Access control method, authentication method, and authentication device

• US 9,667,625 B2
• Filed: 07/02/2015
• Issued: 05/30/2017
• Est. Priority Date: 07/10/2014
• Status: Active Grant

• Current Assignee: Ricoh Company Limited
• Original Assignee: Ricoh Company Limited
• Inventors: Wang, Wei, Sun, Yan, Yang, Linju, Liao, Ke, Da, Bin
• Primary Examiner(s): Pyzocha, Michael
• Application Number:
  US14/790,269
• Publication Number:
  US 20160014118A1
• Time in Patent Office: 698 Days
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity

Abstract

Disclosed is an access control method of an area restricted network system including a central control device and at least one area restricted network. Each area restricted network includes at least a master node. The method comprises a detection step of detecting that an access device has entered into an area restricted network in the area restricted network system; a receipt step of receiving, by a master node in the area restricted network, an authentication information request sent by the access device; a sending step of, in response to the authentication information request, generating and sending the authentication information for the access device by the master node in the area restricted network; and a request step of, by the access device, receiving the authentication information, and then utilizing the authentication information so as to send an authentication request to the central control device.

Claims

1. An access control method of an area restricted network system including a central control device that allows access to any resource in one or more area restricted networks, each area restricted network amongst the area restricted networks including at least a master node, and an area restriction signal transmission device which is associated with the master node in the corresponding area restricted network and broadcasts an area restriction signal for restricting the corresponding area restricted network, the access control method comprising:

(a) detecting that an access device has entered into a first area restricted network in the area restricted network system, and sending, by the area restriction signal transmission device, a response to a connection request from the access device upon detecting that the access device has entered into the first area restricted network, and establishing a connection between the area restriction signal transmission device and the access device;

(b) forwarding by the area restriction signal transmission device to the associated master node in the first area restricted network, an authentication information request received by the area restriction signal transmission device from the access device, the authentication information request being used to request authentication information for the access device from the master node;

(c) forwarding, by the area restriction signal transmission device to the access device, authentication information from the master node, in response to the authentication information request; and

(d) performing authentication of the access device, by the central control device in response to an authentication request from the access device, based on the authentication information obtained by the access device via the area restriction signal transmission device from the master node, the access device being permitted to simultaneously access the first area restricted network and another network which is external to the system, after authentication.

2. The method according to claim 1, wherein the detection in (a) includes:

determining a signal strength of the area restriction signal which is used to restrict the first area restricted network and is received by the access device,

wherein, if the signal strength is greater than a first threshold, then determining that the access device has entered into the first area restricted network, and if the signal strength is less than a second threshold, then determining that the access device has departed from the first area restricted network.

3. The method according to claim 2, wherein the authentication information request includes a device ID of the access device, and the master node in the first area restricted network generates, in response to the received authentication information request, the authentication information based on the device ID included in the authentication information request.

4. The method according to claim 3, wherein the authentication information request sent by the access device is received and forwarded to the master node in the first area restricted network by the area restriction signal transmission device, and the authentication information sent by the master node is received and forwarded to the access device by the area restriction signal transmission device.

5. The method according to claim 2, further comprising:

comparing the authentication information acquired from the master node and the authentication information provided to the central control device by the access device so as to conduct the authentication with respect to the access device.

6. The method according to claim 1, further comprising:

generating, by the central control device, an area device service table for each area restricted network in the area restricted network system, and conducting access control with respect to an authenticated access device based on a corresponding area device service table.

7. The method according to claim 6, wherein the area device service table of each area restricted network includes an area ID of the corresponding area restricted network as well as a device ID and a device function list of each device in the corresponding area restricted network.

8. The method according to claim 7, wherein after the access device passes through the authentication conducted by the central control device, the central control device adds the access device into an area device service table corresponding to the first area restricted network so as to update the area device service table.

9. An authentication method of conducting authentication with respect to an access device, which is used by a central control device that allows access to any resource in an area restricted network system that includes one or more area restricted networks, each area restricted network amongst the area restricted networks including at least one master node, and an area restriction signal transmission device which is associated with the master node in the corresponding area restricted network and broadcasts an area restriction signal for restricting the corresponding area restricted network, the authentication method comprising:

(a) receiving by the central control device an authentication request from the access device which has entered into a first area restricted network in the area restricted network system, the authentication request requesting authentication of the access device by the central control device based on authentication information obtained by the access device via the area restriction signal transmission device from the associated master node;

(b) acquiring, by the central control device, in response to the authentication request, authentication information from the master node in the first area restricted network; and

(c) performing, based on (i) the authentication information included in the authentication request received by the central control device from the access device and (ii) the authentication information acquired by the central control device from the master node, an authentication process by the central control device with respect to the access device to be authenticated, the access device being permitted to simultaneously access the first area restricted network and another network which is external to the system, after authentication.

10. An authentication device for conducting authentication with respect to an access device, which is used to allow access to any resource in an area restricted network system that includes one or more area restricted networks, each area restricted network amongst the area restricted networks including at least one master node, and an area restriction signal transmission device which is associated with the master node in the corresponding area restricted network and broadcasts an area restriction signal for restricting the corresponding area restricted network, the authentication device comprising:

a receipt part to receive an authentication request from the access device which has entered into a first area restricted network in the area restricted network system, the authentication request requesting authentication of the access device by the authentication device based on authentication information obtained by the access device via the area restriction signal transmission device from the associated master node;

an acquisition part to acquire, in response to the authentication request, authentication information from the master node in the first area restricted network; and

an authentication part to perform, based on the authentication information included in the authentication request received from the access device and the authentication information acquired from the master node, an authentication process with respect to the access device, the access device being permitted to simultaneously access the first area restricted network and another network which is external to the system, after authentication,

wherein the functions of the receipt part, the acquisition part and the authentication part are implemented by execution by a processor of the host authentication device, of one or more programs stored in a non-transitory computer readable medium.