JP2008294502A - Access control system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To improve security by controlling access to a predetermined network. <P>SOLUTION: Disclosed is an access control system which controls access to the network by an information processing terminal via an access point installed in a specified area. The access control system includes: an identification information registering means of receiving and registering inputs of preset specific identification information by information processing terminals; an entrance permitting means which is installed at an entrance to the specified area and permits an information processing terminal decided to have its identification information registered by the identification information registering means on the basis of information transmitted from the information processing terminal, to enter the specified area; and an access permitting means of permitting an information processing terminal to access the predetermined network when deciding that the information processing terminal accessing an access point is the one permitted by the entrance permitting means to enter the area on the basis of the information transmitted from the information processing terminal. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

  The present invention relates to an access control system, and more particularly to a system for performing access control to a wireless network by an information processing terminal within a predetermined area.

  In recent years, wireless networks that do not use wired cables have become widespread for network connections by computers. When such a wireless network is used, it is set so that radio waves from an access point installed in a room within a predetermined area can reach only the room, so that only the computer existing in the room Access is permitted and unauthorized access by third parties is suppressed. For example, as described in Patent Document 1, it is used in a hot spot service. Then, authentication of a computer that accesses the Internet via an access point is performed using, for example, a MAC address that is identification information unique to the computer or a network device that is equipped.

  However, even in a wireless network that allows access only within the predetermined area (indoors) as described above, it can be accessed by a computer from outside the predetermined area (outdoors) as long as the radio wave reaches, There is a possibility of being accessed by an unauthorized person, resulting in a problem that security is lowered. On the other hand, as described above, it is possible to determine whether the computer that has accessed the access point is permitted or not permitted to connect using the MAC address, but whether the computer is accessed from the permitted area or from the unauthorized area. It cannot be determined whether the access is made. In such a case, even if it is desired to limit the place where the computer is used due to security problems, it cannot be limited, and a problem of reduced security may occur as described above.

  Related techniques are disclosed in the following Patent Documents 2, 3, and 4. The technique disclosed in Patent Document 2 is specific to a terminal when a terminal equipped with a memory card in which connection information such as an encryption key is stored in advance accesses an access point using the connection information and authentication is successful. The terminal identifier (MAC address) and authentication information stored in the memory card are registered. The terminal connection is permitted based on the registered MAC address and authentication information. However, the memory card only stores an encryption key or the like necessary for authentication performed before registering the MAC address, that is, information for identifying the terminal is not stored. For this reason, there arises a problem that any terminal equipped with a memory card can be connected. Further, there is no description about a technique for preventing access from outside a specific area.

  Patent Document 3 discloses a technique in which a security card is used to manage entry / exit of a user with an entrance / exit management device installed at an entrance / exit of an area. However, even with such a technique, if a card is provided, connection by another person's computer becomes possible, and a problem of impersonation arises. In addition, since entry / exit to the area is managed with a card, there is a problem that even if a terminal once entered the area goes out, it can be used outside the area if wireless communication arrives. Arise.

  Further, Patent Document 4 discloses a system including an entrance gate that passes when entering a predetermined place. Specifically, it is a system that communicates with a mobile wireless terminal by short-range wireless communication, authenticates whether or not the mobile wireless terminal is a pre-registered terminal, and opens and closes an entrance gate. However, such a technique is a system that only restricts entry of a user having a mobile radio terminal, and as described above, a technique relating to access to a network via an access point is not disclosed. Therefore, there is a problem that no countermeasure is taken against unauthorized access from outside the area where the access point is installed, and security cannot be improved.

JP 2003-318991 A JP 2006-67174 A JP 2006-345451 A JP 2003-30363 A

  For this reason, in the present invention, the inconvenience of the above conventional example is improved, and in particular, unauthorized access is suppressed by performing access control to a predetermined network via wireless communication by an information processing terminal in a specific area, The purpose is to improve security.

Therefore, an access control system according to one aspect of the present invention is
An access control system that performs access control to a network via an access point for an information processing terminal that has accessed an access point installed in a specific area by wireless communication,
Identification information registration means for receiving and registering input of unique identification information preset for each information processing terminal;
Admission to a specific area for an information processing terminal that is installed at the entrance of a specific area and that has been determined that identification information has been registered by the identification information registration means based on information transmitted from the information processing terminal Admission permission means to allow
When it is determined that the information processing terminal that has accessed the access point is the information processing terminal permitted to enter by the entrance permission means based on the information transmitted from the information processing terminal, the information processing terminal An access permission means for permitting access to a predetermined network,
It has the structure of having.

  Since the present invention is configured as described above, only information processing terminals registered in advance can enter a specific area, and only information processing terminals permitted to enter the specific area are predetermined. Access to any network. Therefore, it has an unprecedented superior effect that information processing terminals accessing a predetermined network can be restricted, unauthorized access can be suppressed, and security can be improved.

One aspect of the present invention is:
An access control system that performs access control to a network via an access point for an information processing terminal that has accessed an access point installed in a specific area by wireless communication,
Identification information registration means for receiving and registering input of unique identification information preset for each information processing terminal;
Admission to a specific area for an information processing terminal that is installed at the entrance of a specific area and that has been determined that identification information has been registered by the identification information registration means based on information transmitted from the information processing terminal Admission permission means to allow
When it is determined that the information processing terminal that has accessed the access point is the information processing terminal permitted to enter by the entrance permission means based on the information transmitted from the information processing terminal, the information processing terminal An access permission means for permitting access to a predetermined network,
It has the structure of having.

Further, in addition to the above configuration, the identification information registration means corresponds to the identification information received from the information processing terminal, and issues authentication information issuing means for issuing unique authentication information stored in the storage means mounted on the information processing terminal. And data management means for registering identification information and authentication information in association with each other,
The admission means accepts input of authentication information transmitted from the information processing terminal, and when the accepted authentication information is registered in the data management means, admission to the information processing terminal enters a specific area. Allow,
The structure is adopted.

In addition to the above configuration, the admission permission means requests the data management means to register admission information indicating that the information processing terminal permitted to enter the specific area is entering,
The data management means registers the admission information in association with the identification information registered for the information processing terminal requested to register the admission information by the admission permission means,
The access permission means accepts the input of identification information transmitted from the information processing terminal, and when the entry information is registered in association with the received identification information, the access permission means sends the information processing terminal to a predetermined network. Allow access to
The structure is adopted.

  In addition to the above configuration, the authentication information issuing means transmits the authentication information to the information processing terminal by short-range wireless communication so as to store the authentication information issued to the storage means stored inside the information processing terminal. , Is adopted.

Further, in addition to the above configuration, the authentication information issuing means stores the authentication information and can transmit the authentication information to the outside through short-range wireless communication, and generates and issues an RFID tag attached to the information processing terminal. And
The admission means accepts authentication information transmitted from the RFID tag attached to the information processing terminal.
The structure is adopted.

  Furthermore, in addition to the above configuration, the admission permission means is installed at the entrance / exit of the specific area, and manages the exit of the information processing terminal from the specific area based on the information transmitted from the information processing terminal. The composition is taken.

  According to the above invention, first, when identification information unique to each information processing terminal is input to the identification information registration means, unique authentication information corresponding to this identification information is issued (authentication information issuing means), and this authentication information is issued. And identification information are registered in association with each other (data management means). The authentication information issued corresponding to the identification information is stored in a storage unit mounted inside or outside the information processing terminal. For example, authentication information is stored in a memory provided inside the information processing terminal, or an RFID tag storing authentication information is issued and attached to the information processing terminal. After that, when the information processing terminal transmits authentication information to the admission permission means installed at the entrance of a specific area, it is determined whether or not this authentication information is registered in the data management means. In this case, admission of this information processing terminal is permitted. Then, an information processing terminal permitted to enter enters a specific area, transmits identification information to an access point installed in the specific area by wireless communication, and accesses the network Request. Then, the access permission means permits access to a predetermined network when the identification information of the information processing terminal that has requested access is registered and entry is permitted.

  As a result, only information processing terminals that have registered unique identification information in advance can enter a specific area, and only information processing terminals permitted to enter the specific area access a predetermined network. be able to. Accordingly, it is possible to suppress unauthorized access to a predetermined network, and to manage bringing in an information processing terminal to a specific area, thereby improving security. In particular, at the time of registration of identification information preset in the information processing terminal, higher security can be realized by issuing authentication information corresponding to this and storing it in the information processing terminal and using it for authentication at the time of entrance. . For example, the issued authentication information can be transmitted via the short-range wireless communication means and stored in the information processing terminal for the information processing terminal previously provided with the short-range wireless communication means. On the other hand, even if the information processing terminal is not preliminarily equipped with short-range wireless communication means or the like, the same configuration as described above is adopted by issuing an RFID capable of short-range wireless communication storing authentication information and attaching it to a computer. be able to.

Moreover, the other form of this invention is:
A data management device that controls access to a network via an access point for an information processing terminal that has accessed an access point installed in a specific area by wireless communication,
The authentication information issuing means that has received the input of unique identification information set in advance for each information processing terminal is issued corresponding to the received identification information and stored in the storage means mounted on the information processing terminal An identification information registration unit for storing the authentication information in association with the identification information;
When it is determined that the identification information of the information processing terminal is registered in the identification information registration unit based on the information transmitted from the information processing terminal to the admission means installed at the entrance of the specific area In addition, an admission authentication unit that instructs the admission means to allow admission to a specific area of the information processing terminal,
When it is determined that the information processing terminal that has accessed the access point is an information processing terminal permitted to enter the specific area by the admission authentication unit based on information transmitted from the information processing terminal An access determination unit for instructing the access point to permit the information processing terminal to access the predetermined network via the access point;
It has the structure of having.

Moreover, the other form of this invention is:
For an information processing terminal that has accessed an access point installed in a specific area by wireless communication, a data management device that performs access control to a network via the access point,
The authentication information issuing means that has received the input of unique identification information set in advance for each information processing terminal is issued corresponding to the received identification information and stored in the storage means mounted on the information processing terminal An identification information registration unit for storing the authentication information in association with the identification information;
When it is determined that the identification information of the information processing terminal is registered in the identification information registration unit based on the information transmitted from the information processing terminal to the admission means installed at the entrance of the specific area And an admission authentication unit that instructs the admission means to allow admission to a specific area of the information processing terminal,
When it is determined that the information processing terminal that has accessed the access point is an information processing terminal that is permitted to enter a specific area by the admission authentication unit based on information transmitted from the information processing terminal, An access determination unit that instructs the access point to permit the information processing terminal to access the predetermined network via the access point;
It is a program for realizing.

Moreover, the other form of this invention is:
An access control method for performing access control to a network via the access point for an information processing terminal that has accessed the access point installed in a specific area by wireless communication,
An identification information registration step of receiving and registering input of unique identification information preset for each information processing terminal;
For the information processing terminal that has determined that the identification information is registered in the identification information registration step based on the information transmitted from the information processing terminal to the entrance permission means installed at the entrance of the specific area, An admission process that allows admission to specific areas;
When it is determined that the information processing terminal that has accessed the access point is the information processing terminal permitted to enter in the entrance permission process based on the information transmitted from the information processing terminal, the information processing terminal An access permission step for permitting access to a predetermined network,
It has the structure of having.

In addition to the above configuration, the identification information registration step corresponds to the identification information received from the information processing terminal and issues unique authentication information stored in the storage means mounted on the information processing terminal. And a data management step of registering the identification information and the authentication information in association with each other,
The admission permission process accepts input of authentication information transmitted from the information processing terminal, and when the accepted authentication information is registered in the data management process, the information processing terminal Allow admission,
It is characterized by that.

  The specific configuration and operation of the access control system according to the present invention will be described below with reference to examples.

  A first embodiment of the present invention will be described with reference to FIGS. FIG. 1 is a schematic diagram showing the overall configuration of the access control system, and FIG. 2 is a block diagram showing the detailed configuration thereof. 3 to 7 are functional block diagrams showing the configuration of each device constituting the access control system, and FIG. 8 is a diagram showing an example of data managed by the access control system. 9 to 12 are explanatory diagrams showing the operation of the access control system, and FIGS. 13 to 16 are sequence diagrams showing the operation.

[Constitution]
First, the overall configuration of the access control system will be described with reference to FIGS. As shown in FIG. 1, the access control system according to the present invention is configured such that a user terminal 6 (information processing device) operated by a user U is accessed from an access permission area A to an access point installed in the access permission area A ( AP) 4 is a system for controlling access to a predetermined network N through wireless communication. Here, the access-permitted area A is a specific area such as a specific room whose security is managed in the company. Moreover, the network network which the user terminal 6 accesses via an access point is, for example, a corporate intranet network or the Internet network.

  As shown in FIG. 1, the access control system according to the present embodiment includes a gate type authentication device having a gate 51 or a door that restricts the user U from passing through the area A at the entrance / exit of the access permission area A. 5 (entrance permission means). A network management device 3 (access permission means) that manages whether or not the user terminal 6 that has accessed the access point 4 can connect to the network N is provided. Furthermore, an identification information registration device 10 (identification information registration means) for registering a user terminal 6 that can access the network N in advance is provided. The identification information registration device 10 is connected to the gate type authentication device 5 and the network management device 3. Then, the identification information registration device 10 permits entry of the user terminal 6 that has requested entry to the gate type authentication device 5 based on the registered user information, or further connects to the access point 4. It has a function of determining whether to permit access to the network N of the requested user terminal 6 (admission permission means, access permission means).

  Here, FIG. 2 shows a configuration in which the identification information registration apparatus 10 of the access control system disclosed in FIG. 1 is further embodied. As shown in this figure, the access control system includes an authentication chip issuing device 1 and a data management device 2 as the identification information registration device 10 described above. The data management device 2 is connected to the authentication chip issuing device 1, the gate type authentication device 5, and the network management device 3, and for each user terminal 6 to perform access control of the user terminal 6. Information is managed. Hereinafter, each device constituting the access control system will be described in more detail.

  First, it is assumed that the network for performing access control of the user terminal 6 is an intranet network N in the company to which the user U belongs. The intranet network N is further connected to the Internet network. An access point (AP) 4 capable of wireless communication is connected to the intranet network N. The access point 4 has a function of relaying communication between the user terminal 4 that has been accessed by wireless communication and the intranet network N. The access point 4 is installed in an access-permitted area A such as a company security room that is an area where wireless communication with the access point 4 is possible (see the shaded area in FIG. 2). Therefore, mainly within the access-permitted area A, the user terminal 6 can wirelessly communicate with the access point 4 and can access the intranet network N. In addition, the access point 4 is not limited to being equipped with one unit as shown in the figure, and may be equipped with a plurality of units.

  Next, the configuration of the user terminal 6 will be described with reference to the functional block diagram of FIG. The user terminal is a computer such as a laptop computer that includes a wireless communication unit 12 having a network connection function so as to enable wireless communication with the access point 4 and is operated by the user. In addition, the user terminal 6 is equipped with an RFID tag 61 and can perform near field communication with an authentication chip issuing device 1 and a gate type authentication device 5 described later. In addition, an authentication data issuance processing unit 63, a gate authentication processing unit 64, and a wireless access processing unit 65 are constructed by incorporating a predetermined program into the CPU of the user terminal 6. Further, the memory in the user terminal 6 stores a terminal data storage unit 66 that stores a MAC address that is unique identification information preset for each terminal, and authentication data issued by the authentication chip issuing device 1. The authentication data storage unit 67 is formed.

  The authentication data issuing processing unit 63 transmits a MAC address from the RFID tag 61 to the authentication chip issuing device 1. Then, an authentication ID (authentication data) generated and transmitted corresponding to the MAC address in the authentication chip issuing device 1 is received from the authentication chip issuing device 1 via the RFID tag 61 and stored in the authentication data storage unit 67. Remember. The MAC address and the authentication ID are registered in the data management device 2 via the authentication chip issuing device 1 as will be described later. Here, the MAC address of the user terminal 6 is not necessarily input from the RFID tag 61 to the authentication chip issuing device 1, and the user U manually inputs it to the input unit provided in the authentication chip issuing device 1. May be.

  The gate authentication processing unit 64 transmits the authentication ID issued by the authentication data issuing processing unit 63 and stored in the authentication data storage unit 67 as described above from the RFID tag 61 to the gate type authentication device 5. To do. Thereby, when it is determined that the authentication ID has already been registered in the gate type authentication device 5 and the data management device 2, the gate 51 is opened and the user U can enter the access permission area A.

  The wireless access processing unit 65 performs wireless communication with the access point 4 via the wireless communication unit 62 when the user terminal 6 is located in the access-permitted area A, transmits a MAC address, and transmits the intranet network. Request access to N. As will be described later, when access is permitted by the data management device 2, an IP address is allocated to the user terminal 6 by the network management device 3, and access to the intranet network N and further to the Internet network becomes possible.

  Next, the authentication chip issuing device 1 will be described with reference to the functional block diagram of FIG. As shown in this figure, an authentication chip issuing device 1 includes an RFID tag communication unit 11 capable of short-range wireless communication with an RFID tag 61 of a user terminal 6, and a data input unit such as a touch panel on which a user U can manually input data. 12 and at least a network communication unit 13 connectable to the data management device 2. In addition, a terminal data reception processing unit 14, an authentication data issuing processing unit 15, and a user data registration processing unit 16 are constructed by incorporating a predetermined program into the CPU.

  The terminal data reception processing unit 14 receives the MAC address of the user terminal 6 transmitted from the RFID tag 61 of the user terminal 6 and received by the RFID tag communication unit 11 as described above. At this time, user information related to the user terminal 6 input from the user U via the data input unit 12 is also accepted. Further, the authentication data issuing device 15 issues a unique authentication ID corresponding to the input MAC address, and transmits it to the user terminal 6 via the RFID tag communication unit 11. The user data registration processing unit 16 transmits the data to the data management apparatus 2 via the network communication unit 13 so as to register the MAC address and the authentication ID in association with each other.

  Next, the gate type authentication device 5 will be described with reference to the functional block diagram of FIG. The gate-type authentication device 5 is installed at the entrance of the access-permitted area A as described above, and has a function of authenticating the user terminal 6 of the user U and controlling the opening and closing of the gate 51 that restricts the entrance of the user U. Have. Specifically, first, an RFID tag communication unit 52 is provided, and a predetermined program is incorporated into a CPU provided in the gate type authentication device 5 to thereby obtain an authentication data reading processing unit 53, an authentication processing unit 54, The gate control processing unit 55 is constructed.

  The authentication data reading processing unit 53 receives the authentication ID of the user terminal 6 transmitted from the RFID tag 61 of the user terminal 6 and received by the RFID tag communication unit 52. And the said authentication process part 54 inquires the said data management apparatus 2 whether the received authentication ID is registered into the data management apparatus 2, and receives a result. As a result, if it is determined that the authentication ID is already registered in the data management device 2, the gate control processing unit 55 controls to open the gate 51, and the user U (user terminal) accesses the access permission area A. Allow to enter. At this time, the gate control processing unit 55 determines that the user U has entered by opening the gate 51 and registers the fact that the user terminal 6 has entered the access-permitted area A together with the user U. Ask.

  Conversely, the gate-type authentication device 5 also has a function of detecting the user U leaving. For example, a user terminal that leaves the access-permitted area A by installing the RFID tag communication unit 52 inside the access-permitted area A and receives an authentication ID from the user terminal 6 that leaves the RFID tag communication part 52. 6 is detected. When the user terminal 6 that leaves is detected, the data management apparatus 2 is notified that the user terminal 6 with the authentication ID has left, and the data management apparatus 2 requests management. Whether or not the user U has entered or exited is separately provided with a human sensor such as an infrared sensor in the vicinity of the gate 51, and the entrance / exit is detected by the detection of the sensor, and then the data management device 2 is entered or exited. You may request registration.

  Next, the network management device 3 will be described with reference to the functional block diagram of FIG. An initial communication processing unit 31, an IP address issue processing unit 32, and an IP address management processing unit 33 are constructed by incorporating a predetermined program in the CPU of the network management device 3. The initial communication processing unit 31 indicates the MAC address notified from the user terminal 6 when the user terminal 6 performs initial communication with the access point 4 by wireless communication for a network connection permission request. It has the function to transfer to. The IP address issue processing unit 32 determines whether or not network connection is possible in the data management device 2 based on the transferred MAC address, and if it is permitted, the IP address for network connection to the user terminal 6 It has a function to issue. Further, the IP address management processing unit 33 has a function of managing the continuous use / end of use of the issued IP address.

  Next, the data management device 2 will be described with reference to the functional block diagram of FIG. 7 and the data configuration diagram of FIG. The data management device 2 is a general server computer, and manages the registration status of the user terminal 6, the entrance / exit status to the access-permitted area A, the access status to the intranet network N, and the like as described above. Specifically, a user data registration processing unit 21, an authentication processing unit 22, and a connection determination processing unit 23 are constructed by incorporating a predetermined program into the CPU of the data management device 2. A user data storage unit 24 is formed in a storage device such as a hard disk.

  As described above, the user data registration processing unit 21 (identification information registration unit) uses the MAC address input from the user terminal 6 to the authentication chip issuing device 1 and the authentication ID generated corresponding thereto as an authentication chip. Accept from the issuing device 1 and register in the user data storage unit 24. The registered data is distinguished and managed for each user terminal 6 as shown in each row of FIG. At this time, information representing the characteristics of the user terminal 6 input from the user terminal 6 or from the user U to the authentication chip issuing device 1 is received from the authentication chip issuing device 1 and registered as computer terminal information.

  The authentication processing unit 22 (admission authentication unit) receives the authentication ID input from the user terminal 6 to the gate type authentication device 5 and checks whether or not the authentication ID is registered in the user data storage unit 24. Is notified to the gate type authentication device 5. When the notification that the user terminal 6 has passed the gate is received from the gate-type authentication device 5, the gate passage flag is changed from “0” to “1”, and the time at that time is set as “In time”. To record. When a notification that the user terminal 6 that has left the access-permitted area A is detected is received from the gate type authentication device 5, the gate passage flag of the user terminal 6 is set to “0”, and the time at that time is set. Recorded in “Out time” as the time of exit.

  Further, the connection determination processing unit 23 (access determination unit) authenticates the authentication ID by the authentication processing unit 22 as described above, and assigns the MAC address corresponding to the user terminal 6 permitted to pass through the gate to the intranet network. N is notified to the network management apparatus 3 as a user terminal permitted to connect to N. In addition, the connection determination processing unit 23 performs initial communication for permitting network connection to the access point 4 from the user terminal 6, and the MAC address notified from the user terminal 6 is transmitted to the access point 4 and the network management device 3. Receive via. Then, it is checked whether this MAC address is registered in the user data storage unit 24 and the gate passage flag is “1”. That is, it is determined whether the user terminal is already registered in the data management device 2 via the authentication chip issuing device 1 and has been authenticated by the gate type authentication device 5. If the terminal has already been registered and passed through the gate, the network management apparatus 3 is instructed to issue a network connection IP address.

[Operation]
Next, the operation of the access control system configured as described above will be described with reference to FIGS. First, an operation (identification information registration step) for registering information of the user terminal 6 will be described with reference to FIGS. 9, 13, and 14 (step S1 in FIG. 13).

  First, the user U brings the user terminal 6 close to the authentication chip issuing device 1 and brings the RFID tag 61 of the user terminal 6 close to the RFID tag communication unit 11 of the authentication chip issuing device 1 so that they are close to each other. The distance wireless communication is performed, and the MAC address of the user terminal 6 is transmitted and input to the authentication chip issuing device 1 (arrow Y1 in FIG. 9, step S2 in FIG. 13). Note that the input of the MAC address to the authentication chip issuing device 1 may be manually performed by the user U or a system administrator from an input unit such as a touch panel equipped in the authentication chip issuing device 1.

  Then, the authentication chip issuing device 2 that has received the input of the MAC address once inquires of the data management device 2 about user information in order to determine whether or not the input MAC address has been registered (arrow Y2 in FIG. 9). , Step S3 in FIG. Then, the data management device 2 confirms the presence / absence of registration in the database, and notifies the authentication chip issuing device 1 of the presence / absence of registration (step S4 in FIG. 13).

  Subsequently, the authentication chip issuing device 1 makes a determination based on the data transmitted from the data management device 2 (step S5 in FIG. 13). In the case of new data registration (“unregistered” in step S5 in FIG. 13). ) Is displayed on the screen provided in the authentication chip issuing device 1 to prompt the user U to input new data. At this time, for example, when new data such as information representing the characteristics of the user terminal is input (step S6 in FIG. 13), the authentication chip issuing device 1 creates a unique authentication ID in the MAC address, and the user terminal 6 (Step S7 in FIG. 13, authentication information issuing step). The authentication chip issuing device 1 transmits an authentication ID from the RFID tag communication unit 11 to the RFID tag 61 of the user terminal 6 (arrow Y3 in FIG. 9). Then, the authentication ID is stored in the user terminal 6 (step S10 in FIG. 13).

  Thereafter, the authentication chip issuing device 1 transmits the MAC address and the authentication ID to the data management device 2 (arrow Y4 in FIG. 9, step S8 in FIG. 13). Then, the data management device 2 associates the MAC address with the authentication ID and registers it in the database in the device as shown in FIG. 8 (step S9 in FIG. 13, data management process).

  On the other hand, if it is determined in step S5 of FIG. 13 that the MAC address of the user terminal 6 has been registered (goes to “when already registered” in step S5 of FIG. 13), the authentication chip issuing device 1 6 is registered (step S11 in FIG. 14), and it is confirmed whether the registration information is to be changed or deleted. In the case of a change, the changed part is input from the user U or the user terminal 6 (step S12 in FIG. 14), and is passed through the authentication chip issuing device 1 (step S13 in FIG. 14) to the database of the data management device 2. This is reflected (step S14 in FIG. 14). In the case of deletion, the registration information is deleted from the database of the data management device 2.

  Then, after the data change of the data management device 2 is completed, the data management device 2 sends a change / deletion notification to the authentication chip issuing device 1 (step S15 in FIG. 14). Then, the authentication chip issuing device 1 issues the changed authentication ID again to the user terminal 6 (step S16 in FIG. 14). Accordingly, as described above, the authentication ID issued corresponding to the MAC address is stored in the user terminal 6 and registered in association with the data management device 2.

  Next, with reference to FIG. 10, FIG. 11, and FIG. 15, the operation until the user terminal 6 passes through the gate type authentication device 5 that also functions as an entry / exit gate and connects to the wireless network will be described.

  First, as described above, the user terminal 6 registered in the data management device 2 approaches the entrance / exit gate 51 where the gate type authentication device 5 is installed in order to enter the access permission area A. Then, when the user U brings the RFID tag 61 of the user terminal 6 close to the RFID tag communication unit 52 of the gate type authentication device 5, short-range wireless communication is performed (step S21 in FIG. 15). The authentication ID stored in the user terminal 6 is read by the authentication device 5 (arrow Y11 in FIG. 10, step S22 in FIG. 15). Then, the gate type authentication device 5 inquires of the data management device 2 about the read authentication ID (arrow Y12 in FIG. 10, step S23 in FIG. 15).

  The data management device 2 confirms whether the authentication ID is registered in the database, and notifies the gate type authentication device 5 (step S24 in FIG. 15). At this time, if the authentication ID matches the correctly registered data (goes to “match” in step S24 in FIG. 15, step S25), the gate 51 is opened (arrow Y13 in FIG. 10), and the user U, that is, the user The terminal 6 is allowed to pass (step S26 in FIG. 15, entrance permission process).

  The gate type authentication device 5 authenticates the data management device 2 as soon as it is confirmed that the gate 51 is opened, or as soon as it is confirmed that the user terminal 6 has passed through the gate by a human sensor or the like. 6 is requested to add a gate passage flag to step 6 (step S27 in FIG. 15). Then, the data management device 2 changes the database in the device itself so as to set the gate passing flag of the authenticated user terminal 6 to “1”, and the MAC address corresponding to the user terminal 6 is changed to the network management device 5. (Arrow Y14 in FIG. 10, step S28 in FIG. 15). Then, the network management device 5 permits the subordinate access point 4 to connect to the wireless network with the notified MAC address (arrow Y15 in FIG. 10, step S29 in FIG. 15).

  Further, when the user terminal 6 that has passed through the gate type authentication device 5 and entered the access-permitted area A is activated by the user U, the user terminal 6 automatically accesses the access point 4 through wireless communication and performs network management. An access permission request to the intranet network N via the access point 4 is made to the device 3 (arrows Y21 and Y22 in FIG. 11, step S30 in FIG. 15). At this time, the user terminal 6 transmits the MAC address to the network management device 3 via the access point 4. Receiving this, the network management device 3 compares the MAC address transmitted from the user terminal 6 with the MAC address notified from the data management device 2 as the user terminal 6 permitted to pass through the gate in step S28 of FIG. (Step S31 in FIG. 15), if they match, the user terminal 6 issues an IP address for accessing the intranet (arrow Y22 in FIG. 11, step S32 in FIG. 15, access permission step). Then, the user terminal 6 uses the issued IP address to connect to the intranet network N via the access point 4 (step S33 in FIG. 15).

  Next, referring to FIG. 12 and FIG. 16, without passing through the gate type authentication device 5, that is, from outside the access permission area A, the user terminal 6 is used to enter the intranet network N via the access point 4. A case where connection is attempted will be described.

  First, the user terminal 6 that has not passed through the gate type authentication device 5 performs wireless communication with the access point 4 from the outside, notifies the MAC address, and requests the issuance of an IP address (arrow Y31 in FIG. 12, Steps S41 and S42 in FIG. Upon receiving the MAC address, the access point 4 transmits the MAC address to the network management device 3 (arrow Y32 in FIG. 12, step S43 in FIG. 16). Then, the network management device 3 confirms the gate passing flag with the data management device 2 based on the MAC address (arrow Y33 in FIG. 12, step S44 in FIG. 16). The data management device 2 confirms the database based on the MAC address sent from the network management device 3, confirms the gate passage flag of the corresponding user terminal 6, and notifies the network management device 3 of passage / non-passage. (Step S45 in FIG. 16). The network management device 3 notifies the access point that the IP address cannot be issued to the MAC address without the gate passage flag (step S46 in FIG. 16). Then, the access point 4 notifies the user terminal 6 that an IP address cannot be issued (step S47 in FIG. 16). As a result, the user terminal 6 cannot obtain an IP address and cannot connect to the intranet network (arrow Y34 in FIG. 12, step S48 in FIG. 16).

  As described above, according to the present invention, only the user terminal 6 (information processing terminal) that has previously registered the MAC address (unique identification information) can enter the access-permitted area A (specific area) and access Only the user terminal 6 (information processing terminal) that enters the permitted area A (specific area) can access the intranet network N (predetermined network network). Therefore, even if communication from the outside of the access-permitted area A to the access point 4 is possible, the issuance of the network connection resource (IP address) to the user terminal 6 that does not pass through the gate 51 is stopped. Therefore, unauthorized access to a predetermined network can be suppressed. In addition, by managing a unique MAC address (unique identification information) for the user terminal 6, it is possible to manage bringing / taking out of the user terminal 6 (information processing terminal) with respect to the access permission area A (specific area). , Security can be improved.

  Here, in the above description, an example in which an authentication ID corresponding to the MAC address is generated at the time of registration of the user terminal 6 and authentication is performed using the authentication ID when passing through the gate type authentication device 5 is registered. The data may be only information (unique identification information) for identifying the user terminal 6 such as a MAC address, or the MAC address may be used at the time of authentication in the gate type authentication device 5. Moreover, although the case where the MAC address is used as identification information unique to the user terminal 6 is exemplified, other information may be used instead of the MAC address as information unique to the user terminal 6. Further, although a notebook personal computer has been described as an example of the user terminal 6, another information processing terminal such as a PDA or a mobile phone may be used.

  Next, a second embodiment of the present invention will be described with reference to FIGS. The access control system in the present embodiment has a configuration substantially similar to that of the first embodiment described above, but the configuration of the authentication chip issuing device 101 is different. Hereinafter, such differences will be mainly described.

  First, the user terminal 106 in this embodiment is not equipped with an RFID tag. The authentication chip issuing device 101 has a function of generating and issuing a seal-like RFID tag 111 that can be attached to the housing of the user terminal 106. Specifically, when the MAC address is transmitted from the user terminal 106 during registration of the user terminal 106 (arrow Y41 in FIG. 17), an authentication ID uniquely corresponding to this is generated, and this authentication ID is The stored RFID tag 111 is generated (arrow Y42 in FIG. 17). And the user U who received this sticks the RFID tag 111 on the housing | casing surface of the user terminal 106 (arrow Y43 of FIG. 17). Then, the authentication chip issuing device 101 transmits the data to the data management device 2 so as to register the MAC address and the authentication ID in association with each other (arrow Y44 in FIG. 17). Thereby, it becomes the structure similar to what stored authentication ID similarly to the user terminal 6 of Example 1 mentioned above.

  Thereafter, the user terminal 106 can operate in the same manner as in the first embodiment. Specifically, with reference to FIG. 18, a case where the user terminal 106 tries to pass through the gate type authentication device 5 that also serves as an entrance / exit gate will be described. When the user terminal 106 reaches the entrance / exit gate where the gate type authentication device 5 is installed, the RFID tag 111 attached to the gate type authentication device 5 and the user terminal 106 performs short-range wireless communication, and the attached RFID tag The authentication ID is read from 111 by the gate type authentication device 5 (arrow Y51 in FIG. 18). Then, the gate type authentication device 5 inquires of the data management device 2 about the read authentication ID, the data management device 2 confirms whether the authentication ID is registered, and notifies the gate type authentication device 5 (FIG. 18 arrow Y52). At this time, if the authentication ID matches the correctly registered data, the gate 51 is opened (arrow Y53 in FIG. 18), and the user U, that is, the user terminal 6 is passed.

  Thereafter, the operation is the same as that of the first embodiment. That is, when the user terminal 106 enters the access permission area A, the user terminal 106 accesses the access point 4 and notifies the MAC address, so that the MAC address of the user terminal 106 is registered in advance. In addition, since the authentication with the corresponding authentication ID is completed in the gate type authentication device 5, an IP address is given from the network management device 3 to the user terminal 6 through the access point 4, and access to the intranet network N is performed. It becomes possible.

  In this way, even when a user terminal that is not equipped with a short-range wireless communication means such as an RFID tag in advance is used, an RFID storing authentication information corresponding to identification information can be issued and pasted. As described above, security can be improved.

  The access control system of the present invention can be applied to companies that place importance on security, such as restricting access of information processing terminals to a network according to terminals and locations, and has industrial applicability.

It is a block diagram which shows the outline of a structure of the access control system in Example 1. FIG. It is a block diagram which shows the detailed structure of the access control system in Example 1. FIG. It is a functional block diagram which shows the structure of the user terminal disclosed in FIG. It is a functional block diagram which shows the structure of the authentication chip | tip issuing apparatus disclosed in FIG. It is a functional block diagram which shows the structure of the gate type | mold authentication apparatus disclosed in FIG. It is a functional block diagram which shows the structure of the network management apparatus disclosed in FIG. It is a functional block diagram which shows the structure of the data management apparatus disclosed in FIG. It is a figure which shows an example of the user data managed with the data management apparatus disclosed in FIG. It is explanatory drawing which shows operation | movement of an access control system, and shows the mode at the time of registration of a user terminal. It is explanatory drawing which shows operation | movement of an access control system, and shows the mode at the time of a gate passage of a user terminal. It is explanatory drawing which shows operation | movement of an access control system, and shows the mode at the time of the network access by a user terminal. It is explanatory drawing which shows operation | movement of an access control system, and shows the mode at the time of the network access from the outside by a user terminal. It is a sequence diagram which shows operation | movement of an access control system, and shows the mode at the time of registration of a user terminal. It is a sequence diagram which shows operation | movement of an access control system, and shows the mode at the time of registration of a user terminal. It is a sequence diagram which shows operation | movement of an access control system, and shows the mode at the time of the gate passage of a user terminal, and network access. It is a sequence diagram which shows operation | movement of an access control system, and shows the mode at the time of the network access from the outside by a user terminal. It is a figure which shows the structure of the access control system in Example 2, and the operation | movement at the time of registration of a user terminal. It is a figure which shows the structure of the access control system in Example 2, and the operation | movement at the time of the gate passage of a user terminal.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 Authentication chip issuing apparatus 2 Data management apparatus 3 Network management apparatus 4 Access point 5 Gate type authentication apparatus 6 User terminal 10 Identification information registration apparatus A Access permission area N Intranet network U User

Claims (10)

An access control system that performs access control to a network via the access point, for an information processing terminal that has accessed an access point installed in a specific area by wireless communication,
Identification information registration means for receiving and registering input of unique identification information preset for each information processing terminal;
The specific information is installed at the entrance of the specific area and the specific information processing terminal determines that the identification information is registered by the identification information registration unit based on the information transmitted from the information processing terminal. Admission means for admission to the area,
When it is determined that the information processing terminal that has accessed the access point is an information processing terminal permitted to enter by the admission permission means based on information transmitted from the information processing terminal, An access permission means for permitting an information processing terminal to access a predetermined network;
An access control system comprising: The identification information registration means corresponds to the identification information received from the information processing terminal and issues authentication information issuing means for issuing unique authentication information stored in a storage means mounted on the information processing terminal, and the identification Data management means for registering information and the authentication information in association with each other,
The admission means accepts the input of the authentication information transmitted from the information processing terminal, and when the accepted authentication information is registered in the data management means, the admission permission means Allow admission to the territory of
The access control system according to claim 1. The admission permission means requests the data management means to register the admission information indicating that the information processing terminal permitted to enter the specific area is entering,
The data management means registers the admission information in association with the identification information registered for the information processing terminal requested to register admission information from the admission permission means,
The access permission means receives an input of identification information transmitted from the information processing terminal, and when the entrance information is registered in association with the received identification information, Allow access to the network,
The access control system according to claim 2. The authentication information issuing means transmits the authentication information to the information processing terminal by short-range wireless communication so as to store the authentication information issued to a storage means stored inside the information processing terminal.
4. The access control system according to claim 2 or 3, wherein The authentication information issuing means is capable of storing the authentication information and transmitting the authentication information to the outside by short-range wireless communication, generating and issuing an RFID tag attached to the information processing terminal,
The admission permission means receives the authentication information transmitted from the RFID tag attached to the information processing terminal.
4. The access control system according to claim 2 or 3, wherein The entrance permission means is installed at an entrance / exit of the specific area, and manages exit of the information processing terminal from the specific area based on information transmitted from the information processing terminal.
6. The access control system according to claim 1, 2, 3, 4 or 5. A data management device that performs access control to a network via the access point for an information processing terminal that has accessed the access point installed in a specific area by wireless communication,
An authentication information issuing unit that receives input of unique identification information preset for each information processing terminal is issued corresponding to the received identification information and stored in a storage unit mounted on the information processing terminal. An identification information registration unit that stores unique authentication information in association with the identification information;
When the identification information of the information processing terminal is registered in the identification information registration unit based on the information transmitted from the information processing terminal to the entrance permission means installed at the entrance of the specific area An admission authentication unit that instructs the admission permission means to allow admission to the specific area of the information processing terminal,
The information processing terminal that has accessed the access point is determined to be an information processing terminal permitted to enter the specific area by the admission authentication unit based on information transmitted from the information processing terminal. An access determination unit that instructs the access point to permit the information processing terminal to access the predetermined network via the access point;
A data management apparatus comprising: For an information processing terminal that has accessed an access point installed in a specific area by wireless communication, a data management device that performs access control to a network via the access point,
An authentication information issuing unit that receives input of unique identification information preset for each information processing terminal is issued corresponding to the received identification information and stored in a storage unit mounted on the information processing terminal. An identification information registration unit that stores unique authentication information in association with the identification information;
When the identification information of the information processing terminal is registered in the identification information registration unit based on the information transmitted from the information processing terminal to the entrance permission means installed at the entrance of the specific area An admission authentication unit that instructs the admission permission means to allow admission to the specific area of the information processing terminal,
The information processing terminal that has accessed the access point is determined to be an information processing terminal permitted to enter the specific area by the admission authentication unit based on information transmitted from the information processing terminal. An access determination unit that instructs the access point to permit the information processing terminal to access the predetermined network via the access point;
A program to realize An access control method for performing access control to a network via the access point for an information processing terminal that has accessed the access point installed in a specific area by wireless communication,
An identification information registration step of receiving and registering input of unique identification information preset for each information processing terminal;
An information processing terminal that has determined that identification information has been registered in the identification information registration step based on information transmitted from the information processing terminal to an entrance permission means installed at the entrance of the specific area On the other hand, an admission permission process for permitting admission to the specific area,
When it is determined that the information processing terminal that has accessed the access point is an information processing terminal permitted to enter in the admission permission step based on information transmitted from the information processing terminal, An access permission step for allowing an information processing terminal to access a predetermined network; and
An access control method comprising: The identification information registration step corresponds to the identification information received from the information processing terminal, and issues an authentication information issuance step for issuing unique authentication information stored in storage means mounted on the information processing terminal, and the identification A data management step of registering information and the authentication information in association with each other,
The admission permission step accepts an input of the authentication information transmitted from the information processing terminal, and when the accepted authentication information is registered in the data management step, the admission permission step Allow entry into certain areas,
The access control method according to claim 9.

Images