JP2008146351A - Gateway system - Google Patents

Abstract

【Task】
The present invention simplifies the work prior to the introduction of an authentication system using authentication data, and further reduces the burden on construction and maintenance by eliminating the time from authentication data expiration to application to an authentication device. Provide a gateway system that improves security.
[Solution]
The authentication gateway has a means to determine whether the access is from inside or outside the backbone network. For access from inside the backbone network, password authentication is executed, and after authentication is established, authentication data is generated and revoked. Allow use of the function. In addition, the authentication device receives a request for loading authentication data. For access from outside the backbone network, authentication using authentication data is executed. After authentication is established, only access to the backbone network is permitted, and use of functions during internal access such as authentication data generation is restricted.
[Selection] Figure 2

Description

  The present invention relates to a technology for access control when accessing a backbone network such as an intranet via a network including the Internet. In particular, the present invention relates to a technology that enables authentication data to be generated and managed as an access permission determination factor.

  In recent years, the per-capita data transfer bandwidth for communications over the Internet, corporate intranets, and other networks has become widespread, and access to external servers from internal devices, as well as outside companies such as homes, hotels, and hotspots. Can access devices inside the company in a bandwidth of several Mbps to several tens of Mbps. In addition, the price of information devices such as personal computers (PCs), PDAs, and mobile phones for mobile use has been lowered, and an increasing number of companies are distributing information terminals to employees and allowing them to work from outside the company. ing. To allow many companies to use information devices outside the office, such as business trips, homes, and moving offices, and to access devices such as PCs and servers inside the company for quick business execution It has become. On the other hand, there have been many reports of information leakage damage such as browsing, destroying, and taking out information inside a company by users who do not have a legitimate access authority, such as impersonation and unauthorized access. For this reason, there is a need for a secure authentication means for permitting access from outside the company to information equipment inside the company.

There is a technique called “public key encryption technology” for safely exchanging data on the Internet. In this method, data is protected with two keys, a “public key” and a “private key”, and the public key and its owner are linked by an “electronic certificate”. Due to the characteristics of public key cryptography, even if a public key or electronic certificate is disclosed to another person, the other person cannot use it illegally. Authentication using public key cryptography is more secure than ID and password, as it is difficult to steal or guess compared to password authentication, and the identity cannot be verified without an electronic certificate itself. It is. The infrastructure for creating an environment in which secure data can be exchanged over the Internet using this public key encryption technology is “PKI (Public Key Infrastructure)”. In authentication by PKI, an electronic certificate has an important role, and an authority that issues the electronic certificate is a “certification authority”. The certificate authority confirms the identity of the user with a database or documents according to the use of the electronic certificate, and issues the electronic certificate.
An authentication device that controls access to information equipment inside the company from outside the office has a function to verify the validity of the electronic certificate, and only for users who hold a certificate with a legitimate authority. (Mobile data communication, wireless LAN spot, etc.) By giving access permission from home, etc., secure communication within the company has been realized.

JP 2005-341519 A

  Access to the information devices inside the (corporate) specific organization (or a specific network such as an intranet) from outside the (corporate) specific organization (or a specific network such as an intranet) described above is authenticated using an electronic certificate By performing the above, it is possible to perform authentication with high reliability. However, in order to actually construct and operate an authentication system, there is a problem that the burden on installation of the device (certificate authority) which is the prerequisite and operation after operation is large. Specifically, in order to build an authentication system using electronic certificates, apart from the installation of the authentication device, the certificate authority (control and management of issuance and revocation of electronic certificates) and revocation information are sent to each authentication device When an electronic certificate is mounted on an authentication device or an authentication device, the mounted system is necessary, and the cost and operational burden for building each system are a cause of reluctance to introduce a PKI authentication system in each company.

  The present invention has been made in view of the above circumstances, and can simplify the apparatus and work necessary for introducing a PKI authentication system in a company, thereby reducing the burden on construction and maintenance, An object of the present invention is to provide an authentication gateway system that can eliminate a time lag that occurs in a conventional system until an electronic certificate revocation list issued by a certificate authority is applied to each authentication device.

  In order to achieve the above object, the present application provides at least one of an authentication data generation function, an authentication data revocation function, and a function of mounting authentication data in an authentication device in a user authentication gateway apparatus installed between a backbone network and a public segment. Control to include. In other words, a CA station function that can be accessed from the backbone network is mounted on an authentication device having a gateway function, and certificate issuance and management are performed. In addition, the certificate may be mounted on the token by mounting the token on the authentication device (access is possible with the mounted PC). A CRL (Certificate Revocation List) for certificate management may be provided. Furthermore, network information setting information may be generated and stored in the gateway.

More specifically, the following aspects are included.
A user authentication gateway device installed between a backbone network and a public segment, wherein authentication data generating means for authentication data used for access control when a client outside the backbone network passes through the gateway, and the client An authentication unit that performs access control by authentication using the authentication data when accessing the gateway device; and an authentication data holding unit that manages authentication data information that is authentication data information generated by the authentication data generation unit; Authentication data management means for controlling the authentication data information, authentication data mounting means for mounting the authentication data in an authentication device that is dedicated hardware connected to the client, and device information for managing device information of the authentication device Holding means and the device A device management means for controlling the information, the gateway to the backbone network outside the client's access request, said authentication data generation means, the authentication data gateway device and a limiting means for limiting the execution of the mounting means.

  The gateway apparatus further includes means for receiving an authentication data generation request from a client inside the backbone network, and the authentication data generation means is configured to send an authentication data generation authority to the client when the client has authentication data generation authority. A gateway device that generates authentication data is also included in the present invention.

Further, in these gateway devices, when the gateway device receives the authentication request transmitted from the public segment client, the authentication unit instructs the public segment client to transmit authentication data. Verify the validity of the authentication data sent in accordance with the instructions,
A gateway device that permits the public segment client to access the backbone network when it is verified that the authentication data held by the public segment client of the authentication request source holds validity is also included in the present invention.

  In these gateway devices, the authentication data management means registers authentication data information for identifying the generated authentication data in the authentication data holding means when the authentication data is generated by the authentication data generation means. A gateway device that updates the authentication data information registered in the authentication data holding means every time the authentication data information is changed is also included in the present invention.

  Further, in these gateway devices, when the authentication data mounting means receives an authentication data mounting request transmitted from a client inside the backbone network, the use of the client inside the backbone network that is the transmission source of the authentication data mounting request When the authentication device, which is dedicated hardware connected to the client and the client inside the backbone network, has authentication data loading authority, the gateway device that controls the authentication device to load the authentication data is also included in the present invention. It is.

  Further, in this gateway device, the authentication device management means sends device information that is information for specifying the authentication device when a client in the backbone network to which the authentication device is connected accesses the gateway device. The device information is registered in the information holding unit, and the device information registered in the device information holding unit is updated every time the device information is changed. The device information holding unit is loaded from the authentication data loading unit into the authentication device. Further, the present invention also includes a gateway apparatus that holds the authentication data information to be updated, and the authentication device management means updates the device information holding means when receiving the authentication data loading notification from the authentication data loading means.

  Further, in these gateway devices, when the authentication data management means receives an authentication data revocation request transmitted from a client inside the backbone network, when the gateway accepts the request, the authentication data holding means A gateway device that updates authentication data information corresponding to a client to an invalid state is also included in the present invention.

  Further, in these gateway devices, address information for specifying the position of the gateway device on the network used when the client of the public segment accesses the gateway device, and authentication data information in which the gateway is self-signed A gateway apparatus further comprising means for transmitting network connection information to the client when receiving a network connection information acquisition request transmitted from a client in the backbone network. included. Note that the present invention includes a processing method in these gateway devices and a program for executing the processing method.

  According to the present invention, it is possible to simplify the installation work of the certificate authority prior to the introduction of the authentication system using the authentication data, and further eliminate the time from the authentication data revocation processing to the application to the authentication device. -The burden on maintenance can be reduced.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings.
FIG. 1 is an example of a detailed system configuration diagram of the authentication gateway system of the present embodiment. The authentication gateway system of the present embodiment includes an authentication gateway 101, a backbone network 111, and client devices (PC-A131, PC-B132, PC-C133) inside the backbone network 111, the Internet 121, and a client device (PC that connects to the Internet 121) -D134, PC-E135, PC-F136). In the present embodiment, the client devices (PC-A131, PC-B132, PC-C133, PC-D134, PC-E135, PC-F136) include authentication devices (authentication device-A141, authentication device-B142, authentication device). -C143, authentication device-D144, authentication device-E145, authentication device-F146) are connected.

  The authentication gateway 101 is a user authentication gateway device installed between the backbone network 111 and the Internet 121. Access control for access from inside and outside the backbone network 111, generation and invalidation of authentication data used for access control, and authentication device The authentication data is installed, and this information is managed. Various data held by the authentication gateway 101 for realizing these will be described later.

  The backbone network 111 connects the authentication gateway 101, PC-A131, PC-B132, and PC-C133 to each other. In the present embodiment, a network that performs communication using the TCP / IP protocol will be described below. However, communication according to a protocol other than the TCP / IP protocol may be performed. The PC-A131, PC-B132, and PC-C133 of the embodiment are described as PCs, but the OS and applications stored in the recording medium are stored on the memory and CPU in both servers, workstations, and embedded devices. There is no particular limitation as long as it is an information device to be executed. Further, in the present embodiment, a case where PC-A 131, PC-B 132, and PC-C 133 are provided as client devices in the backbone network 111 will be described as an example.

  The PC-A 131 is an information processing apparatus that performs calculations in accordance with user instructions, uses devices as necessary, and presents calculation results to the user. The PC-A 131 is connected to the backbone network 111 via a network interface (not shown). The PC-A 131 includes a storage device such as a hard disk drive or flash memory (not shown), a memory, and a CPU, and performs calculations according to user instructions. The calculation result is displayed on a display (not shown) connected to the PC-A 131. An instruction from the user is transmitted to the PC-A 131 via a user interface such as a keyboard and a mouse (not shown). Hereinafter, when it is not necessary to distinguish between PC-A131, PC-B132, and PC-C133, PC-A131 will be described as a representative.

  Next, a client device that accesses the authentication gateway 101 via the Internet 121 will be described.

  In the present embodiment, a case where PC-D134, PC-E135, and PC-F136 are provided as client devices connected via the Internet 121 will be described as an example. Each client device is not limited to this.

  The PC-D 134 is an information processing apparatus that performs calculations in accordance with user instructions, uses devices as necessary, and presents calculation results to the user. The PC-D 134 is connected to the Internet 121 via a network interface (not shown). The PC-D 134 includes a storage device such as a hard disk drive or flash memory (not shown), a memory, and a CPU, and performs calculations according to user instructions. The calculation result is displayed on a display (not shown) connected to the PC-D134. An instruction from the user is transmitted to the PC-D 134 via a user interface such as a keyboard and a mouse (not shown). Hereinafter, when it is not necessary to distinguish between PC-D134, PC-E135, and PC-F136, PC-D134 will be described as a representative.

  Interfaces for device connection include devices such as universal serial devices (USB), wireless USB, short-range wireless communication interfaces, infrared communication interfaces, serial port interfaces, parallel port interfaces, IEEE1394 interfaces, PS / 2 interfaces, and audio interfaces to PCs. An interface for connection can be considered. In this embodiment, the case where the interface connecting the PC-A 131 and the authentication device-A 141 is USB will be described as an example, but the interface is not limited to this.

  The authentication device-A141 can be an IC card or USB token for securely storing an electronic certificate and its public key pair. In the present embodiment, the authentication device-A141 will be described as an example of an authentication device having an IC card function and a flash memory function. In addition, the authentication device-A141 is an authentication device such as an IC card or a USB token. However, the present invention is not limited to these. In this embodiment, it is attached to an authentication device reader (not shown) connected to the PC-A 131 and connected to the PC-A 131. The authentication device-A141 performs a calculation according to an instruction from the PC-A131 via an authentication device reader (not shown), and presents the calculation result to the PC-A131. The authentication device-B142, the authentication device-C143, the authentication device-D144, the authentication device-E145, and the authentication device-F146 have the same configuration as the authentication device-A141. Hereinafter, the authentication device-A141 will be described as a representative when there is no reason to distinguish the authentication device-A141, the authentication device-B142, the authentication device-C143, the authentication device-D144, the authentication device-E145, and the authentication device-F146.

FIG. 2 is an example of a block diagram showing the configuration of the authentication gateway 101. As shown in FIG. As shown in the figure, the authentication gateway 101 includes a control unit 201, a communication port-A202, a communication port-B203, a password authentication unit 204, a PKI (Public Key Infrastructure) authentication unit 205, and a CA (Certificate Authority) function unit 206. Prepare. The control unit 201 receives the data transmitted to the authentication gateway 101, determines the access path (communication port-A202, communication port-B203) of the request source, and each part (Password authentication) mutually connected to the control unit 201 Unit 204, PKI authentication unit 205, CA function unit 206). In addition to the data from outside the authentication gateway 101, the control unit 201 also performs data transfer inside (password authentication unit 204, PKI authentication unit 205, CA function unit 206, communication port-A202, communication port-B03). . Communication port-A202 and communication port-B203 are ports for communication paths. In this embodiment, the communication port A-202 is a port that transmits and receives data to and from the backbone network 111, and the communication port-B203 is a client (PC-D134) connected via the Internet 121. A description will be given taking as an example the case of a port for transmitting and receiving data between them. The password authentication unit 204 is a part that includes means for performing ID / Password authentication that identifies a user by a user ID and a password. The PKI authentication unit 205 is a part having means for performing PKI authentication using authentication data. In this embodiment, password authentication and PKI authentication will be described as examples, but the authentication method is not limited to this. The CA function unit 206 is a part having a function for performing processing for realizing an authentication data generation function, an authentication data revocation function, and a function for mounting authentication data in an authentication device in response to an access request. Each function provided in this embodiment will be described later. In the present embodiment, the CA function unit 206 has the functions described as an example of the authentication data generation function, the authentication data revocation function, and the function of mounting the authentication data in the authentication device. However, the present invention is not limited to this.
Next, the authentication device management table 300, the authentication data management table 400, the authentication device master 500, the network connection information master 600, and the user information master 700 held by the authentication gateway 101 will be described.

  The authentication device table 300 is a table for managing device information of the authentication device-A141 connected to the PC-A131. When the authentication data generated by the authentication gateway 101 is installed in the authentication device, the authentication device is installed. This information is registered in the authentication device management table as information for specifying the authentication device to be used.

  FIG. 3 shows an example of the authentication device management table 300. As shown in the figure, the authentication device management table 300 includes an authentication device management No record 301, a user ID record 302, a device ID record 303, a device serial number record 304, a registration date record 305, an authentication data allocation record 306, an authentication A data management number record 307 is recorded. The records of the authentication device management table 300 are not limited to these, and other records may be recorded.

  The authentication device management No record 301 is an identification number (for example, a serial number) that is automatically assigned to each authentication device information when the authentication device information is registered by the authentication gateway 101. The authentication device management No record 301 is registered in the authentication device table. This information uniquely identifies device information.

  In the user ID record 302, an ID for identifying a user holding authentication data is registered. This information is registered when authentication data is installed in the device by the authentication gateway 101.

  The device ID record 303 is an ID for uniquely identifying authentication device information registered in the authentication device master 500.

  The device serial number record 304 is a device identification number previously assigned to the device itself. Each authentication device is uniquely identified by a set of a product ID record 503, a vendor name record 504, and a device serial number record 304 recorded in an authentication device master 500 described later. The authentication device master 500 can be inquired by using the device ID record 303 as a key. The device serial number record 304 is a number assigned to each product individually.

  The registration date record 305 is a date when the authentication device information is registered in the authentication device management table 300.

The authentication data allocation record 306 is information for determining whether or not the authentication data generated from the authentication gateway 101 is mounted on the authentication device, and values of “present” and “absent” are set.
This information is registered / updated by the authentication gateway to a setting value of “present” when authentication data is installed in the authentication device, and to a setting value of “none” when the authentication data is invalidated.

  The authentication data management No record 307 is a management number of the authentication data management table 400 in which authentication data information installed in the authentication device is stored. Using the authentication data management No record 307 as a key, authentication data information mounted on the authentication device can be extracted from the authentication data management table 400.

  In the authentication data management table 400, when a client (PC-D134) connected via the Internet 121 makes an access request to a device in the backbone network 111, the access requesting user holds the access permission authority. Authentication data information used to determine (authenticate) whether or not the password is registered. For example, the validity of the authentication data, the device serial number of the authentication device on which the authentication data is mounted, information for specifying the holder of the authentication data, and the like are recorded. In the present embodiment, an example in which an electronic certificate is used as authentication data will be described. However, the authentication data is not limited to this. This table is registered when authentication data is generated by the authentication gateway 101. Since then, there has been a change in information related to authentication data, such as when authentication data is installed in an authentication device or when authentication data has expired. If appropriate, it will be updated accordingly.

  FIG. 4 shows an example of the authentication data management table 400. As shown in the figure, the authentication data management table 400 includes an authentication data management No record 401, a user ID record 402, a status record 403, an authentication device management No record 404, a Version record 405, a Signature record 406, an Issuer record 407, and an effective record. A start date / time record 408, an effective end date / time record 409, a Subject record 410, a SubjectUniqueID record 411, a public key algorithm record 412, a key length record 413, and a key usage record 414 are recorded. The records of the authentication data management table 400 are not limited to these, and other records may be recorded.

  The authentication data management No record 401 is an identification number (for example, a serial number) that is automatically given to each authentication data information when the authentication data is generated by the authentication gateway 101 and the authentication data information is registered in the authentication data table 400. This is information for uniquely specifying authentication data information registered in the authentication data table.

  In the user ID record 402, an ID for identifying a user holding authentication data is registered. The user ID record 402 is information transmitted from the client device (PC-A 131) to the authentication gateway when accessing the authentication gateway 101, and is information that identifies the user by collating with the user master table 700. It is. The user ID record 402 is registered when authentication data is generated by the authentication gateway 101.

  The status record 403 is information indicating the validity of the authentication data, and values of “valid”, “invalid (expired)”, and “invalid (expired)” are set. The status record 403 is registered with a setting value of “valid” when the authentication data is generated by the authentication gateway 101. When the setting value of the authentication data valid end date record 409 described later passes, it is set (updated) to the setting value of “invalid (expired)”, and when the authentication data is revoked by the authentication gateway 101, Set (update) the setting value to “Invalid (Revocation)”. The Version record 405 is information indicating the version of authentication data. The Signature record 406 is information indicating an encryption algorithm used when the authentication data creator (authentication gateway 101) signs. The Issuer record 407 is information indicating the organization that generated the authentication data, and corresponds to the authentication gateway 101 in this embodiment. The valid start date / time record 408 is information indicating the date and time when the authentication data is valid. The valid end date / time record 409 is information indicating the date / time when the authentication data becomes invalid. The Subject410 record is information indicating the name of the holder (owner) of authentication data. The SubjectUniqueID record 411 is information indicating a unique ID that identifies the holder (owner) of the authentication data.

  The public key algorithm record 412 is information for specifying the public key algorithm included in the authentication data. The key length record 413 is information indicating the key length of the public key included in the authentication data.

  The key usage record 414 is information indicating the purpose of use of the public key included in the authentication data. Version record 405, signature record 406, issuer record 407, valid start date record 408, valid end date record 409, subject record 410, SubjectUniqueID record 411, public key algorithm record 412, key length record 413, key usage record 414 Is information stored in the authentication data. When the authentication data is generated by the authentication gateway 101, it is read from the authentication data and registered in the authentication data management table 400.

  The authentication device master 500 is information for determining whether the device can be used as an authentication device (this authentication device-A141) on which authentication data generated by the authentication gateway 101 is mounted. In the present embodiment, the authentication device master 500 is described as being registered in advance by an administrator, but may be in a form that can be registered by the user.

  FIG. 5 shows an example of the authentication device master 500. As shown in the figure, a device ID record 501, a device name record 502, a product ID record 503, and a vendor name record 504 are recorded. The records of the authentication device master 500 are not limited to these, and other records may be recorded.

The device ID record 501 is an identification number (for example, a serial number) given to each authentication device master information when the administrator registers the authentication device master, and uniquely identifies the authentication device master information registered in the authentication device master 500. Information to identify.
The device name record 502 is information indicating a name for making the device easy to call.

  The product ID record 503 is a device identification number previously assigned to the device, and is an ID uniquely assigned to each product. The vendor name record 504 is information indicating the vendor name of the device.

  The network connection information master 600 is an authentication gateway 101 such as address information necessary for a user to access the authentication gateway 101 and self-signed authentication data of the authentication gateway 101 (hereinafter referred to as a root certificate in this embodiment). Network connection information for accessing is registered. The information of the network connection information master is transmitted from the authentication gateway 101 to the user in response to a transmission request from the user. In this embodiment, in the network connection information master, the administrator registers a plurality of pieces of network information in advance, and the administrator sets in advance which information is transmitted in response to a transmission request from the user. Although it takes a form, it may take a form in which the user registers and selects which information is to be transmitted and which network information is to be transmitted.

  FIG. 6 shows an example of the network connection information master 600. As shown in the figure, the network connection information master 600 records a connection information management No record 601, a route certificate storage destination record 602, a gateway address record 603, and a gateway port number record 604. The records of the network connection information master 600 are not limited to these, and other records such as a Proxy server address and its port number may be recorded.

  The connection information management No record 601 is an identification number (for example, a serial number) that is automatically given when network connection information is registered by the administrator, and uniquely identifies the network connection information registered in the network connection information master. It is a number to identify.

  The root certificate storage location record 602 is information indicating the storage location of the root certificate of the authentication gateway 101. When the network connection information transmission request is received, the storage destination root certificate is transmitted together with other address information.

  The gateway address record 603 is address information that identifies the location of the authentication gateway 101 on the network. The gateway port number record 604 is a port number that identifies the service used by the authentication gateway 101.

  In the user master 700, information for identifying users connectable to the backbone network 111 is recorded. The user master 700 is registered in advance by the administrator.

  FIG. 7 shows an example of the user master 700. User ID record 701, user name record 702, user password record 703, belonging group ID record 704, belonging group name record 705, belonging department ID record 706, belonging department 707 record are recorded as shown in this figure. The The user ID record 701 is information indicating a unique ID that identifies a user. The user name record 702 is information indicating the name of the user corresponding to the user ID 701. The user password record 703 is information indicating a password indicating that the user is a valid user.

  The affiliation group ID record 704 and the affiliation group name record 705 are information specifying an ID for identifying a group to which the user belongs, and the group name. The department ID record 706 and department name record 707 are information indicating an ID for identifying the department to which the user belongs and the department name.

  Further, the records of the user master 700 are not limited to these, and other records may be recorded.

  Next, a PIN (Personal Identification Number) storage table 800 held by the authentication device-A 141 will be described.

  PIN storage table 800 records PIN information indicating that the device is a valid holder of authentication device-A141. When a user accesses an authentication device-A141 and uses data or functions stored in the authentication device-A141, the user enters a PIN indicating that the user is a valid holder of the authentication device-A141. It transmits to the authentication device-A141 via the client (PC-A131). Upon receiving the transmitted PIN, the authentication device-A 141 verifies the PIN within the authentication device-A 141 and transmits the verification result to the client (PC-A 131). If the PIN verification is not successful, the data and functions inside the authentication device-A141 cannot be used.

  FIG. 8 shows an example of the PIN storage table 800. As shown in the figure, the PIN storage table 800 records a PIN area No record 801, a PIN record 802, a LimitCounter record 803, and a TryCounter record 804. The records in the PIN storage table 800 are not limited to these, and other records may be recorded. The PIN area number record 801 is an identification number of an area that stores PIN information, and is a number that uniquely specifies information in the PIN storage table 800. The PIN record 802 is information indicating that the authentication device-A 141 is a valid holder.

LimitCounter record 803 is information that indicates the number of times the user has sent an incorrect PIN to authentication device-A141. is there. It is incremented every time an incorrect PIN is sent. When the setting value of the TryCounter record 804 and the setting value of the LimitCounter record 803 become the same value, the authentication device-A 141 is blocked. Also, the set value of the TryCounter record 804 is cleared after performing a block release process described later.
In the present embodiment, the PIN storage table 800 will be described assuming that default values are set in advance.

Next, the operation of FIGS. 1 and 2 will be described based on the flowcharts of FIGS.
FIG. 9 shows an access control process performed by the control unit 201 when there is an access to the authentication gateway 101 from within the backbone network 111.

  First, when there is an authentication request (Step 901, Step 902, Step 903) in the authentication gateway 101, the control unit 201 determines whether the authentication request is received from inside or outside the backbone network 111. The communication port is confirmed (step 904). In the present embodiment, a method of confirming a communication port using a Mac address will be described. However, as long as the communication port-A202 and the communication port-B203 can be distinguished, other identification information such as an IP address may be used. . If the authentication request is from the communication port-A202, it is determined as an authentication request from within the backbone network 111, and the data is transmitted to the password authentication unit 204 (step 905). Upon receiving the authentication request from the control unit 201, the password authentication unit 204 transmits an ID / Password request to the transmission source (step 906, step 907, step 908, step 909). When the ID / Password is received from the user (Step 910, Step 911, Step 912, Step 913), the transmitted ID / Password is checked with reference to the user information master 700 (Step 914). The collation result is transmitted to the control unit 201 (step 915). When the ID / Password authentication result is True (step 916), the control unit 201 instructs the CA function unit 206 to transmit the data held by the CA function unit 206 (step 917, step 918, step 919). Step 920), and thereafter, the functions of the CA function unit 201 can be used, and the process ends normally (Step 921). On the other hand, if the ID / Password authentication result is False (Step 914), the control unit 201 sends a message “Authentication failed” to the user (Step 922, Step 923) (Step 924).

FIG. 10 shows an access control process performed by the control unit 201 when a client (PC-D 134) connected via the Internet 121 receives an authentication request from the authentication gateway 101.
First, when there is an authentication request (Step 1001, Step 1002, Step 1003) in the authentication gateway 101, the control unit 201 determines whether the authentication request is received from inside or outside the backbone network 111. Confirm the communication port (step 1004). If the authentication request is from the communication port-B203, it is determined that the access is from a client (PC-D134) connected via the Internet 121, and the data is transmitted to the PKI authentication unit 205 (step 1005). When receiving the authentication request from the control unit 201, the PKI authentication unit 205 transmits an authentication data request to the transmission source (step 1006, step 1007, step 1008). Upon receiving the authentication data request, the client (PC-A131) requests the user to enter the authentication device-A141 PIN (step 1009, step 1010) in order to obtain authentication data from the authentication device-A141. -PIN and authentication data request is made to A141 (step 1011). The authentication device-A 141 refers to the PIN storage table 800 held by the authentication device-A 141 and performs PIN verification (step 1012). If the PIN verification result is True, the authentication data is transmitted to the authentication gateway 101 via the client (PC-A 131) (Steps 1013, 1014, 1015, and 1016). If the PIN authentication result is False, an error message “PIN is incorrect” is output (step 1027), and the process ends abnormally (step 1028). Upon receiving the authentication data transmitted from the user, the PKI authentication unit 205 of the authentication gateway 101 performs PKI authentication processing (step 1017). The collation result is transmitted to the control unit 201 (step 1018). When the result of PKI authentication is True (step 1019), the control unit 201 transmits the authentication result to the client (PC-A131) (step 1020, step 1021), and thereafter from the client (PC-A131). Is transferred to the communication port-A202 (step 1022), and the process ends normally (step 1023). If the result of PKI authentication is False (step 1019), the control unit 201 sends a message “authentication failed” to the user (step 1024, step 1025), and terminates illegally (step 1026). ).

  Next, processing of the CA function unit 206 of the authentication gateway 101 will be described. FIGS. 11 and 12 show access control to each function controlled by the CA function unit 206. FIG. When there is an authentication data generation request in the CA function unit 206 (step 1101), it is checked whether the authentication device-A 141 is connected to the client (PC-A 131) that is the access request transmission source (step 1201). When authentication device-A141 is not connected (step 1202), a message “authentication device-A141 is not connected” is transmitted (step 1209). This message only needs to indicate that the message is not connected, and the expression is not limited.

  On the other hand, when the authentication device-A141 is connected (step 1202), a request for the PIN of the authentication device-A141 is made to specify that the user of the client is a valid holder of the authentication device-A141 ( Step 1203). In response to the PIN request, the user sends PIN information to the authentication device-A 141 via the client (PC-A 131). The authentication device-A141 performs a PIN verification process and sends the verification result to the authentication gateway 101 via the client (PC-A131). If the PIN verification result is true (step 1204), the CA function unit 206 of the authentication device 101 starts an authentication data generation process to be described later in response to a request from the user (step 1205). On the other hand, if the PIN verification result is False (step 1204), the block status of the authentication device-A141 is confirmed from the PIN verification result. If it is blocked (step 1206), “The entered PIN is incorrect. "Authentication device-A141 has been blocked" is sent (step 1207). If the terminal is not in the blocked state (step 1206), the message “The entered PIN is incorrect” is transmitted (step 1208).

  When there is an authentication data revocation request in the CA function unit 206 (step 1102), when there is a request for releasing the block (step 1104), when there is a request for sending user information (step 1106), the authentication data revocation to be described later Processing (step 1103), blockage release processing (step 1105), and user information sending processing are performed (step 1107).

  Next, the authentication data generation process and the authentication data loading process to the authentication device will be described. 13 and 14 show the authentication data generation process and the authentication data loading process in the authentication device-A 141.

  When the authentication data generation request is received, the access request source authentication device-A 141 is checked with reference to the authentication device management table 300 held by the authentication gateway 101 in order to confirm whether or not the access request source authentication device-A 141 is registered in the authentication gateway 101. The device serial number of the authentication device-A141 is compared with the device serial number record 306 of the device management table 300 (1301). If the collation result is true (step 1302), it is subsequently confirmed whether or not authentication data has been generated and installed in the authentication device-A 141 (step 1303). In this embodiment, the authentication data allocation record 308 of the authentication device management table 300 held by the authentication gateway 101 is referred to. Further, when the authentication data has been generated and installed in the authentication device-A 141 (step 1304), it is confirmed whether the authentication data has been revoked (step 1305). In this embodiment, the status record 403 of the authentication data table 400 held by the authentication gateway 101 is referred to using the authentication data management No record 307 of the authentication device management table 300 as a key. Furthermore, if the authentication data has not been revoked (step 1305), it is confirmed whether the authentication data has expired (step 1306). In this embodiment, the expiration date is confirmed by referring to the status record 403 of the authentication data table 400. If the authentication data has not expired (step 1307), a message “Valid authentication data is already installed” is sent to the client (PC-A131), and the network connection information loading process described later is performed. .

  When the serial number of the authentication device has not been registered (step 1302), the authentication data has been revoked (step 1305), the expiration date has expired (step 1306), and the authentication data from the user Is issued (reissue) request (step 1401), authentication data is generated (step 1402), and the authentication data is loaded on the IC part of the authentication device-A141 (step 1403). When there is no request for issuing (reissuing) authentication data from the user (step 1401), a CA function use menu is transmitted (step 1409).

  After loading the authentication data, each record in the authentication device management table 300 and the authentication data management table 400 is updated (step 1404).

  Next, network connection information loading processing will be described. After generating and loading authentication data, a message “Do you want to set network connection information?” Is sent (step 1405), and a request for setting network connection information is received from the user (step 1406) ), The network connection information is transmitted from the network connection information master 600 to the flash memory unit of the authentication device-A 141 via the client (PC-A 131) (step 1407), and then the CA function use menu is transmitted (step 1408). ). When the user does not set the network connection information (step 1406), the CA function use menu is transmitted. (Step 1408).

  Next, authentication data revocation processing for revoking authentication data will be described. If the qualification of the authentication data is lost even though the authentication data is within the validity period, it is necessary to make the authentication data unavailable. When the qualification of the authentication data is lost, for example, when the authentication device that stores the authentication data is lost or when the private key is expected to be misused by a third party or described in the authentication data However, the present invention is not limited to these cases. FIG. 15 shows an authentication data revocation process when the authentication gateway 101 receives an authentication data revocation request by a user.

  Upon receiving the authentication data revocation request, the authentication gateway 101 refers to the authentication data management table 400 and identifies the authentication data assigned to the user ID from the user ID of the access request source user (step 1501). ), The authentication data is revoked (step 1502). After the revocation process, the authentication data management table 400 is updated (step 1503), and the CA function use menu is transmitted (step 1504). In this embodiment, an example has been described in which only the authentication data of the user who sent the authentication data revocation request can be revoked. However, the user information master 700 authenticates users other than the user who can revocation. Data revocation authority may be retained, for example, administrator authority may be provided to provide a function that allows the administrator to revoked authentication data for users other than the user in a batch.

  Next, the block release process of the authentication device-A 141 will be described. FIG. 16 illustrates the block release processing when the authentication device-A 141 is blocked.

  Upon receiving the block release processing request, the CA function unit 206 checks whether the authentication device-A 141 is connected to the access request transmission source client (PC-A 131) (step 1601). When authentication device-A141 is not connected (step 1602), a message “authentication device-A141 is not connected” is transmitted (step 1607). On the other hand, when the authentication device-A 141 is connected (step 1602), a blocking release request is transmitted to the authentication device-A 141 via the client (PC-A 131) (step 1603). Upon receiving the block release request from the authentication gateway 101, the authentication device-A 141 performs block release processing and transmits the processing result to the authentication gateway 101 via the client (PC-A 131). The CA function unit 206 of the authentication gateway 101 receives the result of the block release processing from the authentication device-A 141 and confirms whether the block release is successful. If the block release processing result from the authentication device-A 141 is True (step 1604), it is determined that the block release has been executed normally, and the processing ends normally (step 1605). In addition, when the shutdown release result is False, a message “Shutdown release processing failed. Please contact the administrator” is transmitted (step 1606).

  Next, a user information transmission process for transmitting the authentication device and authentication data information held by the user from the authentication gateway 101 to the user will be described. FIG. 17 shows processing when the CA function unit 206 of the authentication gateway 101 receives a user information transmission request from the user.

  Upon receiving the user information transmission request, the CA function unit 206 refers to and extracts the authentication device management table 300 and the authentication data management table 400 (step 1701), and transmits the user information to the client (PC-A131) ( Step 1702).

  In this embodiment, PKI authentication is used for authentication, and an IC function built-in flash memory is used as an authentication device. However, OTP (One Time Password) authentication and biometric authentication (finger vein authentication, fingerprint authentication, bill authentication, retina authentication, iris, etc.) Authentication, face authentication, blood vessel authentication, signature authentication, typing habit authentication, voice / voice print authentication) can also be applied, and authentication devices such as IC cards and USB tokens may be used as authentication devices. Furthermore, it is not limited to these.

FIG. 1 is a block diagram illustrating a system configuration of the authentication gateway system according to the embodiment. FIG. 2 is a block diagram illustrating a configuration of the authentication gateway device according to the embodiment. FIG. 3 is a data table diagram illustrating an example of an authentication device management table according to the embodiment. FIG. 4 is a data table diagram illustrating an example of an authentication data management table according to the embodiment. FIG. 5 is a data table diagram illustrating an example of the authentication device master according to the embodiment. FIG. 6 is a data table diagram illustrating an example of the network connection information master according to the embodiment. FIG. 7 is a data table diagram illustrating an example of a user master according to the embodiment. FIG. 8 is a data table diagram illustrating an example of the PIN storage table of the embodiment. FIG. 9 is a flowchart illustrating access control processing to the authentication gateway according to the embodiment. FIG. 10 is a flowchart illustrating access control processing to the authentication gateway according to the embodiment. FIG. 11 is a flowchart illustrating CA function control processing according to the embodiment. FIG. 12 is a flowchart illustrating CA function control processing according to the embodiment. FIG. 13 is a flowchart illustrating authentication data generation processing according to the embodiment. FIG. 14 is a flowchart illustrating authentication data generation processing according to the embodiment. FIG. 15 is a flowchart illustrating authentication data revocation processing according to the embodiment. FIG. 16 is a flowchart illustrating the block release processing of the authentication device according to the embodiment. FIG. 17 is a flowchart illustrating user information transmission processing according to the embodiment.

Explanation of symbols

101: Authentication gateway device
111: Core network
112: Internet
131: PC
132: PC
133: PC
134: PC
135: PC
136: PC
141: Authentication device
142: Authentication device
143: Authentication device
144: Authentication device
145: Authentication device
146: Authentication device
201: Control unit
202: Communication port
203: Communication port
204: Password authentication section
205: PKI Authentication Department
206: CA function

Claims (8)

A user authentication gateway device installed between a backbone network and a public segment,
Authentication data generation means for authentication data used for access control when a client outside the backbone network passes through the gateway;
An authentication means for performing access control by authentication using the authentication data when the client accesses the gateway device;
Authentication data holding means for managing authentication data information that is authentication data information generated by the authentication data generating means; authentication data management means for controlling the authentication data information;
Authentication data loading means for loading the authentication data in an authentication device that is dedicated hardware connected to the client;
Device information holding means for managing device information of the authentication device; device management means for controlling the device information;
The gateway device comprising a gateway for restricting execution of the authentication data generation means and the authentication data loading means in response to an access request from a client outside the backbone network. The gateway device according to claim 1, wherein
Means for receiving an authentication data generation request from a client inside the backbone network;
The gateway device according to claim 1, wherein the authentication data generation means generates authentication data for the client when the client has an authority to generate authentication data. The gateway device according to claim 1, wherein
The authentication means includes
When the gateway apparatus receives the authentication request transmitted from the public segment client, the public segment client is instructed to transmit the authentication data, and the validity of the authentication data transmitted in accordance with the instruction is verified. ,
The gateway device, wherein when it is verified that the authentication data held by the client of the public segment of the authentication request source holds validity, the client of the public segment is permitted to access the backbone network. The gateway device according to claim 1, wherein
The authentication data management means includes:
When the authentication data is generated by the authentication data generating means, the authentication data information for specifying the generated authentication data is registered in the authentication data holding means,
A gateway device, wherein the authentication data information registered in the authentication data holding means is updated every time the authentication data information is changed. The gateway device according to claim 1, wherein
Authentication data loading means
When the authentication data loading request transmitted from the client inside the backbone network is received, the dedicated hardware connected to the client user inside the backbone network and the client inside the backbone network that is the transmission source of the authentication data loading request When the authentication device which is the hardware has the authorization to mount the authentication data, the gateway device controls the authentication device to mount the authentication data. The gateway device according to claim 5, wherein
The authentication device management means includes:
When a client in the backbone network to which the authentication device is connected accesses the gateway device, device information that is information for specifying the authentication device is registered in the device information holding unit, and the device information is changed. Update the device information registered in the device information holding means each time,
The device information holding means further holds authentication data information mounted on the authentication device from the authentication data mounting means,
The gateway device according to claim 1, wherein the authentication device management unit updates the device information holding unit when receiving the authentication data mounting notification from the authentication data mounting unit. In the gateway device according to claim 1,
The authentication data management means includes:
When an authentication data revocation request transmitted from a client inside the backbone network is received, when the gateway accepts the request, the authentication data information corresponding to the client of the authentication data holding means is updated to a revocation state. A featured gateway device. The gateway device according to claim 1, wherein
Network connection information holding for holding address information for specifying the location of the gateway device on the network used when the client of the public segment accesses the gateway device and self-signed authentication data information for the gateway device means,
The gateway device further comprising means for transmitting the network connection information to the client when a network connection information acquisition request transmitted from the client in the backbone network is received.

Images