JP4809916B2 - Authentication system, method, and program - Google Patents

Description

  The present invention relates to a network communication technique, and more particularly to an authentication technique for authenticating a user when providing a communication service.

  With the shift to IT for office work and the spread of IP networks, data communication is performed by connecting office systems distributed at a plurality of bases via an IP network. At this time, a service for constructing a virtual private network (VPN) on a public IP network is widely used for cost reduction.

  In order to connect to the VPN, it is necessary to perform user authentication by transmitting and receiving an authentication request message including attribute information including user information and the like from the authentication requesting device to the authentication device. With the widespread use of VPN services, a plurality of types of authentication requesting devices having different device scales / functions / prices have been released from a plurality of companies. Also, multiple types of access lines with different line speed / quality / price are sold. In order to construct a VPN according to the usage form, there are increasing cases of constructing a VPN by combining these plural types of authentication requesting devices and access lines.

The authentication packet transmitted from the authentication requesting device to the authentication device includes attribute information indicating the request content. Even if the attribute information indicates the same information depending on the type of the authentication requesting device or the access line type, the description format (format) of the attribute information may be different, so the authentication device performs processing corresponding to the difference between them. There is a need.
Based on the above situation, there is a need for an authentication device that can cope with differences in the description format of information that differs depending on the authentication requesting device type and the access line type.

The Steel-Belted RADIUS system (see Non-Patent Document 1, etc.), which is one of the conventional authentication devices, performs authentication based on setting values or database values in realm units or authentication system units when receiving and transmitting authentication request packets. It has an Attribute filter function that allows editing of packet attribute information.
With these functions, it is possible to add authentication processing logic corresponding to the difference in attribute information, and to convert the value of attribute information into a predetermined description format.

Steel-Belted Radius Carrier Administration and Configuration Guide Release 7.2, http://www.juniper.net/techpubs/software/aaa_802/sbrc/sbrc72/bookpdfs/sw-sbrc-admin.pdf

  However, in such a conventional technique, since the editing of attribute information is performed based on a preset value or database value in realm units or authentication system units, it is based on the attribute information value of the received authentication request packet. Editing content cannot be changed. For this reason, different types of authentication request devices and access line types are accommodated in the same realm, and there is a problem that the method cannot be applied to an environment in which the attribute information editing method differs for each authentication request packet.

  Since attribute information can be edited by the Attribute filter function only at the time of packet reception and transmission, conversion of attribute information necessary for authentication processing must be performed collectively at the time of packet reception. For this reason, authentication packets that do not necessarily require conversion processing are also subject to processing, and in an environment where a large number of authentication request packets that do not require conversion processing are received, unnecessary processing load may increase.

  The present invention is intended to solve such problems, and it is also possible to provide an environment in which different types of authentication request devices and access lines are accommodated without depending on a realm and without generating unnecessary processing burden. The object is to provide an authentication technique that can be handled by one authentication system.

  In order to achieve such an object, an authentication system according to the present invention performs an authentication process for a user terminal in response to an authentication request packet from an authentication request apparatus connected to the user terminal via an access line. A packet processing unit that extracts one or more attribute information necessary for authentication processing from the authentication request packet, and a device type of the authentication requesting device and / or a line type of the access line is determined based on the attribute information. Based on the type determination result, an attribute conversion unit that converts attribute information consisting of individual individual description formats for each device type and / or line type into a specific unified description format, and is converted into a unified description format And an authentication processing unit that performs an authentication process on the user terminal based on the attribute information.

  At this time, the type determination unit refers to the device type determination rule consisting of the combination of the transmission source information of the authentication requesting device and the type of the authentication requesting device, and the packet processing unit extracts the authentication requesting device extracted as attribute information. The device type paired with the transmission source information may be acquired as the device type of the authentication requesting device.

  Further, the type determination unit refers to a line type determination rule consisting of a set of a value type related to the determination target attribute information to be determined from the attribute information extracted by the packet processing unit and the line type of the access line, and packet The line type paired with the value type of the determination target attribute information extracted as attribute information by the processing unit may be acquired as the line type of the authentication requesting apparatus.

  In addition, the attribute conversion unit determines the type by referring to a conversion rule consisting of a combination of the device type of the authentication requesting device and / or the line type of the access line, the conversion target attribute information to be converted and its conversion formula. Obtains the conversion target attribute information and conversion formula that form a pair with the device type and / or line type obtained in the packet, and converts the value of the conversion target attribute information extracted by the packet processing unit into a unified description format based on the conversion formula You may make it convert.

  Further, the attribute conversion unit reversely converts the attribute information indicating the authentication processing result into the individual description format based on the type determination result, and the packet processing unit creates an authentication response packet including the reversely converted attribute information. Alternatively, it may be transmitted to the authentication requesting device.

  Also, the attribute conversion unit refers to a reverse conversion rule consisting of a combination of the device type of the authentication requesting device and / or the line type of the access line, the reverse conversion target attribute information, the value type, and the attribute value to be reverse converted. Then, the reverse conversion target attribute information, value type, and attribute value corresponding to the device type and / or line type obtained by the type determination unit are acquired, and the reverse conversion target attribute of the attribute information indicating the authentication processing result The information value may be converted back into the individual description format based on the value type and the attribute value.

  In addition, the authentication processing unit determines whether or not the authentication processing can be performed on the attribute information extracted by the packet processing unit based on the device type and / or the line type obtained by the type determination unit, and the authentication processing cannot be performed. In this case, the attribute conversion unit is notified of a unified information request for requesting attribute information in the unified description format, and an individual information request for requesting attribute information in the individual description format is sent if the authentication process is possible. The attribute conversion unit notifies the attribute conversion unit. When the unified information request is notified, the attribute conversion unit converts the attribute information extracted by the packet processing unit into a unified description format and outputs it to the authentication processing unit. Is notified, the attribute information extracted by the packet processing unit may be output to the authentication processing unit in the individual description format.

  The authentication method according to the present invention is an authentication method used in an authentication system for performing authentication processing of a user terminal in response to an authentication request packet from an authentication requesting device connected to the user terminal via an access line. A packet processing step in which the packet processing unit extracts one or more attribute information necessary for the authentication processing from the authentication request packet, and a type determination unit determines the device type and / or access of the authentication requesting device based on the attribute information. The type determination step for determining the line type of the line and the attribute conversion unit convert attribute information consisting of individual individual description formats for each device type and / or line type into a specific unified description format based on the result of the type determination The attribute conversion step and the authentication processing unit perform authentication processing related to the user terminal based on the attribute information converted into the unified description format. And a processing step.

  At this time, in the type determination step, the device type determination rule consisting of a set of the transmission source information of the authentication request device and the type of the authentication request device is referred to, and the authentication request device extracted as attribute information in the packet processing step The device type paired with the transmission source information may be acquired as the device type of the authentication requesting device.

  Further, in the type determination step, refer to a line type determination rule consisting of a set of a value type related to the determination target attribute information to be determined from the attribute information extracted in the packet processing step and the line type of the access line, and packet The line type that is paired with the value type of the determination target attribute information extracted as attribute information in the processing step may be acquired as the line type of the authentication requesting apparatus.

  Also, in the attribute conversion step, type determination is performed by referring to a conversion rule consisting of a combination of the device type of the authentication requesting device or / and the line type of the access line, the conversion target attribute information to be converted and its conversion formula. Acquires conversion target attribute information and a conversion expression paired with the device type and / or line type obtained in the step, and converts the value of the conversion target attribute information extracted in the packet processing step into a unified description format based on the conversion expression You may make it convert.

  In the attribute conversion step, the attribute information indicating the authentication processing result is reversely converted into an individual description format based on the type determination result, and in the packet processing step, an authentication response packet including the reversely converted attribute information is created. Alternatively, it may be transmitted to the authentication requesting device.

  Also, in the attribute conversion step, refer to the reverse conversion rule consisting of a combination of the device type of the authentication requesting device and / or the line type of the access line, the reverse conversion target attribute information, the value type, and the attribute value to be reverse conversion target. Then, the reverse conversion target attribute information, value type, and attribute value corresponding to the device type and / or line type obtained in the type determination step are acquired, and the reverse conversion target attribute among the attribute information indicating the authentication processing result The information value may be converted back into the individual description format based on the value type and the attribute value.

  In the authentication processing step, based on the device type and / or line type obtained in the type determination step, it is determined whether authentication processing is possible for the attribute information extracted in the packet processing step. Is notified to the attribute conversion step of the attribute information requesting the attribute information in the unified description format, and if the authentication process is possible, the attribute conversion is performed on the individual information request that requests the attribute information in the individual description format. When the unified information request is notified in the attribute conversion step, the attribute information extracted in the packet processing step is converted into a unified description format and output to the authentication processing step, and the individual information request is notified In such a case, the attribute information extracted in the packet processing step may be output to the authentication processing step in the individual description format.

  The program according to the present invention is a program for causing a computer to function as each unit constituting the authentication system described above.

  According to the present invention, it is possible to cope with an environment in which different types of authentication requesting devices and access lines are accommodated without depending on a realm and without generating unnecessary processing burdens.

It is a block diagram which shows the structure of the authentication system concerning 1st Embodiment. It is an example of composition of a device classification judging rule. It is an example of a structure of a line classification determination rule. It is a structural example of a conversion rule. It is a structural example of a reverse conversion rule. It is a sequence diagram which shows operation | movement of the authentication system concerning 1st Embodiment. It is a flowchart which shows the apparatus classification determination process concerning 1st Embodiment. It is a flowchart which shows the line | wire type determination process concerning 1st Embodiment. It is explanatory drawing which shows the classification determination example. It is a flowchart which shows the attribute conversion process concerning 1st Embodiment. It is explanatory drawing which shows the example of attribute information conversion. It is a flowchart which shows the attribute reverse conversion process concerning 1st Embodiment. It is explanatory drawing which shows the example of attribute information reverse conversion. It is a sequence diagram which shows operation | movement (attribute conversion required) of the authentication system concerning 2nd Embodiment. It is a sequence diagram which shows operation | movement (attribute conversion unnecessary) of the authentication system concerning 2nd Embodiment.

Next, embodiments of the present invention will be described with reference to the drawings.
[First Embodiment]
First, an authentication system according to a first embodiment of the present invention will be described with reference to FIG. FIG. 1 is a block diagram illustrating a configuration of an authentication system according to the first embodiment.

  The authentication system 10 is composed of one or more communication processing devices such as a server device as a whole. When providing a communication service such as VPN to the user terminal 40 (41, 42, 43), the access line 30 (31 , 32, 33) has a function of performing an authentication process on the user terminal 40 in response to an authentication request packet from the authentication requesting device 20 (21, 22, 23) connected to the user terminal 40. The user terminal 40 refers to a generic name or representative of the user terminals 41, 42, 43, the access line 30 refers to a generic name or representative of the access lines 31, 32, 33, and the authentication requesting device 20 corresponds to the authentication requesting devices 21, 22, 22. 23 generic names and representatives.

  The authentication requesting device 20 includes a communication processing device such as a server device, a switch, and a router as a whole. The authentication requesting device 20 receives a communication service request from the user terminal 40 and sends an authentication request packet including various attribute information necessary for the authentication processing to the authentication system. 10 and a function of performing communication path establishment processing for providing a communication service to the user terminal 40 in accordance with an authentication processing result included in the authentication response packet received from the authentication system 10. .

  The user terminal 40 is composed of a communication terminal device such as a personal computer or a portable terminal as a whole, and is connected to the authentication requesting device 20 via the access line 30 at the start of the communication service and includes various attribute information necessary for authentication processing. It has a function of transmitting a request packet and a function of starting a communication service in response to reception of a communication service start packet from the authentication requesting device 20.

  In the connection form of FIG. 1, three authentication requesting devices 21, 22 and 23 are connected to the authentication system 10. Each of these authentication request devices 21, 22, and 23 has an individual device type according to a difference in manufacturer and model, and attribute information included in an authentication request packet transmitted to the authentication system 10 for each device type. The description format of is different. In the example of FIG. 1, it is assumed that the authentication requesting devices 21 and 22 have a device type X, and the authentication requesting device 23 has a device type Y.

Further, one user terminal 41, 42, and 43 is connected to each of the authentication requesting devices 21, 22, and 23 via individual access lines 31, 32, and 33, respectively. Each of these access lines 31, 32, and 33 has a unique line type according to a difference in line speed, communication quality, or communication cost, and an authentication request packet to be transmitted to the authentication system 10 for each line type. The description format of the attribute information included in is different. In the example of FIG. 1, it is assumed that the access lines 31 and 33 have the line type α and the access line 32 has the line type β.
The number of authentication requesting devices 20 connected to the authentication system 10 and the number of user terminals 40 connected to each authentication requesting device 20 are not limited to the example of FIG.

  In the present embodiment, the authentication system 10 determines the device type of the authentication requesting device and / or the line type of the access line based on the attribute information extracted from the authentication request packet from the authentication requesting device, and the type determination result Based on the above, the attribute information consisting of individual individual description formats for each device type and / or line type is converted into a specific unified description format, and the authentication processing related to the user terminal is performed based on the attribute information consisting of this unified description format Is to do.

  In the present invention, the device type is a value for identifying a device having the same function for processing an authentication request from a user terminal but having a different attribute information description format in the authentication request transmitted to the authentication system. Point to. The line type refers to a value that identifies a line having the same function for relaying communication between the user terminal and the authentication requesting device, but having a different description format or the like of the line identifier. The correspondence relationship between the device type or / and the line type and the individual description format may be not only one-to-one but also many-to-one.

Next, the configuration of the authentication system 10 according to the present exemplary embodiment will be described in detail with reference to FIG.
The authentication system 10 includes, as main functional units, a communication interface unit (hereinafter referred to as a communication I / F unit) 11, a packet processing unit 12, a type determination unit 13, a determination rule database (hereinafter referred to as a determination rule DB) 14, An attribute conversion unit 15, a conversion rule database (hereinafter referred to as conversion rule DB) 16, an authentication processing unit 17, a storage unit 18, and a user database (hereinafter referred to as user DB) 19 are provided, and various types are provided via an internal bus. They are connected so that they can exchange data with each other.

  The communication I / F unit 11 includes a dedicated communication circuit unit, and exchanges various packets such as an authentication request packet and an authentication response packet with the authentication request device 20 (21, 22, 23), thereby requesting an authentication request. It has a function of performing data communication with the device 20.

  The packet processing unit 12 extracts the attribute information used for authentication processing from the authentication request packet received from the authentication requesting device 20 received by the communication I / F unit 11 and the communication I / F based on the attribute information indicating the authentication processing result. A function of creating an authentication response packet to be transmitted from the F unit 11 to the authentication requesting device 20.

  The type determination unit 13 refers to the determination rule stored in the determination rule DB 14, and based on the attribute information extracted by the packet processing unit 12, the device type of the authentication requesting device 20 that has transmitted the authentication request packet, and the authentication It has a function of determining the line type of the access line 30 used by the user terminal 40 to be processed. The device type and the line type are for specifying a conversion rule used for converting attribute information. Therefore, if the conversion rule can be specified by either the device type or the line type, it is sufficient to determine the type of only one of them, and both the device type and the line type are required to specify the conversion rule. Therefore, both types may be determined.

  The determination rule DB 14 includes a storage device such as a hard disk or a semiconductor memory, and includes a device type determination rule for determining the device type of the authentication requesting device 20 that is a transmission source of the authentication request packet, and a user terminal 40 that is an authentication processing target. Has a function of storing a line type determination rule for determining the line type of the access line 30 used by the.

The device type determination rule is composed of a set of an IP address of the authentication requesting device 20, that is, a transmission source address of the authentication request packet and a device type of the authentication requesting device 20.
FIG. 2 is a configuration example of the device type determination rule. Here, in the case of the transmission source address “10.0.0.1”, the identification type of the authentication requesting device 20 is “X”, and in the case of the transmission source address “10.0.1.1”, the identification type of the authentication requesting device 20 is “X”. In the case of the transmission source address “10.0.2.1”, it is registered that the identification type of the authentication requesting device 20 is “Y”.

The line type determination rule is composed of a set of a value type relating to attribute information and a line type of the access line.
FIG. 3 is a configuration example of a line type determination rule. Here, when the value type of the attribute information A is “IPv4 address”, the line type of the access line 30 is “α”, the value type of the attribute information B is “IPv4 address”, and the value type of the attribute information C is In the case of “integer”, the line type of the access line 30 is “β”, and when the value type of the attribute information A is “IPv6 address”, it is registered that the line type of the access line 30 is “α”. Yes. Note that “-” in FIG. 3 indicates that the authentication request packet does not include the corresponding value type attribute information.

  The attribute conversion unit 15 is one of the conversion rules stored in the conversion rule DB 16 based on the type determination result in the type determination unit 13, that is, the device type of the authentication requesting device 20 and / or the line type of the access line 30. A function for identifying the conversion target attribute information to be converted and its conversion formula by referring to the conversion rule, and the value of the conversion target attribute information among the attribute information extracted by the packet processing unit 12 Based on the conversion formula, it has a function of converting from an individual individual description format for each device type and / or line type to a specific unified description format determined in advance.

In this embodiment, a case where a character string combination method is used as an attribute information conversion method will be described as an example.
The character string combining method is a method of combining character string information indicating the value type of the original attribute information with the attribute information to be converted. According to this character string combination method, since the amount of attribute information is not reduced, the attribute information converted into the unified description format includes the original attribute information as it is, so the value registered in the authentication database is not changed. The comparison can be confirmed and the authentication processing burden can be reduced.

  As a conversion method of attribute information applicable to the present embodiment, a method other than the character string combination method may be used. There is a hashing method as another conversion method. The hashing method is a method in which a hash value of attribute information to be converted is calculated using a hash function prepared in advance, and the attribute information is replaced with the hash value. According to this hashing method, the character length after conversion can be made constant, and parallelization of authentication processing becomes easy, so that the authentication processing can be speeded up.

  In addition, the attribute conversion unit 15 performs the reverse conversion rule stored in the conversion rule DB 16 based on the type determination result in the type determination unit 13, that is, the device type of the authentication requesting device 20 and / or the line type of the access line 30. A function for identifying any of the above, a function for acquiring reverse conversion target attribute information, a value type, and an attribute value to be reverse converted with reference to the reverse conversion rule, and authentication obtained by the type determination unit 13 It has a function to reversely convert reverse conversion target attribute information among the attribute information indicating the processing result into an individual description format based on the value type and the attribute value.

In this embodiment, a case where a value replacement method is used as an attribute information inverse conversion method will be described as an example.
The value replacement method is a method of replacing attribute information in a unified description format to be reversely converted with attribute information of an arbitrary value type used in the original individual description format. The conversion method for converting the attribute information in the individual description format into the attribute information in the unified description format and the conversion method for converting back the attribute information in the unified description format into the attribute information in the individual description format always use the same conversion method. There is no need. For example, even when the hashing method is used as the conversion method, another conversion method may be used as the inverse conversion method.

  The conversion rule DB 16 includes a storage device such as a hard disk or a semiconductor memory. The conversion rule DB 16 converts the attribute information in the individual description format extracted from the authentication request packet by the packet processing unit 12 into a unified description format, and the authentication processing unit 17. And a reverse conversion rule for reversely converting the attribute information in the unified description format indicating the authentication processing result obtained in step 1 into the original individual description format.

The conversion rule is composed of a set of a device type of the authentication requesting device 20 and / or a line type of the access line 31, conversion target attribute information to be converted, and a conversion formula thereof.
FIG. 4 is a configuration example of a conversion rule. Here, when the device type is “X” and the line type is “α”, a rule for converting attribute A with a conversion formula “IPv4_ [attribute information A]” is registered. This conversion expression is a conversion expression in which character string information “IPv4_” indicating the value type of the original attribute information A is combined before [attribute information A] indicating the value of the original attribute information A. .

  In addition, in the example of FIG. 4, when the device type is “X” and the line type is “β”, a rule for converting attribute information A by a conversion formula “IPv6_ [attribute information A]” and the device type are When “Y” and the line type is “α”, the values of a plurality of attribute information, attribute information B and attribute information C, are combined with character string information to “IPv4_ [attribute information B] _ [attribute information C]”. If the device type is “Y” and the line type is “β”, the rule that the attribute information is not converted, the device type is “determination impossible”, and the line type is also “determination impossible” In this case, a rule that attribute information is not converted is registered. Note that “-” in FIG. 4 indicates that the corresponding conversion target or conversion formula is not assigned to the combination of the device type and the line type.

The reverse conversion rule is composed of a set of a device type of the authentication requesting device 20 and / or a line type of the access line 31, and reverse conversion target attribute information, a value type, and an attribute value to be reverse converted.
FIG. 5 is a configuration example of the reverse conversion rule. Here, when the device type is “X” and the line type is “α”, the value “1” of the attribute information D is inversely converted to the attribute value “OK” whose value type is “character string”, and the attribute information D A rule for inversely converting the value “0” of the attribute value into the attribute value “NG” having the value type “character string” is registered.

  In addition, in the example of FIG. 5, when the device type is “X” and the line type is “β”, the rule that reversely converts the attribute information D into the attribute value “OK” having the value type “character string”; When the device type is “Y” and the line type is “α”, a rule that reversely converts the attribute information E into the attribute value “1” having the value type “integer”, the device type is “Y”, and the line type is “ If it is “β”, a rule that does not perform reverse conversion of attribute information, and a rule that does not perform reverse conversion of attribute information when the device type is “determination impossible” and the line type is also “determination impossible” are registered respectively. ing. Note that “-” in FIG. 5 indicates that the corresponding inverse conversion target, value type, and conversion formula are not assigned to a set of device type and line type.

Based on the attribute information in the unified description format obtained by the attribute conversion unit 15, the authentication processing unit 17, for example, the attribute information and the attributes of the user and user terminal 40 that are stored in the user DB 19 and are the authentication processing target. It has a function of performing authentication processing related to the user terminal 40 by comparing information and the like, and a function of outputting attribute information in a unified description format as an authentication processing result related to this authentication processing.
The storage unit 18 includes a storage device such as a hard disk or a semiconductor memory, and has a function of storing processing information and programs used in each of the above-described functional units.
The user DB 19 includes a storage device such as a hard disk or a semiconductor memory, and has a function of storing authentication data including attribute information of individual users and user terminals 40 used for authentication processing in the authentication processing unit 17. .

  Among these functional units, the packet processing unit 12, the type determination unit 13, the attribute conversion unit 15, and the authentication processing unit 17 are configured by one or a plurality of arithmetic processing units. The arithmetic processing unit includes a microprocessor such as a CPU and its peripheral circuits, and has a function of realizing various processing units by executing a program read from the storage unit 18.

[Operation of First Embodiment]
Next, the operation of the authentication system 10 according to this exemplary embodiment will be described with reference to FIG. FIG. 6 is a sequence diagram illustrating an operation of the authentication system according to the first embodiment.
Here, in response to the authentication request packet from the authentication requesting device 20, the authentication system 10 converts the attribute information of the individual description format included in the authentication request packet into the unified description format, and then the unified description format. Authentication processing is performed on the attribute information, and the attribute information in the unified description format indicating the obtained authentication processing result is converted back to the attribute information in the original individual description format, and then an authentication response packet is created to generate the authentication request device 20. The case of transmitting to will be described.

  When the packet processing unit 12 of the authentication system 10 receives an authentication request packet from the authentication requesting device 20 via the communication I / F unit 11 (step 100), various attribute information necessary for the authentication process from the authentication request packet. Is extracted (step 101), and the extracted attribute information is passed to the type determination unit 13 and the attribute conversion unit 15 (step 102). This attribute information is described in an individual description format for each device type of the authentication requesting device 20 and each line type of the access line 30.

  When processing information such as attribute information and type determination results is exchanged between the functional units, they may be directly transmitted / received between the functional units via the internal bus, or indirectly via the storage unit 18. Also good. In particular, when performing parallel processing with a plurality of authentication processing units 17, attribute information and type determination results are sequentially stored from the packet processing unit 12 and type determination unit 13 to a buffer in the storage unit 18, and the authentication processing is completed. The attribute information in the buffer and the type determination result may be acquired as appropriate from the authentication processing unit 17 that performs the processing.

The type determination unit 13 receives the attribute information from the packet processing unit 12, refers to the determination rule stored in the determination rule DB 14, and transmits an authentication request packet based on the attribute information extracted by the packet processing unit 12. The device type relating to the authentication requesting device 20 and the line type relating to the access line 30 used by the user terminal 40 to be authenticated are determined (step 103).
The type determination unit 13 determines the device type and the line type in this way, and then passes these type determination results to the attribute conversion unit 15 (step 104).

  On the other hand, the attribute conversion unit 15 receives the attribute information in the individual description format from the packet processing unit 12, receives the type determination result from the attribute conversion unit 15, and refers to the conversion rule stored in the conversion rule DB 16, Of the attribute information extracted by the packet processing unit 12, the value of the conversion target attribute information is converted from the original individual description format to the unified description format (step 110), and the attribute information in the unified description format is passed to the authentication processing unit 17 ( Step 111).

  The authentication processing unit 17 receives the attribute information in the unified description format from the attribute conversion unit 15, and based on this attribute information, the attribute information and the attributes of the user and user terminal 40 that are the authentication processing target stored in the user DB 19. Authentication processing related to the user terminal 40 is performed by comparing the information (step 112), and attribute information having a unified description format is passed to the attribute conversion unit 15 as an authentication processing result related to the authentication processing (step 113). Note that step 111 and step 113 are both attribute information in the unified description format. The attribute information in step 111 is obtained by converting the attribute information extracted from the authentication request packet by the attribute conversion unit 15. The attribute information is generated by the authentication processing unit 17.

  After receiving the attribute information in the unified description format from the authentication processing unit 17, the attribute conversion unit 15 refers to the reverse conversion rule stored in the conversion rule DB 16 and reverses the attribute information received from the authentication processing unit 17. The value of the conversion target attribute information is inversely converted from the unified description format to the original individual description format (step 114), and the attribute information in the individual description format is passed to the packet processing unit 12 (step 115).

The packet processing unit 12 creates an authentication response packet based on the attribute information in the individual description format received from the attribute conversion unit 15 (step 116), and returns it to the authentication requesting device 20 via the communication I / F unit 11. (Step 117).
As a result, the authentication requesting device 20 performs communication path establishment processing for providing a communication service to the user terminal 40 when the authentication result notified by the authentication response packet is OK, and in the case of an authentication error, the user terminal 40 An error message indicating that the communication service cannot be provided is notified.

[Type judgment operation]
Next, the type determination operation in the type determination unit 13 of the authentication system according to this exemplary embodiment will be described.
First, the device type determination operation in the type determination unit 13 will be described with reference to FIG. FIG. 7 is a flowchart illustrating apparatus type determination processing according to the first embodiment. Here, a case where the device type of the authentication requesting device 20 is determined based on the above-described device type determination rule of FIG. 2 will be described as an example.

  When receiving the attribute information in the individual description format from the packet processing unit 12, the type determining unit 13 refers to the device type determining rule stored in the determination rule DB 14 and starts the device type determining operation. Note that the device type determination process in FIG. 7 is merely an example of a processing procedure that is applied when the above-described device type determination rule in FIG. 2 is used. Processing procedures apply.

First, the type determination unit 13 confirms whether the IP address of the authentication requesting device 20, that is, the transmission source address in the attribute information in the individual description format from the packet processing unit 12 exists in any set of the device type determination rules. (Step 130).
Here, when the transmission source address exists in any pair (step 130: YES), the type determination unit 13 acquires a device type that forms a pair with the transmission source address (step 131), and a series of device types. The determination process ends.

  On the other hand, if the source address does not exist in any group (step 130: NO), the type determination unit 13 determines that the device type determination is impossible, and executes an abnormal process such as discarding the authentication request packet ( Step 132), a series of device type determination processing is terminated.

  Next, the line type determination operation in the type determination unit 13 will be described with reference to FIG. FIG. 8 is a flowchart illustrating the line type determination process according to the first embodiment. Here, a case where the line type of the access line 30 is determined based on the above-described line type determination rule of FIG. 3 will be described as an example.

  When the type determination unit 13 receives the attribute information in the individual description format from the packet processing unit 12, the type determination unit 13 refers to the line type determination rule stored in the determination rule DB 14 and starts the line type determination operation. When the above-described line type determination rule of FIG. 3 is used, the line type determination process of FIG. 8 is executed. Note that the line type determination process of FIG. 8 is merely an example of a processing procedure applied when the above-described line type determination rule of FIG. 3 is used, and when other line type determination rules are used, Processing procedures apply.

  First, the type determination unit 13 confirms whether or not the attribute information A exists in the attribute information in the individual description format received from the packet processing unit 12 (step 140). In the packet processing unit 12, when the attribute information A is not included in the authentication request packet or when the attribute information A having a valid value cannot be extracted, the attribute information A is not output as the attribute information.

  When the attribute information A exists in the received attribute information (step 140: YES), it is confirmed whether the value type of the received attribute information A is an IPv4 address or an IPv6 address (step 141). Each value type may be confirmed based on a numerical range, characters / symbols that can be taken by each value type, and features such as the digit position and the number of digits.

Here, when the value type of the attribute information A is an IPv4 address or an IPv6 address (step 141: YES), the type determination unit 13 determines the line type of the access line 30 as “α” (step 142), The line type determination process is terminated.
On the other hand, when the value type of the attribute information A is other than the IPv4 address or the IPv6 address (step 141: NO), the type determining unit 13 determines that the line type cannot be determined and executes an abnormal process such as discarding the authentication request packet. (Step 146), the series of line type determination processing is terminated.

In step 140, when the attribute information A does not exist in the attribute information in the individual description format received from the packet processing unit 12 (step 140: NO), the type determination unit 13 sets the value type to the received attribute information. It is confirmed whether or not the attribute information B of the IPv4 address exists (step 143).
Here, when the attribute information B whose value type is IPv4 address exists (step 143: YES), the type determination unit 13 confirms whether or not the attribute information C whose value type is an integer format exists in the received attribute information. (Step 144).

Here, when the attribute information C whose value type is an integer format exists (step 144: YES), the type determination unit 13 determines the line type of the access line 30 as “β” (step 145), and a series of lines The type determination process ends.
On the other hand, when the attribute information B whose value type is IPv4 address does not exist in the received attribute information (step 143: NO), and when attribute information C whose value type is an integer format does not exist (step 144: NO), The determination unit 13 determines that the line type cannot be determined (step 146), and ends the series of line type determination processes.

FIG. 9 is an explanatory diagram illustrating a type determination example. Here, the type determination result based on the apparatus type determination process of FIG. 7 and the line type determination process of FIG. 8 described above is shown.
For example, when the transmission source address is “10.0.0.1” and the attribute information A is “10.0.0.2”, that is, the value type is “IPv4 address”, it is determined that the device type is “X” and the line type is “α”. . Further, the source address is “10.0.1.1”, the attribute information A does not exist, the attribute information B is “10.0.1.2”, that is, the value type is “IPv4 address”, and the attribute information C is “12345678”, that is, the value type. Is an integer, it is determined that the device type is “X” and the line type is “β”. Further, when the transmission source address is “10.0.2.1” and the attribute information A is “2001 :: 1”, that is, the value type is “IPv6 address”, it is determined that the device type is “Y” and the line type is “α”. The Note that “-” in FIG. 9 indicates that the authentication request packet does not include the corresponding value type attribute information.

[Attribute conversion operation]
Next, an attribute conversion operation in the type determination unit 13 of the authentication system according to this exemplary embodiment will be described.
First, the attribute conversion operation in the attribute conversion unit 15 will be described with reference to FIG. FIG. 10 is a flowchart illustrating attribute conversion processing according to the first embodiment. Here, a case will be described as an example where the attribute information received from the packet processing unit 12 is converted from the individual description format to the unified description format based on the conversion rule of FIG. 4 described above.

  When the attribute conversion unit 15 receives the type determination result from the type determination unit 13, the attribute conversion unit 15 refers to the conversion rule stored in the conversion rule DB 16 and starts the attribute conversion operation. Note that the attribute conversion process of FIG. 10 is merely an example of a process procedure applied when using the conversion rule of FIG. 4 described above, and other process procedures are applied when using other conversion rules. The

First, the attribute conversion unit 15 checks whether the device type and the line type of the type determination result received from the type determination unit 13 exist in the conversion rule (step 150).
When the device type and the line type exist in any one of the conversion rules (step 150: YES), the attribute conversion unit 15 designates the conversion target in the conversion rule that includes the device type and the line type. (Step 151).

Here, when the conversion target exists in the conversion rule that includes the device type and the line type (step 151: YES), the attribute conversion unit 15 determines the conversion target based on the conversion formula of the set. The attribute information is converted from the individual description format to the unified description format (step 152), and the series of attribute conversion processing ends.
On the other hand, when the device type and the line type do not exist in any one of the conversion rules (step 150: NO), the conversion target does not exist in the combination of the conversion rule in which the device type and the line type exist. In the case (step 151: NO), the attribute conversion unit 15 determines that the attribute information cannot be converted, executes an abnormal process such as discarding the authentication request packet (step 153), and then ends the series of attribute conversion processes.

FIG. 11 is an explanatory diagram illustrating an example of attribute information conversion. Here, an attribute conversion result based on the attribute conversion process of FIG. 10 described above is shown.
For example, in the case of entry 1 in FIG. 9 in which the device type is determined to be “X” and the line type is determined to be “α”, the attribute information A becomes the conversion target, and the attribute information A value “10.0.0.2” of the original individual description format Is converted to the unified description format “IPv4 — 1.0.0.0.2”. In the case of entry 2 in FIG. 9 in which the device type is “X” and the line type is “β”, the attribute information A is the conversion target, and the attribute information A value “2001 :: 1” of the original individual description format is used. Is converted to “IPv6 — 2001 :: 1” in the unified description format. In the case of entry 3 in FIG. 9 in which the device type is determined to be “Y” and the line type is determined to be “α”, the attribute information B and C are to be converted, and the attribute information B value “10.0. 0.2 ”and the attribute information C value“ 12345678 ”are converted into“ IPv4 — 1.0.0.0.2 — 12345678 ”in the unified description format.

  Next, the attribute reverse conversion operation in the attribute conversion unit 15 will be described with reference to FIG. FIG. 12 is a flowchart illustrating attribute reverse conversion processing according to the first embodiment. Here, a case will be described as an example in which attribute information related to the authentication processing result received from the authentication processing unit 17 is reversely converted from the unified description format to the individual description format based on the reverse conversion rule of FIG. 5 described above.

  When the attribute conversion unit 15 receives the attribute information regarding the authentication processing result from the authentication processing unit 17, the attribute conversion unit 15 refers to the reverse conversion rule stored in the conversion rule DB 16 and starts the attribute reverse conversion operation. Note that the attribute reverse conversion process of FIG. 12 is merely an example of a process procedure applied when using the reverse conversion rule of FIG. 5 described above, and when using another reverse conversion rule, other process procedures are performed. Applies.

First, the attribute conversion unit 15 confirms whether the device type and the line type of the type determination result corresponding to the attribute information received from the authentication processing unit 17 exist in the reverse conversion rule (step 160).
When the device type and the line type exist in any one of the reverse conversion rules (step 160: YES), the attribute conversion unit 15 performs reverse conversion to a set in which the device type and the line type exist among the reverse conversion rules. It is confirmed whether the target designation exists (step 161).

Here, when the reverse conversion target is specified in the combination of the device type and the line type in the reverse conversion rule (step 161: YES), the attribute conversion unit 15 unifies the attribute information to be the reverse conversion target. The description format is inversely converted to the attribute value of the individual description format composed of the value type of the set (step 162), and the series of attribute conversion processing ends.
On the other hand, when the device type and the line type do not exist in any of the reverse conversion rules (step 160: NO), the conversion target is specified in the reverse conversion rule in which the device type and the line type exist. If it does not exist (step 161: NO), the attribute conversion unit 15 determines that the attribute information reverse conversion is impossible and executes an abnormal process such as discarding the authentication request packet (step 163), and then performs a series of attribute conversion processes. finish.

FIG. 13 is an explanatory diagram illustrating an example of reverse conversion of attribute information. Here, an attribute reverse conversion result based on the attribute reverse conversion process of FIG. 12 described above is shown.
For example, in the case of entry 1 in FIG. 9 in which the device type is “X” and the line type is determined to be “α”, the attribute information D is subject to reverse conversion, and the attribute information D value in the unified description format is “1”. Is converted to “OK” in the individual description format consisting of character strings, and when the attribute information D value in the unified description format is “0”, the value type is changed to “NG” in the individual description format consisting of character strings. Converted. The same applies to the case of entry 2 in FIG. 9 where the device type is “X” and the line type is determined to be “β”. In addition, in the case of entry 3 in FIG. 9 in which the device type is determined to be “Y” and the line type is “α”, the attribute information E is to be converted, and the new attribute information E in the individual description format whose value type is a numerical value “1” is added.

[Effect of the first embodiment]
As described above, according to the present embodiment, the type determination unit 13 determines the device type of the authentication requesting device 20 and / or the line type of the access line 30 based on the attribute information extracted from the authentication request packet from the authentication requesting device 20. Based on the type determination result, the attribute conversion unit 15 converts attribute information composed of individual individual description formats for each device type and / or line type into a specific unified description format. The authentication processing unit 17 performs authentication processing on the user terminal 40 based on the attribute information consisting of

  Therefore, even in an environment where different types of authentication requesting devices 20 and access lines 30 are accommodated without depending on the realm, the authentication processing unit performs authentication processing in one authentication system and further in one type of unified description format. Yes. For this reason, even when different types of authentication requesting devices 20 and access lines 30 are added to the realm, it is not necessary to add authentication processing units 17 corresponding to these, and facilities can be used flexibly and efficiently. .

  In addition, since it is possible to determine whether or not the attribute information extracted from the authentication request packet needs to be converted to a unified description format according to the device type and / or line type, authentication packets that do not require conversion processing are not subject to conversion processing. As compared with the case where all the authentication request packets are converted, the generation of unnecessary processing burden can be suppressed. For this reason, in an environment where a large number of authentication request packets that do not require conversion processing are received, the processing load required for the conversion processing can be greatly reduced.

  In the present embodiment, the type determination unit 13 refers to a device type determination rule including a set of the IP address of the authentication requesting device 20 and the device type of the authentication requesting device 20, and the packet processing unit 12 performs attribute information. Since the device type paired with the IP address of the authentication requesting device 20 extracted as is acquired as the device type of the authentication requesting device 20, the device type of the authentication requesting device 20 can be accurately obtained by extremely simple processing. Can be determined.

  Further, in the present embodiment, a line made up of a set of a value type relating to determination target attribute information to be determined among the attribute information extracted by the packet processing unit 12 by the type determination unit 13 and the line type of the access line. By referring to the type determination rule and acquiring the line type paired with the value type of the determination target attribute information extracted as attribute information by the packet processing unit 12 as the line type of the authentication requesting apparatus 20, it is extremely simple. The device type of the authentication requesting device 20 can be determined with high accuracy.

  In the present embodiment, the attribute conversion unit 15 includes a set of the device type of the authentication requesting device 20 and / or the line type of the access line 30, the conversion target attribute information to be converted and its conversion formula. The value of the conversion target attribute information extracted by the packet processing unit 12 by acquiring the conversion target attribute information and the conversion formula paired with the device type or / and the line type obtained by the type determination unit 13 with reference to the conversion rule Is converted to a unified description format based on the conversion formula, so that any attribute information can be converted to a unified description format for each device type and / or line type without requiring complicated processing. Can do.

  In the present embodiment, the attribute conversion unit 15 reversely converts the attribute information indicating the authentication processing result into the individual description format based on the type determination result in the type determination unit 13, and the packet processing unit 12 performs the reverse conversion. Since the authentication response packet including the converted attribute information is created and transmitted to the authentication requesting device 20, it is not dependent on the realm, and in an environment in which different types of authentication requesting devices 20 and access lines 30 are accommodated. Even in this case, attribute information in the individual description format corresponding to the device type and / or the line type can be returned to the authentication requesting device 20 as an authentication response packet.

  Further, in the present embodiment, the attribute conversion unit 15 causes the device type of the authentication requesting device 20 and / or the line type of the access line 30, the reverse conversion target attribute information, the value type, and the attribute value to be reverse converted. Referring to the reverse conversion rule consisting of the group, the reverse conversion target attribute information, value type, and attribute value corresponding to the device type and / or line type obtained by the type determination unit 13 are acquired, and the authentication processing result is obtained. Since the value of the reverse conversion target attribute information among the attribute information shown is reversely converted into the individual description format based on the value type and the attribute value, the device type or / and / or without complicated processing is required. The attribute information indicating the authentication processing result can be converted into the original individual description format for each line type.

[Second Embodiment]
Next, an authentication system according to the second embodiment of the present invention will be described.
In the first embodiment, the attribute conversion unit 15 converts the attribute information extracted from the authentication request packet from the individual description format to the unified description format according to the device type and / or the line type determined by the type determination unit 13. The case where the authentication processing unit 17 performs authentication processing based on the attribute information having the unified description format after conversion has been described as an example. This is based on the premise that one or a plurality of authentication processing units 17 that perform authentication processing based on attribute information in a unified description format are provided.

On the other hand, a plurality of authentication processing units 17 having different description formats of attribute information that can be authenticated may be used. For example, an authentication system that combines an authentication processing unit 17 that performs authentication processing only on attribute information in a unified description format, or an authentication processing unit 17 that performs authentication processing on attribute information in a specific individual description format and a unified description format. May be configured.
In the present embodiment, a case will be described in which authentication processing units 17 having different description formats capable of authentication processing are used in combination.

  In the present embodiment, the authentication processing unit 17 determines, based on the device type and / or line type determined by the type determining unit 13, whether authentication processing is possible for the attribute information in the individual description format corresponding to these types. When the authentication process is impossible for the function and the individual format, the function for notifying the attribute conversion unit 15 of a unified information request for requesting attribute information in the unified description format, and the authentication process for the individual format are performed. If possible, it has a function of notifying the attribute conversion unit 15 of an individual information request for requesting attribute information in the individual description format.

In addition, the attribute conversion unit 15 converts the attribute information extracted by the packet processing unit 12 into a unified description format in response to a unified information request from the authentication processing unit 17 and passes the attribute information to the authentication processing unit 17; In response to an individual information request from the unit 17, the attribute information extracted by the packet processing unit 12 is passed to the authentication processing unit 17 in the individual description format.
Other configurations in the authentication system 10 are the same as those in the first embodiment, and a detailed description thereof is omitted here.

[Operation of Second Embodiment]
Next, the operation of the authentication system according to the present embodiment will be described with reference to FIGS. FIG. 14 is a sequence diagram showing the operation (attribute conversion required) of the authentication system according to the second embodiment, and the same or equivalent parts as in FIG. 6 are denoted by the same reference numerals. FIG. 15 is a sequence diagram showing the operation (attribute conversion unnecessary) of the authentication system according to the second embodiment, and the same or equivalent parts as those in FIG. 6 are denoted by the same reference numerals.

  Here, in response to the authentication request packet from the authentication requesting device 20, the authentication system 10 converts the attribute information included in the authentication request packet into a unified description format for authentication processing, and the individual description format A case where authentication processing is performed as it is will be described.

  As shown in FIG. 14, when the packet processing unit 12 of the authentication system 10 receives an authentication request packet from the authentication requesting device 20 via the communication I / F unit 11 (step 100), authentication is performed from the authentication request packet. Various attribute information necessary for processing is extracted (step 101), and the extracted attribute information is passed to the type determination unit 13 and the attribute conversion unit 15 (step 102). This attribute information is described in an individual description format for each device type of the authentication requesting device 20 and each line type of the access line 30.

  When processing information such as attribute information and type determination results is exchanged between the functional units, they may be directly transmitted / received between the functional units via the internal bus, or indirectly via the storage unit 18. Also good. In particular, when performing parallel processing with a plurality of authentication processing units 17, attribute information and type determination results are sequentially stored from the packet processing unit 12 and type determination unit 13 to a buffer in the storage unit 18, and the authentication processing is completed. The attribute information in the buffer and the type determination result may be acquired as appropriate from the authentication processing unit 17 that performs the processing.

The type determination unit 13 receives the attribute information from the packet processing unit 12, refers to the determination rule stored in the determination rule DB 14, and transmits an authentication request packet based on the attribute information extracted by the packet processing unit 12. The device type relating to the authentication requesting device 20 and the line type relating to the access line 30 used by the user terminal 40 to be authenticated are determined (step 103).
After determining the device type and the line type in this way, the type determination unit 13 passes these type determination results to the attribute conversion unit 15 and the authentication processing unit 17 (step 104).

  The authentication processing unit 17 receives the type determination result from the type determination unit 13, and based on the device type or / and the line type of the type determination result, whether or not the authentication processing is possible for the attribute information in the individual description format corresponding to these types (Step 105). At this time, for example, the authentication processing unit 17 presets, as authentication processing determination information, the device type and / or the line type from which attribute information in a description format that can be authenticated by the authentication processing unit 17 is obtained. The authentication process determination information may be referred to determine whether or not the authentication process for the determination information from the type determination unit 13 is acceptable.

If it is determined that authentication processing is impossible, the authentication processing unit 17 notifies the attribute conversion unit 15 of a unified information request for requesting attribute information in the unified description format (step 106).
The attribute conversion unit 15 refers to the conversion rule stored in the conversion rule DB 16 in response to the unified information request from the authentication processing unit 17, and converts the conversion target attribute information from the attribute information extracted by the packet processing unit 12. The value is converted from the original individual description format to the unified description format (step 110), and the attribute information in the unified description format is passed to the authentication processing unit 17 (step 111).
Thereafter, in the authentication system 10, the processing after step 112 in FIG. 6 described above is executed.

On the other hand, as shown in FIG. 15, when it is determined in step 105 that authentication processing is possible, the authentication processing unit 17 sends an individual information request for requesting attribute information in the individual description format to the attribute conversion unit 15. Notification is made (step 107).
In response to the individual information request from the authentication processing unit 17, the attribute conversion unit 15 passes the attribute information extracted by the packet processing unit 12 to the authentication processing unit 17 in the original individual description format (step 120).

The authentication processing unit 17 receives the attribute information in the individual description format from the attribute conversion unit 15, performs the authentication process for the user terminal 40 (step 121), and obtains the attribute information in the individual description format as the authentication processing result for the authentication process. It passes to the attribute conversion part 15 (step 122).
The attribute conversion unit 15 receives the attribute information in the individual description format from the authentication processing unit 17 and passes the attribute information in the individual description format to the packet processing unit 12 without performing the reverse conversion process (step 123).

The packet processing unit 12 creates an authentication response packet based on the attribute information in the individual description format received from the attribute conversion unit 15 (step 124), and returns it to the authentication requesting device 20 via the communication I / F unit 11. (Step 125).
As a result, the authentication requesting device 20 performs communication path establishment processing for providing a communication service to the user terminal 40 when the authentication result notified by the authentication response packet is OK, and in the case of an authentication error, the user terminal 40 An error message indicating that the communication service cannot be provided is notified.

[Effect of the second embodiment]
As described above, in this embodiment, whether or not the authentication processing unit 17 can perform authentication processing on the attribute information extracted by the packet processing unit based on the device type and / or the line type obtained by the type determination unit. If the authentication process is impossible, a unified information request for requesting attribute information in the unified description format is notified to the attribute conversion unit 15. If the authentication process is possible, the individual description format is used. An individual information request for requesting attribute information is sent to the attribute conversion unit 15, and when the unified information request is notified by the attribute conversion unit 15, the attribute information extracted by the packet processing unit 12 is converted into a unified description format. When converted and output to the authentication processing unit 17 and an individual information request is notified, the attribute information extracted by the packet processing unit 12 is output to the authentication processing unit 17 in the individual description format.
As a result, when the individual description format of the attribute information included in the authentication request packet can be authenticated by the authentication processing unit 17, the attribute conversion processing by the attribute conversion unit 15 can be omitted.

[Extended embodiment]
The present invention has been described above with reference to the embodiments, but the present invention is not limited to the above embodiments. Various changes that can be understood by those skilled in the art can be made to the configuration and details of the present invention within the scope of the present invention.

  In each embodiment, the case where various functional units are mounted in one information device constituting the authentication system 10 has been described as an example. However, these functional units are distributed to a plurality of information processing devices such as server devices. May be implemented. In such a system configuration, various processing devices may be exchanged by performing data communication between these information processing devices via a communication network. These functional units may be provided with a plurality of the same functional units in parallel according to the system configuration.

  In each embodiment, three authentication requesting devices 21, 22, 23 are connected to the authentication system 10, and one user terminal 41, 42, one for each of these authentication requesting devices 21, 22, 23, respectively. Although the case where 43 is connected was demonstrated as an example, it is not limited to this. What is necessary is just to change suitably about the number of the authentication request | requirement apparatuses 20 connected with respect to the authentication system 10, and the number of the user terminals 40 connected with respect to each authentication request | requirement apparatus 20 according to each realm.

  In each embodiment, the authentication process performed when providing a communication service such as VPN has been described as an example. However, the present invention can be similarly applied to a communication service other than VPN, and further to an authentication process other than the communication service. Applicable.

  DESCRIPTION OF SYMBOLS 10 ... Authentication system, 11 ... Communication I / F part, 12 ... Packet processing part, 13 ... Type determination part, 14 ... Determination rule DB, 15 ... Attribute conversion part, 16 ... Conversion rule DB, 17 ... Authentication processing part, 18 ... storage unit, 19 ... user DB, 20, 21, 22, 23 ... authentication request unit, 30, 31, 32, 33 ... access line, 40, 41, 42, 43 ... user terminal.

Claims (15)

In accordance with an authentication request packet from an authentication request device connected to a user terminal via an access line, an authentication system that performs authentication processing of the user terminal,
A packet processing unit that extracts one or more pieces of attribute information necessary for the authentication processing from the authentication request packet;
A type determination unit that determines a device type of the authentication requesting device or / and a line type of the access line based on the attribute information;
Based on the type determination result, an attribute conversion unit that converts the attribute information consisting of individual individual description formats for each of the device types and / or the line types into a specific unified description format;
An authentication system comprising: an authentication processing unit that performs an authentication process on the user terminal based on the attribute information converted into the unified description format. The authentication system according to claim 1,
The type determination unit refers to a device type determination rule including a set of transmission source information of the authentication request device and a device type of the authentication request device, and the authentication request device extracted as the attribute information by the packet processing unit An authentication system characterized in that the device type paired with the transmission source information is acquired as the device type of the authentication requesting device. The authentication system according to claim 1 or 2,
The type determination unit refers to a line type determination rule including a set of a value type related to determination target attribute information to be determined among the attribute information extracted by the packet processing unit and a line type of the access line, and An authentication system characterized in that a line type paired with a value type of the determination target attribute information extracted as the attribute information by a packet processing unit is acquired as a line type of the authentication requesting apparatus. The authentication system according to any one of claims 1 to 3,
The attribute conversion unit refers to a conversion rule composed of a set of a device type of the authentication requesting device or / and a line type of the access line, conversion target attribute information to be converted, and a conversion formula thereof, Acquires conversion target attribute information and a conversion formula paired with the device type and / or the line type obtained by the type determination unit, and converts the value of the conversion target attribute information extracted by the packet processing unit into the conversion formula An authentication system characterized in that the system is converted into the unified description format. An authentication system according to any one of claims 1 to 4, wherein
The attribute conversion unit reversely converts the attribute information indicating the authentication processing result into the individual description format based on the type determination result,
The packet processing unit creates an authentication response packet including the inversely converted attribute information, and transmits the authentication response packet to the authentication requesting device. The authentication system according to claim 5,
The attribute conversion unit includes a reverse conversion rule composed of a set of a device type of the authentication requesting device or / and a line type of the access line, reverse conversion target attribute information to be reverse conversion, a value type, and an attribute value. Referring to the attribute information indicating the authentication processing result by acquiring the reverse conversion target attribute information, the value type, and the attribute value corresponding to the device type or / and the line type obtained by the type determination unit. An authentication system, wherein the value of the reverse conversion target attribute information is reversely converted into the individual description format based on the value type and the attribute value. The authentication system according to any one of claims 1 to 6,
The authentication processing unit determines whether the authentication process is possible for the attribute information extracted by the packet processing unit based on the device type or / and the line type obtained by the type determination unit, When the authentication process is impossible, the attribute conversion unit is notified of a unified information request for requesting attribute information having the unified description format. When the authentication process is possible, the attribute having the individual description format is sent. Notifying the attribute conversion unit of an individual information request for requesting information,
When the unified information request is notified, the attribute conversion unit converts the attribute information extracted by the packet processing unit into the unified description format and outputs the unified description format to the authentication processing unit, and the individual information request is notified. If so, the attribute information extracted by the packet processing unit is output to the authentication processing unit in the individual description format. In accordance with an authentication request packet from an authentication request device connected to a user terminal via an access line, an authentication method used in an authentication system that performs authentication processing of the user terminal,
A packet processing step in which a packet processing unit extracts one or more pieces of attribute information necessary for the authentication processing from the authentication request packet;
A type determining step for determining a device type of the authentication requesting device or / and a line type of the access line based on the attribute information;
An attribute conversion step for converting, based on the type determination result, the attribute information composed of individual individual description formats for each of the device types and / or the line types into a specific unified description format;
An authentication method comprising: an authentication processing step in which an authentication processing unit performs an authentication process on the user terminal based on the attribute information converted into the unified description format. The authentication method according to claim 8, comprising:
The authentication requesting device extracted in the packet processing step as the attribute information with reference to a device type determination rule consisting of a set of source information of the authentication requesting device and a device type of the authentication requesting device An authentication method comprising: acquiring a device type paired with the transmission source information as the device type of the authentication requesting device. The authentication method according to claim 8 or 9, wherein:
The type determination step refers to a line type determination rule consisting of a set of a value type related to determination target attribute information to be determined among the attribute information extracted in the packet processing step and a line type of the access line, An authentication method, comprising: acquiring a line type paired with a value type of the determination target attribute information extracted as the attribute information in the packet processing step as a line type of the authentication requesting apparatus. An authentication method according to any one of claims 8 to 10, comprising:
The attribute conversion step refers to a conversion rule comprising a set of a device type of the authentication requesting device or / and a line type of the access line, conversion target attribute information to be converted, and a conversion formula thereof, Obtaining the conversion target attribute information and the conversion formula paired with the device type or / and the line type obtained in the type determination step, and converting the value of the conversion target attribute information extracted in the packet processing step into the conversion formula An authentication method comprising a step of converting to the unified description format based on the authentication method. An authentication method according to any one of claims 8 to 11, comprising:
The attribute conversion step includes a step of reversely converting attribute information indicating the authentication processing result into the individual description format based on the type determination result,
The packet processing step includes a step of creating an authentication response packet including the inversely transformed attribute information and transmitting the packet to the authentication requesting device. An authentication method according to claim 12, comprising:
The attribute conversion step includes a reverse conversion rule including a set of a device type of the authentication requesting device or / and a line type of the access line and reverse conversion target attribute information, a value type, and an attribute value to be reverse conversion target. Referring to the attribute information indicating the authentication processing result by obtaining the reverse conversion target attribute information, value type, and attribute value corresponding to the device type or / and the line type obtained in the type determining step An authentication method comprising a step of reversely converting the value of the reverse conversion target attribute information into the individual description format based on the value type and the attribute value. An authentication method according to any one of claims 8 to 13, comprising:
The authentication processing step determines whether the authentication processing is possible for the attribute information extracted in the packet processing step based on the device type or / and the line type obtained in the type determination step, If the authentication process is impossible, the attribute conversion step is notified of a unified information request for requesting attribute information in the unified description format. If the authentication process is possible, the attribute in the individual description format is sent. Notifying the attribute conversion step of an individual information request for requesting information,
In the attribute conversion step, when the unified information request is notified, the attribute information extracted in the packet processing step is converted into the unified description format and output to the authentication processing step, and the individual information request is notified. If so, an authentication method comprising: outputting the attribute information extracted in the packet processing step to the authentication processing step in the individual description format.   The program for functioning a computer as each part which comprises the authentication system in any one of Claims 1-7.

Images