JP7540991B2 - Network system and network authentication method - Google Patents

Description

The present invention relates to a network system and a network authentication method.

One example of a network system in which user authentication is performed is a network system that includes a user terminal, a relay device such as an authentication switch, and an authentication device. In this network system, a registration list in which user information (authentication information) of legitimate users is recorded is stored in the authentication device. To obtain authentication, the user terminal transmits user information to the authentication device via the relay device. The authentication device compares the received user information with the user information in the stored list, and if there is a match, it transmits information indicating successful authentication to the relay device.

However, in such a network system, if an abnormality occurs in communication with the authentication device, the user terminal cannot be authenticated. Against this background, technology that enables authentication even when an abnormality occurs in communication with the authentication device is being considered.

For example, Patent Document 1 discloses a multifunction device control system that performs authentication using an alternative authentication function provided in the multifunction device when the multifunction device cannot connect to an authentication server.

JP 2011-095793 A

However, according to the technology disclosed in Patent Document 1, it is necessary to store the user information required for authentication in advance in the device with the alternative authentication function. Furthermore, if a change occurs in the user information required for authentication, it is necessary to update not only the user information stored in the authentication server, but also the user information stored in the device with the alternative authentication function. In this way, the work of storing user information in the device with the alternative authentication function and updating the stored user information is very complicated, and management costs also increase.

Due to the above circumstances, there is a demand for technology that can perform authentication processing for user terminals connected to a network, without the need for cumbersome tasks, even if an abnormality occurs in communication with the authentication device.

A network system according to an embodiment includes:
A network system comprising a first authentication device and a second authentication device interposed between a user terminal and the first authentication device, wherein the second authentication device has a second storage device and performs the following processes: receiving user information from the user terminal, communicating with the first authentication device to obtain a result of authentication success or failure based on the user information, recording information of successfully authenticated users in the second storage device, detecting an abnormality in communication with the first authentication device, and, when an abnormality in communication is detected, determining whether authentication of the user terminal has been successful by comparing the user information from the user terminal with the user information stored in the second storage device.

According to one embodiment, it is possible to perform authentication processing of a user terminal connected to a network even if an abnormality occurs in communication with an authentication device, without requiring cumbersome operations.

1 is a diagram illustrating a schematic configuration of a network system according to a first embodiment. FIG. 11 is a diagram showing a processing flow when no communication abnormality occurs in the first embodiment. FIG. 11 is a diagram illustrating a processing flow when a communication abnormality occurs in the first embodiment. FIG. 11 is a diagram illustrating a configuration of a network system according to a second embodiment. FIG. 11 is a diagram showing a processing flow in the case where there is no communication abnormality in the second embodiment. FIG. 11 is a diagram illustrating a processing flow when a communication abnormality occurs in the second embodiment.

Now, we will explain the embodiments. Note that each embodiment described below is an example for realizing the present invention, and does not limit the technical scope of the present invention. Furthermore, in each embodiment below, components having the same function are given the same reference numerals, and repeated explanations will be omitted unless particularly necessary.

The network system according to each embodiment described below is characterized in that it has a second authentication device connected between the first authentication device and the user terminal, and the second authentication device executes the following processes. The second authentication device executes a process of receiving user information from the user terminal, and a process of obtaining a result of authentication success or failure based on the user information by communicating with the first authentication device. The second authentication device also has a second storage device, and executes a recording process of recording successfully authenticated user information in the second storage device, a detection process of detecting an abnormality in communication with the first authentication device, and a determination process of determining whether authentication of the user terminal has been successful by comparing the user information from the user terminal with the user information stored in the second storage device when a communication abnormality is detected.

The above-mentioned process of obtaining the result of authentication success or failure based on the user information by communicating with the first authentication device can be implemented in the following two ways, for example.

In the first embodiment, the first authentication device stores user information for which authentication should be successful. The first authentication device compares the user information from the user terminal received from the second authentication device with the user information stored in itself, determines whether authentication is successful based on the comparison result, and transmits the result of authentication success or failure to the second authentication device. The second authentication device receives the result of authentication success or failure from the first authentication device.

In the second embodiment, the first authentication device stores user information for which authentication should be successful. The first authentication device compares the user information received from the user terminal by the second authentication device with the user information stored in the first authentication device, and transmits the comparison result to the second authentication device. The second authentication device determines whether authentication is successful or not based on the comparison result received from the first authentication device, and obtains a result of authentication success or failure.

(Embodiment 1)
Overview of the network system according to the first embodiment
An overview of a network system according to the first embodiment will be described. The network system according to the first embodiment has a configuration in which a second authentication device is interposed between a user terminal and a first authentication device. The first authentication device stores a registration list in which user information of a legitimate user who should be successfully authenticated is recorded. Normally, the second authentication device transmits user information from the user terminal to the first authentication device. The first authentication device compares the received user information with the user information in the registration list to determine whether authentication is successful. Meanwhile, the second authentication device has a function of recording history information related to authentication success or failure and a function of detecting an abnormality in communication with the first authentication device. When the second authentication device detects an abnormality in communication, it determines whether authentication is successful or failure based on the history information instead of the first authentication device.

Configuration of the network system according to the first embodiment
Fig. 1 is a diagram showing a schematic configuration of a network system according to embodiment 1. As shown in Fig. 1, the network system 1 according to embodiment 1 includes a first authentication device 10, a second authentication device 20, a relay device 30, a user terminal 40, and an administrator terminal 50. The network is, for example, a local area network (LAN) within a company or organization.

The first authentication device 10 and the second authentication device 20 are connected to each other so that they can communicate with each other. The second authentication device 20 and the relay device 30 are connected to each other so that they can communicate with each other. The relay device 30 and the user terminal 40 are connected to each other so that they can communicate with each other. Similarly, the relay device 30 and the administrator terminal 50 are connected to each other so that they can communicate with each other. The connection that enables communication may be a wired connection or a wireless connection.

The user terminal 40 is a terminal that a user uses to connect to the network. The user terminal 40 transmits information representing a request to connect (access) to the network (hereinafter may be simply referred to as a "connection request") and user information required for authentication to the relay device 30. The user terminal 40 also receives information representing the result of authentication success or failure determined by the first authentication device 10 from the second authentication device 20 via the relay device 30 (hereinafter may be simply referred to as the "result of authentication success or failure").

The user information includes, for example, an identity (hereinafter sometimes referred to as "ID"), a password (hereinafter sometimes referred to as "PW"), and a media access control (MAC) address (hereinafter sometimes referred to as "MAC"). The user terminal 40 is, for example, a personal computer, a smartphone, a tablet terminal, etc. The user terminal 40 may also be called a client terminal, an authentication client, a supplicant, etc.

The administrator terminal 50 is a terminal used by an administrator who manages the settings of the first and second authentication devices 10, 20 to connect to the network. The administrator terminal 50 accesses the first and second authentication devices 10, 20 after going through special authentication, and stores data, changes data, installs programs, and changes programs as necessary. The administrator terminal 50 is, for example, a personal computer, a smartphone, or a tablet terminal.

The relay device 30 is a device that relays the transmission and reception of information between the user terminal 40 and the second authentication device 20. When the relay device 30 receives a connection request from the user terminal 40, it transmits information representing a request to transmit user information required for authentication (hereinafter, may be simply referred to as a "user information transmission request") to the user terminal 40. When the relay device 30 receives user information from the user terminal 40, it transmits the received user information to the second authentication device 20. Furthermore, when the relay device 30 receives information representing successful authentication (hereinafter, may be simply referred to as "successful authentication") from the second authentication device 20, it opens a port of the user terminal 40 to permit access to the network and transmits a successful authentication to the user terminal 40.

In this embodiment, various other servers on the network are not shown because they are not closely related to the technology proposed in this application. The relay device 30 is, for example, an authentication switch, a router, an access point, a virtual private network server, a dial-up server, or a RADIUS proxy server. The relay device 30 may also be called a RADIUS client, an authenticator, or the like.

The first authentication device 10 receives user information required for authentication from the user terminal 40, determines whether the authentication was successful, and responds.

More specifically, the first authentication device 10 has a first storage device 11. The first authentication device 10 stores in its own first storage device 11 a registration list L1 in which user information of one or more legitimate users who should be successfully authenticated is pre-registered. The first authentication device 10 receives user information from the user terminal 40 via the relay device 30 and the second authentication device 20. The first authentication device 10 determines whether authentication has been successful by comparing the received user information with the user information in the registration list L1. The first authentication device 10 transmits the result of authentication success or failure to the second authentication device 20.

The first authentication device 10 is, for example, a server. The first storage device 11 possessed by the first authentication device 10 is composed of, for example, a semiconductor memory, a magnetic disk, an optical disk, etc. The first authentication device 10 may be called an authentication server, a RADIUS server, etc.

The second authentication device 20 is interposed between the user terminal 40 and the first authentication device 10, and transmits and receives user information, authentication success/failure results, etc., exchanged between the user terminal 40 and the first authentication device 10. More specifically, the second authentication device 20 receives user information from the user terminal 40 via the relay device 30, and transmits the received user information to the first authentication device 10. The second authentication device 20 also receives the authentication success/failure result from the first authentication device 10, and transmits it to the relay device 30. The second authentication device 20 is, for example, a server.

The second authentication device 20 has a second storage device 21. The second authentication device 20 stores a specific ID list (an example of a history list in this application) L2 in this second storage device 21. Each time the second authentication device 20 receives a successful authentication from the first authentication device 10, it executes a process of recording the successfully authenticated user information in this specific ID list L2. Specifically, the second authentication device 20 records at least the combination of ID and MAC address of the successfully authenticated user information in the specific ID list L2. The second storage device 21 possessed by the second authentication device 20 is composed of, for example, a semiconductor memory, a magnetic disk, an optical disk, etc.

The second authentication device 20 also executes a process to detect an abnormality in communication with the first authentication device 10. For example, if the first authentication device 10 does not respond with a result of authentication success or failure within a predetermined period of time after sending user information to the first authentication device 10 for authentication, the second authentication device 20 determines that an abnormality has occurred in communication with the first authentication device 10 and detects the communication abnormality.

When the second authentication device 20 detects an abnormality in communication with the first authentication device 10, it executes a process to determine whether authentication has been successful on behalf of the first authentication device 10. Specifically, when the second authentication device 20 receives user information from the user terminal 40, it compares the ID and MAC address included in the user information with the combination of ID and MAC address in the specific ID list L2. Then, if the comparison results in a matching combination, the second authentication device 20 transmits a successful authentication to the relay device 30.

When the second authentication device 20 detects that the abnormality in communication with the first authentication device 10 has been resolved, it stops the process of determining whether authentication was successful and resumes normal processing. In other words, when the second authentication device 20 does not detect an abnormality in communication with the first authentication device 10, it performs processing as an intermediary between the user terminal 40 and the first authentication device 10 as described above.

<Processing flow in the network system according to the first embodiment>
A process flow in the network system according to the first embodiment will be described. First, a process flow will be described in a case where no abnormality occurs in communication with the first authentication device 10, i.e., where the second authentication device 20 does not detect an abnormality in communication. Next, a process flow will be described in a case where an abnormality occurs in communication with the first authentication device 10, i.e., where the second authentication device 20 detects an abnormality in communication. Note that, although the actual process flow is assumed to involve sending and receiving complex information in accordance with the authentication protocol applied, it should be noted that the process flow is described here in a simplified manner in order to facilitate understanding of the technology proposed by the present application.

<<Processing flow when there is no abnormality in communication with the first authentication device>>
The process flow when no abnormality occurs in the communication with the first authentication device 10 will be described.

Figure 2 is a diagram showing the process flow when there is no communication abnormality in embodiment 1. As shown in Figure 2, first, the user terminal 40 transmits a connection request AR to the relay device 30 (S1). When the relay device 30 receives the connection request AR from the user terminal 40, it returns a user information transmission request SR to the user terminal 40 (S2). When the user terminal 40 receives the user information transmission request SR from the relay device 30, it receives an input operation from the user and transmits user information including the ID and PW to the relay device 30 (S3).

In addition, data sent from the user terminal 40, such as the connection request AR and user information, includes the MAC address of the user terminal 40 that sent it.

The relay device 30 transmits the ID and PW received from the user terminal 40 together with the MAC address of the user terminal 40 to the second authentication device 20 (S4). When the second authentication device 20 receives the ID and PW and the MAC address from the relay device 30, it transmits the received ID and PW to the first authentication device 10 (S5).

When the first authentication device 10 receives the ID and PW from the second authentication device 20, it checks the received ID and PW against the ID and PW in the registration list L1 (S6). That is, the first authentication device 10 determines whether the received ID and PW are in the registration list L1 and identifies whether the user requesting the connection is a legitimate user.

If the first authentication device 10 determines that the received ID and PW are in the registration list L1, it transmits information A1 indicating successful authentication (permission) (hereinafter, sometimes simply referred to as "successful authentication") to the second authentication device 20 (S7).

When the second authentication device 20 receives the authentication success A1 from the first authentication device 10, it records the ID and MAC address from the user terminal 40 in the specific ID list L2 (S8). Also, when the second authentication device 20 receives the authentication success A1, it transmits the received authentication success A1 to the relay device 30 (S9).

When the relay device 30 receives the authentication success A1 from the second authentication device 20, it transmits the received authentication success A1 to the user terminal 40 (S10). The relay device 30 also permits the user terminal 40 to access the network. In other words, it opens the port of the user terminal 40.

On the other hand, if the first authentication device 10 determines that the received ID and PW are not in the registration list L1, it transmits information A2 indicating authentication failure (rejection) (hereinafter, sometimes simply referred to as "authentication failure") to the second authentication device 20 (S11).

When the second authentication device 20 receives the authentication failure A2 from the first authentication device 10, it transmits the received authentication failure A2 to the relay device 30 (S12).

When the relay device 30 receives the authentication failure A2 from the second authentication device 20, it transmits the received authentication failure A2 to the user terminal 40 (S13). In addition, the relay device 30 keeps the port of the user terminal 40 closed, and denies the user terminal 40 access to the network.

The above is the authentication process flow under normal circumstances when there are no communication abnormalities. By repeatedly performing this authentication process flow for many users, combinations of ID and MAC address, which are user information for users who have been successfully authenticated, are recorded and accumulated in the specific ID list L2.

<<Processing flow when an abnormality occurs in communication with the first authentication device>>
The process flow when an abnormality occurs in communication with the first authentication device 10 will be described.

Figure 3 is a diagram showing a processing flow in the case where a communication abnormality occurs in embodiment 1. As shown in Figure 3, first, the user terminal 40 transmits a connection request AR to the relay device 30 (S21). When the relay device 30 receives the connection request from the user terminal 40, it returns a user information transmission request SR to the user terminal 40 (S22). When the user terminal 40 receives the user information transmission request SR from the relay device 30, it transmits user information including an ID and PW to the relay device 30 in response to an input operation by the user (S23). As described above, the information transmitted from the user terminal 40, such as the connection request AR and user information, includes the MAC address of the user terminal 40 that is the transmission source.

The relay device 30 transmits the ID and PW received from the user terminal 40 together with the MAC address of the user terminal 40 to the second authentication device 20 (S24). When the second authentication device 20 receives the ID and PW and the MAC address from the relay device 30, it transmits the received ID and PW to the first authentication device 10 (S25).

In normal circumstances, the first authentication device 10 receives the ID and PW from the second authentication device 20 and determines whether the authentication is successful or not based on the received ID and PW. However, if an abnormality occurs in the communication with the first authentication device 10, the first authentication device 10 cannot receive the ID and PW from the second authentication device 20, or cannot transmit the result of the authentication success or failure to the second authentication device 20.

The second authentication device 20 detects whether or not there is a response from the first authentication device 10 within a predetermined period of time after transmitting the ID and PW to the first authentication device 10. If the second authentication device 20 detects that there is no response from the first authentication device 10 within the period of time, it detects that an abnormality has occurred in communication with the first authentication device 10 (S26).

When the second authentication device 20 detects that an abnormality has occurred in communication with the first authentication device 10, it determines whether the authentication has been successful or not based on the authentication history on behalf of the first authentication device 10. Specifically, the second authentication device 20 compares the combination of ID and MAC address received from the user terminal 40 with the combination of ID and MAC address recorded in the specific ID list L2 (S27). If the comparison finds a matching combination, i.e., if the comparison is successful, the second authentication device 20 determines that the authentication has been successful. On the other hand, if the comparison finds no matching combination, i.e., if the comparison is unsuccessful, the second authentication device 20 determines that the authentication has failed.

If the second authentication device 20 determines that the authentication is successful, it sends an authentication success A1 to the relay device 30 (S28).

When the relay device 30 receives the authentication success A1 from the second authentication device 20, it transmits the received authentication success A1 to the user terminal 40 (S29). The relay device 30 also permits the user terminal 40 to access the network. In other words, it opens the port of the user terminal 40.

On the other hand, if the second authentication device 20 determines that the authentication has failed, it sends an authentication failure A2 to the relay device 30 (S30).

When the relay device 30 receives the authentication failure A2 from the second authentication device 20, it transmits the received authentication failure A2 to the user terminal 40 (S31). The relay device 30 also denies the user terminal 40 access to the network. In other words, it keeps the port of the user terminal 40 closed.

As described above, according to the network system 1 of the first embodiment, the second authentication device 20 records and accumulates user information of successfully authenticated users when no abnormality occurs in communication with the first authentication device 10. When an abnormality occurs in communication with the first authentication device 10, the second authentication device 20, instead of the first authentication device 10, judges whether authentication has been successful based on the accumulated user information. Therefore, even if an abnormality occurs in communication with the first authentication device 10 and the first authentication device 10 cannot judge whether authentication has been successful, it is possible to respond to a connection request from a user terminal that already has a history of successful authentication. In other words, it is possible to perform authentication processing of a user terminal connected to the network even when an abnormality occurs in communication with the authentication device, while eliminating the need for the cumbersome task of storing and updating user information.

(Embodiment 2)
Overview of the network system according to the second embodiment
An overview of a network system according to the second embodiment will be described. The network system according to the second embodiment has a configuration in which a second authentication device is interposed between a user terminal and a first authentication device, as in the first embodiment. The first authentication device stores a registration list in which user information of a legitimate user who should be successfully authenticated is recorded. Normally, the second authentication device inquires of the first authentication device whether user information from a connection request source is in the registration list. The first authentication device collates the received user information with the registration list and responds to the inquiry. The second authentication device judges whether authentication is successful or not based on the response result, i.e., the comparison result. On the other hand, when the second authentication device detects that an abnormality has occurred in communication with the first authentication device, it switches the method of judging whether authentication is successful or not and judges whether authentication is successful or not by using history information of past authentication processing.

Configuration of the network system according to the second embodiment
Fig. 4 is a diagram showing a schematic configuration of a network system according to the second embodiment. As shown in Fig. 4, the network system 2 according to the second embodiment basically has the same configuration as that of the first embodiment. However, the functions (roles) of the first authentication device 10 and the second authentication device 20 are partially different from those of the first embodiment. In the first embodiment, the first authentication device 10 stores the registration list L1 and judges whether authentication is successful, and the second authentication device 20 acts as an intermediary for transmitting and receiving information. On the other hand, in the second embodiment, the first authentication device 10 stores the registration list L1 but does not judge whether authentication is successful, and the second authentication device 20 judges whether authentication is successful.

The second authentication device 20 transmits to the first authentication device 10, together with the user information from the user terminal 40, information representing a request to match the user information (hereinafter, may be referred to simply as a "matching request"). The matching request is a request to match the user information with the registration list L1. The second authentication device 20 determines whether or not the authentication is successful based on the information representing the matching result received from the first authentication device 10 (hereinafter, may be referred to simply as a "matching result"). The second authentication device 20 may be referred to as an authentication server, a RADIUS server, etc.

The first authentication device 10 stores a registration list L1. When the first authentication device 10 receives user information and a matching request from the second authentication device 20, it matches the user information against the registration list and transmits the matching result to the second authentication device 20. The first authentication device 10 may be called, for example, an active directory server or an active directory database.

Note that the functions of the relay device 30, the user terminal 40, and the administrator terminal 50 are the same as those in embodiment 1, so their explanations are omitted here.

<Processing flow in the network system according to the second embodiment>
A process flow in a network system according to the second embodiment will be described. First, a process flow will be described in a case where no abnormality occurs in communication with the first authentication device 10, i.e., where the second authentication device 20 does not detect a communication abnormality. Next, a process flow will be described in a case where an abnormality occurs in communication with the first authentication device 10, i.e., where the second authentication device 20 detects a communication abnormality. Note that, although the actual process flow involves sending and receiving more complicated information in accordance with the authentication protocol applied, it is noted that the process flow is described here in a simplified manner in order to facilitate understanding of the method proposed by the present application.

<<Processing flow when there is no abnormality in communication with the first authentication device>>
The process flow when no abnormality occurs in the communication with the first authentication device 10 will be described.

Figure 5 is a diagram showing a processing flow in the case where there is no communication abnormality in embodiment 2. As shown in Figure 5, first, the user terminal 40 transmits a connection request AR to the relay device 30 (S41). When the relay device 30 receives the connection request AR from the user terminal 40, it returns a user information transmission request SR to the user terminal 40 (S42). When the user terminal 40 receives the user information transmission request SR from the relay device 30, it transmits an ID and PW to the relay device 30 in response to an input operation by the user (S43). Note that, as described above, the information transmitted from the user terminal 40, such as the connection request AR and user information, includes the MAC address of the user terminal 40, which is the transmission source.

The relay device 30 transmits the ID and PW received from the user terminal 40 together with the MAC address of the user terminal 40 to the second authentication device 20 (S44). When the second authentication device 20 receives the ID, PW, and MAC address from the relay device 30, it transmits the received ID and PW and a matching request VR to the first authentication device 10 (S45).

When the first authentication device 10 receives the ID and PW and the matching request VR from the second authentication device 20, it matches the received ID and PW with the ID and PW in the registration list L1 to identify whether the user requesting the connection is a legitimate user. In other words, the first authentication device 10 determines whether the received ID and PW are in the registration list L1 (S46).

If the first authentication device 10 determines that the received ID and PW are in the registration list L1, it transmits information indicating successful matching (hereinafter, sometimes simply referred to as "successful matching") V1 to the second authentication device 20 (S47).

When the second authentication device 20 receives the successful match V1 from the first authentication device 10, it records the ID and MAC address from the user terminal 40 in the specific ID list L2 (S48). Also, when the second authentication device 20 receives the successful match V1 from the first authentication device 10, it transmits the successful authentication A1 to the relay device 30 (S49).

When the relay device 30 receives the authentication success A1 from the second authentication device 20, it transmits the received authentication success A1 to the user terminal 40 (S50). The relay device 30 also permits the user terminal 40 to access the network. In other words, it opens the port of the user terminal 40.

On the other hand, if the first authentication device 10 determines that the received ID and PW are not in the registration list L1, it transmits information indicating a failed match (hereinafter, sometimes simply referred to as "failed match") V2 to the second authentication device 20 (S51).

When the second authentication device 20 receives a matching failure V2 from the first authentication device 10, it transmits an authentication failure A2 to the relay device 30 (S52).

When the relay device 30 receives the authentication failure A2 from the second authentication device 20, it transmits the received authentication failure A2 to the user terminal 40 (S53). The relay device 30 also denies the user terminal 40 access to the network. In other words, it keeps the port of the user terminal 40 closed.

The above is the authentication process flow under normal circumstances when there are no communication abnormalities. By repeating this authentication process flow, the combination of the ID of a successfully authenticated (authorized) user and the MAC address of that user's terminal is recorded and stored in the specific ID list.

<<Processing flow when an abnormality occurs in communication with the first authentication device>>
The process flow when an abnormality occurs in communication with the first authentication device 10 will be described.

Figure 6 is a diagram showing a processing flow in the case where a communication abnormality occurs in embodiment 2. As shown in Figure 6, first, the user terminal 40 transmits a connection request AR to the relay device 30 (S61). When the relay device 30 receives the connection request AR from the user terminal 40, it returns a user information transmission request SR to the user terminal 40 (S62). When the user terminal 40 receives the user information transmission request SR from the relay device 30, it transmits user information including an ID and PW to the relay device 30 in response to an input operation by the user (S63). Note that, as described above, the information transmitted from the user terminal 40, such as the connection request AR and user information, includes the MAC address of the user terminal 40 that is the transmission source.

The relay device 30 transmits the ID and PW received from the user terminal 40 together with the MAC address of the user terminal 40 to the second authentication device 20 (S64). When the second authentication device 20 receives the ID, PW and MAC address from the relay device 30, it transmits a matching request VR together with the received ID and PW to the first authentication device 10 (S65).

Here, normally, the first authentication device 10 receives the ID and PW from the second authentication device 20 and compares the received ID and PW with the registration list L1. However, if an abnormality occurs in the communication with the first authentication device 10, the first authentication device 10 cannot receive the ID and PW or the comparison request VR from the second authentication device 20, or cannot transmit the comparison result to the second authentication device 20.

The second authentication device 20 detects whether or not there is a response from the first authentication device 10 within a predetermined period of time after transmitting the ID and PW to the first authentication device 10. When the second authentication device 20 detects that there is no response from the first authentication device 10, it senses that an abnormality has occurred in communication with the first authentication device 10 (S66).

When the second authentication device 20 detects that an abnormality has occurred in communication with the first authentication device 10, it stops determining whether authentication has been successful based on the matching result by the first authentication device 10, and determines whether authentication has been successful based on the authentication history. Specifically, the second authentication device 20 compares the combination of ID and MAC address received from the user terminal 40 with the combination of ID and MAC address recorded in the specific ID list L2 (S67).

The second authentication device 20 determines that the authentication is successful if there is a matching combination as a result of comparing with the specific ID list L2, and transmits an authentication success A1 to the relay device 30 (S68).

When the relay device 30 receives the authentication success A1 from the second authentication device 20, it transmits the received authentication success A1 to the user terminal 40 (S69). The relay device 30 also permits the user terminal 40 to access the network. In other words, it opens the port of the user terminal 40.

On the other hand, if there is no matching combination as a result of the comparison with the specific ID list L2, the second authentication device 20 determines that the authentication has failed and sends an authentication failure A2 to the relay device 30 (S70).

When the relay device 30 receives the authentication failure A2 from the second authentication device 20, it transmits the received authentication failure A2 to the user terminal 40 (S71). The relay device 30 also denies the user terminal 40 access to the network. In other words, it keeps the port of the user terminal 40 closed.

As described above, according to the network system 2 of the second embodiment, the second authentication device 20 records and accumulates user information that has already been successfully authenticated, and when an abnormality in communication with the first authentication device 10 is detected, the success or failure of authentication is determined based on the recorded and accumulated user information. Therefore, even if an abnormality occurs in communication with the first authentication device 10 and the first authentication device 10 is unable to obtain a user information matching result, the second authentication device 20 can respond to a connection request from a user terminal that already has a history of successful authentication. In other words, it is possible to perform authentication processing of a user terminal connected to the network even if an abnormality occurs in communication with the authentication device, while eliminating the need for the cumbersome task of storing and updating user information.

(Embodiment 3)
A third embodiment of the present application is a network authentication method for realizing the above-mentioned network system. The network authentication method according to the third embodiment is a network authentication method in which a second authentication device intervening between a user terminal and a first authentication device executes a process of receiving user information from the user terminal, a process of obtaining a result of authentication success or failure based on the user information by communicating with the first authentication device, a process of storing the successfully authenticated user information in a second storage device owned by the second authentication device, a process of detecting an abnormality in communication with the first authentication device, and a process of collating the user information from the user terminal with the user information stored in the second storage device when the abnormality in communication is detected to determine whether authentication of the user terminal is successful or not.

The network authentication method can also be understood from the explanation of the processing flow of the network system in the first and second embodiments above.

Similar to the above-mentioned first and second embodiments, this network authentication method makes it possible to perform authentication processing for a terminal connected to the network, while eliminating the need for the cumbersome task of storing and updating user information, even if a communication abnormality occurs with the authentication device.

In the above embodiment, the second authentication device 20 detects an abnormality in communication with the first authentication device 10 by detecting whether or not there is a response within a certain time after transmitting an ID and PW to the first authentication device 10. However, the method of detecting an abnormality in communication is not limited to the above method. For example, the second authentication device 20 may detect an abnormality in communication by detecting whether or not there is a response within a certain time after transmitting information other than the ID and PW to the first authentication device 10 and obtaining some kind of response from the first authentication device 10. Also, for example, another device may be provided that monitors the communication status with the first authentication device 10, and the other device may detect an abnormality in communication, and the second authentication device 20 may detect the abnormality in communication by receiving information indicating the abnormality from the other device.

In addition, in the above embodiment, the second authentication device 20 records a combination of ID and MAC address in the specific ID list as user information used to determine whether authentication is successful when a communication abnormality occurs. However, the user information recorded in the specific ID list is not limited to a combination of ID and MAC address. For example, the second authentication device 20 may record a combination of ID and PW, a combination of MAC address and PW, or a combination of ID, PW, and MAC address in the specific ID list and use the combination to determine whether authentication is successful.

Although various embodiments of the present invention have been described above, the present invention is not limited to the above-mentioned embodiments and includes various modified examples. Furthermore, the above-mentioned embodiments have been described in detail to clearly explain the present invention, and are not necessarily limited to those having all of the configurations described. Furthermore, it is possible to replace part of the configuration of one embodiment with the configuration of another embodiment, and it is also possible to add the configuration of another embodiment to the configuration of one embodiment. All of these belong to the scope of the present invention. Furthermore, the numerical values etc. included in the text and figures are merely examples, and the effect of the present invention will not be impaired even if different ones are used.

1, 2... network system 10... first authentication device 11... first storage device 20... second authentication device 21... second storage device 30... relay device 40... user terminal 50... administrator terminal L1... registration list L2... specific ID list AR... connection request A1... authentication success A2... authentication failure SR... transmission request VR... verification request V1... verification success V2... verification failure

Claims (5)

a first authentication device;
a second authentication device interposed between a user terminal and the first authentication device,
The second authentication device is
A second storage device is provided.
receiving user information including an ID, a password, and a MAC address from the user terminal;
A process of obtaining a result of authentication success or failure based on an ID and a password included in the received user information by communicating with the first authentication device;
a recording process of recording an ID and a MAC address as user information of a successfully authenticated user in the second storage device;
a detection process for detecting an abnormality in communication with the first authentication device;
a determination process for determining whether authentication of the user terminal has been successful by comparing an ID and a MAC address as user information received from the user terminal with successfully authenticated user information stored in the second storage device when an abnormality in the communication is detected ;
In the determination process, when the ID and MAC address from the user terminal are stored in the second storage device, it is determined that the authentication is successful;
The first authentication device is
a first storage device in which an ID and a password are stored as user information for successful authentication;
executing a verification process for verifying the ID and password as user information received from the second authentication device with the user information stored in the first storage device;
Network system. 2. The network system according to claim 1,
The first authentication device is
A process of determining whether the authentication has been successful or not based on a result of the matching process ;
and transmitting a result of the authentication success or failure to the second authentication device.
Network system. 2. The network system according to claim 1,
The first authentication device is
A process of transmitting a matching result obtained by the matching process to the second authentication device is performed;
The second authentication device is
determining whether the authentication has been successful or not based on a matching result received from the first authentication device;
Network system. In the network system according to any one of claims 1 to 3 ,
the second authentication device is connected to the user terminal via a relay device;
Network system. A second authentication device interposed between the user terminal and the first authentication device,
receiving user information including an ID, a password, and a MAC address from the user terminal;
A process of obtaining a result of authentication success or failure based on an ID and a password included in the received user information by communicating with the first authentication device;
a recording process of recording an ID and a MAC address as user information of the successfully authenticated user in a second storage device of the second authentication device ;
A process of detecting an abnormality in communication with the first authentication device;
and when an abnormality in the communication is detected, executing a determination process for determining whether authentication of the user terminal has been successful by comparing an ID and a MAC address as user information received from the user terminal with user information of successfully authenticated users stored in the second storage device;
In the determination process, when the ID and MAC address from the user terminal are stored in the second storage device, it is determined that the authentication is successful;
The first authentication device,
executing a verification process for verifying the ID and password as user information received from the second authentication device against the ID and password as user information for successful authentication stored in a first storage device of the first authentication device;
Network authentication method.

Images