JP4332071B2 - Client terminal, gateway device, and network system including these - Google Patents

Description

  The present invention relates to access control based on access authority given by user authentication, and relates to access control to a plurality of networks.

Conventionally, even if you have multiple servers in the network and access restrictions for users on each server are different, there is no user authentication on multiple servers by performing user authentication once with a single integrated authentication server. There is a technique that reduces the management burden on each server and the operation burden on the user (for example, Patent Document 1).
JP 2003-242119 A

However, such a conventional network system relates to user authentication in a server with different access restrictions. When accessing another network with a different address system, it is necessary to receive user authentication again.
Accordingly, the present invention has been invented in view of the above-described problems, and provides a client terminal, a gateway device, and a network system including these that can access a plurality of networks with one user authentication. Objective.

  The present invention that achieves the above-described object is provided in a gateway device connected to another network in a network to which the client terminal is not connected, and the address of the client terminal from which the access request is output and the gateway connected to the client terminal. A verification processing unit that verifies a match with the address of the ticket generated by the apparatus and verifies the authenticator of the ticket with a secret key or a public key, and at least mutually correlates with normal verification of the verification processing unit It has a ticket generation unit that generates an authenticator by performing encryption processing of a user identifier and an address with a new secret key, and generates a ticket with the authenticator and at least the user identifier and the address. .

  According to the present invention, a client terminal that accesses through a connected network is authenticated by a ticket and an address issued in this network, so that authentication information can be input by a user in another network. In addition, the authentication process associated therewith can be omitted, and access in a plurality of networks is possible with only one user authentication.

Hereinafter, a client terminal, a gateway device, and a network system including these will be described with reference to the drawings.
[First embodiment]
1 to 12 are diagrams showing a network system according to a first embodiment of the present invention.
As shown in FIG. 1, the network system of the present embodiment includes a plurality of networks 1 to 4 each having a different address system, and each network 1 to 4 controls connection with another network or client terminal 5. Gateway devices 11a to 11g and server devices 12a to 12f for providing services to the client terminal 5 are provided.

  As shown in FIG. 2, each gateway apparatus 11 (11a to 11g) is connected to a line, and through this line, a communication interface unit 111 that controls communication with the gateway apparatus 11 and the client terminal 5 of another network, In response to an access request from the client terminal 5, an address is issued to a user who is authenticated normally, a user authenticator and an address are allocated, a ticket for permitting access is issued, and only packets from the issued address are issued. The access control unit 112 that controls to pass, the authentication processing unit 113 that performs user authentication and ticket verification in response to a request from the access control unit 112, the ticket generation unit 114 that generates a ticket, and the authentication processing unit 113 Data and address for ticket verification Metame data, ticket generation unit 114 and a database section 115 to be accumulated such data for generating the ticket. Here, the authentication processing unit 113 is a device that performs user authentication and ticket verification. However, in the individual gateway device described later with reference to FIGS. 3 and 9, authentication and verification are described separately for convenience of explanation.

In FIG. 1, the server apparatus 12 (12a to 12f) provides services such as WWW (World Wide Web), FTP (File Transfer Protocol), and content distribution.
In the network system shown in FIG. 1, in order to perform the verification of the user by the ticket without inputting the authentication information by the user for the user who requests access via the network, the gateway apparatus 11 between the directly connected networks is used. The unique shared secret key is exchanged and held for each of the networks 1 to 4. Therefore, the gateway devices 11b and 11c share the keys of the networks 1 and 2, the gateway devices 11d and 11f share the keys of the networks 2 and 3, and the gateway devices 11e and 11g share the keys of the networks 2 and 4. Share. When a public key unique to the networks 1 to 4 is used, this public key is shared.

The above is an explanation based on the outline of the network system shown in FIG. 1 and the gateway device shown in FIG.
Next, the gateway device 11a will be described regarding the relationship between the client terminal 5 and the network 1 shown in FIG. FIG. 3 shows the gateway device 11a together with its function in the network system shown in FIG. 1, and FIG. 4 is a process flowchart of the gateway device 11a in FIG. In the network system shown in FIG. 1, a case where the client terminal 5 operated by the user requests a service of the server device 12a by the user's operation will be described.

First, the client terminal 5 transmits an access request to the gateway device 11a by a user operation. Here, the access control unit 112 of the gateway device 11a performs user authentication when receiving an access request from the client terminal 5 via the communication interface unit 111 as shown in FIG. Is requested from the client terminal 5 (step 4-1 in FIG. 4).
The client terminal 5 requests the user to input user identification information and a password in response to a request from the gateway device 11a, transmits the user identification information and password input by the user to the access control unit 112 as user authentication information, and User authentication information stored in a storage medium (not shown) is transmitted to the access control unit 112. At this time, the user authentication information may include the public key of the user.

  Next, in the gateway device 11a to which the user authentication information is transmitted from the client terminal 5, the access control unit 112 receives the user authentication information and transmits the received user authentication information to the authentication processing unit 113x to perform user authentication. Ask. Upon receiving the user authentication information, the authentication processing unit 113x requested for user authentication searches the user information registered in the database unit 115 by the user identification information of the user authentication information, and matches the user identification information. If the user information to be registered is registered, the password of the user information is compared with the password of the received user authentication information, and if these passwords match, "authentication normal" is returned, otherwise In this case, “authentication abnormality” is returned to the access control unit 112 (step 4-2 in FIG. 4).

  When an “authentication error” is returned from the authentication processing unit 113x (step 4-3 in FIG. 4), the access control unit 112 rejects access from the client terminal 5 (step 4-7 in FIG. 4). On the other hand, when “authentication normal” is returned from the authentication processing unit 113x, the access control unit 112 assigns a unique user identifier in the network 1 and searches for an available address from the address data stored in the database unit 115. The payout is assigned to the user (step 4-4 in FIG. 4), and the user identifier and address are stored in association with each other. Here, as the user identifier, a user identifier registered in advance corresponding to the user may be used, or a user name may be used.

Next, the access control unit 112 transmits the assigned user identifier and address to the ticket generation unit 114 to request generation of a ticket. At this time, in response to the request for ticket generation, information on the bandwidth used by the user (client terminal 5) and public key information of the user may be transmitted to the ticket generation unit 114 together.
When the ticket generation unit 114 receives the ticket generation request from the access control unit 112, the ticket generation unit 114 adds information such as the current time as the ticket issuance time stamp and the expiration date of the ticket to the received information (user identifier, address, etc.) An authenticator is generated using a shared secret key (shared secret key unique to the network 1) shared in advance between the server apparatuses 12a and 12b and a hash function for this information (step 4-5 in FIG. 4). That is, as shown in the configuration example of the ticket in FIG. 5, the received information including the user identifier and the address (including the public key information of the client terminal 5 in FIG. 5) includes the time stamp of the ticket and the expiration date of the ticket. The added information, and further, an authenticator obtained by encrypting the hash value that has passed through the hash function with the shared secret key is added, and is transmitted to the access control unit 112 as a ticket. Note that a digital signature generated using a public key pair unique to the network 1 may be used as the authenticator of this ticket. In generating the ticket authenticator as shown in FIG. 5, a simplified hash value is obtained in the hash function block 1141 for the portion other than the ticket authenticator as shown in FIG. 6, and the shared secret key or public key pair is determined. In an encryption processing block 1142 composed of a public key, an output block 1143 for obtaining an authenticator is obtained.

In FIG. 3, when the access control unit 112 receives a ticket from the ticket generation unit 114, the access control unit 112 transmits the received ticket to the client terminal 5 together with “authentication normal” information (step 4-6 in FIG. 4). At this time, if the user authentication information includes the user's public key, the ticket may be encrypted with this public key and transmitted to the client terminal 5.
Returning to FIG. 1, when the client terminal 5 receives the ticket together with the “authentication normal” information, the client device 5 registers the address included in the received ticket as the address of its own terminal, and the server device from which the user requests the service A service request including a ticket is transmitted to 12a.

  On the other hand, as shown in the flowchart of FIG. 7, when the server apparatus 12a receives a service request (step 3-1), it determines whether or not the source address of the received service request matches the address of the received ticket. If it is verified (step 3-2) and the addresses match (step 3-3), the authenticator of the received ticket is verified using the shared secret key unique to the network 1 and the hash function (step 3-4). ). The verification process of the authenticator here is the same as the verification of the gateway device described later. However, as shown in FIG. 8, the authenticator is decrypted in the decryption processing block Y2 with the common secret key or the public key pair for the ticket. The hash value is obtained, the hash value is obtained from the hash function block Y1 for the part other than the authenticator of the other ticket, the hash value is compared in the block Y3, and the match is seen to verify the authenticator. When a digital signature generated using a public key pair unique to the network 1 is used as the authenticator, the authenticator is verified using the public key unique to the network 1. Further, when the ticket includes a time stamp and an expiration date, it is verified whether the ticket is within the expiration date.

If all the verification results are normal (step 3-5 in FIG. 7), the server apparatus 12a determines that the request is from the correct user without falsification of the ticket, and is requested by the client terminal 5. A service is provided (step 3-6 in FIG. 7).
In this way, the user can provide services to the server apparatuses 12a and 12b in the network 1 without performing authentication processing (such as user input of a user identifier and password) by one-time user authentication by the gateway apparatus 11a. Can receive.
Next, returning to FIG. 1, a case where a user who has performed user authentication in the network 1 accesses another network 2 having a different address system via the network 1 will be described with reference to the configuration of the gateway device 11c in FIG. This will be described with reference to the flowchart. When the client terminal 5 requests a service of the server apparatus 12c in the network 2 by a user operation, the client terminal 5 transmits an access request to the gateway apparatus 11c.

When the access control unit 112 of the gateway device 11c shown in FIG. 9 receives an access request from the client terminal 5 via the connected network 1, the user authentication such as user identification information and password is performed to authenticate the user. Information is requested from the client terminal 5 (step 2-1 in FIG. 10).
In response to a request from the gateway device 11c, the client terminal 5 transmits the ticket acquired in the network 1 to the gateway device 11c as user authentication information.
When receiving the user authentication information via the network 1, the access control unit 112 of the gateway device 11c requests the verification processing unit 113Y to perform verification. The verification processing unit 113Y extracts the ticket from the user authentication information, verifies whether the transmission source address of the user authentication information matches the ticket address (step 2-2 in FIG. 10), and if the addresses match ( Step 2-3 in FIG. 10), the authenticator of the received ticket is verified using a shared secret key unique to the network 1 shared with the network 1 and a hash function (step 2-4 in FIG. 10). ).

If a digital signature generated using a public key pair unique to the network 1 is used as the authenticator, the authenticator is verified using the public key unique to the network 1. This verification is as shown in FIG. 8 described above. If the ticket includes a time stamp and an expiration date, it is verified whether the ticket is within the expiration date.
If all the verification results are normal (step 2-5 in FIG. 10), the access control unit 112 determines that the ticket has not been tampered with and is a request from the correct user, and Similar to the gateway device 11a, a user identifier and an address are assigned (step 2-6 in FIG. 10), and the assigned user identifier and address are transmitted to the ticket generation unit 114 to request generation of a ticket in the gateway device 11c. .

At this time, as information included in the ticket, information on a band used by the user (client terminal 5) set in the received ticket and user public key information may be transmitted to the ticket generation unit 114 together.
As the user identifier, a user identifier registered in advance for the user may be used, or a user name or a user identifier in the received ticket may be used.
When the ticket generation unit 114 receives a ticket generation request from the access control unit 112, as in the gateway device 11a described above, the ticket generation unit 114 adds the current time and expiration date as a time stamp to the received information (user identifier, address, etc.). Based on this information, an authenticator is generated using a shared secret key (shared secret key unique to the network 2) and a hash function shared in advance with the server apparatuses 12c and 12d, and the above-mentioned reception is received in this authenticator. The information added with the information, time stamp, expiration date, etc. is transmitted as a ticket to the access control unit 112 (step 2-7 in FIG. 10). Note that a digital signature generated using a public key pair unique to the network 2 may be used as the authenticator. This function is the same as that shown in FIGS. 3 and 4 in the gateway device 11a.

When the access control unit 112 receives a ticket from the ticket generation unit 114, the access control unit 112 transmits the received ticket to the client terminal 5 via the network 1 together with information of “normal authentication” (step 2-8 in FIG. 10). At this time, if the user authentication information includes the user's public key, the ticket may be encrypted with this public key and transmitted to the client terminal 5.
When the client terminal 5 receives the “authentication normal” information and the ticket, the client terminal 5 registers the address included in the received ticket as an address when connecting to the network 2, and registers it with the server device 12 c from which the user has requested the service. On the other hand, a service request including a ticket is transmitted.

  Upon receiving the service request, the server device 12c verifies whether the source address of the received service request matches the address of the received ticket as described in the case of the server device 12a of FIGS. If the addresses match, the authenticator of the received ticket is verified using the shared secret key unique to the network 2. When a digital signature generated using a public key pair unique to the network 2 is used as an authenticator, the authenticator is verified using a public key unique to the network 2. Further, when the ticket includes a time stamp and an expiration date, it is verified whether the ticket is within the expiration date.

If all the verification results are normal, the server device 12c determines that the ticket has not been tampered with and is a request from the correct user, and provides the requested service to the client terminal 5.
In this way, the user can authenticate the user not only to the server devices 12a and 12b in the network system 1 but also to the server devices 12c and 12d in the network system 2 by one user authentication by the gateway device 11a. The service can be provided without the user identifier or password input.

Similarly, the network systems 3 and 4 can be accessed without authentication processing using the ticket acquired by the network system 2.
FIGS. 11 and 12 are diagrams summarizing the entire description so far using a ticket to be generated or verified. Based on the user authentication information from the client terminal 5 in the network 1, the ticket generation unit 114 of the gateway device 11a in FIG. 3 generates the uppermost ticket in FIG. In the case of access to the server apparatus 12a of the network 1, the generated ticket is used to verify the address and verify the authenticator as shown in the second row of FIG. Further, the gateway device 11c of the network 2 verifies the address and the authenticator as shown in the third row of FIG. 11 using the uppermost ticket as the user authentication information. With this verification as a trigger, a ticket is generated in the gateway device 11c shown at the top of FIG. In the access of the server device 12c in the network 2, as shown in the second row in FIG. 12, the address verification and the authenticator verification are performed on the uppermost ticket. As described above, the user authentication information is only generated for the first ticket, and thereafter, the ticket is generated based on the verification of the ticket.

In this embodiment, a case has been described in which an access request is automatically made to the gateway device by a user access request to the server device, and then a service request is transmitted to the server device. The same processing can be performed when a service request is transmitted to the server device by a user operation after an access request is made and access is permitted.
As described above, since the client terminal that accesses through the connected network is authenticated by the ticket and address issued in this network, it is verified without the input of authentication information by the user and access is permitted. Will be.
[Second Embodiment]
Next, FIGS. 13 and 14 are diagrams showing a network system according to a second embodiment of the present invention. Since the present embodiment is configured in substantially the same manner as the first embodiment described above, only the features of this embodiment will be described with reference to FIGS.

In the second embodiment, a case where the client terminal 5 remotely accesses the networks 1 to 4 by IPsec (security architecture for Internet Protocol) (security service for ensuring communication security between IP networks) is shown.
Similarly to the above-described first embodiment, the networks 1 to 4 are directly connected to each other's gateway device 11 and exchange a unique shared secret key for each of the networks 1 to 4.

FIG. 13 is a sequence diagram when the client terminal 5 is accessed, for example, between the client terminal 5, the gateway device 11a, and the server devices 12a and 12b.
In FIG. 13, when the client terminal 5 tries to connect to the gateway device 11a by remote access by IPsec, the client terminal 5 performs phase 1 (phase 1) (executed by the IKE protocol) with the gateway device 11a according to the IKE (Internet Key Exchange) protocol. The secure authentication channel is established with one of the two services to be performed), and the encryption method used in phase 2 (Phase 2) is determined and the encryption key is generated (S11; display in step 11) The same applies hereinafter).

When the processing of phase 1 is completed, the access control unit 112 of the gateway device 11a requests the user name and password from the client terminal 5 according to the Xauth (Extended Authentication within IKE) protocol (S12).
In response to the request from the gateway device 11a, the client terminal 5 transmits the user name “Joe @ client” and the password “foobar” (S13). Here, “@client” in the user name indicates that a ticket acquisition request is made by the method of the present embodiment.
When the access control unit 112 of the gateway device 11a receives a response with “@client” in the user name, the authentication processing unit 113 performs user authentication using the user name “Joe” and the password. If the user authentication is normal, a user identifier and an address are allocated as in the first embodiment, and the allocated user identifier and address are transmitted to the ticket generation unit 114 to request a ticket generation. As the user identifier, a user identifier registered in advance for the user may be used, or a user name may be used.

  The ticket generation unit 114 generates a secret key, obtains a hash value of the generated secret key, adds a time stamp, an expiration date, and a hash value of the secret key based on the information received from the access control unit 112, and generates a server device An authenticator is generated using a shared secret key (shared secret key unique to the network 1) and a hash function that are shared in advance with 12a and 12b, and the received information, time stamp, and valid information described above are used for this authenticator A ticket to which a time limit and a hash value of the generated secret key are added is transmitted as a ticket to the access control unit 112 together with the generated secret key. As the authenticator, a digital signature generated using a public key pair unique to the network 1 may be used.

The access control unit 112 converts the ticket and secret key generated by the ticket generation unit 114 into text data using BASE64 (which is one of the data encoding methods) and transmits (BASE64TOKEN) to the client terminal 5 ( S14).
Further, the generated secret key is transmitted to the server apparatuses 12a and 12b together with the user identifier and address using a secure communication path established in advance (S15). Also, the secret key is transmitted to the gateway device 11 of the adjacent network using a secure communication path established in advance.

When the server devices 12a and 12b and the gateway device 11 of the adjacent network receive the secret key, the secret key is stored in association with the user identifier and address transmitted together.
The client terminal 5 that has received the ticket and the private key decrypts the ticket and the private key of the received text data, confirms the decrypted ticket, confirms the private key by the hash value of the private key in the ticket, and obtains the ticket and the private key. The key is saved and a response is returned (S16). When receiving the response from the client terminal 5, the access control unit 112 transmits “normal authentication” to the client terminal 5 (S17).

  The client terminal 5 that has received “authentication normal” returns an acknowledgment ACK to the gateway device 11a (S18). Thereafter, the address is given to the client terminal 5 by Mode Config (abbreviated as Mode Config in the configuration method (combination technology) of ISAKMP (Internet Security Association and Key Management Protocol) (service for providing key management function and security negotiation function)). (S19). At this time, the access control unit 112 of the gateway device 11a assigns the address set to the ticket. The client terminal 5 registers the assigned address as its own device address. Thereafter, the encryption method and encryption key used in IPsec are determined by the processing of phase 2 of the IKE protocol (S20).

The client terminal 5 accesses the server device 12a (sends a service request including a ticket) in the same manner as in the first embodiment by the encrypted communication by IPsec established in this way (S21).
The server device 12a verifies whether the source address of the received service request matches the address of the received ticket. If the addresses match, the server device 12a uses the network 1 specific shared secret as the received ticket authenticator. Verify using key and hash function. If a digital signature generated using a public key pair unique to the network 1 is used as the authenticator, the authenticator is verified using the public key unique to the network 1. At this time, when authenticating the user more strictly, the client terminal 5 uses a signature obtained by encrypting the hash value of the ticket with the secret key (secret key generated by the gateway device 11a) received at the same time as the ticket together with the ticket. Send it in the service request. The server device 12a verifies the ticket and address by the above-described method, selects a secret key corresponding to the user (the secret key received from the gateway device 11a) based on the user identifier and address in the ticket, and the secret. The user is authenticated by verifying the signature with the key and hash function.

In this way, even in remote access by IPsec, the user can perform authentication processing (such as input of a user identifier and password by the user) to the server devices 12a and 12b in the network system 1 by one user authentication by the gateway device 11a. ) Can be provided without any service.
Further, since tickets are exchanged within the sequence of the Xauth protocol, it is not necessary to add a special procedure for exchanging tickets, and it is possible to connect to a client terminal that does not use the method of this embodiment.

Next, a case where a user who has performed user authentication on the network 1 accesses another network system 2 having a different address system via the network 1 will be described.
FIG. 14 is a sequence diagram when the client terminal 5 is connected to the gateway device 11c of the network 2 via the network 1 by remote access by IPsec.
As shown in FIG. 14, when the client terminal 5 that has completed user authentication in the network system 1 tries to connect to the gateway apparatus 11c by remote access using IPsec, the process of phase 1 is performed with the gateway apparatus 11c according to the IKE protocol. The encryption method used in phase 2 is determined and the encryption key is generated (S31). When the processing of phase 1 is completed, the access control unit 112 of the gateway device 11c requests the user name and password from the client terminal 5 according to the Xauth protocol (S32).
In response to the request from the gateway device 11c, the client terminal 5 transmits a ticket converted to text data (BASE64TOKEN) using BASE64 or the like acquired on the network 1 as a user name “Joe @ client” and a password (S33). Here, “@client” of the user name indicates that a ticket acquisition is requested by the method of the present embodiment.

In addition, when authenticating the user more strictly, the client terminal 5 uses the BASE64 or the like as a text with the signature obtained by encrypting the hash value of the ticket acquired by the network system 1 with the private key acquired by the network system 1. Convert it to data and send it as a password.
When the access control unit 112 of the gateway device 11c receives a response with “@client” in the user name through access via the network system 1, the access control unit 112 determines that a ticket is included in the password, and the received text data ticket. And the decrypted ticket is verified in the same manner as in the first embodiment. When the signature is received together with the ticket, a secret key corresponding to the user is selected by the user identifier or address in the decrypted ticket, and the signature is verified by the secret key and the hash function to authenticate the user.

If the verification of the ticket and signature is normal, the access control unit 112 assigns a user identifier and an address, and transmits the assigned user identifier and address to the ticket generation unit 114 as in the first embodiment. Request to generate a ticket.
As the user identifier, a user identifier registered in advance for the user may be used, or a user name or a user identifier in the received ticket may be used.
The ticket generation unit 114 generates a secret key, obtains a hash value of the generated secret key, adds a time stamp, an expiration date, and a hash value of the secret key based on the received information, and connects the server devices 12c and 12d. An authenticator is generated using a shared secret key (shared secret key unique to the network 2) and a hash function shared in advance, and the received information, time stamp, expiration date, and generated secret are generated in this authenticator The information including the hash value of the key is added to the access control unit 112 together with the secret key generated as a ticket.

Note that a digital signature generated using a public key pair unique to the network system 2 may be used as the authenticator.
The access control unit 112 changes the ticket and secret key generated by the ticket generation unit 114 to text data (BASE64TOKEN2) using BASE64 or the like, and transmits it to the client terminal 5 (S34).
Further, the generated secret key is transmitted together with the user identifier and address to the server devices 12c and 12d using a secure communication path established in advance (S35). Further, the secret key is transmitted to the gateway device of the adjacent network using a secure communication path established in advance.

When the server device 12c, 12d and the gateway device of the adjacent network receive the secret key, the secret key is stored in association with the user identifier and address transmitted together. The client terminal 5 that has received the ticket and the private key decrypts the ticket and the private key of the received text data, confirms the decrypted ticket, confirms the private key by the hash value of the private key in the ticket, and obtains the ticket and the private key. The key is saved and a response is returned (S36).
When receiving the response from the client terminal 5, the access control unit 112 transmits “normal authentication” to the client terminal 5 (S37).

The client terminal 5 that has received “authentication normal” returns a response to the gateway device 11c (S38). Thereafter, an address is given to the client terminal 5 by Mode Config (S39). At this time, the access control unit 112 of the gateway device 11c gives the address set in the ticket.
The client terminal 5 registers the assigned address as an address when accessing the network 2. Thereafter, the encryption method and encryption key used in IPsec are determined by the processing of phase 2 of the IKE protocol (S40).

The client terminal 5 accesses the server device 12c (sends a service request including a ticket) in the same manner as in the first embodiment by the encrypted communication by IPsec established in this way (S41).
The server device 12c verifies whether the source address of the received service request matches the address of the received ticket. If the addresses match, the server device 12c uses the network 2 specific shared secret as the received ticket authenticator. Verify using key and hash function.
If a digital signature generated using a public key pair unique to the network system 2 is used as an authenticator, the authenticator is verified using a public key unique to the network 2.

At this time, when authenticating the user more strictly, the client terminal 5 encrypts a signature obtained by encrypting the hash value of the ticket with the secret key (secret key generated by the gateway device 11c) received at the same time with the ticket. Send it in the service request.
The server device 12c verifies the ticket and address by the above-described method, selects a secret key corresponding to the user (the secret key received from the gateway device 11c) according to the user identifier or address in the ticket, and The user is authenticated by verifying the signature with the secret key and the hash function.

In this way, even in remote access by IPsec, the user can perform not only the server apparatuses 12a and 12b in the network 1 but also the server apparatuses 12c and 12d in the network 2 by one-time user authentication by the gateway apparatus 11a. Service can be received without authentication processing (such as user input of a user identifier and password).
Further, since tickets are exchanged within the sequence of the Xauth protocol, it is not necessary to add a special procedure for exchanging tickets, and it is possible to connect to a client terminal that does not use the method of this embodiment.

In the present embodiment, a case has been described in which an access request is automatically made to the gateway device by a user access request to the server device, and then a service request is transmitted to the server device. However, the gateway device is operated by a user operation. The same processing is performed when a service request is transmitted to the server device by the user's operation after the access request is made and access is permitted.
[Third Embodiment]
Next, FIGS. 15 to 18 are diagrams showing a network system according to a third embodiment of the present invention. Since this embodiment is configured in substantially the same manner as the first embodiment described above, only the features will be described with reference to FIGS. 1 and 2.

In the present embodiment, when the client terminal 5 remotely accesses the networks 1 to 4 by IPsec, an ITU-T (International Telecommunication Union Telecommunication Standardization Sector) recommendation X. This is a case where an electronic certificate of 509 is used.
In FIG. 15, when the client terminal 5 tries to connect to the gateway device 11a by remote access by IPsec, the client terminal 5 performs the phase 1 process with the gateway device 11a according to the IKE protocol, and the encryption method used in the phase 2 is used. Determination and encryption key generation are performed (S51). When the processing of phase 1 is completed, the access control unit 112 of the gateway device 11a requests the user name and password from the client terminal 5 according to the Xauth protocol (S52).

In response to the request from the gateway device 11a, the client terminal 5 transmits the user name “Joe @ client” and the password “foobar” (S53). Here, “@client” of the user name indicates that a ticket acquisition is requested by the method of the present embodiment.
When the access control unit 112 of the gateway device 11a receives a response with “@client” in the user name, the authentication processing unit 113 performs user authentication using the user name “Joe” and the password. If the authentication is normal, the client terminal 5 is requested for a public key (S54). When the client terminal 5 receives a public key from the gateway device 11a, the client terminal 5 returns the public key stored in advance or the generated public key to the gateway device 11a (S55).

When receiving the public key from the client terminal 5, the access control unit 112 of the gateway device 11a allocates a user identifier and an address, and the assigned user identifier, address, and the public key received from the client terminal, as in the first embodiment. A key or the like is transmitted to the ticket generation unit 114 to send the X. 509 requests the generation of an electronic certificate. As the user identifier, a user identifier registered in advance for the user may be used, or a user name may be used.
Based on the received information, the ticket generation unit 114 creates an electronic certificate in which the certificate expiration date, address, user identifier, public key, and the like are set, and transmits the electronic certificate to the access control unit 112.

The access control unit 112 changes the electronic certificate generated by the ticket generation unit 114 to text data using BASE64 or the like, and transmits (BASE64CERT) to the client terminal 5 (S56).
The client terminal 5 that has received the electronic certificate decrypts the electronic certificate of the received text data, confirms and stores the decrypted electronic certificate, and returns a response (S57). When receiving the response from the client terminal 5, the access control unit 112 transmits “normal authentication” to the client terminal 5 (S58). The client terminal 5 that has received “authentication normal” returns a response to the gateway device 11a (S59).

Thereafter, an address is given to the client terminal 5 by Mode Config (S60). At this time, the access control unit 112 of the gateway device 11a gives the address set in the electronic certificate.
The client terminal 5 registers the assigned address as its own device address. Thereafter, the encryption method and encryption key used in IPsec are determined by the processing of phase 2 of the IKE protocol (S61).
When the processing of phase 2 is completed, the client terminal 5 registers an electronic certificate (S62).

The encrypted communication by IPsec established in this manner allows the client terminal 5 to access the server by SSL (Secure Sockets Layer) (standard protocol for secure exchange over the WWW having an authentication and encryption function) access using an electronic certificate. The device 12a is accessed (S63).
The server device 12a verifies the received electronic certificate, and provides the service to the client terminal 5 if the address and the expiration date are correct.
FIG. 16 is a diagram showing a sequence when the encrypted communication by IPsec established as described above is disconnected from the SSL connection.

In FIG. 16, when the client terminal 5 being connected to the server apparatus 12a by SSL (S71) terminates the communication and disconnects the connection with the gateway apparatus 11a by IPsec (S72), the client terminal 5 The key is deleted and the registered electronic certificate is deleted (S73).
In the gateway device 11a, in addition to the revoked electronic certificate list (CRL: Certificate Revocation List), the server devices 12a and 12b in the network 1 and gateways of adjacent networks are used in the gateway device 11a. The data is transmitted to the device (S74).

When the server devices 12a and 12b and the adjacent network receive the CRL, the CRL is registered (S75).
In this way, even in remote access by IPsec, the user can perform authentication processing (such as input of a user identifier and password by the user) to the server devices 12a and 12b in the network system 1 by one user authentication by the gateway device 11a. ) Can be provided without any service.
Further, since tickets are exchanged within the sequence of the Xauth protocol, it is not necessary to add a special procedure for exchanging tickets, and it is possible to connect to a client terminal that does not use the method of this embodiment.

Next, a case where a user who has performed user authentication in the network system 1 accesses another network system 2 having a different address system via the network system 1 will be described.
FIG. 17 is a sequence diagram when the client terminal 5 is connected to the gateway device 11c of the network 2 via the network 1 by remote access by IPsec.
As shown in FIG. 17, when the client terminal 5 that has completed user authentication in the network system 1 tries to connect to the gateway apparatus 11c by encrypted communication using IPsec, the client terminal 5 performs phase 1 communication with the gateway apparatus 11c according to the IKE protocol. Processing is performed, and the encryption method used in phase 2 is determined and the encryption key is generated (S81). In the processing of phase 1, authentication may be performed using a certificate issued by the network 1.

When the phase 1 processing is completed, the access control unit 112 of the gateway device 11c requests the user name and password from the client terminal 5 according to the Xauth protocol (S82).
In response to the request from the gateway device 11c, the client terminal 5 changes the electronic certificate acquired in the network 1 as the user name “Joe @ client” and the password to text data using BASE64 or the like and transmits (BASE64CERT) (S83). . Here, the user name “@client” indicates that a ticket acquisition request is made according to the method of the present embodiment.

When the access control unit 112 of the gateway device 11c receives a response with “@client” in the user name through access via the network 1, the access control unit 112 determines that an electronic certificate is included in the password, and the received text data Decrypt the electronic certificate, verify the decrypted electronic certificate, and verify whether the address and expiration date are correct.
If the verification of the electronic certificate is normal, the access control unit 112 requests a public key from the client terminal 5 (S84).
When the client terminal 5 is requested for the public key from the gateway device 11c, the client terminal 5 returns the public key stored in advance or the generated attempted key to the gateway device 11c (S85).

When receiving the public key from the client terminal 5, the access control unit 112 of the gateway device 11c assigns a user identifier and an address, and assigns the assigned user identifier and address to the received electronic certificate, as in the first embodiment described above. The set public key or the like is transmitted to the ticket generation unit 114 and the X. 509 requests the generation of an electronic certificate. As the user identifier, a user identifier registered in advance for the user may be used, or a user name or a user identifier in the received certificate may be used.
The ticket generation unit 114 generates an electronic certificate in which the certificate expiration date, address, user identifier, public key, and the like are set based on the received information, and transmits the generated electronic certificate to the access control unit 112. .

The access control unit 112 transmits (BASE64CERT2), in which the electronic certificate generated by the ticket generation unit 114 is changed to text data using BASE64 or the like (S86). The client terminal 5 that has received the electronic certificate decrypts the electronic certificate of the received text data, confirms and stores the decrypted electronic certificate, and returns a response (S87).
When receiving the response from the client terminal 5, the access control unit 112 transmits “normal authentication” to the client terminal 5 (S88).
The client terminal 5 that has received “authentication normal” returns a response to the gateway device 11c (S89).

Thereafter, an address is assigned to the client terminal 5 by Mode Config (S90). At this time, the access control unit of the gateway device 11c gives the address set in the electronic certificate.
The client terminal 5 registers the assigned address as an address when accessing the network 2.
Thereafter, the encryption method and encryption key used in IPsec are determined by the processing of phase 2 of the IKE protocol (S91).

When the processing in phase 2 is completed, the client terminal 5 registers an electronic certificate (S92).
The client terminal 5 accesses the server device 12c by SSL access using an electronic certificate by the encrypted communication by IPsec established in this way (S93).
The server device 12c verifies the received electronic certificate, and provides a service to the client terminal 5 if the address and the expiration date are correct.
FIG. 18 is a diagram showing a sequence when the encrypted communication by IPsec via the network 1 thus established is disconnected.

In FIG. 18, when the client terminal 5 that is currently connected to the server device 12c by SSL (S101) terminates the communication and disconnects the connection with the gateway device 11c by IPsec (S102), the client terminal 5 2 deletes the public key generated at the time of access and deletes the registered electronic certificate of the network system 2 (S103).
In the gateway device 11c, in addition to the revoked electronic certificate list (CRL: Certificate Revocation List), the server devices 12c and 12d in the network 2 and the gateways of adjacent networks are used in the gateway device 11c. The data is transmitted to the device (S104).

When the server devices 12c and 12d and the adjacent network receive the CRL, the CRL is registered (S105).
like this. Thus, even in remote access by IPsec, the user is authenticated not only to the server devices 12a and 12b in the network 1 but also to the server devices 12c and 12d in the network 2 by one user authentication by the gateway device 11a. Services can be provided without processing (user identification, password input, etc. by the user).

Further, since tickets are exchanged within the sequence of the Xauth protocol, it is not necessary to add a special procedure for exchanging tickets, and it is possible to connect to a client terminal that does not use the method of this embodiment.
In the present embodiment, a case has been described in which an access request is automatically made to the gateway device by a user access request to the server device, and then the server device is accessed, but an access request is made to the gateway device by a user operation. The same processing is performed when the server device is accessed by a user operation after the access is permitted.

In this embodiment, the gateway device transmits the CRL to the server device and the gateway device of another network system. However, the CRL is registered on the gateway device side and online such as OCSP (Online Certificate Status Protocol). It is also possible to support online reference from a server device or a gateway device of another network system so as to correspond to a protocol for verifying a certificate in the network.
Further, as in this embodiment, the gateway device transmits the CRL to the server device and the gateway device of the other network system, and as described above, the gateway device registers the CRL and corresponds to the OCSP. You may make it respond | correspond to the online reference from the gateway apparatus of a server apparatus or another network system.

1 is an overall configuration diagram showing a network system according to a first embodiment of the present invention. It is a simplified block diagram of a gateway device. It is a block diagram of the gateway apparatus 11a. It is a process flowchart of the gateway apparatus 11a. It is a figure which shows the structural example of a ticket. It is a partial block diagram of a ticket generation part. It is a process flowchart of a server apparatus. It is a simplified block diagram of a verification process part. It is a block diagram of the gateway apparatus 11c. It is a process flowchart of the gateway apparatus 11c. It is explanatory drawing which shows the production | generation and verification process of a ticket. It is explanatory drawing following FIG. It is a connection sequence diagram which shows the network system of 2nd Embodiment of this invention. It is a connection sequence figure in the case of passing through the network system in the gateway apparatus 11c. It is a connection sequence diagram which shows the network system of 3rd Embodiment of this invention. FIG. 16 is a connection sequence diagram continued from FIG. 15. It is a connection sequence figure in the case of passing through the network system in the gateway apparatus 11c. FIG. 18 is a connection sequence diagram continued from FIG. 17.

Claims (11)

A gateway device of a network to which a client terminal is directly connected,
An authentication processing unit for performing user authentication by searching user information registered in the database unit by user identification information transmitted from a client terminal connected to the network;
When the user authentication is normal, a unique user identifier is allocated in the network and a free address is issued, the user identifier and the address are recorded in association with each other, and the ticket generated by the ticket generation unit is stored in the client terminal. An access control unit to transmit;
Using the user identifier and the address as input, a cryptographic function is generated using a hash function and a shared secret key unique to the network or a public key pair to generate an authenticator, and the authenticator is added to the user identifier and the address. A ticket generation unit for generating the ticket to which
A gateway device between client terminals. A gateway device for connecting two networks having different address systems,
The client terminal verifies the match between the address of the client terminal to which the access request is output and the address of the ticket generated in the gateway device between the client terminals to which the client terminal is connected, and the client terminal connects the authenticator of the ticket A verification processing unit that verifies using a shared secret key and a hash function shared with one of the networks
If the verification is normal, assign a unique user identifier in its own network and issue a free address, record the user identifier and the address in association with each other,
An access control unit that transmits the ticket generated by the ticket generation unit to the client terminal;
Using the user identifier and the address as input, a cryptographic function is generated using a hash function and a shared secret key or public key pair unique to the network, and an authenticator is generated, and the authentication is performed on the user identifier and the address. A ticket generation unit for generating the ticket with the child added thereto;
A gateway device between networks characterized by comprising:   3. The gateway device according to claim 1, wherein the ticket is an electronic certificate generated using a secret key based on a public key obtained from the client terminal.   4. The gateway device according to claim 1, wherein communication between the client terminal and the gateway device is performed by remote access using IPsec. A client terminal connected to a gateway device,
When the user authentication information transmitted to the gateway device is normal, the user identifier generated by the gateway device and a unique address in the network are encrypted using a hash function and a shared secret key or public key pair unique to the network As an input, a ticket obtained by adding the authenticator to the user identifier and the address,
A client terminal, wherein the address included in the ticket is registered as its own address when a service request is made, and a service request including the ticket is transmitted.   6. The client terminal according to claim 5, wherein the ticket is an electronic certificate generated using a secret key based on a public key obtained from the client terminal.   7. The client terminal according to claim 6, wherein the electronic certificate is used for SSL communication with a server device in the network.   8. The client terminal according to claim 5, wherein communication between the client terminal and the gateway device is performed by remote access using IPsec. A client terminal that registers the address contained in the ticket as the address of its own terminal;
User authentication is performed based on user authentication information sent from the client terminal, and a user having a normal user authentication is assigned a unique user identifier in its own network, and a free address is issued as the address. The address is cryptographically processed using a hash function and a shared secret key unique to the network, or a public key pair to generate an authenticator, and a ticket obtained by adding the authenticator to the user identifier and the address, A gateway device between client terminals for transmission to the client terminal;
A server device that verifies the ticket and the address with a secret key or a public key of the own network, and permits access to a user whose verification is normal;
A network system comprising: The network system according to claim 9, wherein the gateway device performs processing in response to a remote access request using IPsec. The network system according to claim 9, wherein the ticket includes a time stamp and an expiration date.

Images