JP5778066B2 - Authentication method using a firewall - Google Patents

Description

  The present invention relates to an authentication method used when a relay device opens a port.

  Conventional use of the net involves sending a request from the user terminal side to the server and receiving a response. However, with the spread of smartphones, users can remotely access their home network from outside to use their home network file server, or call from outside to make calls using IP phone software. The usage methods for starting up software in response to external requests are expanding.

  However, if you leave the port open to receive access from such an external network, it becomes a security hole. On the other hand, there is known a technique for securing security by performing authentication using a user ID / password in an application waiting at the port. However, in order for this method to be secure, it is assumed that there is no security hole in the sequence from when the application receives the packet until authentication is performed. In fact, it cannot be guaranteed that such network software has no security holes.

  Therefore, in order to avoid the security risk that occurs in the communication application to the maximum extent, it is desirable that no illegal packets are read into the application. For that purpose, it is ideal if the application can be stopped during normal times and started up as needed.

  As a method similar to this, Patent Document 1 proposes a method for handling a port opening request. In this technology, when a port opening request is received from the outside, the opening request is authenticated, and if the authentication is successful, the subordinate terminal list is responded, the terminal name is designated as the other party, and the corresponding port is opened.

  As another method, as a technique related to IP telephone, Patent Document 2 discloses a destination port number to be applied to a voice packet in an IP telephone terminal that starts voice communication with a partner terminal in order to eliminate unauthorized access packets due to spoofing. A method has been proposed in which the source IP address and the destination port number of the received packet are checked by specifying each other and if the received packet is determined to be an illegal packet, the received packet is discarded.

JP 2008-78823 A JP 2008-217668 A

  However, in the method described in Patent Document 1, as long as another application is used to notify that it is “necessary” from the outside, the application has a function of waiting for a port opening request. If this function itself has a security hole, there is a high possibility that attacks from the network cannot be prevented.

  In the technique described in Patent Document 2, the authentication target is performed by the access target function (SIP function) itself. Since the target function itself receives and processes the corresponding packet, it was not possible to handle the case where a security hole was inherent in the flow from the reception of the packet to the completion of authentication.

  Accordingly, an object of the present invention is to enable communication to be started by a request from the outside by a technique with a lower security risk.

The present invention records a predetermined authentication format in an external request terminal to be accessed from an external network and a communication function device such as a relay device or a user terminal that has a firewall and receives the access,
The external request terminal divides authentication data in accordance with the authentication format into a size that can be embedded as a port number of a packet such as TCP or UDP, and continuously in the port number portion of a series of packets in the order of embedding. Send to the above equipment,
The device with the communication function monitors the continuous pattern of the port numbers of the packets received by the firewall, refers to the recorded authentication format, and the pattern conforms to the authentication format. If this is detected, the above problem has been solved by opening the port for access to the firewall in order to accept access, or launching predetermined software that accepts access. .

  In other words, the packet information acquisition process in the firewall function is a process that must be performed, but is performed at the earliest stage among the processes that are performed by the device. By providing an authentication function there, it is possible to accept a request without always opening a new accepting port that leads to a security hole. The information touched by the firewall function is very simple information such as the IP address and port number set in the IP header and TCP / UDP header, so malicious users can devise packets to prevent problems such as buffer overflow. Difficult to trigger. If basic information such as IP header or TCP / UDP header is modified, it will be difficult to reach the above equipment in the first place because it is not routed correctly in the middle of the router. It is unlikely that an abnormal value will be inserted into the part. For this reason, the high security of the firewall itself can be maintained. In addition, the number of bits required for authentication can be secured by authenticating the port numbers of consecutive packets instead of the port number of one packet, making it difficult to break through. be able to.

Specifically, the firewall function unit of the device has a packet information acquisition unit that acquires the port number of the received packet,
In addition, a key table that records a number sequence for authentication in a part that is protected externally as software by the firewall function unit, and a pattern analysis that compares and refers to a series of port numbers of the obtained packets with the key table. An authentication function unit having an access unit, and when the authentication is successful, an access target function unit that opens a firewall port or activates software that accepts access, such as IP phone software, is executed. On the other hand, the terminal to be accessed from the outside has a function for continuously sending out authentication information embedded packets in which data conforming to the above-mentioned number sequence is embedded in the port number of continuous packets in accordance with a predetermined authentication format and continuously transmitted. Make it.

  Here, the number sequence for authentication may be determined in advance as a reception pattern, for example, a sequence of numerical values in a range that can be expressed in 16 bits, or a common key for authentication and an external request recognized by the device. A hash value may be generated from the source IP address of the terminal, and a numerical sequence divided every 16 bits may be automatically generated every time authentication is performed. When an external requesting terminal sends data conforming to it, the number sequence is divided into individual numerical values and embedded in the source port number and destination port number items of consecutive packets as they are, or with predetermined encryption It may be embedded after applying. For example, a 128-bit MD5 can be sent by being embedded in eight port numbers. In the key table, the numerical sequence and the converted numeric sequence are always stored or temporarily stored in a comparable format. It is easy to compare if it is stored in a form divided into 16 bits. When a common key is used, the device must store it in a storage unit separately from the key table, and the external request terminal must also hold the common key.

  The longer the above sequence, the higher the security strength. However, since the number of required packets increases accordingly, there is a high possibility that authentication will fail without receiving a packet due to packet loss. For this reason, the external requesting terminal may transmit a series of packets used for authentication several times at regular intervals.

  The port number part used for sending data in accordance with this authentication format has two locations, the source port number and the destination port number of the packet, each having a length of 16 bits. Or both may be used for authentication. If both are used, data can be transmitted with a smaller number of packets. However, depending on the destination port, there is a possibility that an allow rule is already set in the firewall for a specific number or some application may be waiting, so if only the source port number that can be set relatively freely is used for authentication, an error will occur. Is less likely to occur.

  According to the present invention, when communication is performed from an external network, an application that performs the communication can be stopped or a port can be closed in normal times, and a security risk can be reduced. And when necessary, you can start applications from the outside and open ports in a safe way.

Functional block diagram of the relay device according to the present invention Sequence diagram for advancing the embodiment of the present invention Example of key table when only source port number is used Example flow in the firewall function section Example of authentication flow when key table is fixed Example of authentication flow when key table is dynamically generated Example of key table dynamic generation flow

Hereinafter, the present invention will be described with specific embodiments.
As an embodiment in which an external request terminal 2 connected to the external network 3 accesses a device protected by a firewall, a case where access to the relay apparatus 1 is performed will be described as an example. FIG. 1 is a functional block diagram of a relay apparatus 1 which is a device accessed in this embodiment, and FIG. 2 is a sequence diagram when proceeding with this embodiment.

  The relay device 1 is a relay device between the internal network 4 and the external network 3, and functions as a gateway such as a home gateway such as a home router. For access from the external network 3, a firewall function that allows only a part of the packets to pass through is exhibited.

  The internal network 4 is a network such as a home network that is separated from the external network 3 by the relay device 1 such as a home router. The present invention can also be implemented in a general household LAN or a specific corporate LAN.

  The external network 3 is a network that is separated from the internal network 4 by the relay device 1 and is not managed by a specific individual or a general corporation but has a security risk, and is generally the Internet. However, the present invention can also be used in a wide area network managed by a specific communication carrier.

  The external request terminal 2 is directly or indirectly connected to the external network 3 and requests access to the relay device 1 or the internal terminal 5 of the internal network 4. For example, a notebook personal computer that activates a file server function to read a file, a feature phone that attempts to make a call by an IP phone, a smartphone, and the like, but has a network function that transmits UDP / TCP packets If it is a terminal, it will not specifically limit. It is not necessary to be a portable terminal, and may be a desktop personal computer or a blade server.

  The relay device 1 includes a firewall function unit 10 that protects against communication from the external network 3, an authentication function unit 20 that performs authentication based on information received by the firewall function unit 10, and application activation and port opening. In addition to the access target function unit 30 that performs the above-described functions, although not shown, it has general functions as a relay device such as a gateway function and a routing function that relay communication. Further, a common key described later is held in the storage unit as necessary.

  The firewall function unit 10 executes a packet discard function that discards unnecessary or dangerous packets in accordance with predetermined conditions such as discarding packets other than a specific destination port number. This is software such as a software that prevents intrusion of a packet or a hardware such as a chip having the function. However, regardless of whether or not the packet is discarded, the packet information acquisition unit 11 that acquires information of the header portion of the received packet is included, and a packet information transfer function that passes the information to the next authentication function unit 20 is also executed.

The authentication function unit 20 includes a key table 22 that records a number sequence according to a predetermined authentication format,
A pattern analysis unit 21 that determines whether or not to authenticate a continuation of port numbers included in packets acquired from the same source address among the acquired packets by comparing with the key table. Have. The key table 22 is a numerical sequence determined from the beginning, or is generated by executing a numerical sequence generation function for calculating a hash value using a common key shared in advance with the external request terminal 2 and is temporarily recorded. There is. The pattern analysis unit 21 compares or calculates the key table 22 and the packet information sent from the packet information delivery function of the packet information acquisition unit 11, and continues the port numbers of the sent packets. An authentication analysis function for determining whether or not the pattern according to the above satisfies an authentication condition is executed, and when authenticated, an execution instruction function for issuing an execution instruction to the access target function unit 30 described later is executed. In addition, it has a timer 24 for setting a time limit for processing.

  An example of the key table 22 is shown in FIG. In this example, the protocol of the packet to be received is UDP, and the destination port number is not particularly limited. However, the source port numbers of eight consecutively received packets issued from the same source IP address are sequentially listed as “ The authentication is allowed to pass only when “10001, 10002, 10001, 10010, 20000, 12345, 20000, 10001”. Although it is possible to implement without considering the order, it is preferable that the order is as shown in the key table 22 because the burden on the pattern analysis unit 21 is increased and the security is reduced.

  Note that there may be a plurality of such key table 22 or a common key that is the basis of the key table 22. For each key table 22, it is possible to change an application to be activated after passing the authentication or change a port to be opened.

  In addition, as an example of the key table 22 described above, instead of such a fixed table, only a common key is held, and when a packet starts to be received, a source IP address included in the IP header of the packet, etc. Alternatively, the key table 22 may be dynamically generated from the variable elements and the common key. In this case, the external request terminal 2 that performs authentication can also authenticate by generating the same character string from the common key and its own IP address, and sequentially sending them in the packet.

  The access target function unit 30 executes processing for establishing communication required by the external request terminal 2, such as starting an application that the external request terminal 2 requests to start or opening a predetermined port. When the application is activated, there are a case where the relay apparatus 1 activates the internal terminal 5, a case where the relay apparatus 1 itself activates a service as a server, and a case where the internal terminal 5 itself activates the application itself. Further, the access target function unit 30 need not actually execute one form, and different applications can be started depending on the authenticated pattern (that is, the contents of the key table 22 or the type of the common key). Or open different ports. The function requested by the external request terminal 2 that requests access is not particularly limited, and depends on any internal terminal 5 in the internal network 4 such as a file server function, an IP telephone function, and reservation of an HDD recorder connected to the network. Because it is various.

  Since the external request terminal 2 cannot activate the necessary function as it is and cannot access the relay apparatus 1 as it is, the relay apparatus 1 maintains a certain level of security. For example, if the IP telephone application is not started up in the internal terminal 5, it does not make sense to send a packet. Therefore, the authentication information corresponding to the key table 22 is put on successive packets and transmitted. Here, when the reception pattern is fixed, it is transmitted as it is, and when the table is dynamically generated from the common key and the transmission source IP address, the transmission source IP when the packet arrives at the relay device 1 An address is acquired, calculated, and a table that is a dynamic number sequence is generated.

  The operation flow of the firewall function unit 10 that receives this packet will be described with reference to FIG. First (S101), the firewall function unit 10 receives a packet transmitted from the external network 3 (S102). In practice, the network interface portion is received first in the relay device 1, but here, the handling after the signal is restored to the packet form will be described. The packet information acquisition unit 11 of the firewall function unit 10 acquires packet header information (S103). Here, it is desirable to maintain the security of the firewall function unit 10 by not checking the payload of the packet. After obtaining this header information, the next two processes (S104 and S111) are advanced in parallel or back and forth so as not to be over-delayed. In other words, either of S104 and S111 may be performed first.

  The firewall processing function executed in S104 is relaying or discarding a packet in accordance with a predetermined firewall rule, like a general firewall. By discarding the packet of the destination port number that is not permitted to be relayed or the packet of the transmission source IP address that is permitted to access from the header information of the packet obtained by the packet information acquisition unit 11, the internal content from the relay device 1 Maintain the security of network 4. On the other hand, a packet having a port number and an address for which relaying is permitted is relayed. This completes the basic function of the firewall (S105).

  The firewall function unit 10 performs packet header information (basically “IP header”, “UDP header”, “TCP header”) obtained by the packet information acquisition unit 11 in parallel with or before and after the relay or discard of the packet. The packet information notification function for notifying the pattern analysis unit 21 of the authentication function unit 20) is executed (S111). Here, only the extracted header information is passed, not the packet itself, and the possibility of breakthrough due to buffer overflow is kept low. The notification is performed every time one packet is received, and the firewall function unit 10 itself can temporarily hold the information in a buffer and send information for a plurality of packets collectively.

  In response to this notification, the process proceeds to the next authentication process (S112 → S154). In the embodiment of the authentication function unit 20, there are two types of cases where the contents of the key table 22 are fixed in advance and when the contents are dynamically generated. First, the flow when the number sequence of the key table 22 is set in advance will be described with reference to FIG. 5, and the flow when the key table 22 is dynamically generated will be described with reference to FIGS.

  FIG. 5 is a processing flow diagram in the authentication function unit 20 when the numerical sequence of the key table 22 is preset. The initial value of the variable i in the flow is 1 (S152), and the initial value of the variable a for storing the transmission source address is null (S153). In this state, the header information of the packet obtained from the packet information obtaining unit 11 is obtained and processing is started (S112 = S154).

  As the flow, it is determined whether or not the time limit set by the timer 24 described later has expired, and if it has expired, the flow proceeds to another flow (S155 → Yes, S156). Since the time limit set by the timer 24 is not set at the initial time, the process proceeds to the next step (S155 → No). When idling, it waits until packet information is notified from the packet information acquisition unit 11 (S157 → No → S158 → S154). When the packet information is notified (S157 → Yes), the process is started (S161).

  Since i = 1 at the initial time (S161 → Yes), the source address check (which will be described later in S162) is omitted, and the port number included in the packet information (assuming source port number or destination port number) Is compared with the i = 1st entry in the key table 22 (S163). If they do not match (S163 → No), it is determined that the packet is not for authentication using the present invention (S164 → S172), and the set value remains the initial value (S173, S174). Although not activated (S175), the process returns to the beginning (S176 → S154). If i = 1 in the key table 22 matches (S163 → Yes), it is the first entry here (S165 → Yes), so the transmission source address of the packet is substituted into the variable “a” (S166). ), The timer 24 starts counting time (S167). In other words, this is a condition for continuously confirming whether only packets coming from the same source address within a predetermined time match the entry in the key table 22 for authentication. Basically, there are a plurality of entries in the key table 22 in order to make it difficult to break through accidental coincidence, and the number of entries is not 1 (S168 → No), so the variable i is incremented by 1 ( S169) Waits for the next packet (S170 → S154).

  If the time limit previously determined by the timer 24 has already passed during the second and subsequent packet waits (S155 → Yes), it is regarded as a timeout (S156 → S164), and i = 1 is returned ( (S173), the transmission source address is cleared from the variable “a” (S174), the time by the timer 24 is reset (S175), and it waits again for a packet that matches the first entry in the key table 22 (S175). S176 → S154 → S155 → S157 → S158 → S154).

  When the next packet is received within the time limit set by the timer 24 (S155 → No) (S157 → Yes), this time (S161 → No), the source address of the packet is the value of the previous packet stored in the variable “a”. It is determined whether or not the source address matches (S162). If they do not match (S162 → No), it originates from a different source than the series of packets that are currently pending authentication, so authentication is not performed and the next packet is awaited (S163 → S154). In other words, this is a flow for avoiding complicated processing by simultaneously accepting authentications from two or more source addresses. In this case, a transmission source that intends to authenticate later attempts to authenticate by retransmitting a series of packets from the beginning.

  If the transmission source address matches the previous transmission source address stored in the variable “a” (S162 → Yes), the transmission source port number of the packet header is changed to the i-th item in the key table 22. It is determined whether or not the entry matches (S163). If they do not match (S163 → No), whether the match up to that point was accidental or an authentication error, either way, it is an authentication failure (S164 → S172), and the variables and timers are returned to their initial values. (S173 to S175), and waits for the next packet (S176 → S154). If they match (S163 → Yes), it means that the entries in the key table 22 match up to the i-th (S165 → No). If all the entries in the key table 22 have not been reached (S168 → No), the variable i is incremented by 1 (S169) and the authentication operation is continued. If i at that time has reached the number of entries in the key table 22 (S168 → Yes), it is determined that the authentication is successful (S171), the access target function unit 30 is activated, and a necessary port is opened. Thereafter, the variables are reset in preparation for the next authentication (S173 to S175).

  When both the destination port number and the transmission source port number are used in the flow of FIG. 5, both the external request terminal 2 and the relay device 1 that transmit which port number is to be handled first. And the comparison of the packet information of S161 with the entry of the key table 22 at the same time as the (i + 1) -th as well as the i-th, and the addition of i of S169 is +2 instead of +1 The determination in S168 is changed to “Is the number of entries in the key table 22 equal to or less than (i + 1)?”.

  FIG. 6 is a processing flowchart in the authentication function unit 20 when the key table 22 is generated. However, before executing this flow, it is preferable to hold the condition value of the IP address of the external request terminal 2 to be authenticated. Specifically, the present invention holds only an IP address range of a specific mobile phone carrier, an IP address range possessed by a specific provider or a specific corporation, and only those IP addresses to be serviced. Can be executed.

  First (S211), the initial value of the variable i in the flow is 1 (S212), and the key table 22 is cleared before generation (S213). In this state, the header information of the packet obtained from the packet information obtaining unit 11 is obtained and the process is started (S112 = S214).

  As a flow, it is determined whether or not the time limit set by the timer 24 described later has expired, and if it has expired, the flow proceeds to another flow (S215 → Yes, S216). Since the time limit set by the timer 24 is not set at the initial time point, the process proceeds to the next step (S215 → No). When idling, it waits until packet information is notified from the packet information acquisition unit 11 (S217 → No → S218 → S214). When the packet information is notified (S217 → Yes), it is determined whether or not the transmission source IP address is an IP address to be authenticated (S219). For example, if the IP address is not the authentication target (eg, mobile phone carrier is different or provider is different) (S219 → No), the packet is ignored and the packet notification is awaited again (S220 → S214). On the other hand, if the IP address is an authentication target, the process is started (S221).

  Since i = 1 at the initial time (S221 → Yes), the key table 22 is dynamically generated (S222).

  This dynamic generation flow will be described with reference to FIG. First (S251), a hash value is calculated from the acquired transmission source IP address and the common key (S252). Since the key table 22 is newly generated, the key table 22 is initialized here (S253). Here, the handling changes depending on which port number the relay apparatus 1 and the external request terminal 2 use for authentication (S254 → S255 to S257). When only the transmission source port number is used for authentication, an entry in which a value obtained by dividing the calculated hash value into 2 bytes (16 bits) for the key table 22 is assigned to the transmission source port number item is set. It is added (S255). At this time, as shown in FIG. 3 above, the destination port number is “any” which is not designated, and any value satisfies the condition. If the hash value is 128 bits, the number of entries is 8 entries as shown in FIG. When both the destination port number and the source port number are used for authentication, a value obtained by dividing the calculated hash value into 2 bytes (16 bits) for the key table is obtained as the destination port number and the source. An entry assigned and set to the port number item is added (S256). Whichever comes first, it is necessary to unify which is first throughout the system. When only the destination port number is used for authentication, an entry in which a value obtained by dividing the calculated hash value into 2 bytes (16 bits) is assigned to the item of the destination port number is added to the key table 22. (S257). At this time, the source port number is “any” which is not specified, and any value satisfies the condition. The key table 22 is generated by any one of these methods (S258).

  Returning to the description of the flow of FIG. 6 again (S222-). Here, the timer 24 starts counting the time limit (S223). This is to reduce the possibility that the authentication is illegally broken by setting an expiration date for the dynamically generated key table 22 and discarding the key table 22 when the set time is exceeded. . Then, the port number included in the packet information (assuming that only the source port number or the destination port number is used) is compared with the i = 1st entry in the key table 22 (S231). If they do not match (S231 → No), it is determined that the packet is not for authentication using the present invention (S232 → S242), the set value remains the initial value (S243), and the key table 22 is stored. Initialization (S244), the timer 24 is stopped (S245), and the process returns to the beginning (S246 → S214). If it matches with i = 1st entry in the key table 22 (S231 → Yes), the entry in the key table 22 is basically the first entry here, so that it is very difficult to break through coincidence. The number of entries is not 1 (S233 → No), the variable i is incremented by 1 (S234), and the next packet is waited (S235 → S214).

  If the time limit previously determined by the timer 24 has already passed (S215 → Yes) when waiting for the second and subsequent packets, it is regarded as a timeout (S216 → S242), and i = 1 is returned ( S243), the key table 22 is initialized (S244), the time limit set by the timer 24 is reset (S245), and a wait is made again for a packet that matches the first entry in the key table 22 (S246 → S214 → S215 → S217 → S218 → S214).

  When the next packet is received within the time limit set by the timer 24 (S215 → No) (S217 → Yes), this time (S221 → No), the source address of the packet matches the IP address of the authentication target currently handled. It is determined whether or not to perform (S225). If they do not match (S225 → No), it originates from a different source than the series of packets that are currently pending authentication, so authentication is not performed and the next packet is awaited (S226 → S214). In other words, this is a flow for avoiding complicated processing by simultaneously accepting authentications from two or more source addresses. In this case, a transmission source that intends to authenticate later attempts to authenticate by retransmitting a series of packets from the beginning.

  If the transmission source address matches the current transmission source address to be authenticated (S225 → Yes), the transmission source port number (or destination port number) of the header of the packet is subsequently stored in the key table 22. It is determined whether or not it matches the i-th entry (S231). If they do not match (S231 → No), whether the match so far was accidental or an authentication error, in any case as an authentication failure (S232 → S242), the variable, the key table 22 and the timer are stored. It returns to the initial value (S243 to S245) and waits for the next packet (S246 → S214). If they match (S231 → Yes), it means that the entries in the key table 22 match up to the i-th. If all the entries in the key table 22 have not been reached (S233 → No), the variable i is incremented by 1 (S234) and the authentication operation is continued. When i at that time reaches the number of entries in the key table 22 (S233 → Yes), it is determined that the authentication is successful (S241), and the access target function unit 30 is activated to open a necessary port. Thereafter, the variables are reset in preparation for the next authentication (S243 to S245).

  When both the destination port number and the transmission source port number are used in the flow of FIG. 5, both the external request terminal 2 and the relay device 1 that transmit which port number is to be handled first. And the comparison of the packet information of S161 with the entry of the key table 22 at the same time as the (i + 1) -th as well as the i-th, and the addition of i of S169 is +2 instead of +1 The determination in S168 is changed to “Is the number of entries in the key table 22 equal to or less than (i + 1)?”.

  The above authentication method using the relay device 1 can be executed even when a personal computer, a server, or a smartphone having a personal firewall function exists in the internal network 4 separated from the external network 3 by the relay device 1. . That is, as in the above embodiment, the firewall function unit, which is a personal firewall of the terminal itself, has a packet information acquisition unit, and has a common key or key table and an authentication function unit having a pattern analysis unit. Then, the access target function unit may specifically launch an application such as telephone software.

DESCRIPTION OF SYMBOLS 1 Relay apparatus 2 External request terminal 3 External network 4 Internal network 5 Internal terminal 10 Firewall function part 11 Packet information acquisition part 20 Authentication function part 21 Pattern analysis part 22 Key table 24 Timer 30 Access target function part

Claims (7)

Record a predetermined authentication format on the external requesting terminal to be accessed from the external network and a device with a communication function that has a firewall and accepts the access,
The external request terminal embeds only a sequence of numbers in accordance with the authentication format into a size that can be embedded as a port number of a packet and embeds it only in the source port number portion of a series of packets and sends it continuously to the device. ,
The device monitors the continuous pattern of the source port number of the packet received by the firewall, refers to the recorded authentication format, and the pattern conforms to the authentication format. An authentication method using a firewall that, when detected, executes an access target function unit for accepting access. The predetermined authentication format is a sequence of numbers that should be determined to match with the sequence of source port numbers of consecutive packets transmitted from the same source address. The authentication method according to claim 1 , wherein authentication is performed by holding. Predetermined authentication format was described above, generates a hash value from a common key shared by the said equipment and the external request terminal, the device with the source IP address of recognizing the external request terminal, the transmission of the packet The authentication method according to claim 1 , wherein authentication is performed by generating a number sequence divided into sizes that can be stored in the original port number for each authentication. A device with a communication function having a firewall function unit that functions as a firewall for communication from an external network,
The firewall function unit includes a packet information acquisition unit that acquires a transmission source port number of a received packet,
Also,
A key table that records a sequence of numbers according to a predetermined authentication format;
A pattern analysis unit that determines whether or not to authenticate a continuation of source port numbers included in packets acquired from the same source address among the acquired packets by comparing with the key table; ,
Including an authentication function unit protected from an external network by the firewall function unit,
Furthermore, when the authentication is successful, the access target function unit is configured to open a predetermined port of the firewall, start predetermined software that accepts access, or both.
A device with a communication function that can authenticate from an external request terminal connected to an external network by a firewall. 5. The sequence according to claim 4 , wherein the predetermined authentication format is a number sequence that is recorded in advance in the key table to determine a match with a source port number of consecutive packets transmitted from the same source address. Equipment with communication function. The predetermined authentication format generates a hash value from the common key shared with the external request terminal and the source IP address of the external request terminal recognized by the device itself, The apparatus with a communication function according to claim 4 , wherein the authentication is performed by generating the key table composed of a number sequence divided into a size that can be stored in a transmission source port number for each authentication. A communication function device according to any one of claims 4 to 6 repeater der Ru provided between an external network and an internal network,
An external request terminal having a function of continuously transmitting authentication information embedded packets that continuously transmit data that conforms to the above-described number sequence in the transmission source port number of continuous packets according to the above-described predetermined authentication format. Authentication system.

Images