9 by voice of a guidance message for VPN connection (S104).

  For example, when a voice mail (VM) device 7 notifies the user of a guidance message such as “Enter 1 for VPN connection, 2 for continuous connection, 3 for disconnection”, etc. 10 operates the telephone terminal 9 to input work NO (S105).

  At this time, the voice mail (VM) device 7 also notifies the telephone terminal 9 of a voice message prompting a user ID and password input request for authentication together with a VPN connection guidance message. Then, the user 10 inputs a user ID and a password to the voice mail (VM) device 7 from the telephone terminal 9 by a PB signal (S105).

  The voice mail (VM) device 7 refers to the registration information and determines that the user ID acquired from the telephone terminal 9 and the password to the VM 7 are valid. When it is determined that the input user ID and the password to the VM 7 are valid, the voice mail (VM) apparatus 11 generates a user password necessary for user authentication for VPN connection (S106).

  The voice mail (VM) device 7 sends a message for registering the generated user password together with the user ID to the VPN device 3 (S107), and transmits the user password to the telephone terminal 9 by voice message or PB signal (S108). .

  The voice mail (VM) device 7 transmits a user password to the user terminal 1 and then transmits a disconnection request to the PBX 6 (S122). In response to this, the PBX 6 disconnects the call with the user terminal 1. (S123).

  On the other hand, the user 10 logs in (connection request) to the VPN apparatus 3 from the user terminal 1 via the packet network (PNW) 2 (S109). At this time, the VPN apparatus 3 acquires the user terminal ID of the user terminal 1.

  When connecting between the user terminal 1 and the VPN apparatus 3, the VPN apparatus 3 displays a message prompting the user terminal 1 to input a user ID and a user password for user authentication (S110).

  In response to this, the user 10 inputs the user password acquired from the voice mail (VM) device 7 to the user terminal 1 using the telephone terminal 9 (S111).

  The user password may be input manually by the user 10, or the user terminal 1 is connected to the microphone of the voice input unit 12 and the telephone terminal 9, and a voice message or PB signal is sent to the user. It is also possible to send it to the terminal 1.

  When the user ID and user password are input to the user terminal 1, the user ID and user password are transmitted to the VPN apparatus 3 (S112).

  When the user ID and the user password are input from the user terminal 1 in the VPN apparatus 3, the user ID and user password from the user terminal 1 and the user ID from the voice mail apparatus 7 are input by the password confirmation unit 312 of the VPN apparatus 3. And it is confirmed whether or not the user password matches (S113).

  If the password confirmation unit 312 determines that they do not match, the authentication notification unit 32 transmits an error message to the user terminal 1 (S114).

  On the other hand, if the password confirmation unit 312 determines that they match, the authentication notification unit 32 transmits the user ID and the user terminal ID to the authentication server 4 to make an authentication request (S115).

  The authentication server 4 performs an authentication process using the user ID and user terminal ID from the VPN apparatus 3 while referring to the registered information of the registered user registered in advance (S116).

  If the authentication server 4 is authenticated NG, an error message is notified from the authentication server 4 to the user terminal 1 (S117). If the authentication is OK, the authentication server 4 informs the VPN to that effect. It returns to the apparatus 3 (S118).

  After authentication by the authentication server 4, the connection execution unit 311 of the authentication server 4 performs VPN connection processing with the user terminal 1 (S119). When the connection with the user terminal 1 is completed (S120), the user terminal 1 can access various systems (mail server, file server, etc.) in the corporate network 5 (S121).

(A-2-2) Continuation of Connection to Corporate Network 5 FIG. 6 is a sequence showing user authentication processing when the connection to corporate network 5 is continued.

  First, when the connection between the user terminal 1 and the VPN apparatus 3 is completed in S121 of FIG. 6, the VPN apparatus 3 times a timer, and when a predetermined time (T) has elapsed (S201), whether or not registration extension is necessary. Is transmitted to the user terminal 1 (S202).

  When this warning message is displayed on the user terminal 1, the user 10 uses the telephone terminal 9 to use the voice mail (VM) device 7 as in the VPN connection processing (S 101 to S 108, S 111, S 112). The connection request is selected in accordance with the guidance message, the user ID and password are transmitted, the user password is acquired from the voice mail device 7, and the acquired user password is input to the user terminal 1. (S203 to S212).

  The voice mail (VM) device 7 transmits a user password to the user terminal 1 and then transmits a disconnection request to the PBX 6 (S218). In response to this, the PBX 6 disconnects the call with the user terminal 1. (S219).

  On the other hand, the VPN device 3 determines whether or not the user ID and user password from the user terminal 1 match the user ID and user password from the voice mail (VM) device 7 (S213). In step S214, an error message is transmitted to the user terminal 1 (S214). If they match, the VPN connection is continued (S215).

  At this time, the VPN apparatus 3 measures the timer after transmitting the warning message. When the predetermined time (T2) elapses and a timeout occurs (S216), if the user ID and the user password from the user terminal 1 cannot be confirmed, the VPN apparatus 3 transmits an error message to the user terminal 1. Then, the cutting process is performed (S217).

(A-2-3) When Disconnecting Corporate Network 5 FIG. 7 is a sequence showing user authentication processing when disconnecting the corporate network 5.

  When the user 10 disconnects access to the corporate network 5, the user 10 operates the telephone terminal 9 to make a call to the voice mail (VM) device 7 (S301).

  When a connection request addressed to the voice mail (VM) device 7 is given from the telephone terminal 9 to the PBX 6 via the telephone network 8, a connection request regarding this call is given to the voice mail (VM) 7 by the PBX 6 (S302). ), A response from the voice mail (VM) device 7 is received (S303), and a call connection is made between the telephone terminal 9 and the voice mail (VM) device 7.

  The voice mail (VM) 7 connected to the telephone terminal 9 notifies the telephone terminal 9 by voice of a guidance message for VPN connection (S304).

  Then, the user 10 inputs a work NO for disconnecting the connection based on the voice message, and inputs a user ID and a password to the voice mail (VM) device 7 using a PB signal (S305).

  The voice mail (VM) device 7 refers to the registration information and determines that the user ID acquired from the telephone terminal 9 and the password to the VM 7 are valid. When it is determined that the input user ID and the password to the VM 7 are valid (S306), the voice mail (VM) device 11 sends a deletion notification of the user ID and the user password to the VPN device 3 (S307). ). In this way, it is possible to prevent password information from remaining in the VPN apparatus 3 by deleting the password by the VPN apparatus 3.

  In response to this, the VPN apparatus 3 deletes the user ID and the user password, and disconnects the connection with the user terminal 1 (S308).

  The voice mail (VM) device 7 transmits a user password to the user terminal 1 and then transmits a disconnection request to the PBX 6 (S309). In response to this, the PBX 6 disconnects the call with the user terminal 1. (S310).

(A-3) Effect of First Embodiment As described above, according to the first embodiment, a user can use a telephone terminal to connect to a corporate network from a remote location without providing a special user authentication device. Can be accessed via a secure communication path.

  According to the first embodiment, since the user terminal is also authenticated as a terminal prepared by a company, it is possible to provide remote access means with high security strength. Further, a telephone terminal used for user authentication is not prepared by a company, and can be widely applied without depending on various functions and models. Furthermore, since the password can be acquired via the PBX, it can be used even when the initial number cannot be notified, such as roaming from overseas, and therefore, it is a highly versatile authentication method.

  In the first embodiment, a user requests user authentication using a telephone terminal. However, since a user password can be obtained by voice from a voice mail device via PBX, a telephone terminal used for authentication is specified. Not so versatile. That is, the present invention can also be applied to a voice-only telephone terminal without a screen, an extension terminal connected to the PBX, or a call from overseas.

  Further, according to the first embodiment, when a microphone or the like is mounted on the user terminal, the password issued from the telephone terminal can be input without performing the user's manual input. It is possible to eliminate operation burden and erroneous input.

  Furthermore, according to the first embodiment, connection start, continuation, and disconnection of VPN access can be performed from a telephone terminal. Furthermore, if the user terminal is disconnected from the telephone terminal within a certain period of time after connection, or the registration is deleted from the telephone terminal when the connection is disconnected, access can be made even if the user terminal is misplaced or stolen.

(B) Second Embodiment Next, a second embodiment of the authentication system, method and server of the present invention will be described with reference to the drawings.

(B-1) Configuration of Second Embodiment FIG. 8 is a configuration diagram showing an overall configuration of a communication system 200 of the second embodiment. In FIG. 8, the communication system 200 according to the second embodiment includes a user terminal 1, a packet network (PNW) 2, an authentication server 4, a corporate network 5, a PBX 6, a voice mail (VM) device 7, a telephone network 8, and a telephone terminal. 9 and at least a wireless access point 20 and a wireless & tunnel control device 21.

  The second embodiment is different from the first embodiment in that the user terminal 1 is a terminal having a wireless communication function and is connected to the packet network 2 through the wireless access point 20.

  The second embodiment is different from the first embodiment in that a wireless & tunnel control device 21 is provided instead of the VPN device 3 connected to the corporate network 5.

  Therefore, in the following, the features that are characteristic of the second embodiment will be described in detail, and the description of the configuration and operation already described in the first embodiment will be omitted.

  The user terminal 1 is a terminal having a wireless communication function as described above. For example, a personal computer or a portable information terminal having a wireless communication function can be applied. The configuration of the user terminal 1 includes wireless communication means for performing wireless access with the wireless access point 20.

  The wireless access point 20 is an access point device that is wirelessly connected to one or a plurality of user terminals 1. The wireless access point 20 has a tunnel control function unit 201.

  The tunnel control function unit 201 performs virtual communication between one or a plurality of user terminals 1 wirelessly connected to the wireless & tunnel device 21 via the packet network 2.

  Here, various methods related to the wireless terminal can be widely applied as a communication method by the tunnel control function unit 201. For example, a plurality of SSIDs (Service Set Identifiers) are set, and a VLAN is set for each of the plurality of SSIDs. It is possible to apply a VPN method using an SSID that communicates with the tag attached.

  The wireless & tunnel control device 21 performs setting processing of the user terminal 1 connected to the wireless access point 20 together with connection setting of a secure tunneling path with the wireless access point 20 via the packet network 2. is there.

  FIG. 9 is a configuration diagram showing an internal configuration of the wireless & tunnel control device 21. As illustrated in FIG. 9, the wireless & tunnel control device 21 includes at least a tunnel path connection processing unit 210, an authentication notification unit 213, and a wireless AP management unit 214.

  Since the tunnel path connection processing unit 210 and the authentication notification unit 213 correspond to the tunnel path connection processing unit 31 and the authentication notification unit 32 of the first embodiment, detailed description thereof is omitted here.

  The wireless AP management unit 214 manages settings of the user terminal 1 connected to the wireless access point 20.

  Here, as the setting process by the wireless AP management unit 214, for example, by managing the SSID of the wireless access point 20 in association with the user terminal ID of the user terminal 1, the wireless access point 20 and the user terminal 1 are associated with each other. It is possible to apply the management method.

  As described above, since the wireless & tunnel control device 21 can cope with virtual communication of wireless communication, not only the case of VPN as in the first embodiment but also a remote access system by wireless communication can be supported.

(B-2) Operation of Second Embodiment Next, an operation of user authentication processing of the second embodiment will be described with reference to the drawings.

  The following is a user authentication process required when accessing the corporate network 5 from a user terminal 1 located at a remote location. In order to explain this user authentication process in detail, the connection is continued when the connection to the corporate network 5 is started. The case will be described separately at the time of cutting.

(B-2-1) At Start of Connection to Corporate Network 5 FIG. 10 is a sequence showing user authentication processing at the start of connection to corporate network 5.

  First, processing when the user 10 requests access to the corporate network 5 is the same as in the first embodiment.

  That is, the user 10 operates the telephone terminal 9 to make a call to the voice mail (VM) device 7 (S101), and the PBX 6 performs call connection with the voice mail (VM) device 7 (S102, S103). ). After the call connection, the voice mail (VM) device 7 transmits a guidance message to the telephone terminal 9 (S104). In response to the user operation, the telephone terminal 9 transmits a connection start work number, a user ID, and a password according to the guidance message to the voice mail (VM) device 7.

  After determining the validity of the user ID and user password acquired from the telephone terminal 9, the voice mail (VM) device 7 generates a user password necessary for user authentication of the tunnel connection (S106), and uses the generated user password. A message for notifying registration is sent to the wireless & tunnel control device 21 together with the user ID (S107), and the user password is transmitted to the telephone terminal 9 by voice message or PB signal (S108).

  The voice mail (VM) device 7 transmits a user password to the user terminal 1 and then transmits a disconnection request to the PBX 6 (S122). In response to this, the PBX 6 disconnects the call with the user terminal 1. (S123).

  On the other hand, the user 10 operates the user terminal 1, accesses the wireless access point 20, connects to the packet network 2, and logs in (connection request) to the wireless & tunnel control device 21 (S401). At this time, the wireless & tunnel control device 21 acquires the user terminal ID of the user terminal 1.

  When connecting between the user terminal 1 and the wireless & tunnel control device 21, the wireless & tunnel control device 21 displays a message prompting the user terminal 1 to input a user ID and a user password for user authentication (S402). .

  In response to this, the user 10 inputs the user password acquired from the voice mail (VM) device 7 to the user terminal 1 using the telephone terminal 9 (S111).

  The user password may be input manually by the user 10 as in the first embodiment, or connected to the microphone of the voice input unit 12 of the user terminal 1 and the telephone terminal 9. It is also possible to send a voice message or PB signal to the user terminal 1.

  When the user ID and the user password are input to the user terminal 1, the user ID and the user password are transmitted to the wireless & tunnel control device 21 (S112).

  When the user ID and the user password are input from the user terminal 1 in the wireless & tunnel control device 21, the user ID and the user password from the user terminal 1 and voice mail are received by the password confirmation unit 212 of the wireless & tunnel control device 21. It is confirmed whether or not the user ID and the user password from the device 7 match (S113).

  If the password confirmation unit 212 determines that they do not match, the authentication notification unit 213 transmits an error message to the user terminal 1 (S114).

  On the other hand, if it is determined by the password confirmation unit 212 that they match, the authentication notification unit 213 transmits the user ID and the user terminal ID to the authentication server 4 to make an authentication request (S115).

  The authentication server 4 performs an authentication process using the user ID and user terminal ID from the tunnel device 3 while referring to the registered information of the registered user registered in advance (S116).

  If the authentication server 4 is authentication NG, an error message is notified from the authentication server 4 to the user terminal 1 (S117). If the authentication server 4 is authentication OK, the authentication server 4 wirelessly notifies that fact. & Returns to the tunnel control device 21 (S118).

  Upon receiving the authentication OK message from the authentication server 4, the wireless & tunnel control device 21 performs tunnel connection processing with the wireless access point 20 (S 403).

  The wireless & tunnel control device 21 performs connection setting processing for communication with the user terminal 1 via the wireless access point 20 (S404), and performs wireless LAN setting between the wireless access point 20 and the user terminal. (S405) A secure tunneling path connection setting is performed between the wireless access point 20 and the user terminal 1 wirelessly connected.

  That is, the wireless & tunnel control device 21 manages the SSID of the wireless access point 20 and the user terminal ID of the user terminal 1 wirelessly connected to the wireless access point 20 in association with each other. Thereby, the wireless & tunnel control device 21 can set a tunneling path with the wireless access point 20, and can perform secure communication on the communication data of the user terminal 1 by using this tunneling path.

  Thereafter, the user terminal 1 can access various systems (such as a mail server and a file server) in the corporate network 5 (S406).

(B-2-2) Connection Continued to Corporate Network 5 FIG. 11 is a sequence showing user authentication processing when connection to the corporate network 5 continues.

  First, when the connection with the wireless access point 20 is completed in S406 of FIG. 11, the wireless & tunnel control device 21 measures a timer. When a predetermined time (T) has elapsed (S201), a warning message indicating whether registration extension is necessary is transmitted to the user terminal 1 (S501).

  When this warning message is displayed on the user terminal 1, processing using the telephone terminal 9 of the user 10, processing of the voice mail (VM) device 7, and continuation request processing of the user terminal 1 and the wireless & tunnel control device 21 are performed. This is the same as the processing of S203 to S215 of the first embodiment.

  That is, the user 10 makes a call to the voice mail (VM) device 7 using the telephone terminal 9 (S203 to S205). Then, in accordance with the guidance message of the voice mail (VM) device 7 (S206), the operation number indicating that the operation is continued, the password for accessing the voice mail (VM) device 7 and the user ID are input (S207). The generated user password is heard by voice or PB signal (S210) and input to the user terminal 1 (S211).

  When the input of the user password from the user terminal 1 is completed within a certain time (T2) (S216), the wireless & tunneling control device 4 and the user password from the voice mail (VM) 7 and the user from the user terminal 1 A match with the password is determined (S213), and when the user password matches, the communication path (session) continues (S215). If they do not match, the wireless & tunneling control device 4 transmits an error message to the user terminal 1 (S214).

  On the other hand, when time-out occurs, the wireless & tunneling control device 4 displays a disconnect message on the user terminal 1 and performs disconnect processing (S217).

(B-2-3) When disconnecting the corporate network 5 FIG. 12 is a sequence showing a user authentication process when disconnecting the corporate network 5.

  The process in which the user 10 disconnects the access to the corporate network 5 is different from the process at the time of disconnection in the first embodiment in that the wireless & tunnel control device 21 disconnects the communication path with the wireless access point 20. The processing other than is the same as the processing at the time of cutting in the first embodiment.

  That is, the user 10 operates the telephone terminal 9 to make a call to the voice mail (VM) device 7 (S301).

  When a connection request addressed to the voice mail (VM) device 7 is given from the telephone terminal 9 to the PBX 6 via the telephone network 8, a connection request regarding this call is given to the voice mail (VM) 7 by the PBX 6 (S302). ), A response from the voice mail (VM) device 7 is received (S303), and a call connection is made between the telephone terminal 9 and the voice mail (VM) device 7.

  The voice mail (VM) 7 connected to the telephone terminal 9 notifies the telephone terminal 9 by voice of a guidance message for VPN connection (S304).

  Then, the user 10 inputs a work NO for disconnecting the connection based on the voice message, and inputs a user ID and a password to the voice mail (VM) device 7 using a PB signal (S305).

  The voice mail (VM) device 7 refers to the registration information and determines that the user ID acquired from the telephone terminal 9 and the password to the VM 7 are valid. When it is determined that the input user ID and the password for the VM 7 are valid (S306), the voice mail (VM) device 11 notifies the wireless & tunnel control device 21 of the deletion of the user ID and the user password. Send (S307).

  In response to this, the wireless & tunnel control device 21 deletes the user ID and the user password, and disconnects the connection with the wireless access point 20 (S601).

  The voice mail (VM) device 7 transmits a user password to the user terminal 1 and then transmits a disconnection request to the PBX 6 (S309). In response to this, the PBX 6 disconnects the call with the user terminal 1. (S310).

(B-3) Effects of Second Embodiment As described above, according to the second embodiment, the effects described in the first embodiment can be achieved.

  Further, according to the second embodiment, even when the user performs remote access in a wireless network environment such as a wireless LAN, an access means with high security strength can be provided.

(C) Other Embodiments (C-1) The processing sequence at the start of access shown in FIGS. 5 and 10 is an example, and the order of processing is not particularly limited.

  For example, in FIG. 5 and FIG. 10, it is assumed that the user logs in to the VPN device (wireless & tunnel control device) from the user terminal after obtaining the user password using the telephone terminal. However, the order of the user password acquisition process and the login process to the VPN apparatus (wireless & tunnel control apparatus) may be reversed.

  In this case, the VPN device (wireless & tunnel control device) counts a timer when there is a login from the user terminal, and if a user password is not input from the voice mail device even after a predetermined time has elapsed, it is timed out. It may be. Thereby, security intensity | strength can be raised.

(C-2) Regarding the user password input process from the telephone terminal to the user terminal, the first and second embodiments have described the case where sound is emitted from the telephone terminal toward the microphone of the user terminal. . As this modified embodiment, for example, a method in which a user terminal and a telephone terminal are connected by wire and voice is input to the telephone terminal may be applied.

(C-3) The processing of each constituent element such as the voice mail device, VPN device, wireless & tunnel control device, wireless access point, etc. described in the first and second embodiments is realized by software processing. .

  Therefore, as for the various functions of each component, if the various functions described in the first and second embodiments can be realized, physical functions such as a voice mail device, a VPN device, a wireless & tunnel control device, a wireless access point, etc. Even if they are not present in the same apparatus, they may be distributed.

  Conversely, for example, the PBX may be provided with various functions of the voice mail apparatus described in the first and second embodiments. Further, for example, the VPN device may be provided with various functions of the voice mail device. Further, various functions of the VPN device, the voice mail device, and the PBX may be installed in the same server.

1 is an overall configuration diagram of a communication system according to a first embodiment. It is an internal block diagram of the user terminal of 1st Embodiment. It is an internal block diagram of the VPN apparatus of 1st Embodiment. It is an internal block diagram of the voice mail apparatus of 1st Embodiment. It is a sequence which shows the process at the time of the connection start to the corporate network of 1st Embodiment. It is a sequence which shows the process at the time of the connection continuation to the corporate network of 1st Embodiment. It is a sequence which shows the process at the time of the cutting | disconnection to the corporate network of 1st Embodiment. It is a whole block diagram of the communication system of 2nd Embodiment. It is an internal block diagram of the radio | wireless & tunnel control apparatus of 2nd Embodiment. It is a sequence which shows the process at the time of the connection start to the corporate network of 2nd Embodiment. It is a sequence which shows the process at the time of the connection continuation to the corporate network of 2nd Embodiment. It is a sequence which shows the process at the time of the cutting | disconnection to the corporate network of 2nd Embodiment.

Explanation of symbols

  DESCRIPTION OF SYMBOLS 1 ... User terminal, 2 ... Packet network (PNW), 3 ... VPN apparatus, 4 ... Authentication server, 5 ... Corporate network, 6 ... PBX, 7 ... VM (voice mail apparatus), 8 ... Telephone network, 9 ... Telephone terminal , 20 ... Wireless access point, 21 ... Wireless & tunnel control device, 100 and 200 ... Communication system.

Claims (6)

Call control means for performing call connection in response to a call connection request received through a voice communication network;
The call control of the call control means makes a call connection with a telephone terminal operated by a registered user registered in advance, and receives an authentication permission information acquisition request from the telephone terminal. Authentication permission information providing means for generating information and giving the authentication permission information to the telephone terminal and the access control means as sound information;
Controlling access to the access destination through a network, requesting authentication permission information necessary for authentication to the access destination to a user terminal that has made a connection request to the access destination, and the user terminal Access control means for determining whether or not the authentication permission information acquired from the authentication permission information provided from the authentication permission information providing means matches the authentication permission information;
Authentication means for authenticating to the access destination based on pre-registered user identification information and user identification information from the user terminal when the authentication permission information from the user terminal is valid by the access control means And
The telephone terminal inputs the authentication permission information acquired from the authentication permission information providing means to the user terminal as sound information,
The authentication system, wherein the user terminal gives the authentication permission information input as sound information from the telephone terminal to the access control means.   The access control means transmits a message to the user terminal indicating that connection setting is required again after a predetermined time has elapsed since the connection with the user terminal is completed. Item 4. The authentication system according to Item 1.   The authentication system according to claim 1 or 2, wherein a communication path between the user terminal and the access control means is a virtual communication path. The user terminal is a wireless terminal that performs wireless communication via a wireless access point,
A communication path between the wireless access point and the access control means is a virtual communication path, and the access control means manages the user terminal in association with identification information of the wireless access point. The authentication system according to claim 1 or 2, characterized in that. An authentication method for authenticating a user who makes a connection request to an access destination,
A call control step in which the call control means performs call connection in response to a call connection request from the user's telephone terminal received through the voice communication network;
When the authentication permission information providing means performs a call connection with a telephone terminal operated by a registered user registered in advance by the call control of the call control means, and receives an authentication permission information acquisition request from the telephone terminal, the access destination Authentication permission information providing step for generating authentication permission information necessary for the authentication and giving the authentication permission information to the telephone terminal and the access control means as sound information;
The access control means performs access control to the access destination through the network, and requests authentication permission information necessary for authentication to the access destination to the user terminal that has made a connection request to the access destination. An access control step for determining whether the authentication permission information acquired from the user terminal matches the authentication permission information received from the authentication permission information providing unit;
If the authentication permission information from the user terminal is valid by the access control means, the authentication means authenticates the access destination based on the user identification information registered in advance and the user identification information from the user terminal. And an authentication process for performing
The telephone terminal inputs the authentication permission information acquired from the authentication permission information providing means to the user terminal as sound information,
The authentication method characterized in that the user terminal gives the authentication permission information input as sound information from the telephone terminal to the access control means. A server that provides a user's telephone terminal with authentication permission information necessary for access destination authentication processing by an access control means when making a connection request to an access destination through a network,
When a call connection is made with a telephone terminal operated by a registered user registered in advance by call control of the call control means through a voice communication network, and an authentication permission information acquisition request is received from the telephone terminal, authentication of the access destination is performed. A server comprising: authentication permission information providing means for generating necessary authentication permission information and giving the authentication permission information as sound information to the telephone terminal and the access control means.

Images