JPH11355266A - Device and method for user authentication - Google Patents

Abstract

PROBLEM TO BE SOLVED: To reduce a load on a server which performs user authentication in accessing other networks and to simplify the system structure. SOLUTION: An authentication information holding means 2 holds what is authenticated by an authentication server ATS as authenticated user information among the authentication information which a database DB stores. When a user accesses other networks from a terminal TE, if the terminal TE is dial- up-connected to a network access server NAS, an authentication demand including a user name and a password is made by the terminal TE of the NAS. An in-NAS authentication means 3 retrieves whether or not the user name and the password are held by the authentication information holding means 2, 'authenticated' when the two coincide with each other or 'authentication denied' when the password does not coincide is replied to the terminal TE. Also, when the user name concerned does not exist, the authentication is demanded of the authentication server ATS. When the authentication server ATS finds the user name concerned in the database DB, it responds with fulfilled authentication to the NAS and the terminal, and holds its user name and the password in the authentication information holding means 2.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a user authentication apparatus and a user authentication method, and more particularly to a user authentication method for accessing a network such as the Internet connected via a router from a terminal connected to a public network. The present invention relates to a user authentication device and a user authentication method for performing authentication of a user.

[0002]

2. Description of the Related Art In recent years, on the background of innovations in network technology and LSI technology, it has become possible to construct an extensive network system connecting networks.
Users can now communicate over a wider area. However, on the other hand, users who have unlimited access to the computer via the network need to be blocked. For this reason, especially in an open network, an authentication system that authenticates a user as a person who is permitted to use a machine or a service is regarded as important.

FIG. 9 shows a typical example of this type of conventional user authentication system. In FIG. 9, a network in which a plurality of terminals TE are connected to a public network NET is coupled to another network (not shown) connected via a network access server NAS1. Database D
B stores authentication information including a user name and a password of a user who uses the terminal TE.
1 authenticates a user by referring to the database DB in response to an authentication request from the network access server NAS1. The network access server NAS1 is a type of a router and has a built-in modem.

When a user attempts to access another network by inputting a user name and a password from the terminal TE, the network access server NAS1 makes an authentication request to the authentication server ATS1, and the authentication server ATS1 sends the input user name and The user is authenticated by checking whether the password is stored in the database DB. As a result, only authorized users can access the desired network.

In this system, when the number of users and the network access server NAS1 increase,
Network access server NAS1-authentication server AT
The authentication request / response between S1 increases, and the authentication server ATS1
Its own load also increases. Therefore, when the number of users increases, a problem such as a decrease in response to user authentication occurs. This problem is caused by the authentication server ATS1 as shown in FIG.
By adopting a system configuration in which a plurality of authentication servers are installed, the load of the authentication request is distributed to each authentication server ATS1 to solve the problem.

In the field of mobile radio communication,
As a technology that uses the authentication result, a user authentication method that stores the user authentication result together with the user identifier in a proxy authentication device, and when there is an authentication request, authenticates the user using the authentication result stored in the proxy authentication device. Is disclosed in JP-A-10-1
No. 3956.

As shown in FIG. 11, this system is for user authentication when the radio terminal 40 moves and switches from a base station, for example, 30-11 to a base station 30-12. The proxy authentication device 50 is provided in the base station management server 20 that manages the stations 30-11 and the like. When the wireless terminal 4 that has been once authenticated connects to another base station 30-12 and intends to receive re-authentication, the wireless terminal 40
Transmits the previously received certification path to the base station 30-12, and notifies that it has been certified. Base station 30-12
Transfers the authentication path to the base station management server 20, and sends "authentication OK" to the base station 30-12 if the proxy authentication device 50 has the authentication result.
Transfer the authentication request to 0.

[0008]

However, the above-mentioned prior art (FIG. 10) has a problem that the system configuration becomes complicated and the database management of the user authentication information becomes complicated.

In the prior art shown in FIG. 11, it is necessary for the wireless terminal 4 to hold the previously received certification path, and the wireless terminal 4 must be conscious of whether or not it has been authenticated once. There is a problem that it is complicated.

An object of the present invention is to provide a user authentication device and a user authentication method that reduce the load on an authentication server.

It is another object of the present invention to provide a user authentication device and a user authentication method for reducing traffic between a network access server and an authentication server.

Still another object of the present invention is to provide a user authentication apparatus and a user authentication method which simplify the system configuration and database management, reduce the load on the terminal side, and reduce the operation cost. .

[0013]

A user authentication apparatus according to the present invention is a user authentication apparatus for authenticating a user when a terminal connected to a public line network accesses another network connected via a router. Authenticated user authentication information is stored in the router, and the user is authenticated using the authenticated user authentication information.

A user authentication device according to a preferred embodiment of the present invention includes a database storing authentication information of a user who uses a terminal under the router, an authentication server accessing the database and authenticating the user. An authentication information holding unit that holds the authenticated user authentication information, and a network access server that functions as the router including an authentication unit in a NAS that performs authentication of the user by using the held user authentication information. The authentication of the user by the authentication server is performed only when the authenticated user authentication information corresponding to the authentication information holding unit is not held.

[0015] In a user authentication apparatus according to a preferred embodiment of the present invention, the authentication server has authentication information change notifying means for notifying that user authentication information stored in a database has been changed, The network access server includes a user information deleting unit that deletes a corresponding one of the held authenticated user authentication information upon receiving the notification.

In a user authentication apparatus according to a preferred embodiment of the present invention, the authentication information holding means discards authenticated user authentication information for which no authentication request has been received within a predetermined period.

In a user authentication apparatus according to a preferred embodiment of the present invention, the authentication information holding means is configured to discard any further authenticated user authentication information when the number of authenticated user authentication information held reaches a predetermined number. Features.

Further, the user authentication method according to the present invention is a user authentication method for performing user authentication when a terminal connected to a public line network accesses another network connected via a router. Storing the authentication information of the user using the terminal under his / her control in a database, accessing the database and authenticating the user, storing authenticated user authentication information in the router, and authenticating the user. First includes a step of using the authenticated user authentication information held in the router, and a step of authenticating the user by the database access only when there is no corresponding authenticated user authentication information to be held. It is characterized by.

[0019]

Next, an embodiment of the present invention will be described.

A user authentication apparatus according to the present invention is a user authentication apparatus for authenticating a user when a terminal connected to a public line network accesses another network connected via a router. Is stored in the router, and the user is authenticated using the authenticated user authentication information.

The user authentication method according to the present invention is a user authentication method for performing user authentication when a terminal connected to a public network accesses another network connected via a router. Storing the authentication information of the user using the terminal under his / her control in a database, accessing the database and authenticating the user, storing authenticated user authentication information in the router, and authenticating the user. First includes a step of using the authenticated user authentication information held in the router, and a step of authenticating the user by the database access only when there is no corresponding authenticated user authentication information to be held. It is characterized by.

Hereinafter, embodiments of the present invention will be described with reference to the drawings.

FIG. 1 shows an embodiment of the present invention. In FIG. 1, a network in which a plurality of terminals TE are connected to a public network NET is connected to another network (not shown) such as the Internet via a network access server NAS. An authentication server ATS is connected to the network server NAS, and the authentication server ATS can access a database DB. The database DB stores authentication information including a user name and a password of a user using the terminal TE, and the authentication server ATS performs user authentication by referring to the database DB in response to an authentication request from the network access server NAS. .

The authentication server ATS has a database DB
Is provided with an authentication information change notifying means 1 for notifying the network access server NAS of an authentication information change when the authentication information of the user stored by the user is changed.

Also, the network access server NAS
Is provided with an authentication information holding means 2, an intra-NAS authentication means 3, and a user information deletion means 4. When the network access server NAS receives an authentication response indicating that the user has been authenticated from the authentication server ATS, the authentication information holding unit 2 holds the user name and password as authenticated user authentication information in the network access server NAS. I do. The authentication means 3 in the NAS is connected to the connected terminal T.
Based on the user name and the password sent from E, authenticated user information in the network access server NAS is searched. If the user name exists in the authenticated user information, the password sent from the terminal TE is compared with the password in the authenticated user information, and if they match, the result of "authentication" is the result of authenticating the user. Obtain the result and send an authentication response to the terminal. If they do not match, a result of “authentication rejection”, which is a result of rejecting user authentication, is obtained, and an authentication rejection response is transmitted to the terminal. If the user name and the password do not exist in the authenticated user information, the NAS obtains the result of "no user name", which means that the user information does not exist, and sends an authentication request to the authentication server ATS. I do. Further, the user information deletion unit 4 deletes information corresponding to the user name notified from the authentication server ATS in the authentication information change notification from the authenticated user information stored in the authentication information storage unit 2.

Next, the operation of this embodiment will be described with reference to FIGS.
This will be described with reference to FIG. FIG. 2 is a flowchart of the present embodiment. First, when the user accesses another network, the terminal TE connects to the network access server N.
When a dial-up connection is made to the AS, an authentication request including a user name and a password is sent from the terminal TE to the network access server NAS by an authentication protocol between the terminal TE and the network access server NAS.
When the network access server NAS receives this (S1), the in-NAS authentication means 3 searches for the authenticated user information held by the authentication information holding means 2 (S1).
2). As a result, in the case of “authentication”, an authentication response is notified to the terminal TE (S3), in the case of “authentication rejected”, an authentication rejection response is notified to the terminal TE (S4), and in the case of “no user name”, the authentication server is An authentication request is sent to the ATS (S5).

FIG. 3 is a flowchart showing the details of the intra-NAS authentication in S2 of FIG. First, the received user name is searched from the authenticated user information held by the authentication information holding means 2 (S2) (S9). If the user name exists (S10), the received user name is searched from the authenticated user information. (S2), and retrieves the password (S11). If the passwords also match (S12), the authentication is made (S13, S2 in FIG. 2), and if the passwords do not match (S12).
12) Assume “authentication rejected” (S14, S2 in FIG. 2). If there is no user name in S10, it is determined that there is no user name (S15, S2 in FIG. 2).

FIGS. 4, 5, and 6 show “authentication”,
A specific example in the case of “authentication denied” and “no user name” is shown. In FIG. 4, the user name “us0” from the terminal TE
002 "," password ps0002 "and the user name" us0002 "of the authenticated user information," password ps0002 "
0002 ", and in FIG. 5, the user name" us
0002 "matches, but the password" ps0002 "
And "xyzabc" do not match. In FIG. 6, it can be seen that the user name corresponding to the user name "us0002" does not exist in the authenticated user information.

Referring again to FIG. 2, an authentication request is sent (S5).
Receives a response from the authentication server ATS to (S
6) If the response is an authentication response (S7), the authentication server A
The authentication information from the TS is held in the authentication information holding means 2 as authenticated user information (S8), and an authentication response is notified to the terminal TE (S3). If the response is an authentication rejection response (S7),
It notifies the terminal TE of the rejection of the authentication response (S4).

FIG. 7 shows that the authentication server ATS that has received the authentication request (S5 and FIG. 6 in FIG. 2) accesses the database DB and receives it from the terminal TE (S5 in FIG. 2).
1) User name "us0002" and password "ps"
0002 "and find the network access server N
AS, and sends an authentication response to the terminal TE,
User name "us0002" and password "ps00"
02 is stored in the authentication information holding unit 2 as authenticated user information.

Next, when the authentication information in the database DB is changed, as shown in FIG.
In S, the authentication information change notification unit 1 sends an authentication information change notification to the network access server NAS. The network access server NAS that has received the authentication information change notification deletes the authenticated user information corresponding to the notified user name from the authentication information holding unit 2 by the user information deletion unit 4. In FIG. 8, since the password of the user name “us0007” has been changed from “ps0007” to “777777” in the authentication information in the database DB, the user name “user name” that is the corresponding authenticated user information in the authentication information holding unit 2 "us0002" and the password "ps0007" before the change are deleted.

In the embodiment described above, when the authentication information in the database DB is changed, the authentication server ATS notifies the network access server NAS of the changed user name by the authentication information change notifying means. And the network access server NAS receiving this
Deletes the notified user information from the retained authenticated user information by the user information deleting means 4, and, based on the authentication information change notification from the authentication server ATS, transmits the changed user change information to the network. Notifying the access server NAS, the network access server NAS receiving this may update the specified user information of the held authenticated user authentication information to the content notified by the authentication information change notification. Good. In such an embodiment, in FIG. 8, the user name “us0002” and the password “p
“s0007” is not deleted, and the password is changed to “777777”.

In the above embodiment, the conditions for holding the authenticated user information in the network access server NAS are not limited. However, the condition of the memory of the network access server NAS, the influence on the processing speed, and the like are taken into consideration. If the information is retained for a certain period of time and the authentication request is not received within that period, the authenticated user information is discarded, or if a certain number of information is retained, before the subsequent authenticated user information is retained An example is also conceivable in which the oldest authenticated user information is discarded in order to avoid a decrease in processing capacity.

[0034]

According to the present invention, when the terminal transmits an authentication request to the network access server, the user held in the authenticated user information in the network access server is authenticated in the network access server. Therefore, it is not necessary to transmit the authentication request to the authentication server, and the load on the authentication server is reduced. Also, traffic between the network access server and the authentication server is reduced.

Since the load on the authentication server is reduced, there is no need to install many authentication servers in the system.
Furthermore, since the terminal does not need to be aware of whether or not the user has been authenticated once, the system configuration is simplified, database management is simplified, and operation costs are reduced.

[Brief description of the drawings]

FIG. 1 is a block diagram showing an embodiment of the present invention.

FIG. 2 is a flowchart of the embodiment shown in FIG. 1;

FIG. 3 is a detailed flowchart of authentication in the NAS in S2 of FIG. 2;

FIG. 4 is a diagram showing a specific example when the result of intra-NAS authentication in S2 in FIG. 2 is “authentication”;

FIG. 5 is a diagram showing a specific example in a case where the result of intra-NAS authentication in S2 of FIG. 2 is “authentication rejection”;

FIG. 6 is a diagram showing a specific example in a case where the result of intra-NAS authentication in S2 of FIG. 2 is “no user name”;

FIG. 7 is a diagram showing a state when an authentication request is transmitted in S5 of FIG. 2;

FIG. 8 is a diagram showing a state in which authentication information in the database of FIG. 1 has been changed;

FIG. 9 is a block diagram showing a first conventional example.

FIG. 10 is a block diagram showing a second conventional example.

FIG. 11 is a block diagram showing a known technique related to the present invention.

[Explanation of symbols]

 ATS, ATS1, 10 Authentication server NAS, NAS1 Network access server NET Public network TE terminal DB database 1 Authentication information change notification unit 2 Authentication information holding unit 3 NAS authentication unit 4 User information deletion unit 20 Base station management server 30-11, 30-12, 30-1N Base station 40 Wireless terminal 50 Proxy authentication device

Claims (9)

[Claims] A user authentication apparatus for authenticating a user when a terminal connected to a public line network accesses another network connected via a router, wherein authenticated user authentication information is stored in the router. A user authentication device, wherein the user is authenticated using the authenticated user authentication information. 2. A database for storing authentication information of a user who uses a terminal under the router, an authentication server for accessing the database and authenticating the user,
An authentication information holding unit for holding the authenticated user authentication information, and a network access server functioning as the router including an authentication unit in a NAS for performing authentication of the user by using the held user authentication information, 2. The user authentication apparatus according to claim 1, wherein the authentication of the user by the authentication server is performed only when the authenticated user authentication information corresponding to the authentication information holding unit is not held. 3. The authentication server has authentication information change notification means for notifying that user authentication information stored in a database has been changed, and the network access server holds the held information upon receiving the notification. 3. The user authentication apparatus according to claim 2, further comprising a user information deletion unit that deletes a corresponding one of the authenticated user authentication information to be executed. 4. The apparatus according to claim 3, further comprising a user information changing unit for changing a corresponding one of the held user authentication information upon receipt of said notification, in place of said user information deleting unit. User authentication device. 5. The user authentication according to claim 2, wherein said authentication information holding means discards authenticated user authentication information for which no authentication request has been received within a predetermined period. apparatus. 6. The authentication information holding means according to claim 2, wherein when the number of stored authenticated user authentication information reaches a predetermined number, the authentication information holding means discards any further authenticated user authentication information. A user authentication device according to any one of the above. 7. The user authentication apparatus according to claim 6, wherein the discarding is performed in the order of retention. 8. A user authentication method for authenticating a user from a terminal connected to a public line network when accessing another network connected via a router, wherein a user who uses a terminal under the router is authenticated. A step of storing authentication information in a database, a step of accessing the database to authenticate a user, a step of storing authenticated user authentication information in the router, and a step of storing the authenticated user authentication information in the router. A user authentication method, comprising: performing a procedure using authenticated user authentication information; and performing a user authentication by accessing the database only when there is no corresponding stored user authentication information. 9. The method according to claim 8, further comprising the step of deleting or changing a corresponding one of the stored authenticated user authentication information when the user authentication information stored in the database is changed. User authentication method.