JP2006331128A - Authentication server, authentication method, and authentication program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To perform IEEE 802.1X authentication using a newly defined authentication policy.
An authentication server (10) for authenticating whether or not a computer terminal (50) can connect to a network via a NAS (30), and whether or not to connect to the network can be authenticated. An authentication processing unit (12) that performs authentication, and when IEEE 802.1X authentication is affirmed, a policy authentication processing unit (13) that authenticates connection permission based on a predefined authentication policy.
[Selection] Figure 2

Description

The present invention relates to a network connection authentication technique, and more particularly to an authentication technique suitable for IEEE802.1X authentication.

When attempting to connect to a network from a user's computer terminal, the computer terminal makes an access request to a NAS (Network Access Server). The NAS makes an authentication request to the authentication server and asks for confirmation as to whether or not the user has an access right to the network. When the user's right to access the network is affirmed, the NAS connects the user's computer terminal to the network. As an authentication protocol by the authentication server, for example, a RADIUS (Remote Authentication Dial-In User Service) protocol, IEEE 802.1X, or the like is known. The RADIUS protocol is an industry standard protocol that performs user authentication, authorization, and accounting. IEEE 802.1X is a protocol on Ethernet (registered trademark) that authenticates whether or not a LAN access right is granted. As patent documents referring to user authentication, for example, JP 2001-36561 A, JP 2003-513514 A, JP 2004-32525 A, JP 2005-86656 A, and the like are known.
JP 2001-36561 PR Special table 2003-513514 gazette JP 2004-32525 A JP 2005-86656 A

  However, in the authentication in IEEE802.1X, authentication is performed using only a UID (user ID) and a password. If the UID and password are stolen by any means, any computer terminal can connect to the network. Inconvenience arises. In addition, many authentication servers of this type are not equipped with a virus check function, and an expensive server for virus verification is required to strengthen anti-virus measures.

  The present invention has been made in view of such problems, and an object thereof is to propose a new authentication technique for IEEE 802.1X.

  In order to solve the above problems, an authentication server according to the present invention is an authentication server that authenticates whether or not a computer terminal can connect to a network when connected to the network via NAS, and determines whether or not to connect to the network. An authentication processing unit that performs 1X authentication, and a policy authentication processing unit that authenticates connection permission based on a predefined authentication policy when IEEE 802.1X authentication is affirmed. By performing network connection authentication based on the authentication policy, a stronger and more flexible authentication technology can be provided.

  The policy authentication processing unit preferably authenticates whether or not the connection is possible based on a combination of the UID, password, CSID, NAS IP address, and port number of the computer terminal. By adding the CSID of the computer terminal to the policy information, even if the UID and password are leaked, connection is not permitted unless the computer has the CSID registered in the authentication policy. Also, by adding the NAS IP address and its port number to the policy information, the computer terminal can be operated to permit connection only when a connection request is made to a specific port of a specific NAS. The CSID is identification information such as a number uniquely assigned to the network connection device equipped in the computer terminal. The CSID includes a MAC (Media Access Control) address of a computer terminal, a telephone number (for example, a telephone number of an IP phone), and the like.

  The authentication server of the present invention may further include a virus checker operation verification unit that checks whether or not a virus checker is operating on the computer terminal. This makes it possible to check for viruses indirectly. When checking the operation of the virus checker, it is preferable to check whether the virus checker is operating with the computer terminal belonging to the quarantine VLAN. In addition, when it is determined that the virus checker is operating on the computer terminal, it is preferable to transmit a re-authentication request instruction to the NAS. This is because, in order to connect the computer terminal and the network after disconnecting the connection between the computer terminal and the quarantine network, it is necessary to authenticate the connection again.

  An authentication method according to the present invention is a method for authenticating whether or not a computer terminal can connect to a network when connecting to the network via a NAS, wherein the IEEE802.1X authenticates whether or not to connect to the network, and IEEE802.1X A policy authentication step of authenticating whether or not the connection is possible based on a predetermined authentication policy when the authentication is affirmed. By performing network connection authentication based on the authentication policy, a stronger and more flexible authentication technology can be provided.

  In the policy authentication step, it is preferable to authenticate the connection based on the combination of the UID, password, CSID, NAS IP address, and port number of the computer terminal.

  The authentication method of the present invention may further include a virus checker operation verification step of checking whether or not a virus checker is operating on the computer terminal. In the virus checker operation verification step, it is preferable to check whether or not the virus checker is operating with the computer terminal belonging to the quarantine VLAN. In addition, when it is determined that the virus checker is operating on the computer terminal, it is preferable to transmit a re-authentication request instruction to the NAS.

  The authentication program of the present invention is a computer program for causing an authentication server to execute the authentication method of the present invention. This authentication program can be provided by being recorded on a recording medium. As a recording medium, for example, an optical recording medium (a CD-RAM, a CD-ROM, a DVD-RAM, a DVD-ROM, a DVD-R, a PD disk, an MD disk, an MO disk or the like capable of optically reading data) Medium), a magnetic recording medium (a recording medium capable of magnetically reading data such as a flexible disk, a magnetic card, and a magnetic tape), or a memory element (a semiconductor memory element such as a DRAM, a ferroelectric memory element such as an FRAM) Etc.) are suitable.

  According to the present invention, a stronger and more flexible authentication technique can be provided by performing network connection authentication based on an authentication policy.

Embodiments of the present invention will be described below with reference to the drawings.
FIG. 1 shows a user authentication system of a client / server model including a RADIUS server 10 and a NAS (RADIUS client) 30. The RADIUS server 10 is an authentication server that performs IEEE 802.1X RADIUS authentication. The server 10 performs authentication in response to the IEEE 802.1X authentication request from the NAS 30 and determines whether or not the virus checker 51 is operating on the computer terminal 50. The NAS 30 is a network component (switch, router, wireless access point, etc.) that accepts a network connection request, for example.

  The network 40 may be, for example, a corporate internal network, or a network that is assumed to be accessed by outsiders, such as a local area LAN.

  When the NAS 30 receives a connection request from the user's computer terminal 50 to the network 40, the NAS 30 issues an authentication request to the RADIUS server 10. When the RADIUS server 10 determines that the computer terminal 50 has the authority to access the network 40, the computer terminal 50 is temporarily assigned to a quarantine VLAN (Virtual Local Area Network) by the dynamic VLAN, and the computer terminal 50 50, it is checked whether or not the virus checker 51 is operating. When the RADIUS server 10 confirms that the virus checker 51 is operating on the computer terminal 50, the NAS 30 connects the computer terminal 50 to the network 40. As described above, in order to perform both the IEEE 802.1X authentication and the operation check of the virus checker 51, by preparing the DHCP server in both the quarantine VLAN 60 and the network 40, when the operation of the virus checker 51 is checked, the computer terminal 50 It can belong to a closed quarantine VLAN that can be connected only to the RADIUS server 10 and cannot be connected to the network 40 until the operation check of the virus checker 51 is completed.

  Note that the computer terminal 50 does not necessarily belong to the quarantine VLAN 60 when the operation of the virus checker 51 is checked, and the operation check of the virus checker 51 may be performed by temporarily attaching the computer terminal 50 to the network 40.

  The syslog server 20 manages the syslog transmitted from the RADIUS server 10. The server 20 includes a syslog management software 21 that analyzes the syslog information and creates a report 23, and a syslog database 22 that accumulates the syslog information. Syslog is information that is indefinite for each model and function except basic information (event occurrence time, importance level, information about the device in which the event occurred), but the syslog management software 21 has such indefinite form. Information is organized and digitized to convert it into information suitable for network management. The syslog database 22 accumulates the syslog to provide an environment suitable not only for real-time network monitoring but also for medium- to long-term information collection, recording, retrieval, and report creation.

  FIG. 2 shows a functional configuration of the RADIUS server 10. The server 10 includes an authentication request processing unit 11, an authentication processing unit 12, a policy authentication processing unit 13, a policy information management unit 14, a virus checker operation verification unit 15, a virus checker definition unit 16, an authentication status display unit 17, and authentication information. A history management unit 18 is provided. The authentication request processing unit 11 provides an interface function that receives an authentication request from the NAS 30. The authentication processing unit 12 provides a user authentication function based on the RADIUS protocol. The policy authentication processing unit 13 provides a function for performing authentication processing based on a preset authentication policy. Details of the authentication policy will be described later. The policy information management unit 14 stores authentication policy information set by the user. The virus checker operation verification unit 15 provides an operation check function of the virus checker 51. The virus checker definition unit 16 registers information on the virus checker 51 to be checked. The authentication status display unit 17 provides a function of displaying the authentication result. The authentication information history management unit 18 provides a function of managing history information such as syslog. Each of these functions is realized by the cooperation of an authentication program operating on the RADIUS server 10 and hardware (CPU, memory, etc.).

  Next, the setting of the authentication policy will be described. In this embodiment, in addition to the UID and password, an authentication policy is further defined using the IP address and port number of the NAS 30 and the CSID (Calling-Station-ID) of the computer terminal 50. Here, the port number of the NAS 30 is not a physical port number but a value set in the NAS Port ID sent from the NAS 30 to the RADIUS server 10 together with the UID and password when an authentication request is made. The CSID is notified from the NAS 30 to the RADIUS server 10 as indicating the MAC address of the computer terminal 50.

  As an example of the authentication policy, for example, when a user uses a UID and a password by combining the UID and the CSID of the computer terminal 50, a connection request is made from the computer terminal 50 having a specific MAC address. Only in some cases can the connection be allowed. FIG. 3 shows the correspondence between the UID registered as the authentication policy and the CSID. Connections are not permitted for combinations of UIDs and CSIDs other than the combinations of UIDs and CSIDs registered in this authentication policy.

  As another example of the authentication policy, for example, a combination of a UID, an IP address of the NAS 30 and its port number allows a user to authenticate using a UID and a password by requesting connection to a specific port of a specific NAS 30 Only when there is a connection, it is possible to set to allow connection. FIG. 4 shows the correspondence between the UID registered as an authentication policy, the IP address of the NAS 30, and its port number. Connections are not permitted for combinations of UIDs, NAS 30 IP addresses, and port numbers other than combinations of UIDs, NAS 30 IP addresses, and port numbers registered in this authentication policy.

  As another example of the authentication policy, for example, by using a combination of the CSID, the IP address of the NAS 30 and its port number, authentication by a user using a UID and password is specified from the computer terminal 50 having a specific MAC address. Only when there is a connection request to a specific port of the NAS 30, it is possible to set the connection to be permitted. FIG. 5 shows the correspondence between the CSID registered as the authentication policy, the IP address of the NAS 30, and its port number. Connections are not permitted for combinations of CSID, NAS 30 IP address and port number other than the combination of CSID and NAS 30 IP address and port number registered by this authentication policy.

  In this way, by defining not only the UID and password but also the user's hardware (MAC address) in the authentication policy, management is possible such that only a computer terminal having a MAC address registered in the authentication policy in advance can log in. become. In addition, even if the UID and password are leaked, there is an advantage that it is not possible to log in from a computer terminal having a MAC address different from the MAC address registered in advance in the authentication policy. Furthermore, by defining the NAS 30 IP address and its port number in the authentication policy, more flexible policy setting becomes possible.

Next, an authentication sequence of the RADIUS server 10 will be described.
FIG. 6 shows an authentication sequence using the quarantine VLAN 60. A user connected to the NAS 30 from the computer terminal 50 transmits the UID and password to the NAS 30. Receiving the UID and password, the NAS 30 makes a RADIUS authentication request to the authentication request processing unit 11 (S101). This RADIUS authentication request includes the user's UID, password, NAS 30 IP address, port number of the NAS 30 to which the computer terminal 50 is connected, and the CSID of the computer terminal 50. When the authentication request processing unit 11 receives the RADIUS authentication request from the NAS 30, the authentication request processing unit 11 checks the validity of the IP address of the NAS 30 and confirms that the request is from the NAS 30 to be managed by itself. Decrypt password.

  Next, the authentication processing unit 12 searches the UID from the database 19 of the RADIUS server 10 related to the user definition, and performs IEEE 802.1X RADIUS authentication (S102). Here, when the content of the authentication request matches the content of the user definition, the policy authentication processing unit 13 performs policy authentication (S103). Policy authentication by the policy authentication processing unit 13 is performed using a combination of the IP address of the NAS 30 and its port number and the CSID of the computer terminal 50 in addition to the UID and password.

  Here, if the content of the authentication request matches the setting content of the authentication policy, the authentication result is notified to the NAS 30 (S104). This notification of the authentication result includes the VLAN name of the quarantine VLAN 60 to which the computer terminal 50 should belong when the operation of the virus checker 51 is checked. On the other hand, if the contents of the authentication request do not match the user-defined contents, a rejection response is returned to the NAS 30 in S104.

  Then, the authentication processing unit 12 transitions to a standby state for receiving information related to the operation state of the virus checker 51 mounted on the user's computer terminal 50 (S105). When the computer terminal 50 is connected to the quarantine VLAN 60 and the information from the virus checker 51 is transmitted from the terminal 50 to the virus checker operation verification unit 15, the verification unit 15 operates the virus checker 51 designated in advance. And the result is notified to the authentication request processing unit 11 (S106).

  When it is confirmed that the virus checker 51 designated in advance is operating, the authentication request processing unit 11 notifies the authentication processing unit 12 of information indicating that the virus checker 51 is operating normally. (S107).

  Then, the authentication processing unit 12 instructs the NAS 30 to make a re-authentication request (S108). This is because it is necessary to perform RADIUS authentication again in order to disconnect the computer terminal 50 belonging to the quarantine VLAN 60 from the quarantine VLAN 60 and connect it to the network 40. Thereafter, the authentication processing unit 12 waits for a RADIUS authentication request (S109).

  When the RADIUS authentication request is made again from the NAS 30 to the authentication request processing unit 11 (S110), the RADIUS authentication processing by the authentication processing unit 12 is performed again (S111). Here, when the RADIUS authentication is affirmed, the policy authentication processing unit 13 performs the policy authentication again (S112). Here, when the policy authentication is affirmed, the authentication result is notified to the NAS 30 (S113). This notification of the authentication result includes the VLAN name of the network 40 to which the computer terminal 50 should belong.

  Further, the authentication result is notified from the authentication processing unit 12 to the authentication status display unit 17, and the authentication status is displayed on the display unit 17 (S114). Subsequently, a syslog is sent from the authentication processing unit 12 to the authentication information history management unit 18 (S115), and the completion of the RADIUS authentication processing is notified to the authentication request processing unit 11 (S116).

  FIG. 7 shows an authentication sequence that does not use the quarantine VLAN 60. S201 to S207 correspond to S101 to S107 described above. S208 to S210 correspond to S114 to S116 described above. If it is determined that the virus checker 51 is not operating, the connection between the computer terminal 50 and the network 40 is released. The IP address assigned to the computer terminal 50 may be dynamically assigned by a DHCP server, or may be a fixed IP address. According to this sequence, since the computer terminal 50 does not belong to the quarantine VLAN 60 when the operation of the virus checker 51 is checked, the authentication sequence can be simplified.

  Note that the authentication policy is not limited to the above example, and access restriction may be performed in a time zone at the time of a network connection request, for example.

It is a system configuration figure of a user authentication system of this embodiment. It is a functional block diagram of the RADIUS server 10 of this embodiment. It is a display example of a setting registration screen for authentication policy information. It is a display example of a setting registration screen for authentication policy information. It is a display example of a setting registration screen for authentication policy information. This is an authentication sequence using a quarantine network. This authentication sequence does not use the quarantine network.

Explanation of symbols

DESCRIPTION OF SYMBOLS 10 ... RADIUS server 12 ... Authentication process part 13 ... Policy authentication process part 15 ... Virus checker operation verification part 20 ... Syslog server 30 ... NAS 40 ... Network 50 ... Computer terminal 51 ... Virus checker 60 ... Quarantine VLAN

Claims (11)

An authentication server for authenticating whether or not the computer terminal can connect to the network when connecting to the network via NAS,
An authentication processing unit for performing IEEE 802.1X authentication on whether or not to connect to the network;
A policy authentication processing unit that authenticates the connection possibility based on a predetermined authentication policy when the IEEE 802.1X authentication is affirmed;
An authentication server. The authentication server according to claim 1,
The policy authentication processing unit authenticates the availability of connection based on a combination of a UID, password, CSID, NAS IP address, and port number of the computer terminal. The authentication server according to claim 1 or 2, wherein
An authentication server further comprising a virus checker operation verification unit that checks whether or not a virus checker is operating on the computer terminal. The authentication server according to claim 3,
An authentication server that checks whether or not the virus checker is operating on the computer terminal in a state in which the computer terminal belongs to a quarantine VLAN. The authentication server according to claim 4,
An authentication server that transmits a re-authentication request instruction to the NAS when it is determined that the virus checker is operating on the computer terminal. A method for authenticating whether or not a computer terminal can connect to the network when connecting to the network via NAS,
IEEE802.1X authenticating whether to connect to the network;
A policy authentication step of authenticating the connection possibility based on a predefined authentication policy when the IEEE 802.1X authentication is affirmed;
An authentication method comprising: The authentication method according to claim 6, comprising:
The authentication method, wherein the policy authentication step is a step of authenticating the connection possibility based on a combination of a UID, password, CSID, NAS IP address, and port number of the computer terminal. The authentication method according to claim 6 or 7, wherein:
An authentication method further comprising a virus checker operation verification step of checking whether or not a virus checker is operating on the computer terminal. The authentication method according to claim 8, comprising:
The virus checker operation verification step is an authentication method in which the virus checker is operating on the computer terminal in a state where the computer terminal belongs to a quarantine VLAN. The authentication method according to claim 9, comprising:
An authentication method further comprising a step of transmitting a re-authentication request instruction to the NAS when it is determined that the virus checker is operating on the computer terminal.   The authentication program for making an authentication server perform the authentication method of any one of Claim 6 thru | or 10.

Images