Authentication system, authentication server, and authentication device

Abstract

To easily enable a device or a terminal device to be authenticated by a router device. [Solution] The authentication device 20 has a terminal device list that stores identification information of authenticated terminal devices 30, acquires identification information from the connected terminal device 30, and if the acquired identification information is not registered in the terminal device list, sends an authentication request specifying the identification information to the authentication server 10.If the authentication server 10 permits authentication, it sends permission information for the identification information to the authentication device 20, and when the permission information is sent from the authentication server 10, the authentication device 20 registers the identification information related to the permission information in the permission list.

Description

[Technical Field]

[0001] The present invention relates to an authentication system, an authentication server, and an authentication device. [Background technology]

[0002] Router devices such as LTE routers and 5G routers are known that connect terminal devices such as personal computers (PCs) and provide the terminal devices with access to mobile phone carrier networks such as LTE networks and 5G networks. Recently, with the advancement of IoT (Internet of Things) technology, there has been a demand to connect terminal devices other than PCs, such as sensors, to router devices and collect and utilize information obtained by the sensors via mobile phone carrier networks. For IoT purposes, allowing unspecified terminal devices to connect to a router installed in a building or other location and communicate with a carrier network poses a security risk. This may also have a negative impact on the communications and operation of other terminal devices. Therefore, it is desirable to implement access control that allows only specific authenticated terminal devices to communicate with the carrier network via the router. As one means for such access control and device authentication, a technique called MAC (Media Access Control) address filtering is known. The router device disclosed in Patent Document 1 restricts devices in a local area that can communicate with the global area based on the device's MAC address. The router device permits communication between devices registered in a filter of permitted MAC addresses and the global area, and restricts communication between devices that are not registered and the global area. By registering a device in the filter of permitted MAC addresses, the device is authenticated and permitted to communicate with the global area. Patent Document 2 describes another example of MAC address filtering in which a server device stores a MAC list that registers the MAC addresses of client devices that are permitted to communicate. The server device permits communication with client devices whose MAC addresses are registered in the MAC list, and blocks communication with client devices that are not registered. By registering a MAC address in the MAC list, the client device is authenticated and is able to communicate with the server device.

[0003] In Patent Documents 1 and 2, a user can create a MAC list or filter (authenticate devices) by checking the MAC addresses of devices or client devices and entering the MAC addresses of devices for which communication is permitted. However, this is not a practical task when there are a large number of devices. In contrast, in Cited Document 1, the router enters filter registration mode by operating a button on the router, and only while this mode is running, the MAC address of the connected device can be automatically registered in the filter. As long as the filter registration mode is executed by a legitimate operation by the user, the device can be authenticated safely. Furthermore, Cited Document 2 discloses that a client device executes a program to generate a registration processing request packet that stores a MAC address in the header and indicates that the packet is a request for registration in the MAC list, and transmits the packet to a server device. The server device then creates and updates an authorization list by allowing the MAC address. This allows a MAC list to be created safely and easily, and client devices to be authenticated. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Patent Publication No. 2023-9950 [Patent Document 2] JP 2004-173148 A Summary of the Invention [Problem to be solved by the invention]

[0005] However, in the case of cited document 1, in an IoT environment where many devices and router devices are used, it is extremely cumbersome to operate buttons on each router device to change the filter settings every time a device connected to the router device is replaced, etc. In the case of cited document 2, if the client device is a PC, the work of installing the program on each PC is cumbersome, and if the client device is a sensor, it is difficult to even execute the program. According to one aspect of the present invention, a device or a terminal device can be easily authenticated by a router device. [Means for solving the problem]

[0006] In one aspect, the present invention provides an authentication system comprising an authentication device and an authentication server, wherein the authentication device is capable of connecting a terminal device, acquires identification information from the connected terminal device, and makes an authentication request for the terminal device to the server device based on the identification information, and the server device authenticates the terminal device based on the authentication request. [Effects of the Invention]

[0007] According to one aspect of the present invention, it is possible to easily authenticate a device or a terminal device with respect to a router device. [Brief explanation of the drawings]

[0008] [Figure 1] 1 is a diagram showing a schematic configuration of a communication system according to an embodiment of the present invention; [Figure 2] FIG. 2 is a diagram illustrating a functional configuration of an authentication server. [Figure 3] FIG. 2 is a diagram illustrating a configuration of an authentication device. [Figure 4] FIG. 10 is a diagram showing an authentication terminal device list. [Figure 5] FIG. 10 is a diagram showing a terminal device list. [Figure 6] 10 is a flowchart illustrating a terminal device authentication process performed by the authentication device. [Figure 7] 10 is a flowchart illustrating a terminal device registration process performed by an authentication server. [Figure 8] 10 is a flowchart illustrating a communication control process by the authentication device using the terminal device list. [Figure 9] 10 is a flowchart illustrating deauthentication processing by the authentication server and the authentication device. DETAILED DESCRIPTION OF THE INVENTION

[0009] Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings. The present invention is not limited to the following embodiments in any way, and can be practiced with appropriate modifications within the scope of the object of the present invention. FIG. 1 is a diagram showing a schematic configuration of a communication system according to this embodiment. The communication system 1 according to this embodiment includes an authentication server 10 and n (one or more) authentication devices 20-1 to 20-n. One or more terminal devices 30 can be connected to each authentication device 20. In the following description, the authentication device will be simply referred to as authentication device 20, except when it is necessary to distinguish between the authentication devices 20-1 to 20-n.

[0010] The authentication device 20 is a router device such as an LTE router or a 5G router, and can connect to a public network such as a mobile phone carrier network CN via a wireless base station BS. A terminal device 30 connected to the authentication device 20 can connect to the wireless base station BS via the authentication device 20 and connect to the carrier network CN via the wireless base station BS. The authentication device 20 provides the terminal device 30 with access to the mobile phone carrier network CN. The mobile phone carrier network CN is, for example, an LTE network or a 5G network operated by a mobile phone carrier, and will be simply referred to as the carrier network CN hereinafter. The network to which the authentication device 20 can connect and which provides access to the terminal device 30 is not limited to the carrier network CN, but may be a LAN within a company or university campus, a public wireless LAN, etc. In this specification, the case where the authentication device 20 connects to the carrier network CN will be particularly described.

[0011] The authentication device 20 holds a terminal device list, which is a list of terminal devices 30 that have been permitted to be registered by the authentication server 10, and connects only terminal devices 30 that have been authenticated by registering their terminal device identification information in the terminal device list to the wireless base station BS. More precisely, only frames sent from terminal devices 30 that have been authenticated by registering their identification information in the terminal device list are relayed to the wireless base station BS (modulated into wireless signals and transmitted). The terminal device identification information registered in the terminal device list is, for example, a MAC address unique to the terminal device 30. The authentication device 20 performs MAC address filtering using the terminal device list to control communication with the wireless base station BS and ultimately with the carrier network CN. The authentication server 10 is open to the public on, for example, the Internet IN, and the authentication server 10 and the authentication device 20 can communicate with each other via the Internet IN and the mobile carrier network CN. The authentication server 10 authenticates the terminal device 30 connected to the authentication device 20 .

[0012] Although the details will be described later, the outline of this embodiment will be explained using FIG. When a terminal device 30 is connected, the authentication device 20 acquires (1) the terminal identification information from the terminal device 30 and compares it with a terminal device list (registration list) (2). If the acquired terminal identification information of the terminal device 30 is registered in the terminal device list, the following processing is not necessary. If the acquired terminal identification information of the terminal device 30 is not registered in the terminal device list, the authentication device 20 transmits (3) an authentication request including the unregistered terminal device identification information to the authentication server 10 via the wireless base station BS, the carrier network CN, and the Internet IN. The authentication server 10 authenticates the terminal device 30 (determines whether or not the terminal identification information can be added to the terminal device list) in accordance with the terminal device identification information included in the authentication request and an authentication terminal device list (authentication list) stored in the authentication server 10, or based on an operation by the user of the authentication server 10 (4), and if the addition is permitted, transmits information permitting the addition of the terminal device identification information to the terminal device list (5) to the authentication device 20. The authentication device 20 adds the terminal device identification information permitted to be added to the terminal device list (6), and the authentication of the terminal device 30 is completed. In this embodiment, the authentication server 10 and the authentication device 20 to which the terminal device 30 is connected cooperate to automatically authenticate the terminal device 30 based on the terminal device identification information of the terminal device 30. Therefore, the terminal device 30 can be authenticated without the need to install a special program on the terminal device 30 or perform a special operation on the authentication device 20.

[0013] The authentication device 20 is multi-carrier compatible and can connect to different wireless base stations BS provided by different communication carriers and communicate with different carrier networks CN. The wireless base station BS simply performs the normal operation of receiving data from the terminal device 30 that is permitted to communicate in accordance with the terminal device list in the authentication device 20 and transferring the data to the carrier network CN. The communication carrier is not involved in the processing performed by the authentication device 20 at all. The authentication server 10 is installed outside the carrier network CN, such as on the Internet IN, and performs authentication of the terminal device 30. The radio base station BS transmits the authentication request sent by the authentication device 20 to the authentication server 10 via the carrier network CN. This is also a normal operation for the radio base station BS and the carrier network CN. In this embodiment, the authentication server 10 and the authentication device 20 can be applied to the existing carrier network CN as is without making any changes to the existing carrier network CN or the radio base station BS to authenticate the terminal device 30, and the terminal device 30 that is permitted to connect to the carrier network CN can be easily managed.

[0014] [Authentication Server Description] FIG. 2 is a diagram illustrating the functional configuration of the authentication server, where (a) is a hardware functional block diagram and (b) is a software functional block diagram. As shown in Figure 2(a), the authentication server 10 includes a control device 11 that runs an operating system that controls the entire device and also runs programs that realize the functions of the authentication server 10, a RAM (Random Access Memory) 12 that serves as a work area where various programs, temporary data, and variables are expanded for processing by the control device 11, a storage device 13 and a ROM (Read Only Memory) (not shown) in which programs and data are stored, a network interface (I / F) 14, a display device 15, and input devices 16 such as a mouse and keyboard. The network I / F 14 can be an Ethernet I / F or a wireless LAN I / F, and the authentication server 10 can be connected to the Ethernet or wireless LAN.

[0015] The control device 11 is a control circuit included in the authentication server 10 that realizes the control unit 10A, and is a processor such as a CPU (Central Processing Unit), a multi-core CPU, an FPGA (Field Programmable Gate Array), or a PLD (Programmable Logic Device). The storage device 13 is, for example, a hard disk drive (HDD). The HDD is a drive device that drives a built-in hard disk, and the HDD reads programs and data stored on the hard disk as a recording medium and writes data to the hard disk. The storage device 13 may also be a solid state drive (SSD).

[0016] The authentication server 10 may also be provided with a reading / writing device 17 that reads and writes programs and data from a removable recording medium 200 such as an optical disk such as a floppy disk (FD), compact disc (CD), digital versatile disc (DVD), or Blu-ray (registered trademark) disc (BD), or a flash memory. The reading / writing device 17 is a FDD (Floppy Disk Drive), a CDD (Compact Disc Drive), a DVDD (Digital Versatile Disc Drive), a BDD (Blu-ray (registered trademark) Disk Drive), a USB (Universal Serial Bus), or the like. The control device 11, RAM 12, storage device 13, network I / F 14, and reading / writing device 17 are connected via an internal bus, for example.

[0017] As shown in FIG. 2(b), the control device 11 executes an acquisition unit 41, an authentication unit 42, a registration unit 43, a transmission unit 44, an input unit 45, and a display unit 46 as a control unit 10A. These processing units are programs that realize the functions of the control unit 10A of the authentication server 10, and the programs can be stored in a hard disk or SSD included in an HDD as the storage device 13, or in the recording medium 200. The programs are read from the recording medium 200, such as a hard disk, into the RAM 12 by the storage device 13 or the reading / writing device 17, and are executed by the control device 11. The RAM 12 and the storage device 13 constitute a storage unit 10B of the authentication server 10. The storage unit 10B stores, for example, an authentication terminal device list 60 (authentication list).

[0018] FIG. 4 is a diagram showing an authentication terminal device list provided in the authentication server. The authentication terminal device list (authentication list) 60 is a list in which authenticated terminal devices 30 are registered for each authentication device 20. For example, an authentication device ID (1 to n) that identifies the authentication device 20 (20-1 to 20-n) and terminal device identification information (30-1 to 30-m) that identifies the terminal device 30 are stored as pairs. The terminal device identification information is, for example, a MAC address that is information unique to a network adapter included in the terminal device 30. The terminal device identification information may also be a CPU ID that is unique to a CPU included in the terminal device 30. In the following description, the terminal device identification information is assumed to be a MAC address. In Fig. 4, the terminal device identification information is represented as 1 to m for each authentication device 20, but this is a description for convenience, and in reality, the information is unique to each terminal device 30 in the format of 11-22-33-44-55-66, etc. Note that the terminal device identification information may be management information associated with the MAC address of the authenticated terminal device 30. As will be described later, it is possible for the same terminal device 30 to be authenticated simultaneously by different authentication devices 20, and in such a case, for example, it is possible that terminal device identification information 1-4 corresponding to authentication device ID1 and terminal device identification information 3-2 corresponding to authentication device ID3 point to the same MAC address.

[0019] The authentication terminal device list 60 can be pre-registered with the MAC addresses of the terminal devices 30 to be authenticated for each authentication device 20. This can be done by directly editing the list on the authentication server 10 using the input device 16, or by loading a list edited on another device into the storage unit 10B of the authentication server 10. The authentication server 10 authenticates the terminal device 30 based on the user's operation in response to the authentication request, and adds the MAC address of the authenticated terminal device 30 to the authenticated terminal device list 60 in Fig. 4. The authentication server 10 writes the added MAC address into the terminal device list (registration list) 70 (Fig. 5) of the authentication device 20 that made the authentication request, and authenticates the terminal device 30 to the authentication device 20.

[0020] As will be described later in Fig. 3(a), the authentication device 20 has only one wired network I / F for connecting the terminal device 30 by wire, and the authentication device 20 can connect to only one terminal device 30. However, the authentication terminal device list 60 shown in Fig. 4 registers multiple pieces of terminal device identification information for one authentication device 20. This assumes that the terminal device 30 will be replaced with another authentication device 20. A terminal device 30 that has once been authenticated by the authentication device 20 can be connected to a different authentication device 20 without being authenticated again. The authentication device 20 may be provided with a plurality of wired network I / Fs, and the same number of terminal devices 30 may be connected thereto.

[0021] The authentication terminal device list 60 can function as the original terminal device list 70 provided in each authentication device 20. When one of the authentication devices 20 is replaced due to equipment failure or the like, the authentication before the replacement can be easily restored by writing the permitted MAC address to a new authentication device 20 that has been assigned the same authentication device ID as the replacement. The authentication terminal device list 60 may manage the authentication device ID in association with the WAN side IP address of the authentication device 20. The WAN side IP address of the authentication device 20 itself may be used as the authentication device ID.

[0022] The same terminal device 30 can be authenticated by different authentication devices 20. However, because a terminal device list 70 is provided for each authentication device 20 to perform access control, even if a certain terminal device 30 is connected to, for example, authentication device 20-1 and authenticated, when the terminal device 30 is connected to, for example, authentication device 20-2 for the first time, authentication device 20-2 must perform authentication again. After terminal device 30 has been authenticated by authentication device 20-1, if it is removed from authentication device 20-1 and authenticated by authentication device 20-2, the authentication device identification information of the terminal device 30 connected to authentication device 20-1 may be deleted from the authentication terminal device list 60 and authentication may be cancelled for authentication device 20-1, or the authentication device identification information of the terminal device 30 connected to authentication device 20-1 may remain in the authentication terminal device list 60 and authentication may not be cancelled. When authentication is cancelled for authentication device 20-1, the MAC address may be deleted from the terminal device list 70 of authentication device 20-1. Furthermore, by deleting a terminal device 30 that has been authenticated once from the authentication terminal device list 60, authentication for a specific authentication device 20 can be cancelled, and in that case, the MAC address of the terminal device 30 in question is deleted from the terminal device list 70 of the cancelled authentication device 20.

[0023] Returning to the explanation of FIG. 2, the processing by the control unit of the authentication server 10 will be explained in detail. The acquisition unit 41 acquires the authentication request sent from the authentication device 20, and acquires the MAC address specified in the authentication request. The authentication unit 42 performs authentication for the MAC address specified in the authentication request. Specifically, the authentication unit 42 determines whether the MAC address specified in the authentication request is registered in the authentication terminal device list 60, and if it is registered, causes the transmission unit 44 to transmit registration permission information (packet) indicating registration permission to the authentication device 20 that made the authentication request. If the specified MAC address is not registered in the authentication terminal device list 60, the authentication unit 42 causes the display device 15 to display an operation screen on the display unit 46 (described later) to allow the user to operate the display unit 46 to allow or disallow registration of the MAC address. When an operation to permit a MAC address is performed by the input unit 45, which will be described later, the authentication unit 42 causes the registration unit 43, which will be described later, to register the MAC address in the authentication terminal device list 60 in association with the authentication device 20 that made the authentication request, and causes the transmission unit 44 to transmit registration permission information (packet) indicating registration permission to the authentication device 20 that made the authentication request. When an operation to prohibit registration is performed, the authentication unit 42 does not register the MAC address in the authentication terminal device list 60, and causes the transmission unit 44 to transmit registration denial information (packet) indicating registration denial to the authentication device 20 that made the authentication request.

[0024] The registration unit 43 performs a process of registering a MAC address in the authentication terminal device list 60. The registration unit 43 also performs a process of deleting a MAC address from the authentication terminal device list 60. The transmitting unit 44 transmits the registration permission information / registration denial information to the authentication device 20 that has made the authentication request via the network I / F 14. The transmitting unit 44 also transmits deregistration information (packet) to the authentication device 20, instructing the authentication device 20 to delete the MAC address from the terminal device list 70. The input unit 45 accepts input operations by the user using the input device 16 such as a mouse or keyboard. The display unit 46 causes the display device 15 to display an operation screen for operating to permit / deny registration of a MAC address using the input device 16. The display unit 46 also causes the display device 15 to display an editing screen for the authentication terminal device list 60.

[0025] [Authentication device description] 3A and 3B are diagrams illustrating the configuration of an authentication device, where FIG. 3A is a diagram illustrating the hardware configuration of the authentication device, and FIG. 3B is a diagram illustrating the software functional configuration of the authentication device. As shown in Figure 3(a), the authentication device 20 includes a control device 21 that runs an operating system that controls the entire device and also runs programs that realize the functions of the authentication device 20, a RAM 22 that serves as a work area where various programs, temporary data, and variables are expanded for processing by the control device 21, a storage device 23 and a ROM (not shown) that store programs and data, a wired network I / F 24, and a wireless network I / F 25.

[0026] The control device 21 is a control circuit included in the authentication device 20 that realizes the control unit 20A, and is a processor such as a CPU, a multi-core CPU, an FPGA, or a PLD. The storage device 23 is, for example, a flash memory, but may also be an SSD. The control device 21, RAM 22, storage device 23, wired network I / F 24, and wireless network I / F 25 are connected via, for example, an internal bus. The control device 21, RAM 22, and storage device 23 may be configured as an SoC (System On Chip) that integrates them into a single chip. The authentication device 20 may also include a reading / writing device (not shown) that reads and writes programs and data from / to a removable recording medium 200, such as an optical disk (e.g., FD, CD, DVD, BD), or flash memory. The reading / writing device may be an FDD, CDD, DVDD, BDD, USB, or the like.

[0027] The wired network I / F 24 is an Ethernet I / F and includes a controller and an Ethernet cable connector. The wired network I / F 24 realizes data communication with the terminal device 30 via an Ethernet connection under the control of the control device 21. The wireless network I / F 25 includes an LTE or 5G modem and antenna. Based on the control of the control device 21, the modem modulates data transmitted from the terminal device 30 into a wireless signal, transmits the signal from the antenna to the wireless base station BS, and demodulates the wireless signal received from the wireless base station BS by the antenna.

[0028] As shown in FIG. 3(b), the control device 21 executes an acquisition unit 51, a determination unit 52, an authentication request unit 53, a registration unit 54, and a communication unit 55 as a control unit 20A. These processing units are programs that realize the functions of the control unit 20A of the authentication device 20, and the programs can be stored in a flash memory serving as the storage device 23 or in the recording medium 200. The programs are read from the flash memory or the recording medium 200 to the RAM 22 by the storage device 23 or a reading / writing device, and are then executed by the control device 21. The acquisition unit 51, the determination unit 52, the authentication request unit 53, and the registration unit 54 are an authentication request program characteristic of this embodiment, and the communication unit 55 is a communication control program. Each control unit included in the control unit 20A may be configured as a hardware circuit instead of a program. The RAM 22 and the storage device 23 constitute a storage unit 20B of the authentication device 20. The storage unit 20B stores, for example, a terminal device list 70.

[0029] 5 is a diagram showing a terminal device list provided in the authentication device. The terminal device list 70 is a list in which the terminal devices 30 authenticated by the authentication device 20 are registered. The terminal device list 70 stores terminal device identification information (1 to m) authenticated by the authentication device 20. As described above, the terminal device identification information is, for example, a MAC address. As described above, the terminal device identification information may be the CPU ID of the CPU included in the terminal device 30. The terminal device list 70 is automatically generated by the authentication device 20 when the authentication server 10 permits it and the authentication device 20 registers the MAC addresses of the terminal devices 30 . The authentication device 20 has only one wired network I / F for connecting the terminal device 30 by wire, and the authentication device 20 can connect only one terminal device 30. However, the terminal device list 70 shown in Fig. 5 has multiple terminal device identification information registered. This assumes that a terminal device 30 may be replaced with another terminal device 30 for the authentication device 20, and a terminal device 30 that has once been authenticated by the authentication device 20 can be replaced and connected without being authenticated again.

[0030] Alternatively, only one terminal device 30 may be authenticated by the authentication device 20. When one terminal device 30 is authenticated by the authentication device 20 and another terminal device 30 is connected and authenticated, the authentication server 10 deletes the MAC address of the previous terminal device 30 from the authenticated terminal device list 60, and transmits the deleted MAC address to the authentication device 20 to delete the MAC address from the terminal device list 70. Furthermore, for a terminal device 30 that has been authenticated once, it is possible to cancel authentication for a specific authentication device 20 by deleting it from the authentication terminal device list 60, and in that case, the MAC address is deleted from the terminal device list 70 of the authentication device 20 whose authentication has been cancelled.

[0031] Returning to the explanation of FIG. 3, the processing by the control unit of the authentication device 20 will be explained. The acquisition unit 51 acquires a MAC address from the terminal device 30 connected to the wired network I / F 24. The MAC address is written in a frame transmitted from the terminal device 30 and can be easily acquired. In order to easily and appropriately acquire the MAC address, it is advantageous that the authentication device 20 and the terminal device 30 are connected via a wired connection using an Ethernet cable. It is also possible to connect the terminal device 30 and the authentication device 20 via wireless technology such as Bluetooth (registered trademark) and acquire terminal device identification information from the terminal device 30. The determination unit 52 refers to the terminal device list 70 and determines whether or not the MAC address acquired by the acquisition unit 51 has already been registered in the terminal device list 70. The authentication request unit 53 transmits authentication request information including the MAC address that is not registered in the terminal device list 70 to the authentication server 10 to request authentication.

[0032] The registration unit 54 registers the MAC address of the terminal device 30 to which registration permission information has been sent from the authentication server 10 in the terminal device list 70. The registration unit 54 also deletes from the terminal device list 70 the MAC address of the terminal device 30 to which deregistration information has been sent from the authentication server 10. The communication unit 55 filters (MAC address filtering) communication frames from the terminal device 30 in accordance with the terminal device list 70. That is, if the source MAC address specified in a communication frame input from the terminal device 30 connected to the wired network I / F 24 is registered in the terminal device list 70, the communication unit 55 relays the communication frame to the wireless network I / F 25, and if the source MAC address is not registered in the terminal device list 70, the communication frame is discarded without being relayed to the wireless network I / F 25.

[0033] FIG. 6 is a flowchart illustrating the terminal device authentication process performed by the authentication device. In step S101, the authentication device 20 (acquisition unit 51) determines whether or not the terminal device 30 is connected. When it is determined that the terminal device 30 is connected (Yes in step S101), the authentication device 20 (acquisition unit 51) acquires a MAC address from the terminal device 30 in step S102. The authentication device 20 (determination unit 52) ​​refers to the terminal device list in step S103, and determines whether or not the MAC address acquired from the terminal device 30 is registered in the terminal device list in step S104. If the acquired MAC address is registered in the terminal device list 70 (Yes in step S104), the authentication device 20 ends the current terminal device authentication process since authentication has already been completed for the terminal device 30. If the acquired MAC address is not registered in the terminal device list 70 (No in step S104), the authentication device 20 (authentication request unit 53) sends the acquired MAC address to the authentication server 10 to request authentication of the terminal device 30, and terminates the current terminal device authentication process. If the authentication device 20 determines in step S101 that the terminal device 30 has not been connected (No in step S101), it determines in step S111 whether or not there has been a response to the authentication request from the authentication server 10. If it determines that there has been no response to the authentication request from the authentication server 10 (No in step S111), the authentication device 20 ends the current terminal device authentication process. If it is determined that a response to the authentication request has been received from the authentication server 10 (Yes in step S111), the authentication device 20 determines in step S112 whether or not the response includes registration permission information. If it is determined that the response contains registration permission information (Yes in step S112), the authentication device 20 (registration unit 54) registers the permitted MAC address in the terminal device list 70 and ends the current terminal device authentication process. If it is determined that the response does not contain registration permission information (No in step S112), the authentication device 20 ends the current terminal device authentication process without doing anything.

[0034] FIG. 7 is a flowchart illustrating the terminal device registration process performed by the authentication server. In step S201, the authentication server 10 (acquisition unit 41) determines whether or not an authentication request for the terminal device 30 has been made from the authentication device 20. If it is determined that there has been no authentication request from the authentication device 20 (No in step S201), the authentication server 10 terminates the terminal device registration process. If it is determined that there has been an authentication request from the authentication device 20 (Yes in step S201), the authentication server 10 (acquisition unit 41) acquires the MAC address included in the authentication request in step S202. In step S203, the authentication server 10 (authentication unit 42) refers to the authentication terminal device list corresponding to the authentication device 20 that made the authentication request, and in step S204, determines whether the acquired MAC address is registered in the authentication terminal device list 60.

[0035] If it is determined that the acquired MAC address is registered in the authentication terminal device list 60 (Yes in step S204), the authentication server 10 (transmitter 44) transmits registration permission information for the acquired MAC address to the authentication device 20 that made the authentication request in step S205, and terminates the terminal device registration process. If it is determined in step S204 that the acquired MAC address is not registered in the authentication terminal device list 60 (No in step S204), the authentication server 10 (display unit 46) displays a screen (authentication screen) on the display device 15 in step S206, which allows the administrator to select whether to allow or disallow registration of the acquired MAC address.

[0036] In step S207, the authentication server 10 determines whether or not an authorization operation has been performed on the authentication screen. If it is determined that an authorization operation has been performed (Yes in step S207), the authentication server 10 (registration unit 43) registers the MAC address in the authentication terminal device list 60 corresponding to the authentication device 20 that has made the authentication request in step S208. In step S209, the authentication server 10 (transmitter 44) transmits the registration permission information of the MAC address to the authentication device 20 that has made the authentication request, and ends the terminal device registration process. If it is determined in step S207 that a denial operation has been performed (No in step S207), in step S210, the authentication server 10 (transmitter 44) transmits MAC address registration denial information to the authentication device 20 that made the authentication request, and terminates the terminal device registration process. If the authentication server 10 determines that the acquired MAC address is not registered in the authentication terminal device list 60 (No in step S204), it may end the terminal device registration process without performing steps S206 to S209. In other words, the authentication server 10 may authenticate the terminal device 30 using only the registered contents of the authentication terminal device list 60.

[0037] FIG. 8 is a flowchart illustrating a communication control process by the authentication device using the terminal device list. In step S301, the authentication device 20 (communication unit 55) determines whether a communication frame from the terminal device 30 has been input to the wired network I / F 24. If it is determined that a communication frame has been input (Yes in step S301), the authentication device 20 (communication unit 55) acquires the MAC address included in the communication frame in step S302. The authentication device 20 (communication unit 55) refers to the terminal device list in step S303, and determines whether the MAC address acquired from the communication frame is registered in the terminal device list in step S304. If the acquired MAC address is registered in the terminal device list 70 (Yes in step S304), the authentication device 20 (communication unit 55) relays the communication frame to the wireless network I / F 25 in step S305 and terminates the communication control process. If the acquired MAC address is not registered in the terminal device list 70 (No in step S304), the authentication device 20 (communication unit 55) discards the communication frame without relaying it to the wireless network I / F 25 in step S306 and terminates the communication control process.

[0038] As explained in Figures 6 to 8, in this embodiment, the authentication process of the terminal device (processing for creating a terminal device list) and the actual communication control (access control) process using the terminal device list are explained separately. That is, when the terminal device 30 and the authentication device 20 are first connected via Ethernet and a link is established, the authentication process is performed regardless of whether access control is being executed. However, authentication may also be performed when communication with an external network as a destination is first performed after the terminal device 30 and the authentication device 20 are first connected via Ethernet and a link is established. The processes in Figures 6 and 7 may be executed as subroutines in Figure 8.

[0039] As described above, the authentication server 10 can also instruct the authentication device 20 to de-authenticate the terminal device 30 (to delete it from the terminal device list). FIG. 9 is a flowchart illustrating the deauthentication process performed by the authentication server and the authentication device. 9(a) shows the deauthentication process by the authentication server 10. The deauthentication of the terminal device 30 is performed, for example, by an explicit deletion process from the authenticated terminal device list 60. The deauthentication process is typically performed when a specific terminal device 30 was once authorized in the process of step S207 in FIG. 7, but it is desired to deauthenticate it due to a subsequent change in security policy, etc. In addition, the deauthentication process can also be performed when a terminal device 30 that has already been authenticated to one authentication device 20 is to be authenticated to another authentication device 20. In step S401, the authentication server 10 (registration unit 43) determines whether or not a deletion operation has been performed on the terminal device identification information corresponding to a specific authentication device 20 in the authentication terminal device list 60. When it is determined that a deletion operation has been performed (Yes in step S401), the authentication server 10 (registration unit 43) deletes the terminal device identification information of the terminal device 30 designated by the operation in step S402. In step S403, the authentication server 10 (transmitter 44) transmits, to the corresponding authentication device 20, deletion instruction information that instructs the deletion of the MAC address related to the deletion operation, and then ends the deauthentication process.

[0040] 9(b) shows the authentication deactivation process by the authentication device 20. In step S411, the authentication device 20 (registration unit 54) determines whether or not deletion instruction information has been received from the authentication server 10. If it is determined that deletion instruction information has been received (Yes in step S411), the authentication device 20 (registration unit 54) deletes the MAC address specified in the deletion instruction information from the terminal device list 70 in step S412, and ends the authentication deactivation process. In this way, the authentication server 10 can collectively de-authenticate the authentication devices 20 for the terminal devices 30 that should be de-authenticated, so that the terminal devices 30 can be managed appropriately to keep the system secure.

[0041] According to this embodiment configured as described above, even in an environment where many terminal devices 30 are connected, such as an IoT environment, the authentication device 20, which serves as a router device connecting the terminal devices 30, and the authentication server 10 work together to easily control access to an external network (e.g., a carrier network) of the terminal device 30, without the cost or effort of introducing special programs into the terminal devices 30. This embodiment is not limited to the embodiment described above, and various configurations or embodiments can be adopted within the scope of the gist of this embodiment. [Explanation of symbols]

[0042] 1 Communication system, 10 Authentication server, 10A Control unit, 10B Memory unit, 11 Control device, 12 RAM, 13 Storage device, 14 Network I / F, 15 Display device, 16 Input device, 17 Reading / writing device, 41 Acquisition unit, 42 Authentication unit, 43 Registration unit, 44 Transmission unit, 45 Input unit, 46 Display unit, 20 Authentication device, 20A Control unit, 20B Memory unit, 21 Control device, 22 RAM, 23 Storage device, 24 Wired network I / F, 25 Wireless network I / F, 51 Acquisition unit, 52 Determination unit, 53 Authentication request unit, 54 Registration unit, 55 Communication unit, 60 Authentication terminal device list, 70 Terminal device list, 30 Terminal device, 200 Recording medium

Claims

1. An authentication system including an authentication device to which a terminal device is connected and an authentication server, the authentication device acquires identification information from the connected terminal device, and makes an authentication request for the terminal device to the authentication device to the server device based on the identification information; the server device authenticates the terminal device based on the authentication request; An authentication system comprising:

2. 2. The authentication system according to claim 1, The authentication device a permission list storing identification information of authenticated terminal devices; If the identification information acquired from the terminal device is not registered in the permission list, an authentication request is sent to the authentication server to request registration of the identification information in the permission list; The authentication server determining whether to permit or not permit the registration requested in the authentication request, and if the registration is permitted, transmitting registration permission information for the identification information to the authentication device that made the authentication request; The authentication device registering the identification information related to the registration permission information transmitted from the authentication server in the permission list; An authentication system comprising:

3. an acquisition unit that acquires, from an authentication device connected to a terminal device, an authentication request that requests registration of identification information of the terminal device in an authorization list included in the authentication device; an authentication unit that determines whether or not to permit registration of the identification information requested in the authentication request; a transmitting unit that transmits registration permission information for the identification information to the authentication device that has made the authentication request when the registration is permitted; An authentication server comprising:

4. 4. The authentication server according to claim 3, an authentication list storing identification information of authenticated terminal devices for each authentication device; the authentication unit permits registration of the identification information specified in the authentication request in the authorization list when the identification information is registered in the authentication list for the authentication device that made the authentication request.

1. An authentication server comprising:

5. 4. The authentication server according to claim 3, an authentication list in which identification information of authenticated terminal devices is stored in advance for each authentication device; the authentication unit displays an operation screen on a display device that allows the user to select whether to allow or not allow registration of the identification information specified in the authentication request, and when an allow operation is performed on the operation screen, allows the authentication request and registers the identification information in the authentication list in association with the authentication device that made the authentication request.

1. An authentication server comprising:

6. 6. The authentication server according to claim 4, the authentication unit is capable of deleting identification information stored for each authentication device from the authentication list; the transmitting unit transmits, to the corresponding authentication device, deletion instruction information instructing the corresponding authentication device to delete the identification information from the permission list in response to the deletion.

1. An authentication server comprising:

7. An authentication device to which a terminal device is connected, an authorization list storing identification information of authenticated terminal devices; an acquisition unit that acquires identification information from the connected terminal device; an authentication request unit that, if the acquired identification information is not registered in the permission list, sends an authentication request to an authentication server requesting registration of the identification information in the permission list; a registration unit that, when registration permission information permitting the registration is transmitted from the authentication server, registers identification information related to the registration permission information in an authorization list; An authentication device comprising:

8. 8. The authentication device according to claim 7, When receiving deletion instruction information from the authentication server instructing the deletion of the identification information, the registration unit deletes the identification information instructed by the deletion instruction information from the permission list. An authentication device comprising:

9. 9. The authentication device according to claim 7, the authentication device is a router device connectable to a base station of a mobile carrier network, permitting communication from the terminal device whose identification information is registered in the permission list to the base station; not permitting communication from the terminal device whose identification information is not registered in the permission list to the base station; An authentication device characterized by:

10. An authentication control method executed by a processor of an authentication server, comprising: The processor: receiving an authentication request from an authentication device connected to the terminal device, requesting registration of identification information of the terminal device in an authorization list provided in the authentication device; determining whether to permit or not permit registration of the identification information requested in the authentication request; If the registration is permitted, permission information for the identification information is transmitted to the authentication device that made the authentication request.

1. An authentication control method comprising:

11. An authentication request method for causing a processor of an authentication device to which a terminal device is connected to execute the method, the authentication device includes a permission list storing identification information of authenticated terminal devices; The processor: Acquire identification information from the connected terminal device; If the acquired identification information is not registered in the permission list, an authentication request is sent to an authentication server requesting registration of the identification information in the permission list; When registration permission information permitting the registration is transmitted from the authentication server, the identification information relating to the registration permission information is registered in the permission list.

10. An authentication request method comprising:

Images