JP7540992B2 - Network system and access control method - Google Patents

Description

The present invention relates to a network system and an access control method.

One example of a network system in which user authentication is performed is a network system that includes a user terminal, a relay device such as an authentication switch, and an authentication device. In this system, the authentication device stores user information (authentication information) of authorized users. The user terminal transmits the user information to the relay device to obtain the authentication required to connect to the network. The relay device transmits the user information to the authentication device. The authentication device receives the user information from the relay device, compares the received user information with the user information of the authorized user, and if there is a match, transmits information indicating successful authentication to the relay device. When the relay device receives the information indicating successful authentication, it allows the user terminal to connect to the network, and the user terminal becomes able to access servers on the network.

However, in such a network system, if an abnormality occurs in communication with the authentication device, the user terminal cannot be authenticated. Against this background, technology that enables authentication even when an abnormality occurs in communication with the authentication device is being considered.

For example, Patent Document 1 discloses a multifunction device control system that performs authentication using an alternative authentication function provided in the multifunction device when the multifunction device cannot connect to an authentication server.

JP 2011-095793 A

According to the technology disclosed in Patent Document 1, it is necessary to store the user information required for authentication in advance in the device with the alternative authentication function. Furthermore, if a change occurs in the user information required for authentication, it is necessary to update not only the user information stored in the authentication server, but also the user information stored in the device with the alternative authentication function. In this way, the work of storing user information in the device with the alternative authentication function and updating the stored user information is very complicated, and management costs also increase.

Due to the above circumstances, there is a demand for technology that allows a user terminal to access a server or data file on a network without the need for complicated operations, even if an abnormality occurs in communication with the authentication device.

A network system according to one embodiment includes a first authentication device, a second authentication device, and a relay device. The second authentication device is interposed between the first authentication device and the relay device. The relay device is connected to a user terminal and receives user information from the user terminal and transmits the user information to the second authentication device. The second authentication device performs a process of obtaining an authentication success/failure result based on the user information by communicating with the first authentication device, a process of transmitting the authentication success/failure result to the relay device when the authentication success/failure result is obtained, a detection process of detecting an abnormality in communication with the first authentication device, and a process of transmitting information corresponding to the communication abnormality to the relay device when a communication abnormality is detected by the detection process. The relay device stores information that specifies the accessible range of the user terminal when a communication abnormality occurs, and, when receiving the information corresponding to the communication abnormality, performs a process of controlling the connection of the user terminal so that the user terminal can access the accessible range when a communication abnormality occurs. Here, "when there is a communication abnormality" means "when there is a communication abnormality such as a communication failure."

According to one embodiment, even if an abnormality occurs in communication with an authentication device in a network system, a user terminal can access a server or data file on the network without the need for complicated operations.

1 is a diagram illustrating a schematic configuration of a network system according to a first embodiment. FIG. 2 is a diagram showing a state when communication is normal in the network system according to the first embodiment; FIG. 4 is a diagram showing a process flow when communication is normal in the network system according to the first embodiment. FIG. 2 is a diagram illustrating a state in which a communication abnormality occurs in the network system according to the first embodiment. FIG. 4 is a diagram showing a process flow when a communication abnormality occurs in the network system according to the first embodiment. FIG. 11 is a diagram illustrating a schematic configuration of a network system according to a second embodiment. FIG. 11 is a diagram showing a process flow when communication is normal in the network system according to the second embodiment. 11A and 11B are diagrams illustrating examples of settings of an accessible range during normal communication and during abnormal communication.

Now, we will explain the embodiments. Note that each embodiment described below is an example for realizing the present invention, and does not limit the technical scope of the present invention. Furthermore, in each embodiment below, components having the same function are given the same reference numerals, and repeated explanations will be omitted unless particularly necessary.

The basic configuration and functions of the network system according to each embodiment described below are as follows. The network system includes a first authentication device, a second authentication device, and a relay device. The second authentication device is interposed between the first authentication device and the relay device. The relay device is connected to a user terminal, and when it receives a connection request from the user terminal, it transmits a request to transmit user information, and when it receives user information, it transmits the user information to the second authentication device. The second authentication device communicates with the first authentication device, and executes a process to obtain the result of authentication success or failure based on the received user information, and when the result of authentication success or failure is obtained, it transmits the result of authentication success or failure to the relay device.

The above-mentioned process of obtaining the result of authentication success or failure based on the user information by communicating with the first authentication device can be implemented in the following two ways, for example.

In the first embodiment, the first authentication device stores user information for which authentication should be successful. The first authentication device compares the user information from the user terminal received from the second authentication device with the user information stored in itself, determines whether authentication is successful based on the comparison result, and transmits the result of authentication success or failure to the second authentication device. The second authentication device receives the result of authentication success or failure from the first authentication device.

In the second embodiment, the first authentication device stores user information for which authentication should be successful. The first authentication device compares the user information received from the user terminal by the second authentication device with the user information stored in the first authentication device, and transmits the comparison result to the second authentication device. The second authentication device determines whether authentication is successful or not based on the comparison result received from the first authentication device, and obtains a result of authentication success or failure.

The main features of the network system according to each embodiment are as follows. The second authentication device executes a detection process to detect an abnormality in communication with the first authentication device, and a process to transmit information corresponding to the communication abnormality to the relay device when an abnormality is detected by the detection process. The relay device stores information specifying the accessible range of the user terminal when the communication abnormality occurs, and upon receiving the information corresponding to the communication abnormality, executes a process to control the connection of the user terminal so that the user terminal can access the accessible range when the communication abnormality occurs.

(Embodiment 1)
Configuration of the network system according to the first embodiment
Fig. 1 is a diagram illustrating a schematic configuration of a network system according to embodiment 1. As illustrated in Fig. 1, the network system 1 according to embodiment 1 includes a first authentication device 10, a second authentication device 20, a relay device 30, a user terminal 40, a first server 50, a second server 60, and an administrator terminal 70.

The first authentication device 10 and the second authentication device 20 are connected. The second authentication device 20, the user terminal 40, the first server 50, the second server 60, and the administrator terminal 70 are connected to the relay device 30. Note that the above connections are connections that enable mutual communication, and may be wired connections or wireless connections.

The user terminal 40 is a terminal that a user uses to connect to a network. The user terminal 40 transmits information representing a request to connect to the network (hereinafter, may be simply referred to as a "connection request") and user information required for authentication to the relay device 30. The user terminal 40 also receives information representing the result of authentication success or failure determined by the first authentication device 10 from the second authentication device 20 via the relay device 30 (hereinafter, may be simply referred to as the "result of authentication success or failure").

The user information includes, for example, an identity (hereinafter sometimes referred to as "ID"), a password (hereinafter sometimes referred to as "PW"), and a media access control (MAC) address (hereinafter sometimes referred to as "MAC"). The user terminal 40 is, for example, a personal computer, a smartphone, a tablet terminal, etc. The user terminal 40 may also be called a client terminal, an authentication client, a supplicant, etc.

The administrator terminal 70 is a terminal used by the administrator of the network system to connect to the network system 1. The administrator manages the network system 1 overall, for example, managing the settings of the first authentication device 10, the second authentication device 20, and the relay device 30. The administrator accesses the first authentication device 10, the second authentication device 20, or the relay device 30 via the administrator terminal 70, and performs the necessary operations so that these devices have the functions described below and execute the processes described below. These necessary operations include, for example, installing or changing programs, and storing or changing data. The administrator terminal 70 is composed of, for example, a server, a personal computer, a smartphone, or a tablet terminal.

The relay device 30 relays the transmission and reception of information between the user terminal 40 and the second authentication device 20. When the relay device 30 receives a connection request to the network from the user terminal 40, it first transmits information representing a request to transmit user information required for authentication (hereinafter, sometimes simply referred to as a "user information transmission request") to the user terminal 40.

When the relay device 30 receives user information from the user terminal 40, it transmits the received user information to the second authentication device 20. Furthermore, when the relay device 30 receives information indicating successful authentication from the second authentication device 20 (hereinafter, sometimes simply referred to as "successful authentication"), it transmits successful authentication to the user terminal 40. When the relay device 30 receives information indicating unsuccessful authentication from the second authentication device 20 (hereinafter, sometimes simply referred to as "unsuccessful authentication"), it transmits unsuccessful authentication to the user terminal 40.

The relay device 30 has a storage device 31. The storage device 31 stores information specifying an accessible range G1 during normal communication and information specifying an accessible range G2 during abnormal communication. The accessible range G1 during normal communication is a range that is defined as being accessible by the user terminal 40 when communication between the first authentication device 10 and the second authentication device 20 is normal and authentication of the user terminal is successful. The accessible range G2 during abnormal communication is a range that is defined as being accessible by the user terminal 40 when communication between the first authentication device 10 and the second authentication device 20 is abnormal.

When the relay device 30 receives a successful authentication from the second authentication device 20, it controls the connection of the user terminal 40 so that the user terminal 40 can access within the accessible range G1 during normal communication. Also, when the relay device 30 receives information corresponding to a communication abnormality from the second authentication device 20, it controls the connection of the user terminal 40 so that the user terminal 40 can access within the accessible range G2 during abnormal communication.

Here, the information corresponding to the communication abnormality is information that is predetermined to be sent by the second authentication device 20 to the relay device 30 when the communication between the first authentication device 10 and the second authentication device 20 is abnormal.

When the relay device 30 receives a failure to authenticate from the second authentication device 20, it controls the connection of the user terminal 40 so that the user terminal 40 cannot access the network.

The accessible range G1 during normal communication can be, for example, both servers or data files containing highly confidential information and servers or data files containing less confidential information. The accessible range G2 during abnormal communication can be, for example, only servers or data files containing less confidential information. In other words, the accessible range G1 during normal communication can be set to include the accessible range G2 during abnormal communication.

By setting it up in this way, even if an abnormality occurs in the communication of the authentication device, access can be permitted for a user terminal 40 that is requesting access to low confidentiality information, and a situation in which all access is denied can be avoided. In other words, in the case of a user's activities using the network system, even if the user cannot be authenticated due to a communication abnormality in the authentication device, activities with low security risks can be permitted, thereby reducing the impact of the communication abnormality.

The relay device 30 may be, for example, an authentication switch, a router, an access point, a virtual private network server, a dial-up server, or a RADIUS proxy server. The relay device 30 may also be called a RADIUS client or an authenticator.

The first authentication device 10 receives user information required for authentication from the user terminal 40, determines whether the authentication was successful, and responds.

More specifically, the first authentication device 10 has a first storage device 11. The first authentication device 10 stores in its first storage device 11 a registration list L1 in which user information of one or more legitimate users who should be successfully authenticated is preregistered. The first authentication device 10 receives user information from the user terminal 40 via the relay device 30 and the second authentication device 20. The first authentication device 10 determines whether authentication has been successful by comparing the received user information with the user information in the registration list L1. The first authentication device 10 transmits the result of authentication success or failure to the user terminal 40 via the second authentication device 20 and the relay device.

The first authentication device 10 is composed of a computer such as a personal computer or a server. The first storage device 11 possessed by the first authentication device 10 is composed of a semiconductor memory, a magnetic disk, an optical disk, etc. The first authentication device 10 may be called an authentication server, a RADIUS server, etc.

The second authentication device 20 is interposed between the user terminal 40 and the first authentication device 10. The second authentication device 20 receives user information from the relay device 30 and transmits the received user information to the first authentication device 10. The second authentication device 20 receives the result of authentication success or failure from the first authentication device 10 and transmits the received result of authentication success or failure to the relay device 30.

The second authentication device 20 also executes a process to detect whether a failure has occurred in communication with the first authentication device 10, i.e., a process to detect an abnormality in communication with the first authentication device 10. The second authentication device 20 detects an abnormality in communication with the first authentication device 10, for example, when there is no response from the first authentication device 10 indicating whether the authentication was successful or not within a predetermined period of time after sending user information to the first authentication device 10 for authentication.

If the second authentication device 20 obtains a result of authentication success, it transmits a notification of authentication success to the relay device 30, and if the second authentication device 20 obtains a result of authentication failure, it transmits a notification of authentication failure to the relay device 30. In this embodiment, if the second authentication device 20 obtains a result of authentication success, it transmits a VLAN ID (normal) to be described later to the relay device 30 together with the notification of authentication success.

On the other hand, if the second authentication device 20 detects a communication abnormality, it transmits information corresponding to the communication abnormality to the relay device 30. In this embodiment, the second authentication device 20 transmits a VLAN ID (abnormality) described below to the relay device 30 together with authentication success as information corresponding to the communication abnormality. The transmission of authentication success here is a provisional transmission of authentication success, and is a means for allowing connection to the network within a limited range of the user terminal 40 even if a communication abnormality has occurred. This means is one of the major features of the technology disclosed in this application.

The second authentication device 20 is composed of a computer such as a personal computer or a server.

In this embodiment, the first authentication device 10 and the second authentication device 20 are configured as computers. The computer constituting the first authentication device 10 and the computer constituting the second authentication device 20 each include a processor and a storage device, and the necessary programs and data are stored in the storage device. These computers realize the above functions and execute the above processes by the processor executing the programs.

The relay device 30 also has a built-in computer as a component. This computer has a processor and a storage device, and the necessary programs and data are stored in the storage device. This computer realizes the above functions and executes the above processes by the processor executing the programs.

The programs and data to be stored in the first and second authentication devices 10, 20 and the relay device 30 are introduced by the network administrator via the administrator terminal 70. In addition, various settings of the first and second authentication devices 10, 20 and the relay device 30 are also performed by the network administrator via the administrator terminal 70.

The first server 50 is a server on the network, and for example provides some kind of service to the user terminal 40 or functions as a database that stores data files. In this embodiment, the first server 50 functions as a database having a storage device 51, and the storage device 51 stores a data file F1. When the first server 50 receives a request to send the data file F1 from a user terminal 40 that is permitted to access the first server 50, it sends the data file F1 to the user terminal 40.

The second server 60 is a server on the network, and for example provides some kind of service to the user terminal 40 or functions as a database that stores data files. In this embodiment, the second server 60 functions as a database having a storage device 61, and the storage device 61 stores a data file F2. When the second server 60 receives a request to send the data file F2 from a user terminal 40 that is permitted to access the second server 60, it sends the data file F2 to the user terminal 40.

Figure 8 is a diagram showing an example of setting the accessible range during normal communication and during abnormal communication. In this embodiment, as shown in Figure 8, the accessible range G1 during normal communication is the first server 50 and the second server 60. Note that the accessible range G1 during normal communication may be all servers on the network. On the other hand, the accessible range G2 during abnormal communication is the second server 60.

In this embodiment, a method for constructing a virtual LAN called a Virtual Local Area Network (VLAN) is used to control the connection of the user terminal 40. In this method for constructing a VLAN, ports with the same configured VLAN ID (number) construct one virtual LAN. In other words, if a VLAN ID that is the same as the VLAN ID configured on the port of a specific server on the network is configured on the port of the user terminal 40, the user terminal 40 will be able to access that specific server. Conversely, if a VLAN ID different from the VLAN ID configured on the port of a specific server on the network is configured on the port of the user terminal 40, the user terminal 40 will not be able to access that specific server.

In this embodiment, the relay device 30 stores ports to which VLANID (normal) and VLANID (abnormal) are set as the above-mentioned accessible range G1 during normal communication and the accessible range G2 during abnormal communication, respectively.

The contents in parentheses in FIG. 8 show the VLANID setting table stored in the storage device 31 of the relay device 30. Here, VLANID (normal) is the VLAN ID set for the port of the server to which the user terminal 40 is to be allowed access if authentication of the user terminal 40 is successful. Also, VLANID (abnormal) is the VLAN ID set for the port of the server to which the user terminal 40 is to be allowed access if communication between the first authentication device 10 and the second authentication device 20 is abnormal. For VLANID (normal) and VLANID (abnormal), in practice, VLANIDs that are expressed as numbers, such as VLAN10 and VLAN20, are used.

In this embodiment, the relay device 30 pre-sets the VLAN ID (normal) and the VLAN ID (abnormal) to the ports of each server on the network according to the table in FIG. 8. The relay device 30 also sets the same VLAN ID as the VLAN ID received from the second authentication device 20 together with the successful authentication to the port of the user terminal 40.

Specifically, when the relay device 30 receives a VLAN ID (normal) along with successful authentication from the second authentication device 20, it sets the VLAN ID (normal) to the port of the user terminal 40. On the other hand, when the relay device 30 receives a VLAN ID (abnormal) along with successful authentication from the second authentication device 20, it sets the VLAN ID (abnormal) to the port of the user terminal 40.

By this mechanism, if the authentication is successful, the user terminal 40 can access the accessible range G1 during normal communication, i.e., the first server 50 and the second server 60. Furthermore, if an abnormality occurs in the communication between the first authentication device 10 and the second authentication device 20, the user terminal 40 cannot access the first server 50, but can access the accessible range G2 during abnormal communication, i.e., the second server 60.

In the tagged VLAN method, the VLAN ID is information that is originally included in the data (frame) sent to the relay device 30. Therefore, the second authentication device 20 only needs to specify the VLAN ID of the frame to be sent as either VLAN ID (normal) or VLAN ID (abnormal) depending on the situation. The relay device 30 also only needs to set the VLAN ID received from the second authentication device 20 as is in the port of the user terminal 40. In this way, by using the VLAN ID of the tagged VLAN method, it is possible to easily control the connection of the user terminal 40. This is also one of the major features of the technology disclosed in this application.

In addition, this embodiment is an example in which the tag VLAN method is used as the method for constructing the VLAN, but the connection control of the user terminal 40 can also be achieved using the port VLAN method. In the case of the port VLAN method, multiple VLAN IDs cannot be set in duplicate to one port. Therefore, when using the port VLAN method, the relay device 30 needs to reconfigure the ports of each server on the network depending on whether it receives a VLAN ID (normal) or a VLAN ID (abnormal) from the second authentication device 20.

<State of the network system according to the first embodiment when communication is normal>
A state in which communication is normal in the network system according to the first embodiment will be described.

Figure 2 is a diagram showing a state when communication is normal in the network system according to the first embodiment. As shown in Figure 2, when communication between the first authentication device 10 and the second authentication device 20 is normal, the second authentication device 20 can receive the result of authentication success or failure of user information from the first authentication device 10. When the second authentication device 20 receives a successful authentication, it transmits a VLAN ID (normal) together with the successful authentication to the relay device 30. On the other hand, when the second authentication device 20 receives a failed authentication, it transmits a failed authentication to the relay device 30.

When the relay device 30 receives a successful authentication, it sets the VLAN ID received along with the successful authentication, i.e., VLAN ID (normal), to the port of the user terminal 40. This setting enables the user terminal 40 to access the servers that belong to the accessible range G1 during normal communication, i.e., the first server 50 and the second server 60. On the other hand, when the relay device 30 receives a failed authentication, it sets the port of the user terminal 40 to a closed state. This setting prevents the user terminal 40 from accessing any servers on the network.

<Processing flow when communication in the network system according to the first embodiment is normal>
The process flow of the network system according to the first embodiment when communication is normal will be described. Note that the actual process flow of the network system involves sending and receiving complex information in accordance with the authentication protocol applied. Please note that each process flow described below is simplified in order to facilitate understanding of the technology proposed by the present application.

Figure 3 is a diagram showing the processing flow when communication is normal in the network system according to embodiment 1.

As shown in FIG. 3, first, the user terminal 40 transmits a connection request R to the relay device 30 (S1). When the relay device 30 receives the connection request R from the user terminal 40, it returns a user information transmission request SR to the user terminal 40 (S2). When the user terminal 40 receives the user information transmission request SR from the relay device 30, it receives an input operation from the user and transmits the user information, that is, the ID and PW, to the relay device 30 (S3).

When the relay device 30 receives the ID and PW from the user terminal 40, it transmits the received ID and PW to the second authentication device 20 (S4). When the second authentication device 20 receives the ID and PW from the relay device 30, it transmits the received ID and PW to the first authentication device 10 (S5).

When the first authentication device 10 receives the ID and PW from the second authentication device 20, it compares the received ID and PW with the ID and PW in the registration list L1 to make an authentication decision (S6). That is, the first authentication device 10 determines whether the received ID and PW are in the registration list L1 and identifies whether the user who made the authentication request is a legitimate user.

If the first authentication device 10 determines that the received ID and PW are in the registration list L1, it sends authentication success A1 to the second authentication device 20 (S7).

When the second authentication device 20 receives the authentication success A1 from the first authentication device 10, it transmits the VLAN ID (normal) along with the authentication success A1 to the relay device 30 (S8).

When the relay device 30 receives the authentication success A1 from the second authentication device 20, it sets the VLANID (normal), which is the VLANID received together with the authentication success A1, to the port of the user terminal 40 (S9). In this embodiment, as shown in the table of FIG. 8, the VLANID (normal) is set to the ports of the servers belonging to the accessible range G1 during normal communication, that is, the first server 50 and the second server 60. Therefore, the user terminal 40 becomes able to access the first server 50 and the second server 60, which constitute a VLAN with the same VLANID (normal). The relay device 30 transmits the authentication success A1 to the user terminal 40 together with the above setting (S10).

When the user terminal 40 receives the authentication success A1, it transmits, for example, to the relay device 30, a transmission request T1 for the data file F1 directed to the first server 50 (S11). The first server 50 belongs to a VLAN with the same ID (normal) as the user terminal 40. Therefore, the relay device 30 transmits the transmission request T1 to the first server 50 (S12). When the first server 50 receives the transmission request T1 for the data file F1, it transmits the data file F1 to the user terminal 40 (S13).

The user terminal 40 also transmits, for example, to the relay device 30, a transmission request T2 for the data file F2 directed to the second server 60 (S14). The second server 60 belongs to a VLAN with the same ID (normal) as the user terminal 40. Therefore, the relay device 30 transmits the transmission request T2 to the second server 60 (S15). Upon receiving the transmission request T2 for the data file F2, the second server 60 transmits the data file F2 to the user terminal 40 (S16).

Note that the timing of sending transmission request T1, sending transmission request T2, sending and receiving data file F1, and sending and receiving data file F2 is not limited to the above.

On the other hand, if the first authentication device 10 determines in the authentication judgment of step S6 that the received ID and PW are not in the registration list L1, it sends an authentication failure A2 to the second authentication device 20 (S17).

When the second authentication device 20 receives the authentication failure A2 from the first authentication device 10, it transmits the authentication failure A2 to the relay device 30 (S18). When the relay device 30 receives the authentication failure A2, it keeps the port of the user terminal 40 closed and denies the user terminal 40 access to servers on the network, etc. The relay device 30 also transmits the authentication failure A2 to the user terminal 40 (S19).

<State of the network system according to the first embodiment when a communication abnormality occurs>
A state in which a communication abnormality occurs in the network system according to the first embodiment will be described.

Figure 4 is a diagram showing the state of the network system according to the first embodiment when a communication abnormality occurs. As shown in Figure 4, when there is an abnormality in the communication between the first authentication device 10 and the second authentication device 20, the first authentication device 10 cannot receive user information or cannot transmit the result of authentication success or failure. The second authentication device 20 detects the communication abnormality based on the fact that the result of authentication success or failure is not received within a certain time period after transmitting the user information. When the second authentication device 20 detects a communication abnormality, it transmits a VLAN ID (abnormal) together with authentication success to the relay device 30.

When the relay device 30 receives a successful authentication, it sets the VLAN ID received along with the successful authentication, i.e., VLAN ID (abnormal), to the port of the user terminal 40. This setting enables the user terminal 40 to access a server that belongs to the accessible range G1 during normal communication, i.e., the second server 60.

<Processing flow when a communication abnormality occurs in the network system according to the first embodiment>
A process flow when a communication abnormality occurs in the network system according to the first embodiment will be described.

Figure 5 shows the processing flow when a communication abnormality occurs in the network system according to the first embodiment.

As shown in FIG. 5, first, the user terminal 40 transmits a connection request R to the relay device 30 (S21). When the relay device 30 receives the connection request R from the user terminal 40, it returns a user information transmission request SR to the user terminal 40 (S22). When the user terminal 40 receives the user information transmission request SR from the relay device 30, it receives an input operation from the user and transmits the ID and PW to the relay device 30 (S23).

When the relay device 30 receives the ID and PW from the user terminal 40, it transmits the received ID and PW to the second authentication device 20 (S24). When the second authentication device 20 receives the ID and PW from the relay device 30, it transmits the received ID and PW to the first authentication device 10 (S25).

Here, the first authentication device 10 would normally receive the ID and PW from the second authentication device 20 and compare the received ID and PW with the ID and PW in the registration list L1 to determine whether authentication was successful.

However, if an abnormality occurs in the communication between the first authentication device 10 and the second authentication device 20, there is no response from the first authentication device 10. The second authentication device 20 detects that an abnormality has occurred in the communication with the first authentication device 10 based on the absence of a response within a certain period of time after sending the ID and PW to the first authentication device 10 (S26).

When the second authentication device 20 detects a communication abnormality, it sends the VLAN ID (abnormal) along with authentication success A1 to the relay device 30 (S27).

When the relay device 30 receives the authentication success A1 from the second authentication device 20, it sets the VLAN ID (abnormal) received together with the authentication success A1 to the port of the user terminal 40 (S28). In this embodiment, as shown in FIG. 8, the VLAN ID (abnormal) is set to the port of the server belonging to the accessible range G2 during communication abnormality, that is, the second server 60. Therefore, the user terminal 40 can access the second server 60 that configures a VLAN with the same VLAN ID (abnormal). The relay device 30 transmits the authentication success A1 to the user terminal 40 together with the above setting (S29).

When the user terminal 40 receives the authentication success A1, it transmits, for example, a transmission request T1 for the data file F1 intended for the first server 50 to the relay device 30 (S30). However, since the first server 50 does not belong to the VLAN with the same ID as the user terminal 40, the relay device 30 does not send the transmission request T1 to the first server 50 (S31).

The user terminal 40 also transmits, for example, to the relay device 30, a transmission request T2 for the data file F2 intended for the second server 60 (S32). The second server 60 belongs to the same VLAN with the same ID (abnormal) as the user terminal 40. Therefore, the relay device 30 transmits the transmission request T2 to the second server 60 (S33). Upon receiving the transmission request T2, the second server 60 transmits the data file F2 to the user terminal 40 (S34).

Note that the timing of sending transmission request T1, sending transmission request T2, and sending and receiving data file F2 is not limited to the above.

As described above, according to the network system 1 of the first embodiment, when the second authentication device 20 detects a communication abnormality, it transmits the VLANID (abnormal) along with the authentication success A1 to the relay device 30. The relay device 30 sets the received VLANID (abnormal) to the port of the user terminal 40. The VLANID (abnormal) is set to the port of the server belonging to the accessible range G2 during a communication abnormality. Therefore, even during a communication abnormality, the user terminal 40 can access the server belonging to the accessible range G2 during a communication abnormality or a data file stored on that server.

In other words, according to the first embodiment, a situation in which the user terminal 40 cannot be authenticated due to a communication abnormality and the user terminal 40 cannot connect to the network can be avoided, and the user terminal 40 can access servers and the like on the network within a set range.

Furthermore, according to the first embodiment, even when a communication abnormality occurs, the user terminal 40 can access a server on the network without the need for cumbersome work for alternative authentication, such as separately storing user information for authentication in the network device.

(Embodiment 2)
Configuration of the network system according to the second embodiment
FIG. 6 is a diagram showing a schematic configuration of a network system according to the second embodiment. As shown in FIG. 6, the network system 2 according to the second embodiment differs in some functions of the first authentication device 10 and the second authentication device 20 compared to the first embodiment. The first authentication device 10 does not judge whether authentication is successful or not, but compares the received user information with the user information in the registration list L1, and transmits only the comparison result to the second authentication device 20. The second authentication device 20 judges whether authentication is successful or not based on the comparison result received from the first authentication device 10. In other words, the first authentication device 10 compares the user information, but the second authentication device 20, not the first authentication device 10, judges whether authentication is successful or not. The rest is the same as the first embodiment.

<Processing flow when communication in the network system according to the second embodiment is normal>
A process flow when communication in the network system according to the second embodiment is normal will be described.

Figure 7 is a diagram showing a process flow when communication is normal in the network system according to the second embodiment. As shown in Figure 7, in the second embodiment, steps S41 to S45, S48 to S56, and S58 to S59 correspond to steps S1 to S5, S8 to S16, and S18 to S19 shown in Figure 3. Also, in step S46, instead of the authentication judgment in step S6 shown in Figure 3, a match is performed, and in step S47, instead of the transmission of authentication success A1 in step S7 shown in Figure 3, a match success V1 is transmitted. Also, in step S57, instead of the transmission of authentication failure in step S17 shown in Figure 3, a match failure is transmitted. The second authentication device 20 judges whether authentication is successful or not based on the received match result. The rest is the same as in the first embodiment.

The processing flow when a communication abnormality occurs in the network system according to the second embodiment is similar to the processing flow shown in FIG. 5 according to the first embodiment, and therefore will not be described.

As described above, the network system 2 according to the second embodiment differs from the first embodiment in that the first authentication device 10 compares the user information, and the second authentication device 20 judges the authentication based on the result of the comparison. On the other hand, the operation of the relay device 30 is the same as that of the first embodiment. Therefore, the network system 2 according to the second embodiment also provides the same effects as the first embodiment.

(Embodiment 3)
The access control method in a network described next is also one embodiment of the present invention.

The access control method according to this embodiment is an access control method in a network system in which a second authentication device is interposed between a relay device connected to a user terminal and a first authentication device, the relay device executes a process of receiving user information from the user terminal and a process of transmitting the received user information to the second authentication device, the second authentication device executes a process of obtaining an authentication success/failure result based on the received user information by communicating with the first authentication device, a process of transmitting the authentication success/failure result to the relay device when the authentication success/failure result is obtained, a detection process of detecting an abnormality in communication with the first authentication device, and a process of transmitting information corresponding to the communication abnormality to the relay device when an abnormality is detected by the detection process, the relay device stores information specifying the accessible range of the user terminal when a communication abnormality occurs, and, when the information corresponding to the communication abnormality is received, executes a process of controlling the connection of the user terminal so that the user terminal can access the accessible range when a communication abnormality occurs.

According to this access control method, as in the above-mentioned embodiments 1 and 2, it is possible to avoid a situation in which a user terminal cannot be authenticated due to a communication abnormality, and the user terminal cannot connect to the network, and the user terminal can access servers, etc. on the network within a set range.

In addition, according to this access control method, even when a communication abnormality occurs, the user terminal can access a server on the network without the need for cumbersome work for alternative authentication, such as storing user information separately for authentication in the network device.

Although various embodiments of the present invention have been described above, the present invention is not limited to the above-mentioned embodiments and includes various modified examples. Furthermore, the above-mentioned embodiments have been described in detail to clearly explain the present invention, and are not necessarily limited to those having all of the configurations described. Furthermore, it is possible to replace part of the configuration of one embodiment with the configuration of another embodiment, and it is also possible to add the configuration of another embodiment to the configuration of one embodiment. All of these belong to the scope of the present invention. Furthermore, the numerical values etc. included in the text and figures are merely examples, and the effect of the present invention will not be impaired even if different ones are used.

1, 2...network system 10...first authentication device 11...first storage device 20...second authentication device 30...relay device 31...relay device storage device 40...user terminal 50...first server 51...first server storage device 60...second server 61...second server storage device 70...administrator terminal L1...registration list F1, F2...data file R...connection request A1...authentication success A2...authentication failure SR...transmission request T1...transmission request T2 for data file F1...transmission request V1 for data file F2...matching success V2...matching failure G1...accessible range when communication is normal G2...accessible range when communication is abnormal

Claims (9)

A first authentication device, a second authentication device, and a relay device,
the second authentication device is interposed between the first authentication device and the relay device,
the relay device is connected to a user terminal, receives user information from the user terminal, and transmits the user information to the second authentication device;
a process in which the second authentication device communicates with the first authentication device to obtain a result of authentication success or failure based on the user information;
a process of transmitting a result of the authentication success or failure to the relay device when the result of the authentication success or failure is obtained;
a detection process for detecting an abnormality in communication with the first authentication device;
When a communication anomaly is detected by the detection process, a process of transmitting information corresponding to the communication anomaly to the relay device is executed;
The relay device is
storing information specifying an accessible range of the user terminal when a communication abnormality occurs;
When receiving the information corresponding to the communication abnormality, a process of controlling a connection of the user terminal is executed so that the user terminal can access the accessible range during the communication abnormality.
Network system. 2. The network system according to claim 1,
The relay device controls the connection of the user terminal using a VLAN ID.
Network system. 3. The network system according to claim 2,
the information for identifying the accessible range during the communication abnormality is a first VLAN ID that is set to a port of a server on a network corresponding to the accessible range during the communication abnormality,
the second authentication device executes a process of transmitting the first VLAN-ID to the relay device as information corresponding to the communication abnormality when the communication abnormality is detected;
the relay device executes a process of setting the first VLAN ID received from the second authentication device to a port of the user terminal;
Network system. 4. The network system according to claim 3,
the relay device stores a second VLAN ID that is set to a port of a server on the network, the second VLAN ID corresponding to an accessible range during normal communication of the user terminal;
the second authentication device executes a process of transmitting the second VLAN ID to the relay device when a result of authentication success of the user terminal is obtained;
the relay device executes a process of setting the second VLAN ID received from the second authentication device to a port of the user terminal.
Network system. 5. The network system according to claim 4,
The normal communication accessible range includes the abnormal communication accessible range,
Network system. 6. The network system according to claim 1,
The first authentication device is
a first storage device in which user information that results in successful authentication is stored;
a process of collating user information received from the second authentication device with user information stored in the first storage device to determine whether the authentication has been successful;
and transmitting a result of the authentication success or failure to the second authentication device.
Network system. 6. The network system according to claim 1,
The first authentication device is
a first storage device in which user information that will result in successful authentication is stored in advance;
a verification process for verifying the user information received from the second authentication device with the user information stored in the first storage device;
a process of transmitting a matching result obtained by the matching process to the first authentication device;
The second authentication device is
determining whether the authentication has been successful or not based on the matching result received from the first storage device;
Network system. The network system according to any one of claims 1 to 7,
The relay device is an authentication switch, a router, an access point, a virtual private network server, a dial-up server, or a RADIUS proxy server.
Network system. In a network system in which a second authentication device is interposed between a relay device connected to a user terminal and a first authentication device,
The relay device is
receiving user information from the user terminal;
transmitting the received user information to the second authentication device;
The second authentication device is
A process of obtaining a result of authentication success or failure based on the received user information by communicating with the first authentication device;
a process of transmitting a result of the authentication success or failure to the relay device when the result of the authentication success or failure is obtained;
a detection process for detecting an abnormality in communication with the first authentication device;
When a communication anomaly is detected by the detection process, a process of transmitting information corresponding to the communication anomaly to the relay device is executed;
The relay device is
storing information specifying an accessible range of the user terminal when a communication abnormality occurs;
When receiving the information corresponding to the communication abnormality, a process of controlling a connection of the user terminal is executed so that the user terminal can access the accessible range during the communication abnormality.
Access control methods.

Images