AUTHENTICATION SWITCH AND NETWORK SYSTEM

• US 20140223511A1
• Filed: 10/03/2013
• Published: 08/07/2014
• Est. Priority Date: 02/04/2013
• Status: Active Grant

• Current Assignee: Alaxala Networks Corporation (Fortinet Inc.)
• Original Assignee: Alaxala Networks Corporation (Fortinet Inc.)
• Inventors: NOMI, Motohide, YAMAMOTO, Yasunori, HIGUCHI, Hidemitsu
• Granted Patent: US 9,325,685 B2
• Time in Patent Office: Days
• US Class Current: 726/3
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/168 above the transport layer
• CPC Class Codes: H04L 67/563 Data redirection of data network streams

Abstract

An authentication switch monitors a failure of an external server, and redirect information to a Web server that holds authentication information registration screen data is provided to a terminal using a monitoring result. A life-and-death monitoring control unit for monitoring life and death of an external Web server is disposed within an authentication switch to monitor the life and death of the external Web server. An authentication processing unit within the authentication switch switches the redirect information on the basis of a life-and-death monitoring table of the external Web server provided in the life-and-death monitoring control unit in response to an authentication request from the terminal, and enables web authentication even when the external Web server is in failure.

Claims

1. An authentication switch that encompasses a terminal, and is connected to an authentication server, a first server that holds a content associated with data to be transmitted to the authentication server, and a second server with which the terminal can communicate according to an authentication result of the authentication server through a network, the authentication switch comprising:

a state monitoring unit that monitors a state of the first server;

a redirect notifying unit that makes a redirect notification including a URL of the redirect destination to the terminal on the basis of an access status from the terminal and a state of the first server when receiving an access request to the second server from the terminal;

an authentication unit that updates an access status of the terminal to the authentication switch on the basis of an authentication result of the authentication server based on data associated with a content supplied in response to a request from the terminal according to the redirect notification; and

a relay processing unit that relays a communication from the terminal to the second server according to the information included in the access request.

2. The authentication switch according to claim 1, further comprising:

a module that holds a content associated with data transmitted to the authentication server,

wherein if the access status is not subjected to an access authentication of the terminal, the redirect notifying unit makes the redirect notification including a URL indicative of the first server or the module to the terminal on the basis of the result of the state monitoring unit.

3. The authentication switch according to claim 1,

wherein the state monitoring unit holds a life-and-death state indicating that the first server runs, or fails, and

wherein the redirect notification unit determines the URL of the redirect destination on the basis of the life-and-death status of the first server.

4. The authentication switch according to claim 1,

wherein the redirect notification unit determines the redirect destination URL according to a life-and-death status of the first server, and a priority of candidates of the redirect destinations if a plurality of the first servers is provided.

5. The authentication switch according to claim 1,

wherein the redirect notification unit determines the redirect destination URL according to terminal and connection information, or the type of a given site of a network accessed from the terminal if a plurality of the first servers is provided.

6. The authentication switch according to claim 1,

wherein a communication is conducted with the terminal according to a http protocol, and a Web authenticating process is conducted on an access request to the second server from the terminal.

7. The authentication switch according to claim 1,

wherein a content held by the first server or the authentication switch is a login screen for conducting the authentication.

8. The authentication switch according to claim 1,

wherein a content held by the first server is larger in the amount of information than a content held by the authentication switch.

9. An authentication processing method in an authentication switch that encompasses the terminal, and is connected to an authentication server, a first server that holds a content associated with data to be transmitted to the authentication server, and a second server with which the terminal can communicate according to an authentication result of the authentication server through a network, the authentication processing method comprising:

monitoring a state of the first server;

when receiving an access request to the second server from the terminal, determining a URL of a redirect destination on the basis of an access status from the terminal and a state of the first server, and executing a redirect notification including the determined URL on the terminal;

updating an access status of the terminal to the authentication switch on the basis of an authentication result of the authentication server based on data associated with a content supplied in response to a request from the terminal according to the redirect notification; and

relaying a communication from the terminal to the second server according to the access request.

10. A network system, comprising:

a terminal;

an authentication server;

a first server that holds a content associated with data to be transmitted to the authentication server;

a second server with which the terminal can communicate according to an authentication result of the authentication server; and

an authentication switch that encompasses the terminal, and is connected to the first server, the second server, and the authentication server through a network,

wherein the authentication switch includes;

a state monitoring unit that monitors a state of the first server;

a redirect notifying unit that makes a redirect notification including a URL of the redirect destination to the terminal on the basis of an access status from the terminal and a state of the first server when receiving an access request to the second server from the terminal;

an authentication unit that updates an access status of the terminal to the authentication switch on the basis of an authentication result of the authentication server based on data associated with a content supplied in response to a request from the terminal according to the redirect notification; and

a relay processing unit that relays a communication from the terminal to the second server according to the information included in the access request.