Communication system for authenticating or relaying network access, relaying apparatus, authentication apparatus, and communication method

An authentication apparatus that is connected to a first relaying apparatus that relays communication from a terminal device connected via a first network to a second network and to a second relaying apparatus that relays communication to an external authentication apparatus that authenticates the terminal device according to a first authentication protocol via the second network, and authenticates an access to the second network according to a second authentication protocol, the authentication apparatus comprising:

• a request receiving unit that receives a request message from the first relaying apparatus, the request message requesting access authentication for the first relaying apparatus to access the second network;
• a determining unit that determines whether to approve an access of the first relaying apparatus to the second network based on the received request message and confirms an access method preset for each first relaying apparatus, with respect to the first relaying apparatus whose access has been approved;
• a result transmitting unit that transmits a determination result by the determining unit to the first relaying apparatus;
• an address receiving unit that receives the address information of the terminal device associated with identification information for identifying communication with the first relaying apparatus whose access to the second network has been approved, from the second relaying apparatus;
• and
• an approval unit that approves an access of the terminal device in the received address information to the second network by the access method confirmed for the first relaying apparatus, which has established communication identified by the identification information associated with the received address information.

A relaying apparatus that is connected to a terminal device via a first network, and connected via a second network to an external device that relays communication to a first authentication apparatus that authenticates the terminal device according to a first authentication protocol, and to a second authentication apparatus that performs access authentication to the second network according to a second authentication protocol, thereby relaying communication from the terminal device to the second network, the relaying apparatus comprising:

• an identification-information storage unit that can store identification information for identifying communication for the relaying apparatus to access the second network;
• a request transmitting unit that transmits a first request message to the second authentication apparatus, the first request message requesting access authentication for the relaying apparatus to access the second network;
• a result receiving unit that receives a determination result of whether to approve an access of the relaying apparatus to the second network, which is a response to the first request message, from the second authentication apparatus;
• a communication establishing unit that establishes communication to the second network, and stores the identification information of the established communication in the identification-information storage unit, when the determination result indicating approval of the access of the relaying apparatus to the second network is received;
• a request receiving unit that receives a second request message from the terminal device, the second request message requesting access authentication for the terminal device to access the second network;
• and
• a transfer unit that obtains the identification information from the identification-information storage unit and transfers the second request message added with the obtained identification information to the external device, when the second request message is received.

A communication method performed by a communication system that includes a first relaying apparatus that relays communication from a terminal device connected via a first network to a second network;

• a second relaying apparatus that relays communication to a first authentication apparatus that is connected to the first relaying apparatus via the second network and authenticates the terminal device according to a first authentication protocol;
• and a second authentication apparatus that is connected to the first relaying apparatus via the second network and performs access authentication for the first relaying apparatus with respect to the second network according to a second authentication protocol, the communication method comprising:
• transmitting a first request message to the second authentication apparatus, the first request message requesting access authentication for the first relaying apparatus to access the second network;
• receiving the first request message from the first relaying apparatus;
• determining whether to approve an access of the first relaying apparatus to the second network based on the received first request message, to confirm an access method preset for each first relaying apparatus, with respect to the first relaying apparatus whose access has been approved;
• transmitting a determination result of whether to approve the access to the first relaying apparatus;
• receiving the determination result from the second relaying apparatus;
• establishing communication from the first relaying apparatus to the second network, when the determination result indicating approval of the access of the first relaying apparatus to the second network is received, and storing the identification information for identifying the established communication in a storage unit;
• receiving a second request message from the terminal device, the second request requesting access authentication for the terminal device to access the second network;
• obtaining the identification information from the storage unit and transferring the second request message added with the obtained identification information to the second relaying apparatus, when the second request message is received,
• receiving the second request message added with the identification information from the first relaying apparatus, and relaying the received second request message to the first authentication apparatus;
• notifying the second authentication apparatus of address information of the authenticated terminal device associated with the identification information added to the second request message, when the terminal device as a sender of the second request message is authenticated by the first authentication apparatus;
• receiving the address information associated with the identification information from the second relaying apparatus;
• and
• approving the access of the terminal device in the received address information to the second network by the access method confirmed for the first relaying apparatus, which has established communication identified by the identification information associated with the received address information.