Diskless client authentication system, authentication server, program, and diskless client authentication method

Abstract

A diskless client authentication system (10) is configured to include an authentication server (100) and a filter (230) that is on a communication path between a diskless client (280) and a file server (200) which stores a startup file. The authentication server (100) comprises: an address allocation unit that allocates a network address to the diskless client (280); an authentication unit that authenticates the diskless client (280) to which the network address has been allocated; and a client control unit that, when the diskless client (280) which has been allocated the network address is in an unauthenticated state, instructs the authentication unit to authenticate said diskless client (280), and gives an instruction to permit communication between said diskless client (280) and the file server (200) when authentication is successful.

Description

[Technical Field]

[0001] The present invention relates to a diskless client authentication system, an authentication server, a program, and a diskless client authentication method for authenticating a diskless client before the system is started. [Background technology]

[0002] A diskless client is a system that does not store an OS (Operating System), application programs, user data, etc., and is dependent on a server (file server). Diskless clients have the following advantages: they are less prone to failure because they do not have a hard disk drive (HDD), which is prone to failure; they are easy to set up because a system with the same configuration can be easily replicated; and when reset, they are highly resilient because they restart with the same configuration as when they were last started.

[0003] The general operations performed when a diskless client boots are as follows (1) to (3): (1) Network configuration information (such as IP address, netmask value, and gateway address) is obtained and set using DHCP (Dynamic Host Configuration Protocol) or similar. (2) A boot file is obtained from a TFTP (Trivial File Transfer Protocol) server and executed. (3) The OS (OS loader and other files) is obtained using NFS (Network File System) or similar, and the OS is started.

[0004] Diskless clients are a technology that assumes that the client and network are trustworthy, and startup operations do not include authentication of the client or server. When using a diskless client in an environment where client spoofing is possible, client authentication is required. Non-Patent Document 1 discusses three terminal authentication methods for diskless clients. [Prior art documents] [Non-patent literature]

[0005] [Non-Patent Document 1] Fumihiko Sawazaki, Sho Nakazawa, "Applying Diskless Client Technology to Software-Based Terminal-Side Transfer Functions," IEICE General Conference 2022, Communications Society B-6-24, March 15, 2022. Summary of the Invention [Problem to be solved by the invention]

[0006] Non-Patent Document 1 proposes authentication using a Media Access Control Address (MAC), authentication using a public key, and authentication using a line (for example, the NGN (Next Generation Network) standard). However, it has been pointed out that the scenarios in which these methods can be used are limited, and that they require modification of the software that is used as the de facto standard, as well as modification of the firmware installed in the diskless client. It is desirable to be able to perform authentication using widespread technology (technology that is installed as standard) installed in diskless client products that are generally available on the market, regardless of the manufacturer. The present invention has been made in view of the above background, and aims to enable authentication of diskless clients using widely available technology. [Means for solving the problem]

[0007] In order to solve the above-mentioned problems, the diskless client authentication system of the present invention is configured to include an authentication server for a diskless client, and a filter on a communication path between the diskless client and a file server storing a startup file for the diskless client, wherein the filter permits or prohibits communication between the diskless client and the file server in response to an instruction from the authentication server, and the authentication server includes a storage unit having a client management database that stores identification information and an authentication status of the diskless client in association with each other, an address allocation unit that executes a process of assigning a network address to the diskless client, and a network ... Before the OS starts the client control unit is configured to instruct the filter to permit or prohibit communication between the diskless client and the file server; and if a diskless client to which a network address has been assigned is in an unauthenticated state by referring to the client management database, instruct the authentication unit to perform processing to authenticate the diskless client, and if the authentication processing is successful, instruct the filter control unit to permit communication between the diskless client and the file server. [Effects of the Invention]

[0008] The present invention allows for authentication of diskless clients using pervasive technologies. [Brief explanation of the drawings]

[0009] [Figure 1] 1 is a diagram illustrating the overall configuration of a diskless client authentication system according to an embodiment of the present invention. [Figure 2] FIG. 2 is a functional block diagram of an authentication server according to the embodiment. [Figure 3] FIG. 3 is a data configuration diagram of a client management database according to the embodiment. [Figure 4] FIG. 10 is a sequence diagram of an authentication process according to the present embodiment. [Figure 5] FIG. 10 is a sequence diagram of a termination process according to the present embodiment. [Figure 6] FIG. 2 is a hardware configuration diagram illustrating an example of a computer that realizes the functions of an authentication server according to the present embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0010] <<Diskless Client Authentication System Overview>> The following describes a diskless client authentication system in an embodiment (convention) for carrying out the present invention. The diskless client authentication system includes an authentication server and a filter. The filter is located between the diskless client and a file server (storage) that stores boot files and OS files, and filters communication data. The filter is, for example, a router (edge ​​router), and filters IP datagrams based on MAC addresses, network addresses, and protocols. In principle, the filter prohibits communication between the diskless client and the file server. However, if the authentication server issues an instruction to permit communication, the filter will permit communication between the diskless client and the file server until it receives an instruction to prohibit communication.

[0011] The authentication server assigns an IP address to the diskless client using DHCP, and then authenticates the diskless client using standard hardware-based management authentication functions. If authentication is successful, the authentication server instructs the filter to allow communication between the diskless client and the file server and instructs the diskless client to reboot. After rebooting, the diskless client can communicate with the file server and starts the OS according to the normal procedure. If authentication fails, communication between the diskless client and the file server remains prohibited, and the diskless client cannot start the OS.

[0012] This diskless client authentication system allows only authenticated diskless clients to boot (the OS) using diskless clients equipped with popular technologies or existing file servers. This eliminates the need to modify diskless clients or file servers, making it easier to introduce diskless client systems.

[0013] <<Overall configuration of the diskless client authentication system>> 1 is a diagram illustrating the overall configuration of a diskless client authentication system 10 according to this embodiment. The diskless client authentication system 10 includes an authentication server 100 and a filter 230. The diskless client authentication system 10 may further include a boot file server 210 and a storage server 220.

[0014] The boot file server 210 is, for example, a TFTP server, and transmits a boot file (for example, a boot image of PXE (Preboot eXecution Environment)) in response to a request from the diskless client 280. The storage server 220 is, for example, an NFS server, and exchanges an OS, application programs, and user data in response to a request from the diskless client 280. Hereinafter, the boot file server 210 and the storage server 220 will be collectively referred to as the file server 200.

[0015] The filter 230 is installed between the network to which the diskless client 280 is connected and the network to which the file server 200 is connected, and filters communication data. The filter 230 performs filtering based on, for example, a physical address, a network address (IP address), or a protocol (for example, a port number).

[0016] The filter 230 permits communication for setting network information, including network addresses, exchanged between the diskless client 280 and the authentication server 100, and communication for authentication. However, the filter 230 generally prohibits (filters) communication between the diskless client 280 and the file server 200. When the authentication server 100 issues an instruction to permit communication, the filter 230 permits communication between the specified diskless client 280 and the file server 200. Communication between other diskless clients 280 and the file server 200 remains prohibited. When the authentication server 100 issues an instruction to prohibit communication, the filter 230 prohibits communication between the specified diskless client 280 and the file server 200.

[0017] <Authentication server configuration> 2 is a functional block diagram of the authentication server 100 according to this embodiment. The authentication server 100 is a computer, and includes a control unit 110, a storage unit 120, and an input / output unit 180. User interface devices such as a display, keyboard, and mouse are connected to the input / output unit 180. The input / output unit 180 includes a communication device, and is capable of transmitting and receiving data to and from the filter 230 and the diskless client 280. A media drive may also be connected to the input / output unit 180, enabling data exchange using a recording medium.

[0018] ≪Storage section≫ The storage unit 120 includes storage devices such as a read-only memory (ROM), a random access memory (RAM), and a solid-state drive (SSD). The storage unit 120 stores a client management database 130, an address management database 140, and a program 128. The program 128 includes a description of the processing procedure of the authentication server 100 in the authentication process (see FIG. 4) described below.

[0019] 3 is a data configuration diagram of the client management database 130 according to this embodiment. The client management database 130 is, for example, data in a table format, with rows (records) indicating the status of the diskless client 280. The records include columns (attributes) of physical address, network address, authentication status, authentication date and time, and authentication information.

[0020] The physical address indicates the physical address of the diskless client 280, for example, an Ethernet address. The physical address is referred to as identification information of the diskless client 280. The network address indicates the network address assigned to the diskless client 280, for example, an assigned IP address. The authentication status indicates whether the diskless client 280 has been successfully authenticated (authenticated / unauthenticated (including pre-authentication and authentication failure)). The authentication date and time indicates the date and time when the diskless client 280 was last authenticated (only the time is shown in FIG. 3).

[0021] The authentication information indicates information that is referenced when authenticating the diskless client 280, and is, for example, a public key or secret information (password) shared with the diskless client 280. The authentication information, together with the physical address, is set (registered) in advance. The client management database 130 may also include other information (attributes), such as the date and time when authentication was successful, or the date and time when a network address was assigned.

[0022] Returning to Figure 1, we will continue to explain storage unit 120. Address management database 140 stores network addresses assigned to diskless clients 280. Each network address is associated with information such as whether it has already been assigned, the expiration date of the assignment, the physical address of the assigned diskless client 280, and the physical address of the diskless client 280 that was last assigned.

[0023] <Control Unit> The control unit 110 includes a CPU (Central Processing Unit), and is provided with an address allocation unit 111, an authentication unit 112, a client control unit 113, and a filter control unit 114.

[0024] The address allocation unit 111 allocates a network address to the diskless client 280. The address allocation unit 111 also notifies the diskless client 280 of various network setting information (for example, a default gateway or the network address of the boot file server 210). The address allocation unit 111 performs allocation and notification using, for example, DHCP.

[0025] The authentication unit 112 authenticates the diskless client 280. At the start of authentication, the diskless client 280 has already been assigned a network address, but is in a state before the OS has started. The authentication unit 112 performs authentication using an authentication function of the hardware-based management of the diskless client 280. Examples of hardware-based management include Intel AMT (Active Management Technology) and AMD PRO. The authentication unit 112 authenticates the diskless client 280 using an authentication function that is standardly installed in the hardware of the diskless client 280. The client control unit 113 controls the diskless client 280 by instructing it to perform authentication processing, rebooting, and the like.

[0026] The filter control unit 114 instructs the filter 230 to filter communications between the diskless client 280 and the file server 200. For example, the filter control unit 114 notifies the filter of the physical address and network address of the diskless client 280 and instructs it to permit communications between the diskless client 280 and the file server 200. Upon receiving the instruction, the filter 230 refers to the physical address, network address, port number (protocol identification information), etc., and permits the passage of communication data exchanged between the diskless client 280 and the file server 200.

[0027] <Authentication process> Fig. 4 is a sequence diagram of authentication processing according to this embodiment. With reference to Fig. 4, the processing from when the diskless client 280 is started (powered on) until the OS is started will be described. In Fig. 4, the diskless client 280 is referred to as the "client" and the client control unit 113 is referred to as the "C control unit."

[0028] In step S11, the diskless client 280 and the address allocation unit 111 execute a network address allocation process using, for example, DHCP. In addition to the network address allocation, the addresses of the default gateway and the boot file server 210 are notified.

[0029] If the authentication status of the record of the diskless client 280 identified by the physical address in the client management database 130 (see FIG. 3) is "authenticated," the address allocation unit 111 allocates a network address to the network address of that record.

[0030] If there is no record for diskless client 280 in client management database 130 (if it is not registered), address allocation unit 111 notifies diskless client 280 of an error and does not allocate an address. If the authentication status of the record is "unauthenticated," address allocation unit 111 refers to address management database 140 and allocates an unallocated network address. The reason for this processing will be described later.

[0031] In step S12, the address allocation unit 111 updates the client management database 130. More specifically, if an unallocated network address is allocated in step S11, the address allocation unit 111 updates the network address in the record of the diskless client 280 identified by the physical address to the network address allocated in step S11. The authentication status of the record is "unauthenticated."

[0032] When the authentication status in the client management database 130 is "authenticated" and a network address is assigned to the network address, the address assignment unit 111 does not update the client management database 130. In step S13, address allocation unit 111 notifies client control unit 113 of the physical address of diskless client 280 to which the address has been allocated.

[0033] In step S14, client control unit 113 refers to client management database 130 and acquires the authentication status of diskless client 280 notified in step S13. If authenticated (step S14→YES), client control unit 113 ends the authentication process, and if not authenticated (step S14→NO), proceeds to step S15. The operation of diskless client 280 after authentication server 100 has completed the authentication process will be described later.

[0034] In step S 15 , the client control unit 113 instructs the authentication unit 112 to execute authentication processing for the diskless client 280 . In step S16, the diskless client 280 and the authentication unit 112 execute an authentication process. In step S17, the authentication unit 112 updates the client management database 130. More specifically, the authentication unit 112 updates the authentication status to "authenticated" or "unauthenticated" depending on whether the authentication was successful or unsuccessful.

[0035] In step S18, authentication unit 112 notifies client control unit 113 of the result of the authentication process (see step S16). In step S19, if the authentication is successful (step S19→YES), client control unit 113 proceeds to step S20, and if it is unsuccessful (step S19→NO), ends the authentication process.

[0036] In step S 20 , the client control unit 113 notifies the filter control unit 114 of the physical address and network address of the diskless client 280 , and instructs the filter control unit 114 to permit communication between the diskless client 280 and the file server 200 . In step S 21 , the filter control unit 114 notifies the filter 230 of the physical address and network address of the diskless client 280 , and instructs the filter 230 to permit communication between the diskless client 280 and the file server 200 .

[0037] In step S22, the client control unit 113 instructs the diskless client 280 to reboot. Upon receiving the reboot instruction, the diskless client 280 reboots and returns to step S11. At this point, communication between the diskless client 280 and the file server 200 is possible, so normal startup processing can be performed. That is, the rebooted diskless client 280 acquires a network address and other network information (see step S11), acquires and executes a boot file from the boot file server 210, and acquires and executes an OS loader and other files from the storage server 220, thereby starting the OS. The assigned network address is the same as the previous one (the network address acquired in an unauthenticated state, see step S11) because the client has already authenticated.

[0038] <<Termination processing>> 5 is a sequence diagram of the termination process according to this embodiment. With reference to FIG. 5, the process will be described for when an address release notification is received from the diskless client 280, when the network address allocation period has expired, when an instruction to disconnect the diskless client 280 is received from the administrator, and so on.

[0039] In step S31, the address allocation unit 111 updates the client management database 130 (see FIG. 3). More specifically, the address allocation unit 111 sets the network address corresponding to the diskless client 280 to "N / A," the authentication status to "unauthenticated," and the authentication date and time to "N / A." Note that "N / A" is an abbreviation for "Not Applicable," meaning not applicable, inapplicable, invalid, etc. The address allocation unit 111 also updates the network address that was assigned to the diskless client 280 in the address management database 140 to an unassigned state.

[0040] In step S 32 , the address allocation unit 111 notifies the client control unit 113 of the physical address of the diskless client 280 . In step S 33 , the client control unit 113 notifies the filter control unit 114 of the physical address of the diskless client 280 and instructs the filter control unit 114 to prohibit communication between the diskless client 280 and the file server 200 . In step S34, the filter control unit 114 notifies the filter 230 of the physical address of the diskless client 280 and instructs the filter 230 to prohibit (filter) communication between the diskless client 280 and the file server 200.

[0041] <Features of the diskless client authentication system> When diskless client 280 connects to the network or starts up, authentication server 100 assigns a network address (see step S11) and performs authentication (see step S16). If authentication is successful (see step S19 → YES), authentication server 100 permits communication with file server 200 (see step S21). If authentication is unsuccessful, for example, because the diskless client 280 is not registered in client management database 130, the diskless client 280 cannot communicate with file server 200 and cannot start its OS. The authentication process is performed using a function of hardware-based management, a widespread technology, and is available for many diskless clients on the market. Furthermore, no intervention by the user of diskless client 280 is required, and usability remains unchanged from conventional methods.

[0042] <<Variation: Restart Instructions>> In the above-described embodiment, authentication server 100 instructs diskless client 280 to reboot (see step S22) after successful authentication processing (see step S16). If diskless client 280 is attempting to access boot file server 210 while authentication processing is being performed, the reboot instruction may be omitted.

[0043] For example, if the authentication process is completed within the time period equal to the product of the TFTP packet timeout time and the number of packet retransmissions, the reboot instruction may be omitted. Once communication is permitted (see step S21), the diskless client 280 can access the boot file server 210, and can continue with the normal startup process, including network address acquisition (see step S11).

[0044] <<Variations>> Although several embodiments of the present invention have been described above, these embodiments are merely examples and do not limit the technical scope of the present invention. For example, authentication server 100 includes address assignment unit 111 and assigns network addresses to diskless clients 280, but it may also be separated as a network address assignment server (DHCP server). However, the assigned network address is assigned to authenticated diskless clients 280.

[0045] In the embodiment described above, the address allocation unit 111 updates the authentication status of the diskless client 280 in the client management database 130 (see FIG. 3) to "unauthenticated" (see step S31 in FIG. 5). Alternatively, the client control unit 113 may update the authentication status after receiving a notification (see step S32).

[0046] The present invention can take on various other embodiments, and various modifications such as omissions and substitutions can be made without departing from the spirit of the present invention. These embodiments and modifications are included in the scope and spirit of the invention described in this specification, etc., and are also included in the invention described in the claims and their equivalents.

[0047] <Hardware configuration> The authentication server 100 according to the embodiment described above is realized by a computer 900 having a configuration as shown in Fig. 6, for example. Fig. 6 is a hardware configuration diagram showing an example of a computer 900 that realizes the functions of the authentication server 100 according to this embodiment. The computer 900 includes a CPU 901, a ROM 902, a RAM 903, an SSD 904, an input / output interface 905 (referred to as an input / output I / F (Interface) in Fig. 6), a communication interface 906 (referred to as a communication I / F in Fig. 6), and a media interface 907 (referred to as a media I / F in Fig. 6). The computer 900 may include an HDD (Hard Disc Drive) instead of the SSD 904, or may include an HDD in addition to the SSD 904.

[0048] The CPU 901 operates based on a program stored in the ROM 902 or the SSD 904, and performs control by the control unit 110 in Fig. 2. The ROM 902 stores a boot program executed by the CPU 901 when the computer 900 starts up, programs related to the hardware of the computer 900, and the like. The CPU 901 controls an input device 910 such as a mouse or keyboard, and an output device 911 such as a display or printer, via an input / output interface 905. The CPU 901 acquires data from the input device 910 via the input / output interface 905, and outputs generated data to the output device 911.

[0049] The SSD 904 stores programs executed by the CPU 901 and data used by the programs. The communication interface 906 receives data from other devices (not shown) (for example, the filter 230 or the diskless client 280) via a communication network and outputs the data to the CPU 901, and also transmits data generated by the CPU 901 to other devices via the communication network. The media interface 907 reads a program or data stored in the recording medium 912 and outputs it to the CPU 901 via the RAM 903. The CPU 901 loads the program from the recording medium 912 onto the RAM 903 via the media interface 907 and executes the loaded program. The recording medium 912 is an optical recording medium such as a DVD (Digital Versatile Disk), a magneto-optical recording medium such as an MO (Magneto Optical disk), a magnetic recording medium, a conductive memory tape medium, a semiconductor memory, or the like.

[0050] For example, when the computer 900 functions as the authentication server 100 according to the embodiment described above, the CPU 901 of the computer 900 executes the program 128 (see FIG. 2) loaded onto the RAM 903, thereby realizing the functions of the authentication server 100. The CPU 901 reads the program from the recording medium 912 and executes it. Alternatively, the CPU 901 may read the program from another device via a communication network, or may install the program 128 from the recording medium 912 onto the SSD 904 and execute it.

[0051] Effect The effects of the diskless client authentication system 10 will be described below.

[0052] The diskless client authentication system 10 according to the above embodiment includes an authentication server 100 for the diskless client 280, and a filter 230 located on the communication path between the diskless client 280 and a file server 200 that stores startup files (boot files and OS files) for the diskless client 280. The filter 230 permits or prohibits communication between the diskless client 280 and the file server 200 according to instructions from the authentication server 100 . The authentication server 100 includes a storage unit 120 that includes a client management database 130 that stores identification information (physical addresses) of diskless clients 280 in association with their authentication states. The authentication server 100 includes an address assignment unit 111 that executes a process of assigning a network address to the diskless client 280 . The authentication server 100 includes an authentication unit 112 that performs a process of authenticating a diskless client 280 that has been assigned a network address. The authentication server 100 includes a filter control unit 114 that instructs the filter 230 to permit or prohibit communication between the diskless client 280 and the file server 200 . The authentication server 100 has a client control unit 113 that, if a diskless client 280 to which a network address has been assigned is in an unauthenticated state by referring to the client management database 130, instructs the authentication unit to execute a process to authenticate the diskless client, and if the authentication process is successful, instructs a filter control unit 114 to allow communication between the diskless client 280 and the file server 200.

[0053] According to this diskless client authentication system 10, a diskless client 280 that is successfully authenticated can access the file server 200 and successfully boots up (the OS / system). A diskless client 280 that is unsuccessful in authentication cannot access the file server 200 and cannot boot up. Authentication can be performed using the functions of hardware-based management, which is a widespread technology, and is available for many diskless clients on the market.

[0054] When the client control unit 113 according to the embodiment instructs the filter control unit 114 to permit communication between the diskless client 280 and the file server 200, the client control unit 113 instructs the diskless client 280 to reboot.

[0055] According to the diskless client authentication system 10, even if the startup process after the authentication process in the diskless client 280 is interrupted, the diskless client 280 can be restarted to access the file server 200 after acquiring the network address again, and can then be started up.

[0056] In the above-described embodiment, when the client control unit 113 receives a notification from the diskless client 280 that the assigned network address has been released, when the network address assignment period has expired, or when an instruction to disconnect the diskless client 280 is received (for example, from an administrator), the client control unit 113 instructs the filter control unit 114 to prohibit communication between the diskless client 280 and the file server 200, and changes the authentication status of the diskless client 280 to unauthenticated.

[0057] According to this diskless client authentication system 10, a diskless client 280 whose network address has been released, whose network address has expired, or whose network address has been designated by an administrator cannot access the file server 200. Consequently, the diskless client 280 cannot be restarted without authentication.

[0058] The filter 230 allows or prohibits the passage of communication data exchanged between the diskless client 280 and the file server 200 based on at least one of the physical address, network address, and protocol identification information (e.g., port number) of the diskless client 280 and the file server 200.

[0059] According to this diskless client authentication system 10, a standard router or switch can be used as the filter 230. [Explanation of symbols]

[0060] 10 Diskless Client Authentication System 100 Authentication Server 111 Address Allocation Unit 112 Authentication Department 113 Client control section 114 Filter control section 130 Client Management Database 200 file servers 230 filters 280 Diskless Clients

Claims

1. 1. A diskless client authentication system including an authentication server for a diskless client, and a filter on a communication path between the diskless client and a file server storing a startup file for the diskless client, The filter is permitting or prohibiting communication between the diskless client and the file server in accordance with an instruction from the authentication server; The authentication server a storage unit including a client management database that stores identification information and authentication status of the diskless client in association with each other; an address assignment unit that executes a process of assigning a network address to the diskless client; an authentication unit that performs a process of authenticating the diskless client that has already been assigned a network address and has not yet started up an OS; a filter control unit that instructs the filter to permit or prohibit communication between the diskless client and the file server; If a diskless client to which a network address has been assigned is in an unauthenticated state by referring to the client management database, the authentication unit is instructed to execute a process to authenticate the diskless client; a client control unit that instructs the filter control unit to permit communication between the diskless client and the file server if the authentication process is successful. Diskless client authentication system.

2. The client control unit When instructing the filter control unit to permit communication between the diskless client and the file server, the diskless client is instructed to reboot.

10. The diskless client authentication system of claim 1.

3. The client control unit When a notification of release of the assigned network address is received from the diskless client, The network address allocation deadline has expired, and When an instruction to disconnect the diskless client is received, Instruct the filter control unit to prohibit communication between the diskless client and the file server, and set the authentication status of the diskless client to unauthenticated.

10. The diskless client authentication system of claim 1.

4. The filter is The communication data exchanged between the diskless client and the file server is permitted or prohibited from passing based on at least one of the physical address, the network address, and the protocol identification information of the diskless client and the file server.

10. The diskless client authentication system of claim 1.

5. an authentication server that is on a communication path between a diskless client and a file server that stores a startup file for the diskless client, and that is communicatively connected to a filter that permits or prohibits communication between the diskless client and the file server, and that authenticates the diskless client, a storage unit including a client management database that stores identification information and authentication status of the diskless client in association with each other; an address assignment unit that executes a process of assigning a network address to the diskless client; an authentication unit that performs a process of authenticating the diskless client that has already been assigned a network address and has not yet started up an OS; a filter control unit that instructs the filter to permit or prohibit communication between the diskless client and the file server; If a diskless client to which a network address has been assigned is in an unauthenticated state by referring to the client management database, the authentication unit is instructed to execute a process to authenticate the diskless client; a client control unit that instructs the filter control unit to permit communication between the diskless client and the file server if the authentication process is successful. Authentication server.

6. A program for causing a computer to function as the authentication server of claim 5.

7. 1. A diskless client authentication method for an authentication server that is on a communication path between a diskless client and a file server that stores a startup file for the diskless client, and is communicatively connected to a filter that permits or prohibits communication between the diskless client and the file server, and that authenticates the diskless client, comprising: The authentication server a storage unit including a client management database that stores identification information of the diskless client in association with an authentication status of the diskless client; performing a process for assigning a network address to the diskless client; a step of authenticating a diskless client that has been assigned a network address and is not yet authenticated by referring to the client management database; and If authentication of the diskless client is successful, instructing the filter to permit communication between the diskless client and the file server. Diskless client authentication method.

Images