Access control processing method
The present invention provides a device and a method for accurately and efficiently controlling an access from an external network to an internal network. Both a client device connectable to the external network and an application gateway store shared secret information (Secret) including a client ID: GUID(C) as an ID generated by the client and a server ID: GUID(S) as an ID generated by the application gateway in respective storage units. In response to an access request from the client, the application gateway determines whether the client has appropriate shared secret information (Secret) so as to determine an access right. With this configuration, a right of access from the external network to the internal network, such as a home network, can be efficiently and accurately determined.
1. An information processing device performing an access control process, the information processing device comprising:
a data transmitting/receiving unit configured to transmit/receive data to/from a client serving as an access requesting device;
a memory configured to store shared secret information shared with a client having a proper access right, the shared secret information including both a client ID as an ID generated by the client having the proper access right and a server ID as an ID generated by the information processing device; and
a device authenticating processing unit configured to receive a random number generated by a client requesting access and a digest value including a hash of the shared secret information from the client requesting access and determine whether the client requesting access has an access right by identifying whether the digest value includes the shared secret information in response to an access request from the client requesting access.
2. The information processing device according to claim 1 , wherein
the memory is further configured to store the shared secret information including both the client ID and the server ID as encrypted data encrypted by a hardware unique ID unique to hardware of the information processing device.
3. The information processing device according to claim 1 , wherein
the device authenticating unit processing is further configured to
receive a client authentication value including a hash of a self-generated random number coupled with the shared secret information from the client requesting access,
calculate a corresponding self-generated client authentication value including a hash of the self-generated random number coupled with the shared secret information stored in the memory,
compare the client authentication value with the self-generated client authentication value, and
determine that the client requesting access has an access right when the client authentication value and the self-generated client authentication value match.
4. The information processing device according to claim 1 , wherein
the device authenticating unit processing is further configured to
calculate a server authentication value including a hash of the random number from the client requesting access and the shared secret information stored in the memory, and
transmit the server authentication value to the client requesting access.
5. The information processing device according to claim 1 , wherein
the information processing device further comprises a client identifying table in which client identifiers are associated with hash values of the shared secret information, and
the device authenticating unit is further configured to identify the client requesting access by searching the client identifying table based on a hash of shared secret information received from the client requesting access.
6. The information processing device according to claim 1 , wherein
the information processing device further comprises a client session ID table in which client identifiers are associated with session IDs serving as connection identification information and
the device authenticating unit is further configured to identify the client requesting access by searching the client session ID table based on a session ID.
7. The information processing device according to claim 1 , wherein
the device authenticating processing unit is further configured to perform an encryption key sharing process with the client requesting access before determining whether the client requesting access has the access right, so as to determine whether the client requesting access has the access right by encrypted data communication based on the encryption key.
8. The information processing device according to claim 7 , wherein
the encryption key sharing process is an SSL (Secure Socket Layer) handshake process.
9. The information processing device according to claim 1 , further comprising:
a device registering processing unit configured to perform a process of sharing the shared secret information including the client ID and the server ID with the client having the proper access right, wherein
the device registering processing unit is further configured to perform an ID exchange process of exchanging the client ID as an ID generated by the client having the proper access right and the server ID as an ID generated by the information processing device by encrypted data communication through a network.
10. The information processing device according to claim 9 , wherein
the device registering processing unit is further configured to perform a password authentication process in order to perform the ID exchange process.
11. The information processing device according to claim 1 , wherein
each of the client ID and the server ID included in the shared secret information has a global uniqueness.
12. The information processing device according to claim 1 , wherein
the information processing device is an application gateway positioned between an internal local area network and an external network outside the local area network.
13. The information processing device according to claim 1 , wherein
the information processing device is a reverse proxy server positioned between an internal local area network and an external network outside the local area network.
14. An information processing device serving as a client performing an access request process, the information processing device comprising:
a data transmitting/receiving unit configured to transmit/receive data to/from an application gateway;
a memory configured to store shared secret information shared with the application gateway, the shared secret information including both a client ID as an ID generated by the information processing device and a server ID as an ID generated by the application gateway; and
a device authenticating processing unit configured to receive a random number generated by the application gateway and a server authentication value including a hash of the shared secret information from the application gateway and determine whether the application gateway is authorized by identifying whether the server authentication value includes the shared secret information.
15. The information processing device according to claim 14 , wherein
the memory is further configured to store the shared secret information including both the client ID and the server ID as encrypted data encrypted by a hardware unique ID unique to hardware of the information processing device.
16. The information processing device according to claim 14 , wherein
the server authentication value includes a self-generated random number, and the device authenticating processing unit is further configured to
calculate a corresponding self-generated server authentication value including a hash of the self-generated random number coupled with the shared secret information stored in the memory,
compare the sever authentication value with the self-generated server authentication value, and
determine that the application gateway is authorized when the server authentication value and the self-generated server authentication value match.
17. The information processing device according to claim 14 , wherein
the device authenticating processing unit is further configured to
calculate a client authentication value including a hash of the random number generated by the application gateway and the shared secret information stored in the memory, and
transmit the client authentication value to the application gateway.
18. The information processing device according to claim 14 , wherein
the device authenticating processing unit is further configured to perform an encryption key sharing process with the application gateway before determining whether the application gateway is authorized, so as to determine whether the application gateway is authorized by encrypted data communication based on the encryption key.
19. The information processing device according to claim 18 , wherein
the encryption key sharing process is an SSL (Secure Socket Layer) handshake process.
20. The information processing device according to claim 14 , further comprising:
a device registering processing unit configured to perform a process of sharing the shared secret information including the client ID and the server ID with the application gateway, wherein
the device registering processing unit is further configured to perform an ID exchange process of exchanging the client ID as an ID generated by the information processing device and the server ID as an ID generated by the application gateway by encrypted data communication through a network.
21. The information processing device according to claim 20 , wherein
the device registering processing unit is further configured to perform a password authentication process in order to perform the ID exchange process.
22. The information processing device according to claim 14 , wherein
each of the client ID and the server ID included in the shared secret information has a global uniqueness.
23. A server-client system including an application gateway performing an access control process and a client performing a process to request access to the application gateway, comprising:
the application gateway including
a server data transmitting/receiving unit configured to transmit/receive data,
a server memory configured to store shared secret information shared with a client having a proper access right, the shared secret information including both a client ID as an ID generated by the client having the proper access right and a server ID as an ID generated by the application gateway, and
a server device authenticating processing unit configured to receive a random number generated by a client requesting access and a digest value including a hash of the shared secret information from the client requesting access and determine whether the client requesting access has an access right by identifying whether the digest value includes the shared secret information in response to an access request from the client requesting access; and
the client having the proper access right including
a client data transmitting/receiving unit configured to transmit/receive data,
a client memory configured to store the shared secret information shared with the application gateway, and
a client device authenticating processing unit configured to determine whether the application gateway is authorized by determining whether the application gateway has the shared secret information.
24. The server-client system according to claim 23 , wherein
the server memory is further configured to store the shared secret information including both the client ID and the server ID as encrypted data encrypted by a hardware unique ID unique to hardware of the server.
25. The server-client system according to claim 23 , wherein
the server device authenticating processing unit is further configured to
receive a client authentication value including a hash of a random number generated by the application gateway coupled with the shared secret information from the client requesting access,
calculate a corresponding self-generated client authentication value including a hash of the random number generated by the application gateway coupled with the shared secret information stored in the server memory,
compare the client authentication value with the self-generated client authentication value, and
determine that the client requesting access has an access right when the client authentication value and the self-generated client authentication value match.
26. The server-client system according to claim 23 , wherein
the server device authenticating processing unit is further configured to
calculate a server authentication value including a hash of the random number from the client requesting access and the shared secret information stored in the server memory, and
transmit the server authentication value to the client requesting access.
27. The server-client system according to claim 23 , wherein
the client memory is further configured to store the shared secret information including both the client ID and the server ID as encrypted data encrypted by a hardware unique ID unique to hardware of the client having the proper access right.
28. The server-client system according to claim 23 , wherein
the client device authenticating processing unit is further configured to
receive a server authentication value including a hash of a random number generated by the client having the proper access right coupled with the shared secret information stored in the server memory,
calculate a corresponding self-generated server authentication value including a hash of the random number generated by the client having the proper access right coupled with the shared secret information stored in the client memory,
compare the sever authentication value with the self-generated server authentication value, and
determine that the application gateway is authorized when the server authentication value and the self-generated server authentication value match.
29. The server-client system according to claim 23 , wherein
the client device authenticating processing unit is further configured to
receive a random number generated by the application gateway,
calculate a client authentication value including a hash of the random number generated by the application gateway and the shared secret information stored in the client memory, and
transmit the client authentication value to the application gateway.
30. An access control processing method in an information processing device, the access control processing method comprising:
storing shared secret information shared with a client having a proper access right, the shared secret information including both a client ID generated by the client having the proper access right and a server ID generated by the information processing device;
receiving a random number generated by a client requesting access and a digest value including a hash of the shared secret information from the client requesting access; and
determining, by a process executing on a processor, whether the client requesting access has an access right by identifying whether the digest value includes the shared secret information in response to an access request from the client requesting access.
31. The access control processing method according to claim 30 , wherein determining whether the client requesting access has the access right further includes
receiving a client authentication value including a hash of a self-generated random number coupled with the shared secret information from the client,
calculating a corresponding self-generated client authentication value including a hash of the self-generated random number coupled with the shared secret information,
comparing the client authentication value with the self-generated client authentication value, and
determining that the client requesting access has an access right when the client authentication value and the self-generated client authentication value match.
32. The access control processing method according to claim 30 , wherein determining whether the client requesting access has the access right further includes
calculating a server authentication value including a hash of the random number from the client requesting access and the shared secret information, and
transmitting the server authentication value to the client requesting access.
33. The access control processing method according to claim 30 , further comprising:
performing a table search based on the hash of the shared secret information by using a client identifying table in which client identifiers are associated with hash values of the shared secret information, so as to identify the client requesting access.
34. The access control processing method according to claim 30 , further comprising:
performing a table search based on a session ID received from the client requesting access by using a client session ID table in which client identifiers are associated with session IDs serving as connection identification information, so as to identify the client requesting access.
35. The access control processing method according to claim 30 , wherein
an encryption key sharing process is performed with the client requesting access before the determining whether the client requesting access has the access right, and
the determining whether the client requesting access has the access right is further performed by encrypted data communication based on the encryption key.
36. The access control processing method according to claim 35 , wherein
the encryption key sharing process is an SSL (Secure Socket Layer) handshake process.
37. The access control processing method according to claim 30 , further comprising:
a device registering process of sharing the shared secret information including the client ID and the server ID with the client having the proper access right, wherein
the device registering process further performs an ID exchange process of exchanging the client ID as an ID generated by the client having the proper access right and the server ID as an ID generated by the information processing device by encrypted data communication through a network.
38. The access control processing method according to claim 37 , wherein
the device registering process further includes a step of performing a password authentication process in order to perform the ID exchange process.
39. The access control processing method according to claim 30 , wherein
each of the client ID and the server ID included in the shared secret information has a global uniqueness.
40. An information processing method in an information processing device serving as a client performing an access request process, the information processing method comprising:
storing shared secret information shared with an application gateway, the shared secret information including both a client ID generated by the information processing device and a server ID generated by the application gateway;
accessing the application gateway;
receiving a random number generated by the application gateway and a server authentication value including a hash of the shared secret information from the application gateway; and
determining, by a process executing on a processor, whether the application gateway is authorized by identifying whether the server authentication value includes the shared secret information.
41. The information processing method according to claim 40 , wherein
the server authentication value includes a self-generated random number, and
determining whether the application gateway is authorized further includes
calculating a corresponding self-generated server authentication value including a hash of the self-generated random number coupled with the shared secret information,
comparing the sever authentication value with the self-generated server authentication value, and
determining that the application gateway is authorized when the server authentication value and the self-generated server authentication value match.
42. The information processing method according to claim 40 , wherein determining whether the authentication gateway is authorized further includes
calculating a client authentication value including a hash of the random number generated by the application gateway and the shared secret information, and
transmitting the client authentication value to the application gateway.
43. The information processing method according to claim 40 , wherein
an encryption key sharing process is performed with the application gateway before the determining whether the application gateway is authorized, and
the determining whether the application gateway is authorized is further performed by encrypted data communication based on the encryption key.
44. The information processing method according to claim 43 , wherein
the encryption key sharing process is an SSL (Secure Socket Layer) handshake process.
45. The information processing method according to claim 40 , further comprising:
a device registering process of sharing the shared secret information including the client ID and the server ID with the application gateway, wherein
the device registering process further performs an ID exchange process of exchanging the client ID as an ID generated by the information processing device and the server ID as an ID generated by the application gateway by encrypted data communication through a network.
46. The information processing method according to claim 45 , wherein
the device registering process further performs a password authentication process in order to perform the ID exchange process.
47. The information processing method according to claim 40 , wherein
each of the client ID and the server ID included in the shared secret information has a global uniqueness.
48. A non-transitory computer-readable storage medium storing a computer program that, when executed by a computer, directs the computer to perform an access control process in an information processing device, the access control process comprising:
storing shared secret information shared with a client having a proper access right, the shared secret information including both a client ID generated by the client having the proper access right and a server ID generated by the information processing device;
receiving a random number generated by a client requesting access and a digest value including a hash of the shared secret information from the client requesting access; and
determining whether the client requesting access has an access right by identifying whether the digest value includes the shared secret information in response to an access request from the client requesting access.
49. A non-transitory computer-readable storage medium storing a computer program that, when executed by a computer, directs the computer to perform information processing in an information processing device serving as a client performing an access request process, the access request process comprising:
storing shared secret information shared with an application gateway, the shared secret information including both a client ID generated by the information processing device and a server ID generated by the application gateway;
accessing the application gateway;
receiving a random number generated by the application gateway and a server authentication value including a hash of the shared secret information from the application gateway; and
determining whether the application gateway is authorized by identifying whether the server authentication value includes the shared secret information.