JP3645844B2 - Relay connection method, network level authentication server, gateway device, information server, and program - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention is used for network security management. Especially suitable for use in private networks.
[0002]
[Prior art]
In an authentication communication network that is a private communication network controlled by a private network address and can only be used by users who have performed both network level authentication and individual authentication, the network level authentication of the user has been performed conventionally. If there is an access request from a user who has not completed personal authentication by setting an authentication communication channel at the level, personal authentication of the user is performed using this authentication communication channel. Allow users to use the authentication communication network. This conventional example will be described with reference to FIG. FIG. 14 is a diagram for explaining a conventional relay connection method. Hereinafter, in the figure, the network is shown as NW and the gateway as GW.
[0003]
In the example illustrated in FIG. 14, when the gateway device (shown as a GW device) 3 receives a communication start request from the user terminal 1, the gateway device (shown as a NW level authentication server) 6 informs the network level authentication server 6. It communicates as a network level authentication request and performs network level authentication.
[0004]
Specifically, the network level authentication server 6 is registered in advance with network level authentication information of a legitimate user, and whether or not it is a legitimate user based on the network level authentication request transmitted from the gateway device 3. Determine whether. As a result of this determination, if it is determined that the user is a legitimate user, the network level authentication server 6 notifies the gateway device 3 to that effect.
[0005]
When the network level authentication is completed, an authentication communication path 5 is formed in the public communication network 2 between the gateway device 3 and the user terminal 1.
[0006]
When the gateway device 3 detects use within the authentication communication network from the user terminal 1 via the authentication communication path 5 in the gateway device 3, if the user's personal level authentication state is unauthenticated, the gateway device 3 prompts the user terminal 1 to perform personal level authentication.
[0007]
Therefore, in order to perform personal level authentication, the user terminal 1 transmits personal authentication information to the gateway device 3 via the authentication communication path 5. Upon receiving this, the gateway device 3 transfers a personal level authentication request including personal authentication information to the personal level authentication server 7. When the personal level authentication server 7 receives the personal level authentication request, it performs personal level authentication.
[0008]
Specifically, personal level authentication information including user identifier information of the user is registered in advance in the personal level authentication server 7, and the user identifier included in the personal level authentication request transferred from the gateway device 3. It is determined whether or not the access request is a legitimate access request from a legitimate user from the personal level authentication information including As a result of this determination, if it is determined that a legitimate user is making a legitimate access request, the personal level authentication server 7 notifies the gateway device 3 to that effect. Thereby, network level authentication and personal level authentication are completed.
[0009]
In the gateway device 3 between the authentication communication network 4 and the public communication network 2, when the network level authentication and the individual level authentication are completed, network level identification information (a network address that is an address in the public communication network) and Individual level identification information (user identifier) is held, a private network address used inside the authentication communication network 4 is assigned, and network address conversion between the public communication network 2 and the authentication communication network 4 is performed.
[0010]
In the information servers A, B, and C, the gateway device 3 is inquired of the personal authentication status of the user based on the private network address of the accessing user. The gateway device 3 searches for the user identifier based on the private network address, and returns the user identifier as a personal authentication state. Information servers A, B, and C accept access from users who have been properly personally authenticated.
[0011]
[Problems to be solved by the invention]
In such a conventional relay connection method, the following problems occur. When user a uses information server A inside authentication communication network 4 after user a uses information server A inside authentication communication network 4 from user terminal 1, user b uses information server A inside authentication communication network 4 from the same user terminal 1. When the information server A has already been authenticated by the user a with the private network address assigned to the user a, and the user b who uses the same private network address uses the information server A, There is no need to authenticate again. Therefore, it is difficult to normally specify the personal authentication state of the user from the information server side.
[0012]
In addition, the gateway device monitors the access to the information server on the authentication communication path and performs the authentication communication when the access is detected in order to execute the personal level authentication after setting the authentication communication path to access the inside of the authentication communication network. It is necessary to guide the connection to the personal level authentication server from various applications executed on the road, and accordingly, it is necessary to deal with each application. Therefore, the processing load of the gateway device increases.
[0013]
Further, it is necessary to guide to the personal level authentication, hold the packet received during the personal authentication inside the gateway device, and transfer the packet held when the personal level authentication is completed to the inside of the authentication communication network. Accordingly, this also increases the processing load of the gateway device.
[0014]
The present invention has been made in such a background, and an object thereof is to provide a relay connection method capable of specifying a user from the information server side. An object of the present invention is to provide a relay connection method capable of avoiding inconsistency or duplication of authentication states in an authentication communication network. An object of the present invention is to provide a relay connection method that can simplify the procedures of network level authentication and individual level authentication. An object of this invention is to provide the relay connection system which can reduce the processing load of a gateway apparatus.
[0015]
[Means for Solving the Problems]
The present invention relates to an authentication communication network as a private communication network including an information server that can be used by a user who has performed authentication at both the network level and the individual level and is controlled by a private network address and provides information to the user. The relay connection system includes a public communication network connected to a user terminal that accesses the authentication communication network and a gateway device that connects the authentication communication network.
[0016]
Here, a feature of the present invention is that a network level authentication server is provided that holds authentication information obtained by adding personal level authentication information to network level authentication information, and the network level authentication server includes the authentication information and the authentication information. At the same time, means for adding and holding personal level access control information, and verifying the authenticated information received as an authentication request from the gateway device, adding the access control information to the authentication result and returning it to the gateway device And the gateway device sends authentication information and user identifier obtained by adding authentication information at the personal level to authentication information at the network level and expiration date information of the authentication information from the user terminal. Means for receiving and verifying the validity period information to verify the validity of the authentication target information; Means for transmitting the authentication request to the network level authentication server using a user identifier and the authentication target information, and a private network address used inside the authentication communication network when the authentication is completed to the user of the user terminal And assigning the private network address, the network level authentication information returned as the authentication result from the network level authentication server, and the network address and user identifier as personal level authentication information, respectively, and correspondingly The secret information is shared between the means for holding the personal level access control information returned together with the authentication information from the network level authentication server and the user when the authentication is completed. On the encrypted communication path used A means for generating an authentication communication path between the user terminal and an access from the user to the authentication communication network within the authentication communication path. And a private address used inside the authentication communication network, and the access control information corresponding to the user's network address is searched when the user accesses the authentication communication network. And means for controlling access to the information server by the user according to the access control information.
[0017]
Thereby, since the network level authentication and the personal level authentication are simultaneously performed as a pair, the user can be specified from the information server side. Also, it is possible to avoid mismatching or duplication of authentication status. This also simplifies the procedures for network level authentication and personal level authentication. In addition, the processing load on the gateway device can be reduced.
[0018]
The information server includes means for acquiring the user identifier by inquiring of the gateway device about the personal authentication status of the user using the user's private network address when there is an access from the user. desirable.
[0019]
As a result, since the authentication status information is centrally managed by the network level authentication server, it is possible to identify the user from the information server side and to avoid the mismatch or duplication of the authentication status in the authentication communication network. .
[0020]
The gateway device preferably includes means for not reassigning the private network address in the authentication communication network assigned to the user until the information server releases the personal level authentication state.
[0021]
Thereby, it is possible to avoid duplication of a plurality of private network addresses with respect to one authentication state for one user, and thus it is possible to avoid a mismatch of authentication states in the authentication communication network.
[0022]
The gateway device detects the authentication communication in response to a request from a user or when no communication is detected from the user to the authentication communication network using the authentication communication path for a predetermined time or more. Means for deleting the road may be provided.
[0023]
As a result, the authentication communication path so far can be deleted for the convenience of the user to prepare for execution of a new authentication procedure.
[0024]
In addition, when the gateway apparatus deletes the authentication communication path, the gateway apparatus deletes the authentication communication path and the personal level authentication state with respect to the information server used by the user of the authentication communication path. The information server may further include means for releasing the authentication status at the personal level of the corresponding user based on the notification from the gateway device.
[0025]
As a result, it is possible to avoid mismatching or duplication of authentication states in the authentication communication network when the gateway device releases the authentication level at the individual level.
[0026]
Thus, according to the present invention, the user can be specified from the information server side. It is possible to avoid inconsistency of authentication states in the authentication communication network. Network level authentication and personal level authentication procedures can be simplified. The processing load on the gateway device can be reduced.
[0027]
In addition, when the gateway device receives the setting request for the authentication communication path from the user, the gateway device includes a user identifier, authentication target information, and the user included in the setting request to the network level authentication server. Means for setting the network address in the authentication request and transmitting it to the network level authentication server, wherein the network level authentication server receives the authentication request and receives the network address and the user corresponding to the network address. Means for holding an identifier; and the user identifier set in the authentication request by searching for information of the authentication communication path during communication held by the network level authentication server upon receiving the authentication request And / or said authentication already according to said network address Means for detecting whether or not a communication path is set, and when the authentication communication path is already set by the same user identifier or network address, the gateway apparatus setting the authentication communication path Means for transmitting duplicate authentication communication path deletion requests, and the gateway device receives the authentication communication path deletion request and searches for the corresponding authentication communication path, and this search means. Means for deleting the authentication communication path and notifying the network level authentication server of the deletion completion response when the corresponding authentication communication path is searched based on the search result, and the network level authentication servers are the same. When the authentication communication path is not already set by the user identifier or the network address of Alternatively, when the deletion completion response is received, the user identifier and the authentication target information set in the authentication request are verified, and the address control information of the corresponding user is added to the authentication result to respond. Means for receiving the response to which the address control information is added and setting the authentication communication path; and means for transmitting a notification of the authentication communication path setting to the network level authentication server. The network level authentication server receives the notification of the authentication channel setting and sets the authentication channel as the set authentication channel information, the user device identifier, and the identification information of the gateway device Each having a network address stored therein, and the gateway device receives a request from the user. Or a means for deleting the authentication communication path when it detects no communication within the authentication communication network using the authentication communication path from the user for a predetermined time or more, Means for discarding the information on the corresponding authentication communication path, and means for notifying the network level authentication server of the deletion of the corresponding authentication communication path, the network level authentication server receiving the notification of the deletion and corresponding It is also possible to provide means for discarding information relating to the authentication communication path to be performed.
[0028]
In this way, the network level authentication server retains the network address of the authentication communication path set in all the gateway devices and the user identifier corresponding to this network address, so that the network address and the use Duplicate identifiers can be checked.
[0029]
Further, the gateway device has received the network communication address of the user who has established the authentication communication path after the completion of authentication and the user identifier corresponding to the network address, and the setting request for the authentication communication path Depending on the search result of the means for searching for the network address and / or the user identifier corresponding to the network address of the user who is currently using the authentication communication path set by himself / herself The network address of the user included in the setting request and / or the user identifier corresponding to the network address and the network address of the user using the authentication communication path currently set by the user and / or the network identifier The user identification corresponding to the network address And the means for deleting the existing authentication communication path set by the self and setting the authentication communication path based on the setting request, and the setting request based on the search result of the searching means. Corresponding to the network address of the user and / or the user identifier corresponding to the network address and the network address of the user who is currently using the authentication communication path set by the user and / or the network address Means for notifying the other gateway device of the network address and the user identifier corresponding to the network address when the user identifier does not match, and is held by itself when the notification is received from another gateway device. Of the user who is setting up the authentication channel A means for searching whether the network address and / or the user identifier corresponding to the network address are the same as the network address and / or the user identifier included in the notification, and a search result of the searching means If the search results of the means for searching and the search means of the search means are the same, the duplicate authentication communication path held by the self is deleted and the self Means for discarding the information about the duplicated authentication channel that is held; means for responding to the sender of the notification that there is a corresponding user in the authentication channel and the completion of deletion; And a means for setting a new authentication communication path when the response is received. You can also.
[0030]
In this way, the gateway device retains the network address of the user related to the authentication communication path set by the gateway device and the user identifier corresponding to the network address, thereby preventing duplication of the network address and / or the user identifier. Can be checked.
[0031]
Alternatively, the gateway device has received the network communication address of the user who has established the authentication communication path after the completion of authentication and the user identifier corresponding to the network address, and the setting request for the authentication communication path Depending on the search result of the means for searching for the network address and / or the user identifier corresponding to the network address of the user who is currently using the authentication communication path set by himself / herself The network address of the user included in the setting request and / or the user identifier corresponding to the network address and the network address of the user using the authentication communication path currently set by the user and / or the network identifier The user corresponding to the network address Means for deleting the existing authentication communication path set by the self and setting the authentication communication path based on the setting request when the bespoke is the same, and the setting based on a search result of the searching means The network address of the user included in the request and / or the user identifier corresponding to the network address and the network address of the user who is currently using the authentication channel set by the user and / or the network address Means for notifying the other gateway device of the network address and the user identifier corresponding to the network address when the user identifier corresponding to the network identifier does not match, and when receiving this notification from the other gateway device Used during authentication channel setting Means for searching whether or not the network address and / or the user identifier corresponding to the network address are the same as the network address and / or the user identifier included in the notification, and a search for the searching means When the results are not the same, the means for responding to the gateway device that is the source of the notification and the response to the gateway device that is the source of the notification when the search results of the means for searching are the same And when the self is the sender of the notification and receives the response, the gateway apparatus that deletes the duplicate authentication communication path held by the gateway apparatus is deleted from the gateway apparatus that is the sender of the response. It is necessary to delete the information related to the duplicated authentication communication path that is held. Information on the duplicate authentication communication path held by itself and the duplicate authentication communication path held by itself when the request is received and this request is received. A means for discarding, a means for responding that there is a corresponding user in the authentication communication channel that overlaps with the transmission source of the request, and that the deletion has been completed; Means for setting the authentication communication path.
[0032]
Further, the gateway device has means for holding the network address of the user who has established the authentication channel after completion of authentication and the user identifier corresponding to the network address, and the network address held in the means for holding And means for notifying information of the user identifier corresponding to the network address to the other gateway device, and of the gateway device setting the authentication communication path when the notification is received from the other gateway device. Means for holding the information and the network address and the user identifier information corresponding to the network address, and all the gateway devices currently held by itself when receiving the authentication channel setting request The authentication channel Searching for the network address of the user in use and / or the user identifier corresponding to the network address, and when either is the same, means for confirming the gateway device setting the authentication communication path; When the gateway device that has set the authentication communication path is itself, the authentication communication path is deleted and the authentication communication path that is newly requested is set, and the authentication communication path is set. Means for setting the network address and the user identifier corresponding to the network address to the gateway device when the gateway device is another gateway device, and transmitting a request for deleting the authentication communication path; When self receives this delete request, A network address and / or a means for searching for the authentication communication path that matches the user identifier corresponding to the network address, deleting the authentication communication path, and responding to the gateway device of the deletion request source, And a means for setting the authentication communication path that is newly requested when the deletion request source is received and this deletion completion response is received.
[0033]
In this way, all the gateway devices hold the network address of the user of the authentication communication path set by all the gateway devices and the user identifier corresponding to this network address, respectively, and the network address and Alternatively, it is possible to check for duplicate user identifiers.
[0034]
When an information server whose personal authentication is limited to the application level is provided, an access control server is provided between the gateway device and the information server. Means for acquiring the user identifier of the user by inquiring the gateway device of the user's personal authentication status using the private address of the user, and using the information server as personal authentication information at the application level And means for transmitting the person identifier.
[0035]
At this time, the access control server recognizes the application corresponding to the user based on the personal authentication information and the information server at the application level according to the application recognized by the recognition means. It is desirable to provide means for performing access control.
[0036]
As a result, the single sign-on service using the relay connection method of the present invention can be provided even to an information server capable of performing personal authentication only at the application level.
[0037]
The second aspect of the present invention is applied to the relay connection method of the present invention. The second aspect of the present invention is a means for holding authentication information obtained by adding personal level authentication information to network level authentication information. Means for adding and holding access control information, and means for verifying the authenticated information received as an authentication request from the gateway device, adding the access control information to the authentication result, and returning it to the gateway device This is a network level authentication server.
[0038]
When the gateway device receives the authentication communication path setting request from the user, the gateway device receives the authentication request in which the user identifier and the authentication target information included in the setting request and the network address of the user are set. Means for holding the network address and the user identifier corresponding to the network address; and searching for information on the authentication communication path during communication that has been received and held and set in the authentication request Means for detecting whether or not the authentication communication path is already set according to the user identifier and / or the network address, and the authentication communication path is already set by the same user identifier or the network address. The gateway device that sets the authentication communication path when being Means for transmitting a request for deleting the duplicated authentication channel, and when the authentication channel is not already set by the same user identifier or network address, or the deletion completion response has been received Sometimes the user identifier and the authentication target information set in the authentication request are verified, the address control information of the corresponding user is added to the authentication result, and the authentication request or the deletion completion response is transmitted. Means for responding to the gateway device; identification information of the gateway device that has received the notification of the authentication channel setting from the gateway device and sets the authentication channel as the set authentication channel information and the user identifier And means for holding each of the network addresses therein, and the gateway device It is desirable to provide a means for discarding information about authentication communication path appropriate to receive the authentication of the communication path deletion notification al.
[0039]
The third aspect of the present invention is applied to the relay connection method of the present invention, and is the authentication information and user identifier obtained by adding the authentication information at the personal level to the authentication information at the network level and the expiration date of the authentication information. Means for receiving the information from the user terminal and verifying the validity period to confirm the validity of the authentication target information, and using the user identifier and the authentication target information to the network level authentication server. Means for transmitting the authentication request, and assigning a private network address to be used inside the authentication communication network to the user when the authentication is completed. The private network address and the network level returned as the authentication result from the network level authentication server. Authentication information and personal level authentication information in the user's public communication network A network address and a user identifier that are addresses, respectively, and correspondingly holding the personal level access control information returned together with the authentication result from the network level authentication server, and upon completion of authentication, Means for sharing secret information with the user and generating an authentication communication path, which is an encrypted communication path using the secret information, with the user terminal; and authentication communication from the user Means for permitting access to the network limited to the authentication communication path and performing address conversion between a network address in the public communication network and a private address used in the authentication communication network; and the user Corresponding to the network address of the user when accessing the authentication communication network from Access a gateway apparatus characterized by comprising a means for controlling access to said information server of the user according to the access control information searched control information.
[0040]
Further, means for holding a network address of a user who has established the authentication communication path after completion of authentication and a user identifier corresponding to the network address, and is set by the current self when receiving the setting request for the authentication communication path. Means for searching for the network address of the user who uses the authentication communication path and / or the user identifier corresponding to the network address, and the search result of the means for searching for the user included in the setting request The network address and / or the user identifier corresponding to the network address and the user's network address and / or the user identifier corresponding to the network address of the user who is currently using the authentication communication path set by the user Set by the self when Means for deleting the existing authentication communication path and setting the authentication communication path based on the setting request, and the network address of the user included in the setting request according to a search result of the searching means and / or When the user identifier corresponding to the network address does not match the network address of the user who is currently using the authentication communication path set by the user and / or the user identifier corresponding to the network address Means for notifying the gateway device of the network address and the user identifier corresponding to the network address, and when the notification is received from another gateway device, the authentication communication path setting that is held by itself The network address and / or The means for searching whether the user identifier corresponding to the network address is the same as the network address and / or the user identifier included in the notification and when the search results of the searching means are not the same When the search result of the means for searching and the means for searching is the same, the duplicate authentication communication path held by the self is deleted and the duplicate is held by the self Means for discarding information about the authentication communication path; means for responding that there is a corresponding user in the authentication communication path overlapping with the transmission source of the notification; and that the deletion is completed; It is desirable to provide a means for setting a new authentication communication path when a response is received.
[0041]
Alternatively, a means for holding a network address of a user who has established the authentication communication path after completion of authentication and a user identifier corresponding to the network address, and the current self setting when receiving the setting request for the authentication communication path. Means for searching for the network address of the user who uses the authentication communication path and / or the user identifier corresponding to the network address, and the search result of the means for searching for the user included in the setting request The network address and / or the user identifier corresponding to the network address and the user's network address and / or the user identifier corresponding to the network address of the user who is currently using the authentication communication path set by the user Is the same as Means for deleting the existing authentication communication path and setting the authentication communication path based on the setting request, and the network address of the user included in the setting request according to a search result of the searching means, and / or When the user identifier corresponding to the network address does not match the network address of the user who is currently using the authentication communication path set by the user and / or the user identifier corresponding to the network address Means for notifying the other gateway device of the network address and the user identifier corresponding to the network address, and when the notification is received from the other gateway device, the authentication communication path being set by itself is being set. The network address of the user and / or Means for searching whether the user identifier corresponding to the network address is the same as the network address and / or the user identifier included in the notification, and when the search results of the searching means are not the same Means for responding to the gateway device that is the source of the notification, and means for responding to the gateway device that is the source of the notification when the search results of the means for searching are the same; When this response is received as a notification transmission source, the duplicate authentication communication path held by the gateway device is deleted from the gateway device that is the transmission source of the response, and the gateway device holds the duplicate Means for making a request to delete the information on the authentication channel, and the self is the source of the response Yes, when the request is received, the duplicate authentication communication path held by itself is deleted and the information about the duplicate authentication communication path held by itself is discarded, and the request is duplicated in the transmission source of the request It is also possible to provide means for responding that there is a corresponding user on the authentication channel and completion of deletion, and means for setting the new authentication channel when the requester is the sender of the request and receives the response. .
[0042]
Alternatively, means for holding a network address of a user who has established the authentication communication path after completion of authentication and a user identifier corresponding to the network address, and corresponding to the network address and network address held in the means for holding Means for notifying information of the user identifier to the other gateway device, information of the gateway device that has set the authentication communication path when the notification is received from the other gateway device, the network address, and this Means for holding information of the user identifier corresponding to a network address, and the authentication communication path set in all the gateway devices currently held by itself when receiving the setting request for the authentication communication path. The network of the user who is using When the user identifier corresponding to the work address and / or the network address is searched and either of them is the same, a means for confirming the gateway device setting the authentication communication path and the authentication communication path are set. When the gateway device is self, the corresponding authentication communication path is deleted and the newly requested authentication communication path is set, and the gateway device setting the authentication communication path is another gateway. A device that sets the network address and the user identifier corresponding to the network address to the gateway device when it is a device, and transmits the request for deleting the authentication communication path; The requested network address and Means for searching for the authentication communication path that matches the user identifier corresponding to the network address, deleting the authentication communication path, and responding to the gateway device of the deletion request source that the deletion is completed; It is also possible to provide a means for setting the authentication communication path that has been newly requested when the original and deletion completion response is received.
[0043]
The fourth aspect of the present invention is applied to the relay connection method of the present invention, and when there is an access from the user, the gateway device is inquired of the personal authentication status of the user by using the user's private network address. Accordingly, there is provided an information server comprising means for acquiring the user identifier.
[0044]
A fifth aspect of the present invention is applied to the relay connection method of the present invention, and is provided between the gateway device and an information server whose implementation of personal authentication is limited to an application level, and uses a user's private address. Means for obtaining the user identifier of the user by inquiring the personal authentication status of the user to the gateway device, and means for transmitting the user identifier as personal authentication information at the application level to the information server. And an access control server.
[0045]
Means for recognizing an application corresponding to the user based on the personal authentication information, and means for performing access control at the application level for the information server according to the application recognized by the recognizing means. Is desirable.
[0046]
A sixth aspect of the present invention provides network level authentication information as a function corresponding to the network level authentication server applied to the relay connection method of the present invention by installing the information processing apparatus in the information processing apparatus. A function for holding authentication information with personal level authentication information added thereto, a function for holding personal level access control information in addition to the authentication information, and information to be authenticated received as an authentication request from the gateway device And a function of adding the access control information to the authentication result and returning it to the gateway device.
[0047]
Further, the program sets the user identifier and the authenticated information included in the setting request and the network address of the user when the gateway device receives the setting request for the authentication channel from the user. A function for receiving the authentication request and holding the network address and the user identifier corresponding to the network address, and searching for information on the authentication communication path during communication that is received and held by the authentication request. A function for detecting whether or not the authentication communication path is already set according to the user identifier and / or network address set in the authentication request, and already with the same user identifier or network address When the authentication channel is set, the authentication channel is set. A function of transmitting a duplicate request for deleting the authentication communication path to the gateway device, and when the authentication communication path is not already set by the same user identifier or the network address, or the deletion is completed When the response is received, the user identifier and the authentication target information set in the authentication request are verified, the address control information of the corresponding user is added to the authentication result, and the authentication request or the deletion is completed. And the identification information of the gateway device that has set the authentication communication path as the set authentication communication path information by receiving the notification of the authentication communication path setting from the gateway apparatus. And a device for holding the user identifier and the network address, respectively. If, possible to realize the above function discards information about authentication communication path to receive notification of deletion of the authentication communication path appropriate from the gateway device is desirable.
[0048]
Alternatively, by installing it in the information processing apparatus, the personal level authenticated information is added to the network level authenticated information as a function corresponding to the gateway apparatus applied to the relay connection method of the present invention. A function of receiving the added authenticated information and user identifier and the expiration date information of the authenticated information from the user terminal and verifying the expiration date to confirm the validity of the authenticated information; A function of transmitting the authentication request to the network level authentication server using a user identifier and the authentication target information, and assigning a private network address used in the authentication communication network to the user when the authentication is completed. Returned as the authentication result from the address and the network level authentication server A network address and a user identifier which are addresses in the public communication network of the user as network level authentication information and personal level authentication information, respectively, and correspondingly, the authentication result from the network level authentication server The authentication communication that is the encryption communication path using the secret information shared with the user when the authentication is completed and the function of holding the personal level access control information returned together with the user A function of generating a route with the user terminal, and access from the user to the authentication communication network is permitted only in the authentication communication channel and a network address and the authentication in the public communication network A function to perform address conversion with a private address used inside the communication network, Realizing a function of retrieving the corresponding access control information from the network address of the user when the user accesses the authentication communication network, and controlling the user's access to the information server according to the access control information It is a program characterized by making it carry out.
[0049]
Further, the program stores a network address of a user who has established the authentication channel after completion of authentication and a user identifier corresponding to the network address, and when receiving a request for setting the authentication channel, Included in the setting request by the function of searching for the network address of the user who uses the authentication communication path set by the user and / or the user identifier corresponding to the network address, and the search result of the searching function The network address and / or the user identifier corresponding to the network address and the network address and / or the network address of the user who is currently using the authentication channel set by the user. When the user identifier is the same Is a function of deleting the existing authentication communication path set by the self and setting the authentication communication path based on the setting request, and a user included in the setting request according to a search result of the function to be searched. The network address and / or the user identifier corresponding to the network address and the user's network address and / or the user identifier corresponding to the network address of the user who is currently using the authentication communication path set by the user If the network address and the user identifier corresponding to the network address are notified to the other gateway device, and the authentication held by itself when the notification is received from the other gateway device The network address of the user who is setting the communication path The search result of the search function is the same as the function for searching whether the user identifier corresponding to the network address and / or the network address is the same as the network address and / or the user identifier included in the notification. If the search result of the search function is the same as the function of responding to the gateway device that is the source of the notification when it is not, the redundant authentication communication path held by itself is deleted and held by itself. A function of discarding the information related to the authentication channel that is duplicated, a function of responding to the sender of the notification that there is a corresponding user in the authentication channel and the completion of deletion, and the transmission of the notification by itself It is desirable to realize a function of setting the new authentication communication path when the response is received.
[0050]
Alternatively, the function of holding the network address of the user who has established the authentication communication path after completion of authentication and the user identifier corresponding to the network address, and the current self-setting when receiving the setting request for the authentication communication path A function of searching for a network address of a user who uses the authentication communication channel and / or a user identifier corresponding to the network address, and a search result of the search function of the user included in the setting request The network address and / or the user identifier corresponding to the network address and the user's network address and / or the user identifier corresponding to the network address of the user who is currently using the authentication communication path set by the user Is the same as A function of deleting the existing authentication communication path and setting the authentication communication path based on the setting request, and the network address of the user included in the setting request according to a search result of the function to search and / or When the user identifier corresponding to the network address does not match the network address of the user who is currently using the authentication communication path set by the user and / or the user identifier corresponding to the network address The function of notifying the other gateway device of the network address and the user identifier corresponding to the network address, and the authentication communication path being set by itself when the notification is received from the other gateway device The network address of the user and / or A function for searching whether the user identifier corresponding to the network address is the same as the network address and / or the user identifier included in the notification, and a search result of the search function is not the same A function that responds to the gateway device that is the source of the notification, and a function that responds to the gateway device that is the source of the notification when the search result of the function that searches is the same, When this response is received as a notification transmission source, the duplicate authentication communication path held by the gateway device is deleted from the gateway device that is the transmission source of the response, and the gateway device holds the duplicate A function of requesting deletion of information on the authentication communication path, and a self-transmission source Yes, when this request is received, the function deletes the duplicated authentication communication path held by itself and discards the information related to the duplicate authentication communication path held by itself, and duplicates the request transmission source. It is also possible to realize a function of responding that there is a corresponding user on the authentication channel and completion of deletion, and a function of setting a new authentication channel when the requester is the sender of the request and receiving the response. it can.
[0051]
Alternatively, the network address of the user who has established the authentication communication path after the completion of authentication and the user identifier corresponding to the network address, and the network address held in the held function and the network address A function for notifying information of the user identifier to the other gateway device, and information on the gateway device that has set the authentication communication path and the network address when this notification is received from the other gateway device; A function for holding the information of the user identifier corresponding to the network address, and the authentication communication path set in all the gateway devices currently held by itself when the setting request for the authentication communication path is received. The network of the user who is using When the user identifier corresponding to the work address and / or the network address is searched and either of them is the same, the function of confirming the gateway device setting the authentication communication path and the authentication communication path are set. When the gateway device is self, the corresponding authentication communication path is deleted and the newly requested authentication communication path is set, and the gateway device setting the authentication communication path is another gateway. A function of transmitting the authentication communication path deletion request by setting the network address and the user identifier corresponding to the network address to the corresponding gateway device when the device is a device, and the self receiving the deletion request The requested network address and Searches for the authentication communication path that matches the user identifier corresponding to the network address, deletes the authentication communication path, and responds to the deletion request source gateway device that the deletion has been completed, When the original and the deletion completion response is received, a function for setting the authentication communication path that is newly requested can be realized.
[0052]
Alternatively, when installed in the information processing apparatus, when the user accesses the information processing apparatus as a function corresponding to the information server applied to the relay connection method of the present invention, the user's private network A program for realizing the function of acquiring the user identifier by inquiring of the gateway device about the personal authentication status of the user using an address.
[0053]
Alternatively, by installing it in the information processing apparatus, the gateway apparatus can use this private address as a function corresponding to the access control server applied to the relay connection method of the present invention. Realizing a function of acquiring a user identifier of the user by inquiring the user's personal authentication status and a function of transmitting a user identifier as personal authentication information at the application level to the information server; It is a featured program.
[0054]
Further, the program recognizes an application corresponding to the user based on the personal authentication information, and performs access control at the application level for the information server according to the application recognized by the recognition function. It is desirable to realize the function to be performed.
[0055]
A seventh aspect of the present invention is the information processing apparatus-readable recording medium on which the program of the present invention is recorded. The program of the present invention can be installed in the information processing apparatus using the recording medium of the present invention in which the program of the present invention is recorded. The information processing apparatus can also install the program of the present invention when the information processing apparatus downloads the program of the present invention from a server holding the program of the present invention via a network.
[0056]
DETAILED DESCRIPTION OF THE INVENTION
A relay connection system according to an embodiment of the present invention will be described with reference to FIGS. FIG. 1 is an overall configuration diagram of a relay connection system according to an embodiment of the present invention. FIG. 12 is an overall configuration diagram of the relay connection system of the sixth embodiment of the present invention.
[0057]
The present invention is a private communication network including information servers A, B, and C that can be used by a user who has performed authentication at both the network level and the individual level and is controlled by a private network address and provides information to the user. And a gateway device 3 for connecting the authentication communication network 4 to the public communication network 2 connected to the user terminal 1 that accesses the authentication communication network 4.
[0058]
Here, a feature of the present invention is that a network level authentication server 6 is provided that holds authentication information obtained by adding authentication information at the individual level to authentication information at the network level. In addition, personal level access control information is also added and held, the authentication target information received as an authentication request from the gateway apparatus 3 is verified, the access control information is added to the authentication result, and the gateway apparatus 3 is returned. The gateway device 3 receives from the user terminal 1 the authenticated information and user identifier obtained by adding the personal level authenticated information to the network level authenticated information and the expiration date information of the authenticated information. After verifying the validity of the authenticated information based on the expiration date information of the authentication information, the user identifier and the authenticated information are The authentication request is transmitted to the network level authentication server 6 and a private network address used in the authentication communication network 4 is assigned to the user of the user terminal 1 when the authentication is completed. The network level authentication information returned as the authentication result from the authentication server 6 and the network address and user identifier of the user as personal level authentication information are respectively held and correspondingly from the network level authentication server 6 The personal level access control information returned along with the authentication result is held, and when the authentication is completed, the secret information is shared with the user, and the authentication is an encryption communication path using the secret information. Create communication path 5 with user terminal 1 Access to the authentication communication network 4 from the user is permitted only in the authentication communication path 5 and an address between the network address in the public communication network 2 and a private address used in the authentication communication network 4. When the access to the authentication communication network 4 from the user is performed, the access control information is acquired from the network address of the user, and the user's access to the information servers A, B, and C according to the access control information Is in control.
[0059]
In order to realize the relay connection system of the embodiment of the present invention, the network level authentication server 6 and the gateway applied to the relay connection system of the present invention are installed in the computer device by installing the computer device as the information processing device. By using a program that realizes functions corresponding to the device 3, information servers A, B, C, D, E, and the access control server 8, the computer device is connected to the network level authentication server 6, the gateway device 3, and the information server of the present invention. As a device corresponding to A, B, C, D, E, and the access control server 8, the relay connection system of the present invention can be realized. The program is recorded on a recording medium readable by the computer device, and the program is installed in the computer device using the recording medium, or the computer that holds the program is connected to the computer via a network. The device can download and install the program.
[0060]
In the following, embodiments of the present invention will be described in more detail.
[0061]
(First Example)
The configuration of the relay connection system of the first embodiment of the present invention will be described with reference to FIG. The user terminal 1 is connected to the public communication network 2. The authentication communication network 4 is a private communication network controlled by a private network address, and includes a gateway device 3 and a network level authentication server 6. The authentication communication network 4 includes information server communication networks # 1 and # 2 including information servers A, B, and C therein. An authentication communication path 5 is set between the gateway device 3 and the user terminal 1 for a user who has performed both network level and individual level authentication. In the gateway device 3, for communication using the authentication communication path 5, address conversion from the public communication network 2 to a private network address in the authentication communication network 4, and for each of the information server communication networks # 1 and # 2 Access control.
[0062]
Next, the operation of the relay connection system according to the first embodiment of the present invention will be described with reference to FIGS. FIG. 2 is a sequence diagram showing an operation from when the user terminal 1 detects access to the user in the authentication communication network 4 until the authentication communication path 5 is formed. FIG. 3 is a sequence diagram showing an operation in a process in which the user of the user terminal 1 starts using the application and continues communication. FIG. 4 is a sequence diagram showing an operation when communication from the user terminal 1 is interrupted for a certain time. FIG. 5 and FIG. 6 are sequence diagrams showing operations when the user b uses the information server A after using the information server A of the user a.
[0063]
The overall operation of the relay connection system according to the first embodiment of the present invention will be described in detail with reference to the sequence diagrams of FIGS. 1 and 2 to 6. First, for a user who uses the authentication communication network 4, the authentication information obtained by adding the authentication information of the individual level to the authentication information of the network level, and the access control information of the individual level of the user are stored in the authentication communication network 4. The network level authentication server 6 is registered in advance. In the gateway device 3, a list of accessible information server communication networks # 1 and # 2 corresponding to access control information at the individual level is set in advance.
[0064]
As shown in FIG. 2, when the user requests access to the information server A inside the authentication communication network 4, the user terminal 1 makes a communication start request to the gateway device 3. Next, the gateway device 3 that has received the communication start request internally generates authentication information and sets it in the response.
[0065]
In the meantime, the user terminal 1 accepts input of personal level authentication information from the user. Thereafter, the individual personal authentication information, the network level authentication information, and the authentication information received from the gateway device 3 are combined to generate a piece of information to be authenticated, and the user identifier of the user and the user The authentication request signal is generated together with the expiration date information of the information to be authenticated, and the authentication request is transmitted to the gateway device 3.
[0066]
The gateway device 3 verifies the validity of the authenticated information based on the received expiration date information of the authenticated information of the user, and then transmits the user identifier and the authenticated information to the network level authentication server 6 as an authentication request. To do.
[0067]
The network level authentication server 6 performs authentication by recalculating the authentication information held in the network level authentication server 6 based on each information received as an authentication request. After the authentication, the gateway device 3 is notified of the access control type of the user together with the authentication result.
[0068]
The gateway device 3 assigns a private network address used inside the authentication server communication network 4 to the user who has been authenticated normally, and uses the user identifier and the network address information and authentication in the user's public communication network 2. The private network address information and the access control type used inside the authentication communication network 4 when using the communication network 4 are held internally. Also, the shared secret information is exchanged with the user who has been authenticated normally. Thereby, the authentication communication path 5 encrypted using the shared secret information is set between the user terminal 1 and the gateway device 3.
[0069]
The operation during setting of the authentication communication path 5 is shown in FIG. The user Testimony When the information server A in the communication network 4 is used, the gateway device 3 operates as a NAT (network address translate) that performs network address conversion between the public communication network 2 and the authentication communication network 4.
[0070]
In addition, the user in communication is managed at the network level, and the information is held in the gateway device 3 during communication by maintaining communication to maintain the authentication state.
[0071]
Further, the gateway device 3 performs access control according to the access control type held by looking at the destination address of the user. The gateway device 3 has a list of accessible information server communication networks # 1 and # 2 for each access control type. When the user is registered with an access control type that is accessible only to the information server communication network # 1, the gateway device 3 performs access control at the network level. Only the information server A or the information server B belonging to the information server communication network # 1 can be accessed according to the contract.
[0072]
In the information server A, when access from the user occurs, based on the private network address assigned by the gateway device 3 which is the address information of the caller of the communication, the information server A sends the user's information to the gateway device 3. Queries the user identifier.
[0073]
In response to the inquiry about the user identifier from the information server A, the gateway device 3 searches for the user identifier from the private network address and returns the user identifier.
[0074]
The information server A holds the private network address and the user identifier acquired from the gateway device 3 during the access from the user, and uses the user while the communication using the user's private network address is performed. The authentication status of the person at the personal level is retained as authenticated.
[0075]
FIG. 4 shows the operation when the communication is disconnected. When the gateway device 3 receives the disconnection request for the authentication communication path 5 from the user terminal 1, the authentication state of the corresponding user is released.
[0076]
Since the information server A cannot recognize the disconnection of the authentication communication path, the status of communication from the user is monitored, and when no communication is detected for a predetermined time or more, the pair of the private network address and the user identifier is detected. Delete the information and release the personal level authentication status.
[0077]
For this reason, in the gateway device 3, the information server A re-establishes the private network address in the authentication communication network 4 assigned to the user until the no-communication monitoring time expires and the personal level authentication state is released. In order not to perform the allocation, after the authentication communication path 5 is disconnected, the allocation of the private network address is suppressed until the no-communication monitoring time expires in the information server A.
[0078]
FIG. 5 shows the operation when there are accesses from a plurality of users a and b from the same user terminal 1 or the same network address. In the user terminal 1, when the access to the authentication communication network 4 of a different user b is detected on the same terminal used by the user a, the original authentication communication path 5 is deleted. The gateway device 3 releases information related to the authentication communication path 5 of the original user a.
[0079]
After the completion of the release process, the user terminal 1 performs a process for setting the authentication communication path 5 by the newly used user b, and sets the authentication communication path 5 again.
[0080]
FIG. 6 shows a process in the case where an authentication communication path 5 is set for the user terminal 1 and a setting request for the authentication communication path 5 is received by the same user terminal 1 or the same network address. .
[0081]
In the gateway device 3, when access to the authentication communication network 4 from the user terminal 1 is detected by the same network address as the user terminal 1 in which the authentication communication path 5 is set, information on the original authentication communication path 5 And the authentication process for setting the authentication channel 5 is accepted by the user b who is newly used, and the authentication channel 5 is set again.
[0082]
(Second embodiment)
A second embodiment of the present invention will be described with reference to FIG. FIG. 7 is a sequence diagram showing an operation of disconnecting the authentication communication path 5 in accordance with the authentication communication path disconnection request from the user terminal 1.
[0083]
In the first embodiment described above, detection of no-communication time is used in order to match the personal authentication state between the information servers A, B, and C and the gateway device 3. When the usage status of the information server A is monitored at the level, the information server A holds the authentication status only while the user is using the application on the information server A, and the usage of the application is completed. When the password is detected, the personal level authentication state is released.
[0084]
As shown in FIG. 7, when a disconnection request for the authentication communication path 5 is received from the user while the application level usage state is in use, the gateway device 3 uses the user's usage level. Both the gateway device 3 and the information server A can release the personal authentication state by notifying the information server A of the release by disconnection of the authentication communication path 5.
[0085]
In the gateway device 3, as the personal authentication state is released, the network level authentication state of the corresponding user is also released. Therefore, the gateway device 3 deletes the network address and user identifier of the corresponding user held while the authentication state is maintained. Furthermore, the access control information of the corresponding user is also deleted. In this way, the gateway device 3 can reassign the private network address immediately after the authentication communication path 5 is disconnected.
[0086]
(Third embodiment)
A third embodiment of the present invention will be described with reference to FIG. FIG. 8 is a sequence diagram showing a duplication check procedure for a network address and a user identifier according to the third embodiment of the present invention. In the third embodiment of the present invention, the network level authentication server 6 holds the network address of the user of the authentication communication path 5 set by all the gateway devices 3 and the user identifier corresponding to this network address. It is an Example which shows the procedure which checks the duplication of a network address and a user identifier.
[0087]
As shown in FIG. 8, when the gateway apparatus 3 receives a setting request for the authentication communication path 5 from the user, the user identifier and the authentication target information included in the setting request are sent to the network level authentication server 6. The network address of the user is set in the authentication request and transmitted to the network level authentication server 6.
[0088]
The network level authentication server 6 receives the authentication request, holds the network address of the user and the user identifier corresponding to the network address, and holds the authentication during communication held by the network level authentication server 6 The information on the communication path 5 is searched to detect whether the authentication communication path 5 has already been set according to the user identifier and the network address set in the authentication request, and the same user identifier Alternatively, when the authentication communication path 5 has already been set by the network address, a duplicate authentication communication path 5 deletion request is transmitted to the gateway device 3 that has set the authentication communication path 5.
[0089]
The gateway device 3 receives the request for deleting the authentication communication path 5 and searches for the corresponding authentication communication path 5. When the corresponding authentication communication path 5 is searched based on the search result, the gateway apparatus 3 deletes the authentication communication path 5. The network level authentication server 6 is notified of the deletion completion response.
[0090]
The network level authentication server 6 that has received this notification responds to the authentication request when the authentication communication path 5 has not been set with the same user identifier or network address, or when the deletion completion response has been received. The set user identifier and the authentication target information are verified, and the address control information of the corresponding user is added to the result of the authentication to respond.
[0091]
The gateway device 3 receives the response to which the address control information is added, sets the authentication communication path 5, and transmits a notification of the authentication communication path setting to the network level authentication server 6.
[0092]
The network level authentication server 6 receives the notification of the authentication channel setting, and sets the identification information, the user identifier, and the network address of the gateway device 3 that has set the authentication channel 5 as the set authentication channel information. Hold inside self.
[0093]
In response to a request from the user, or when the gateway device 3 detects no communication from the user to the inside of the authentication communication network 4 using the authentication communication channel 5, the authentication communication channel 5 Is deleted, the information about the corresponding authentication communication path 5 held in itself is discarded, and the deletion of the corresponding authentication communication path 5 is notified to the network level authentication server 6.
[0094]
The network level authentication server 6 receives this deletion notification and discards information related to the corresponding authentication communication path 5.
[0095]
(Fourth embodiment)
A fourth embodiment of the present invention will be described with reference to FIGS. 9 and 10 are sequence diagrams showing the duplication check procedure for the network address and the user identifier according to the fourth embodiment of the present invention. In the fourth embodiment of the present invention, each gateway device 3 holds the network address of the user of the authentication communication path 5 set by the gateway device 3 and the user identifier corresponding to this network address. It is an Example which shows the procedure which checks duplication.
[0096]
As shown in FIG. 9, the gateway device 3 holds the network address of the user who has established the authentication communication path 5 after the authentication is completed and the user identifier corresponding to this network address, and receives the setting request for the authentication communication path 5 The network address of the user who is currently using the authentication communication path 5 set by himself / herself and the user identifier corresponding to this network address are searched, and the user included in the setting request based on the search result The network address of the user, the user identifier corresponding to the network address, the network address of the user using the authentication communication path 5 currently set by the user, and the user identifier corresponding to the network address, Are the same, the existing authentication channel set by the self The Delete setting the authentication communication path 5 based on the setting request. Alternatively, based on the search result, the network address of the user included in the setting request and the user identifier corresponding to the network address and the user of the user who uses the authentication communication path 5 currently set by the user When the network address and the user identifier corresponding to the network address do not match, the other gateway device 3 is notified of the network address and the user identifier corresponding to the network address.
[0097]
When the gateway apparatus 3 receives this notification from the other gateway apparatus 3, the network address of the user who is setting the authentication communication path 5 and the user identifier corresponding to this network address held by the gateway apparatus 3 are included in the notification. It is searched whether or not the network address and the user identifier are the same. If the search results are not the same, a response to that effect is sent to the gateway device 3 that sent the notification. Alternatively, when the search results are the same, the redundant authentication communication path 5 held by the self is deleted and the information about the duplicate authentication communication path 5 held by the self is discarded, and the information is duplicated in the transmission source of the notification. It responds that there is a corresponding user on the authentication communication path 5 and that the deletion is completed.
[0098]
The gateway apparatus 3 that is the transmission source of the notification and that has received the response sets a new authentication communication path 5.
[0099]
Alternatively, as shown in FIG. 10, the gateway device 3 uses the search result to set the network address of the user included in the setting request and the user identifier corresponding to the network address and the current self setting. When the network address of the user who uses the authentication communication path and the user identifier corresponding to the network address do not match, the other gateway device 3 sends the network address and the user identifier corresponding to the network address. The gateway device 3 that has received this notification includes the network address of the user who is holding the authentication communication path 5 that is held by the gateway device 3 and the user identifier corresponding to this network address in the notification. The network address If the search result is not the same, a response to that effect is returned to the gateway device 3 that is the transmission source of the notification, and if the search result is the same, the fact is determined. It responds to the gateway device 3 that is the source of the notification.
[0100]
The gateway apparatus 3 that is the sender of the notification and has received this response deletes the redundant authentication communication path 5 held by the gateway apparatus 3 from the gateway apparatus 3 that has transmitted the response, and the gateway A request is made to delete information related to the duplicate authentication communication path 5 held by the device 3.
[0101]
The gateway device 3 that is the sender of the response and that has received this request deletes the duplicate authentication communication path 5 held by itself and discards the information regarding the duplicate authentication communication path 5 held by itself. Then, it responds that the corresponding user exists in the authentication communication path 5 that overlaps with the transmission source of the request and that the deletion is completed.
[0102]
The gateway apparatus 3 that is the transmission source of the request and that has received the response sets a new authentication communication path 5.
[0103]
(Fifth embodiment)
A fifth embodiment of the present invention will be described with reference to FIG. FIG. 11 is a sequence diagram showing a duplication check procedure for a network address and a user identifier according to the fifth embodiment of the present invention. In the fifth embodiment of the present invention, the network address and the user identifier of the user of the authentication communication path 5 set by all the gateway devices 3 and the user identifier corresponding to the network address are respectively held. It is an Example which shows the procedure which checks duplication.
[0104]
As shown in FIG. 11, the gateway device 3 holds the network address of the user who has established the authentication communication path 5 after the completion of authentication and the user identifier corresponding to the network address, and holds the network address and the network. Information on the user identifier corresponding to the address is notified to the other gateway device 3.
[0105]
When this notification is received from another gateway device 3, the information of the gateway device 3 that has set the authentication communication path 5, the network address, and the information of the user identifier corresponding to the network address are held.
[0106]
The gateway device 3 that has received the setting request for the authentication communication path 5 receives the network address of the user who uses the authentication communication path 5 set in all the gateway apparatuses 3 currently held by the gateway apparatus 3 and the network. The user identifier corresponding to the address is searched, and when either one is the same, the gateway device 3 that has set the authentication communication path 5 is confirmed.
[0107]
When the gateway apparatus 3 that sets the authentication communication path 5 is itself, the authentication communication path 5 is deleted and the newly requested authentication communication path 5 is set.
[0108]
When the gateway device 3 that sets the authentication communication path 5 is another gateway device 3, the communication communication is performed by setting the network address and the user identifier corresponding to the network address for the corresponding gateway device 3. A request to delete the path 3 is transmitted.
[0109]
The gateway apparatus 3 that has received this deletion request searches the authentication communication path 5 that matches the network address being requested and the user identifier corresponding to this network address, deletes it, and indicates that the deletion is complete. It responds to the gateway device 3 of the deletion request source.
[0110]
The gateway apparatus 3 that is the deletion request source and receives this deletion completion response sets the authentication communication path 5 that has been newly requested.
[0111]
(Sixth embodiment)
A sixth embodiment of the present invention will be described with reference to FIGS. FIG. 12 is an overall configuration diagram of the relay connection system of the sixth embodiment. FIG. 13 is a sequence diagram for explaining the operation of the access control server of the sixth embodiment.
[0112]
The sixth embodiment is an example in which information servers D and E whose implementation of personal authentication is limited to the application level are provided. In this case, an access control server 8 is provided between the gateway device 3 and the information servers D and E, and the access control server 8 uses the user's private address to connect the user to the gateway device 3. The user identifier of this user is acquired by inquiring the personal authentication status of the user, and the user identifier as personal authentication information at the application level is transmitted to the information servers D and E. At this time, the access control server 8 recognizes an application corresponding to the user based on the personal authentication information, and performs access control at the application level for the information servers D and E according to the recognized application. Do.
[0113]
As a result, the single sign-on service using the relay connection method of the present invention can be provided to the information servers D and E capable of performing personal authentication only at the application level.
[0114]
(Example summary)
By using the relay connection method of the embodiment of the present invention, network level authentication and personal level authentication are executed simultaneously, and the authentication status is collectively managed by the gateway device 3, so that the authentication status of network level authentication and personal level authentication Inconsistency or duplication can be avoided. Thereby, the authentication procedure can be simplified.
[0115]
In addition, while the information server A, B, C holds the personal level authentication state, the private network address assigned to the corresponding user by the gateway device 3 is not assigned, so that the inside of the authentication communication network 4 It is possible to prevent inconsistency or duplication of authentication status. Further, the user a or b can be specified on the information server A, B, or C side.
[0116]
Also, access control at the individual level can be executed at the network level.
[0117]
Since the personal level authentication is performed for the user who uses the authentication communication network 4 when the network-level authentication communication path 5 is set, the execution of the personal level authentication can be made uniform, so that the authentication procedure can be simplified.
[0118]
Since personal level authentication is performed when the authentication communication path 5 is set, communication for accessing the inside of the authentication communication network 4 via the gateway device 3 is communication for which personal level authentication has been completed. It can be avoided.
[0119]
Since the corresponding private network address is not assigned while the personal authentication is held in the information servers A, B, and C, the authentication state between the information servers A, B, and C and the gateway device 3 is not changed. Mismatches or duplicates can be avoided.
[0120]
Corresponding to applications such as the gateway device 3 monitoring communications accessing the inside of the authentication communication network 4 and guiding users who have not completed personal level authentication to personal level authentication according to the application used. It is not necessary to perform a guidance process for personal level authentication, and the processing load on the gateway device 3 can be reduced.
[0121]
Since the gateway device 3 performs the personal level authentication before setting the authentication communication path 5, the communication packet received when the guidance to the personal level authentication is detected is held in the gateway device 3, and after the personal level authentication is completed. Therefore, it is not necessary to perform the process of transferring to the authentication communication network 4, and the processing load of the gateway device 3 can be reduced.
[0122]
【The invention's effect】
As described above, according to the present invention, a user can be specified from the information server side. It is possible to avoid inconsistency of authentication states in the authentication communication network. Network level authentication and personal level authentication procedures can be simplified. The present invention can reduce the processing load of the gateway device.
[Brief description of the drawings]
FIG. 1 is an overall configuration diagram of a relay connection system according to an embodiment of the present invention.
FIG. 2 is a sequence diagram showing an operation from when a user terminal detects access to a user's authentication communication network to when an authentication communication path is formed.
FIG. 3 is a sequence diagram showing an operation in a process in which a user of a user terminal starts using an application and continues communication.
FIG. 4 is a sequence diagram showing an operation of disconnecting an authentication communication path in accordance with an authentication communication path disconnection request from a user terminal and releasing an individual-level authentication state by the information server A without user communication.
FIG. 5 is a sequence diagram showing an operation when a user b uses the information server A after using the information server A of the user a.
FIG. 6 is a sequence diagram showing an operation when a user b uses the information server A after using the information server A of the user a.
FIG. 7 shows an operation of disconnecting an authentication communication path in accordance with an authentication communication path disconnection request from a user terminal and releasing personal authentication to the information server used by the user by a notification of release of the authentication level at the individual level. Sequence Diagram.
FIG. 8 is a sequence diagram showing a duplication check procedure for a network address and a user identifier according to the third embodiment of the present invention.
FIG. 9 is a sequence diagram showing a duplication check procedure for a network address and a user identifier according to the fourth embodiment of the present invention.
FIG. 10 is a sequence diagram illustrating a duplication check procedure for a network address and a user identifier according to the fourth embodiment of the present invention.
FIG. 11 is a sequence diagram illustrating a duplication check procedure for a network address and a user identifier according to a fifth embodiment of the present invention.
FIG. 12 is an overall configuration diagram of a relay connection system according to a sixth embodiment of the present invention.
FIG. 13 is a sequence diagram for explaining the operation of the access control server according to the sixth embodiment of the present invention.
FIG. 14 is a diagram for explaining a conventional relay connection method;
[Explanation of symbols]
1 User terminal
2 Public communication network
3 Gateway device
4 Authentication communication network
5 authentication channels
6 Network level authentication server
7 Personal level authentication server
8 Access control server
A, B, C, D, E Information server
a, b User
# 1, # 2 Information server communication network

Claims (30)

An authentication communication network as a private communication network including an information server that can be used by a user who has performed both network level and individual level authentication, and is controlled by a private network address and provides information to the user;
In a relay connection system including a public communication network connected to a user terminal that accesses the authentication communication network and a gateway device that connects the authentication communication network,
A network level authentication server for holding authentication information obtained by adding individual level authentication information to network level authentication information;
The network level authentication server is:
Means for adding and holding personal level access control information together with the authentication information;
Means for verifying the information to be authenticated received as an authentication request from the gateway device, adding the access control information to the authentication result and returning it to the gateway device;
The gateway device is
The authentication information and the user identifier obtained by adding the authentication information at the personal level to the authentication information at the network level and the expiration date information of the authentication information are received from the user terminal, and the expiration date is verified. Means for confirming the validity of the authenticated information; means for transmitting the authentication request to the network level authentication server using the user identifier and the authenticated information;
A private network address used in the authentication communication network when the authentication is completed is assigned to the user of the user terminal, and the private network address, network level authentication information returned from the network level authentication server as the authentication result, and an individual level The network level and the user identifier, which are addresses in the user's public communication network, as the authentication information of the user, respectively, and correspondingly, the personal level returned from the network level authentication server together with the authentication result Means for holding access control information;
Means for generating, with the user terminal, an authentication communication path that is an encryption communication path using the secret information by sharing the secret information with the user when the authentication is completed;
Access to the authentication communication network from the user is permitted only in the authentication communication path, and address conversion is performed between a network address in the public communication network and a private address used in the authentication communication network. Means to do,
Means for retrieving the corresponding access control information from the network address of the user when the user accesses the authentication communication network, and controlling access to the information server by the user according to the access control information; A relay connection system characterized by comprising. The information server is provided with means for acquiring the user identifier by inquiring of the personal authentication status of the user to the gateway device using the user's private network address when there is an access from the user. Item 1. The relay connection method according to Item 1. 2. The relay connection according to claim 1, wherein the gateway device includes means for not reassigning a private network address in the authentication communication network assigned to the user until the information server releases an authentication state at an individual level. method. The gateway device deletes the authentication communication path in response to a request from a user or when no communication is detected from the user to the authentication communication network using the authentication communication path for a predetermined time or longer. The relay connection system according to claim 1, further comprising means for When the gateway device deletes the authentication communication path, the gateway device deletes the authentication communication path and releases the authentication state at the individual level to the information server used by the user of the authentication communication path. With a means of notification,
The relay connection method according to claim 1, wherein the information server includes means for releasing an authentication state at a personal level of a corresponding user based on the notification from the gateway device. When the gateway device receives the setting request for the authentication communication path from the user, the gateway device includes the user identifier and the information to be authenticated and the network address of the user included in the setting request to the network level authentication server. Means for setting to the authentication request and transmitting to the network level authentication server,
The network level authentication server is:
Means for receiving the authentication request and holding the network address and the user identifier corresponding to the network address;
According to the user identifier and / or the network address set in the authentication request by searching the authentication channel information during communication held by the network level authentication server by receiving the authentication request. Means for detecting whether the authentication channel has already been set;
Means for transmitting duplicate authentication communication path deletion requests to the gateway device that sets the authentication communication path when the authentication communication path is already set by the same user identifier or the network address And
The gateway device is
Means for receiving a request for deleting the authentication communication path and searching for the corresponding authentication communication path; and when the corresponding authentication communication path is searched according to a search result of the searching means, deleting the authentication communication path and Means for notifying the network level authentication server of a deletion completion response,
The network level authentication server is set in the authentication request when the authentication communication path is not already set by the same user identifier or the network address, or when the deletion completion response is received. A means for verifying the user identifier and the information to be authenticated and adding the address control information of the corresponding user to the authentication result and responding;
The gateway device is
Means for receiving the response to which the address control information is added and setting the authentication communication path;
Means for transmitting a notification of the authentication channel setting to the network level authentication server,
The network level authentication server receives the notification of the authentication channel setting and sets the identification information, the user identifier, and the network address of the gateway device that has set the authentication channel as the set authentication channel information. With means to hold inside,
The gateway device is
Means for deleting the authentication communication path in response to a request from the user or when detecting no communication within the authentication communication network using the authentication communication path from the user for a predetermined time or more; ,
A means of discarding information about the relevant authentication channel held inside itself;
Means for notifying the network level authentication server of the deletion of the relevant authentication channel,
2. The relay connection system according to claim 1, wherein the network level authentication server comprises means for receiving the deletion notification and discarding information regarding the corresponding authentication communication path. The gateway device holds a network address of a user who has established the authentication communication path after completion of authentication and a user identifier corresponding to the network address;
Means for retrieving a network address of a user who is currently using the authentication communication path set by the user himself / herself when receiving the setting request for the authentication communication path and / or a user identifier corresponding to the network address;
Utilization of the network address of the user included in the setting request and / or the user identifier corresponding to the network address and the authentication communication path currently set by the user based on the search result of the searching means When the network address of the user and / or the user identifier corresponding to the network address are the same, the authentication communication path based on the setting request is deleted by deleting the existing authentication communication path set by the self Means for setting
Usage using the authentication communication path currently set by the user and the network address of the user included in the setting request and / or the user identifier corresponding to the network address according to the search result of the searching means Means for notifying the network address and the user identifier corresponding to the network address to another gateway device when the network address of the person and / or the user identifier corresponding to the network address do not match,
When the notification is received from another gateway device, the network includes the network address of the user who is holding the authentication communication path and the user identifier corresponding to the network address held by the notification is included in the notification Means for searching for an address and / or whether it is the same as the user identifier;
Means for responding to the gateway device that is the transmission source of the notification when the search results of the means for searching are not identical;
Means for deleting the redundant authentication communication channel held by the self when the search results of the means for searching are the same and discarding the information regarding the duplicate authentication communication channel held by the self;
A means for responding that there is a corresponding user in the authentication communication path that overlaps with the sender of the notification and that the deletion has been completed;
2. The relay connection method according to claim 1, further comprising means for setting a new authentication communication path when it is the sender of the notification and receives the response. The gateway device holds a network address of a user who has established the authentication communication path after completion of authentication and a user identifier corresponding to the network address;
Means for retrieving a network address of a user who is currently using the authentication communication path set by the user himself / herself when receiving the setting request for the authentication communication path and / or a user identifier corresponding to the network address;
Utilization of the network address of the user included in the setting request and / or the user identifier corresponding to the network address and the authentication communication path currently set by the user based on the search result of the searching means When the network address of the user and / or the user identifier corresponding to the network address are the same, the authentication communication path based on the setting request is deleted by deleting the existing authentication communication path set by the self Means for setting
Usage using the authentication communication path currently set by the user and the network address of the user included in the setting request and / or the user identifier corresponding to the network address according to the search result of the searching means Means for notifying the network address and the user identifier corresponding to the network address to another gateway device when the network address of the person and / or the user identifier corresponding to the network address do not match,
When the notification is received from another gateway device, the network includes the network address of the user who is holding the authentication communication path and the user identifier corresponding to the network address held by the notification is included in the notification Means for searching for an address and / or whether it is the same as the user identifier;
Means for responding to the gateway device that is the transmission source of the notification when the search results of the means for searching are not identical;
Means for responding to the gateway device that is the transmission source of the notification when the search results of the means for searching are the same;
When self is the sender of the notification and receives this response, the gateway apparatus that deletes the duplicate authentication communication path held by the gateway apparatus is deleted from the gateway apparatus that is the sender of the response Means for making a request to delete the information related to the authentication channel that overlaps;
Means for deleting the redundant authentication communication channel held by itself when the self is the sender of the response and receiving this request, and discarding the information related to the redundant authentication communication channel held by itself;
A means for responding that there is a corresponding user in the authentication communication channel that overlaps the transmission source of the request and that the deletion is completed;
2. The relay connection method according to claim 1, further comprising means for setting a new authentication communication path when the self is the transmission source of the request and receives the response. The gateway device is
Means for holding a network address of a user who has established the authentication communication path after completion of authentication and a user identifier corresponding to the network address;
Means for notifying the other gateway device of the network address held in the holding means and the information of the user identifier corresponding to the network address;
Means for holding the information of the gateway device that sets the authentication communication path and the network address and the information of the user identifier corresponding to the network address when the notification is received from another gateway device;
When the authentication communication path setting request is received, it corresponds to the network address of the user who uses the authentication communication path set in all the gateway devices currently held by the self and / or this network address. Searching for the user identifier, and when either is the same, means for confirming the gateway device that has set the authentication communication path;
Means for deleting the corresponding authentication communication path and setting the newly requested authentication communication path when the gateway device setting the authentication communication path is self;
When the gateway device setting the authentication communication path is another gateway device, the authentication communication is performed by setting the network address and the user identifier corresponding to the network address for the corresponding gateway device. Means for sending a road deletion request;
When the self receives this deletion request, it searches for the authentication communication path that matches the requested network identifier and / or the user identifier corresponding to this network address, deletes it, and deletes the fact that the deletion is complete. Means for responding to the requesting gateway device;
2. The relay connection method according to claim 1, further comprising means for setting the authentication communication path that is newly requested when the deletion request source is received by itself. There is an information server where the implementation of personal authentication is limited to the application level,
An access control server is provided between the gateway device and the information server,
This access control server
Means for obtaining the user identifier of the user by inquiring the personal authentication status of the user to the gateway device using the private address of the user;
The relay connection method according to claim 1, further comprising means for transmitting a user identifier as personal authentication information at the application level to the information server. The access control server
Means for recognizing an application corresponding to the user based on the personal authentication information;
11. The relay connection method according to claim 10, further comprising means for performing access control at the application level for the information server according to the application recognized by the recognition means. Applied to the relay connection method according to any one of claims 1 to 11,
Means for holding authentication information obtained by adding personal level authentication information to network level authentication information;
Means for adding and holding personal level access control information together with the authentication information;
A network level authentication server comprising: means for verifying authentication target information received as an authentication request from the gateway device, adding the access control information to the authentication result and returning the information to the gateway device. When the gateway device receives the authentication communication path setting request from the user, the gateway device receives the authentication request in which the user identifier and the authentication target information included in the setting request and the network address of the user are set. Means for holding the network address and the user identifier corresponding to the network address;
The authentication communication path is already found in accordance with the user identifier and / or the network address set in the authentication request by searching for information on the authentication communication path in communication that is received and held by the authentication request. Means for detecting whether it is set, and
Means for transmitting duplicate authentication communication path deletion requests to the gateway device that sets the authentication communication path when the authentication communication path is already set by the same user identifier or the network address When,
When the authentication communication path is not already set by the same user identifier or the network address, or when the deletion completion response is received, the user identifier and the authentication target set in the authentication request Means for verifying information and adding the address control information of the corresponding user to the result of this authentication and responding to the gateway device that sent the authentication request or the deletion completion response;
Receiving the authentication channel setting notification from the gateway device, the identification information of the gateway device that has set the authentication channel as the set authentication channel information, the user identifier, and the network address Means for holding
13. The network level authentication server according to claim 12, further comprising means for receiving a notification of deletion of the authentication communication path from the gateway device and discarding information regarding the corresponding authentication communication path. Applied to the relay connection method according to any one of claims 1 to 11,
The authentication information and the user identifier obtained by adding the authentication information at the personal level to the authentication information at the network level and the expiration date information of the authentication information are received from the user terminal, and the expiration date is verified. Means for confirming the validity of the authenticated information; means for transmitting the authentication request to the network level authentication server using the user identifier and the authenticated information;
A private network address to be used inside the authentication communication network is assigned to the user when the authentication is completed. Respectively holding a network address and a user identifier which are addresses of the user's public communication network, and correspondingly holding the personal level access control information returned together with the authentication result from the network level authentication server. Means to
Means for generating, with the user terminal, an authentication communication path that is an encryption communication path using the secret information by sharing the secret information with the user when the authentication is completed;
Access to the authentication communication network from the user is permitted only in the authentication communication path, and address conversion is performed between a network address in the public communication network and a private address used in the authentication communication network. Means to do,
Means for retrieving the corresponding access control information from the network address of the user when the user accesses the authentication communication network, and controlling access to the information server by the user according to the access control information; A gateway device comprising: Means for holding a network address of a user who has established the authentication communication path after completion of authentication and a user identifier corresponding to the network address;
Means for retrieving a network address of a user who is currently using the authentication communication path set by the user himself / herself when receiving the setting request for the authentication communication path and / or a user identifier corresponding to the network address;
Utilization of the network address of the user included in the setting request and / or the user identifier corresponding to the network address and the authentication communication path currently set by the user based on the search result of the searching means When the network address of the user and / or the user identifier corresponding to the network address are the same, the authentication communication path based on the setting request is deleted by deleting the existing authentication communication path set by the self Means for setting
Usage using the authentication communication path currently set by the user and the network address of the user included in the setting request and / or the user identifier corresponding to the network address according to the search result of the searching means Means for notifying the network address and the user identifier corresponding to the network address to another gateway device when the network address of the person and / or the user identifier corresponding to the network address do not match,
When the notification is received from another gateway device, the network includes the network address of the user who is holding the authentication communication path and the user identifier corresponding to the network address held by the notification is included in the notification Means for searching for an address and / or whether it is the same as the user identifier;
Means for responding to the gateway device that is the transmission source of the notification when the search results of the means for searching are not identical;
Means for deleting the redundant authentication communication channel held by the self when the search results of the means for searching are the same and discarding the information regarding the duplicate authentication communication channel held by the self;
A means for responding that there is a corresponding user in the authentication communication path that overlaps with the sender of the notification and that the deletion has been completed;
The gateway device according to claim 14, further comprising: a unit that sets a new authentication communication channel when the device itself is the source of the notification and receives the response. Means for holding a network address of a user who has established the authentication communication path after completion of authentication and a user identifier corresponding to the network address;
Means for retrieving a network address of a user who is currently using the authentication communication path set by the user himself / herself when receiving the setting request for the authentication communication path and / or a user identifier corresponding to the network address;
Utilization of the network address of the user included in the setting request and / or the user identifier corresponding to the network address and the authentication communication path currently set by the user based on the search result of the searching means When the network address of the user and / or the user identifier corresponding to the network address are the same, the authentication communication path based on the setting request is deleted by deleting the existing authentication communication path set by the self Means for setting
Usage using the authentication communication path currently set by the user and the network address of the user included in the setting request and / or the user identifier corresponding to the network address according to the search result of the searching means Means for notifying the network address and the user identifier corresponding to the network address to another gateway device when the network address of the person and / or the user identifier corresponding to the network address do not match,
When the notification is received from another gateway device, the network includes the network address of the user who is holding the authentication communication path and the user identifier corresponding to the network address held by the notification is included in the notification Means for searching for an address and / or whether it is the same as the user identifier;
Means for responding to the gateway device that is the transmission source of the notification when the search results of the means for searching are not identical;
Means for responding to the gateway device that is the transmission source of the notification when the search results of the means for searching are the same;
When self is the sender of the notification and receives this response, the gateway apparatus that deletes the duplicate authentication communication path held by the gateway apparatus is deleted from the gateway apparatus that is the sender of the response Means for making a request to delete the information related to the authentication channel that overlaps;
Means for deleting the redundant authentication communication channel held by itself when the self is the sender of the response and receiving this request, and discarding the information related to the redundant authentication communication channel held by itself;
A means for responding that there is a corresponding user in the authentication communication channel that overlaps the transmission source of the request and that the deletion is completed;
15. The gateway device according to claim 14, further comprising means for setting a new authentication communication path when the self is the transmission source of the request and receives the response. Means for holding a network address of a user who has established the authentication communication path after completion of authentication and a user identifier corresponding to the network address;
Means for notifying the other gateway device of the network address held in the holding means and the information of the user identifier corresponding to the network address;
Means for holding the information of the gateway device that sets the authentication communication path and the network address and the information of the user identifier corresponding to the network address when the notification is received from another gateway device;
When the authentication communication path setting request is received, it corresponds to the network address of the user who uses the authentication communication path set in all the gateway devices currently held by the self and / or this network address. Searching for the user identifier, and when either is the same, means for confirming the gateway device that has set the authentication communication path;
Means for deleting the corresponding authentication communication path and setting the newly requested authentication communication path when the gateway device setting the authentication communication path is self;
When the gateway device setting the authentication communication path is another gateway device, the authentication communication is performed by setting the network address and the user identifier corresponding to the network address for the corresponding gateway device. Means for sending a road deletion request;
When the self receives this deletion request, it searches for the authentication communication path that matches the requested network identifier and / or the user identifier corresponding to this network address, deletes it, and deletes the fact that the deletion is complete. Means for responding to the requesting gateway device;
15. The gateway apparatus according to claim 14, further comprising means for setting the authentication communication path that is newly requested when the self is the deletion request source and receives the deletion completion response. Applied to the relay connection method according to any one of claims 1 to 11,
Information comprising: means for acquiring the user identifier by inquiring of the user's personal authentication status to the gateway device using the user's private network address when there is an access from the user server. Applied to the relay connection method according to any one of claims 1 to 11,
Provided between the gateway device and an information server whose implementation of personal authentication is limited to the application level,
Means for obtaining the user identifier of the user by inquiring the personal authentication status of the user to the gateway device using the private address of the user;
An access control server comprising means for transmitting a user identifier as personal authentication information at the application level to the information server. Means for recognizing an application corresponding to the user based on the personal authentication information;
20. The access control server according to claim 19, further comprising means for performing access control at the application level for the information server in accordance with the application recognized by the recognition means. By installing the information processing apparatus, the function corresponding to the network level authentication server applied to the relay connection method according to any one of claims 1 to 11,
A function for holding authentication information obtained by adding personal level authentication information to network level authentication information;
A function of adding and holding personal level access control information together with the authentication information;
A program that realizes a function of verifying authentication target information received as an authentication request from the gateway device, adding the access control information to the authentication result, and returning it to the gateway device. When the gateway device receives the authentication communication path setting request from the user, the gateway device receives the authentication request in which the user identifier and the authentication target information included in the setting request and the network address of the user are set. A function for holding the network address and the user identifier corresponding to the network address;
The authentication communication path is already found in accordance with the user identifier and / or the network address set in the authentication request by searching for information on the authentication communication path in communication that is received and held by the authentication request. A function to detect whether it is set,
A function of transmitting duplicate authentication communication path deletion requests to the gateway device that has set the authentication communication path when the authentication communication path has already been set by the same user identifier or the network address When,
When the authentication communication path is not already set by the same user identifier or the network address, or when the deletion completion response is received, the user identifier and the authentication target set in the authentication request A function of verifying information and adding the address control information of the corresponding user to the result of this authentication and responding to the gateway device that has transmitted the authentication request or the deletion completion response;
Receiving the authentication channel setting notification from the gateway device, the identification information of the gateway device that has set the authentication channel as the set authentication channel information, the user identifier, and the network address And the function to keep
The program according to claim 21, wherein a function of receiving a notification of deletion of the authentication communication path from the gateway device and discarding information regarding the corresponding authentication communication path is realized. As a function corresponding to the gateway device applied to the relay connection method according to any one of claims 1 to 11, the information processing device is installed in the information processing device.
The authentication information and the user identifier obtained by adding the authentication information at the personal level to the authentication information at the network level and the expiration date information of the authentication information are received from the user terminal, and the expiration date is verified. A function for confirming the validity of the authenticated information; a function for transmitting the authentication request to the network level authentication server using the user identifier and the authenticated information;
A private network address used inside the authentication communication network is assigned to the user upon completion of authentication, and the private network address and network level authentication information and personal level authentication information returned as the authentication result from the network level authentication server Respectively holding a network address and a user identifier, which are addresses in the public communication network of the user, and correspondingly holding the personal level access control information returned together with the authentication result from the network level authentication server Function to
A function of sharing secret information with the user when the authentication is completed, and generating an authentication communication path that is an encrypted communication path using the secret information with the user terminal;
Access to the authentication communication network from the user is permitted only in the authentication communication path, and address conversion is performed between a network address in the public communication network and a private address used in the authentication communication network. Functions to do,
A function of retrieving the corresponding access control information from the network address of the user when the user accesses the authentication communication network, and controlling access to the information server by the user according to the access control information; A program characterized by being realized. A function of holding a network address of a user who has established the authentication communication path after completion of authentication and a user identifier corresponding to the network address;
A function of searching for a network address of a user who is currently using the authentication communication path set by the user himself / herself when receiving the setting request for the authentication communication path and / or a user identifier corresponding to the network address;
Utilization of the network address of the user included in the setting request and / or the user identifier corresponding to the network address and the authentication communication path currently set by the user based on the search result of the function to be searched When the network address of the user and / or the user identifier corresponding to the network address are the same, the authentication communication path based on the setting request is deleted by deleting the existing authentication communication path set by the self A function to set
Utilization using the authentication communication path currently set by the user and the network address of the user included in the setting request or the user identifier corresponding to the network address according to the search result of the function to be searched A function for notifying the network address and the user identifier corresponding to the network address to another gateway device when the network address of the person and / or the user identifier corresponding to the network address do not match,
When the notification is received from another gateway device, the network includes the network address of the user who is holding the authentication communication path and the user identifier corresponding to the network address held by the notification is included in the notification A function for searching whether the address and / or the user identifier are the same;
A function of responding to the gateway device that is the transmission source of the notification when the search results of the function to search are not the same;
When the search results of the function to be searched are the same, the function of deleting the duplicate authentication communication path held by the self and discarding the information related to the duplicate authentication communication path held by the self,
A function of responding that there is a corresponding user in the authentication communication path that overlaps with the sender of the notification and that the deletion has been completed;
24. The program according to claim 23, wherein the program realizes a function of setting a new authentication communication path when the self is the sender of the notification and receives the response. A function of holding a network address of a user who has established the authentication communication path after completion of authentication and a user identifier corresponding to the network address;
A function of searching for a network address of a user who is currently using the authentication communication path set by the user himself / herself when receiving the setting request for the authentication communication path and / or a user identifier corresponding to the network address;
Utilization of the network address of the user included in the setting request and / or the user identifier corresponding to the network address and the authentication communication path currently set by the user based on the search result of the function to be searched When the network address of the user and / or the user identifier corresponding to the network address are the same, the authentication communication path based on the setting request is deleted by deleting the existing authentication communication path set by the self A function to set
Utilization using the authentication communication path currently set by the user and the network address of the user included in the setting request or the user identifier corresponding to the network address according to the search result of the function to be searched A function for notifying the network address and the user identifier corresponding to the network address to another gateway device when the network address of the person and / or the user identifier corresponding to the network address do not match,
When the notification is received from another gateway device, the network includes the network address of the user who is holding the authentication communication path and the user identifier corresponding to the network address held by the notification is included in the notification A function for searching whether the address and / or the user identifier are the same;
A function of responding to the gateway device that is the transmission source of the notification when the search results of the function to search are not the same;
A function of responding to the gateway device that is the transmission source of the notification when the search results of the function to search are the same;
When self is the sender of the notification and receives this response, the gateway apparatus that deletes the duplicate authentication communication path held by the gateway apparatus is deleted from the gateway apparatus that is the sender of the response A function of making a request to delete information related to the authentication channel that is duplicated;
When the self is the sender of the response and receives this request, the function deletes the duplicate authentication communication path held by the self and discards the information related to the duplicate authentication communication path held by the self,
A function of responding that there is a corresponding user in the authentication communication path that overlaps the transmission source of the request and that the deletion is completed;
24. The program according to claim 23, wherein the program realizes a function of setting a new authentication communication path when the self is the transmission source of the request and receives the response. A function of holding a network address of a user who has established the authentication communication path after completion of authentication and a user identifier corresponding to the network address;
A function of notifying other gateway devices of the network address held in the held function and the information of the user identifier corresponding to the network address;
When receiving this notification from the other gateway device, the function to hold the information of the gateway device that has set the authentication communication path and the network address and the information of the user identifier corresponding to the network address;
When the authentication communication path setting request is received, it corresponds to the network address of the user who uses the authentication communication path set in all the gateway devices currently held by the self and / or this network address. A function of checking the gateway device that sets the authentication communication path when searching for the user identifier and when either is the same;
A function of deleting the corresponding authentication communication path and setting the newly requested authentication communication path when the gateway device setting the authentication communication path is self;
When the gateway device setting the authentication communication path is another gateway device, the authentication communication is performed by setting the network address and the user identifier corresponding to the network address for the corresponding gateway device. A function to send a road deletion request,
When the self receives this deletion request, it searches for the authentication communication path that matches the requested network identifier and / or the user identifier corresponding to this network address, deletes it, and deletes the fact that the deletion is complete. A function to respond to the requesting gateway device;
24. The program according to claim 23, wherein when the self is the deletion request source and receives the deletion completion response, the function of setting the authentication communication path that has been newly requested is realized. As a function corresponding to the information server applied to the relay connection method according to any one of claims 1 to 11, by installing in the information processing device,
A program for realizing the function of acquiring the user identifier by inquiring the gateway device about the personal authentication status of the user by using the private network address of the user when there is an access from the user. . As a function corresponding to the access control server applied to the relay connection method according to any one of claims 1 to 11, the information processing device is installed in the information processing device.
A function for acquiring the user identifier of the user by inquiring the personal authentication status of the user to the gateway device using the private address of the user;
A program for causing the information server to realize a function of transmitting a user identifier as personal authentication information at the application level. A function for recognizing an application corresponding to the user based on the personal authentication information;
29. The program according to claim 28, wherein a function for performing access control at the application level for the information server is realized in accordance with an application recognized by the recognition function. 30. A recording medium readable by the information processing apparatus, on which the program according to claim 21 is recorded.

Images