Network connection system

• US 20040177248A1
• Filed: 03/02/2004
• Published: 09/09/2004
• Est. Priority Date: 03/05/2003
• Status: Active Grant

• Current Assignee: Fuji Xerox Company Limited (Xerox Holdings Corp.)
• Original Assignee: Fuji Xerox Company Limited (Xerox Holdings Corp.)
• Inventors: Yoshida, Takeo
• Granted Patent: US 7,681,037 B2
• Time in Patent Office: Days
• US Class Current: 713/155
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226

Abstract

A network connection system includes a client apparatus, an authentication server, and a connection server. The authentication server authenticates a user of the client apparatus and transmits a network address of the client apparatus to the connection server. When information indicating the transition to a connection wait state is received from the connection server, the network address of the connection server is transmitted to the client. The client apparatus transmits an encrypted user name and password to the network address. The connection server 11 conducts authentication using the encrypted user name and password.

Claims

1. A network connection system comprising:

a client apparatus;

an authentication server; and

a connection server, wherein;

the authentication server includes;

a retention unit for storing second connection authentication information prepared on the basis of first connection authentication information used in the connection server while associating the second connection authentication information with a connection server address;

a first unit for acquiring user identification information from the client apparatus and a client address when the first unit receives a connection request from the client apparatus; and

a second unit for transmitting the acquired client address to the connection server having the connection server address associated with the second connection authentication information and transmitting the connection server address to the client apparatus, which has transmitted the connection request;

the client apparatus includes;

a third unit for transmitting the second connection authentication information to the authentication server as the user identification information together with the connection request;

a fourth unit for receiving the connection server address from the authentication server; and

a fifth unit for transmitting the first connection authentication information to the connection server having the received connection server address; and

the connection server includes;

a sixth unit for receiving connection from the client address, which has been received from the authentication server; and

a seventh unit for performing an authentication process by using the first connection authentication information transmitted from the client address.

2. The network connection system according to claim 1, wherein the second connection authentication information is a message digest of the first connection authentication information.

3. An authentication server for being connected to a client apparatus and a connection server, the authentication server comprising:

a retention unit for storing second connection authentication information prepared on the basis of first connection authentication information used in the connection server while associating the second connection authentication information with a connection server address;

a first unit for acquiring user identification information from the client apparatus and a client address when the first unit receives a connection request from the client apparatus; and

a second unit for transmitting the acquired client address to the connection server having the connection server address associated with the second connection authentication information and transmitting the connection server address to the client apparatus, which has transmitted the connection request.

4. A client apparatus for being connected to an authentication server and a connection server, the client apparatus comprising:

a connection request unit for transmitting a connection request and second connection authentication information prepared on the basis of first connection authentication information used in the connection server to the authentication server; and

a unit for receiving a connection server address from the authentication server to transmit the first connection authentication information to the connection server address.

5. A connection server for being connected to an authentication server and a client apparatus, the connection server comprising:

a control unit for receiving a client address from the authentication server and allowing connection from the client address; and

an authentication unit for receiving authentication information from the client apparatus having the client address, which is allowed the connection, to perform an authentication process by using the authentication information.

6. A network connection system comprising:

a client apparatus;

an authentication server; and

a connection server, wherein;

the authentication server includes;

a retention unit for storing a first encrypted user name and a first encrypted password, which are encrypted by a first encryption method, while associating a connection server address with the first encrypted user name and the first encrypted password;

a first unit for acquiring the first encrypted user name and the first encrypted password as identification information for identifying a user of the client apparatus, and a client address when the first unit receives a connection request from the client apparatus; and

a second unit for transmitting the acquired client address to the connection server address associated with the user identification information when the retention unit stores the user identification information, receiving from the connection server information indicating that the connection server is shifted to a connection wait state, and transmitting the connection server address to the client apparatus, which issues the connection request; and

the client apparatus includes;

a third unit for transmitting to the authentication server the first encrypted user name and the first encrypted password, which are encrypted by the first encryption method, together with the connection request; and

a fourth unit for receiving the connection server address from the authentication server, and transmitting to the received connection server address a second encrypted user name and a second encrypted password, which are generated by encrypting a user name and a password, which are input by the user, by a second encryption method.

7. An authentication server for being connected to a client apparatus and a connection server, the authentication server comprising:

a retention unit for storing a user name and a password, which are encrypted by a predetermined method, while the user name and the password are associated with a connection server address;

a first unit for acquiring the encrypted user name and the encrypted password as identification information for identifying a user of the client apparatus, and a client address when the first unit receives a connection request from the client apparatus; and

a second unit for transmitting the acquired client address to the connection server address associated with the user identification information when the retention unit stores the user identification information, receiving from the connection server information indicating that the connection server is shifted to a connection wait state, and transmitting the connection server address to the client apparatus, which issues the connection request.

8. A client apparatus for being connected to an authentication server and a connection server, the client apparatus comprising:

a connection request unit for transmitting to the authentication server a user name and a password, which are encrypted by a first encryption method, together with a connection request; and

a unit for receiving a connection server address from the authentication server, encrypting a user name and a password, which are input by a user, by a second encryption method, and transmitting the user name and the password, which are encrypted by the second encryption method, to the received connection server address.

9. The client apparatus according to claim 8, further comprising:

a retention unit for storing local authentication information, which is previously supplied from the connection server, as information associating unique information of the client apparatus with at least one of the user name and the password; and

a local authentication unit for generating the unique information upon receiving inputting the user name and the password by the user, references the local authentication information to authenticate the user by judging whether or not at least one of the received user name and the received password is associated with the generated unique information, wherein;

the connection request unit transmits to the authentication server the user name and the password, which are encrypted by the first method, together with the connection request only when the local authentication unit authenticates the user.

10. A connection server for being connected to a client apparatus and an authentication server, the connection server comprising:

a unit for receiving an address of the client apparatus to be connected from the authentication server, allowing communication from the address for a predetermined period, and transmitting to the authentication server information indicating that the connection server is shifted to a connection wait state.

11. A network connection system comprising:

a client apparatus;

an authentication server for supplying information guiding a connection destination to the client apparatus; and

a connection server, wherein;

the client apparatus calculates first authentication information unique to the client apparatus to register the first authentication information in the connection server preliminarily, and acquiring local authentication information associating the first authentication information with a predetermined second authentication information from the connection server to store the local authentication information;

the client apparatus receives input of the second authentication information when a user instructs a connection request with respect to the connection server, calculates the first authentication information unique to the client apparatus again, looking into an association between the input second authentication information and the again calculated first authentication information by using the stored local authentication information, encrypting the second authentication information by a first encryption method to transmit to the authentication server the second authentication information encrypted by the first encryption method when it is concluded that the association is established; and

the client apparatus receives the connection server address as the information guiding the connection destination from the authentication server, transmitting the second authentication information encrypted by a second encryption method to a connection server address, and starting a communication with the connection server.

12. A connection method using a network connection system including a client apparatus, an authentication server, and a connection server, the method comprising:

storing by the authentication server second connection authentication information prepared on the basis of first connection authentication information used in the connection server while associating the second connection authentication information with a connection server address;

transmitting by the client apparatus to the authentication server the second connection authentication information as user identification information together with a connection request;

acquiring the user identifying information from the client apparatus and client address when the authentication server receives the connection request from the client apparatus;

transmitting the acquired client address to the connection server identified by the connection server address associated with the second connection authentication information when the user identification information meets the second connection authentication information;

transmitting the connection server address to the client apparatus, which issues the connection request;

receiving by the client apparatus the connection server address from the authentication server;

transmitting by the client apparatus the first connection authentication information to the received connection server address;

receiving by the connection server connection from the client address received from the authentication server; and

performing an authentication process by using the first connection authentication information transmitted from the client address.

13. A connection method using a network connection system including a client apparatus, an authentication server, and a connection server, the method comprising:

storing by the authentication server a user name and a password, which are encrypted by a first encryption method, while associating the encrypted user name and the encrypted password with connection server address;

transmitting by the client apparatus to the authentication server the user name and the password, which are encrypted by the first encryption method, together with a connection request;

receiving by the authentication server the connection request from the client apparatus;

acquiring the user name and the password, which are encrypted by the first encryption method, as information identifying a user of the client apparatus, and a client address;

transmitting the acquired client address to the connection server address associated with the information identifying the user when the authentication server stores the information identifying the user;

receiving by the connection server the client address of the client apparatus to be connected from the authentication server;

allowing communication from the client apparatus;

transmitting to the authentication server information indicating that the connection server is shifted to a connection wait state;

encrypting a user name and a password, which are input by the user, by a second encryption method;

transmitting the user name and the password, which are encrypted by the second encryption method, to the connection server address received by the client server from the authentication server; and

performing an authentication process by using the user name and the password, which are encrypted by the second encryption method and are received by the connection server from the client apparatus.