Authentication device and network authentication system, method for authenticating terminal device and program storage medium

An authentication method for authenticating a terminal device according to a certain authentication protocol with respect to both an IEEE 802.1X protocol that is defined in a data link layer in a protocol stack and a higher layer protocol that is defined in a higher layer than a UDP/IP layer or a TC/IP layer in the protocol stack, the certain authentication protocol being operable on both of the IEEE 802.1X and the higher layer protocols, comprising:

• acquiring a first message required for the terminal device to be subject to authentication with respect to the IEEE 802.1X protocol, from the terminal device;
• when a predetermined authentication identifier is contained in the first message acquired from the terminal device, sending-back to the terminal device a success message to notify the terminal device that the authentication with respect to the IEEE 802.1X protocol is successful without performing IEEE 802.1X protocol authentication;
• establishing a data link of the data link layer with the terminal device to which the success message has been sent-back;
• filtering packets of the UDP/IP or the TCP/IP received from the terminal device through the data link, using a filtering unit which filters the packets;
• when the authentication identifier is contained in the first message, setting the filtering unit so as to pass a first packet required for the terminal device to be subjected to authentication with respect to the higher layer protocol from among the packets sent from the terminal device and to block second packets different from the first packet;
• acquiring a second message carried by the first packet by the filtering unit from the terminal device, the second message being required for the terminal device to be subject to authentication with respect to the higher layer protocol;
• authenticating the terminal device from which the second message is acquired with respect to the higher layer protocol;
• and
• when the authentication with respect to the higher layer protocol is successful, setting the filtering unit so as to pass the second packets sent from the terminal device.

A non-transitory computer readable medium storing an authentication program for authenticating a terminal device according to a certain authentication protocol with respect to both an IEEE 802.1X protocol that is defined in a data link layer in a protocol stack and a higher layer protocol that is defined in a higher layer than a UDP/IP layer or a TC/IP layer in the protocol stack, the certain authentication protocol being operable on both of the IEEE 802.1X protocol and the higher layer protocol, the program causing a computer to execute the steps of:

• acquiring a first message required for the terminal device to be subject to authentication with respect to the IEEE 802.1X protocol, from the terminal device;
• when a predetermined authentication identifier is contained in the first message acquired from the terminal device, sending-back to the terminal device a success message to notify the terminal device that the authentication with respect to the IEEE 802.1X protocol is successful without performing IEEE 802.1X protocol authentication;
• establishing a data link of the data link layer with the terminal device to which the success message has been sent-back;
• filtering packets of the UDP/IP or the TCP/IP received from the terminal device through the data link, using a filtering unit which filters the packets;
• when the authentication identifier is contained in the first message, setting the filtering unit so as to pass a first packet required for the terminal device to be subjected to authentication with respect to the higher layer protocol from among the packets sent from the terminal device and to block second packets different from the first packet;
• acquiring a second message carried by the first packet by the filtering unit from the terminal device, the second message being required for the terminal device to be subject to authentication with respect to the higher layer protocol;
• authenticating the terminal device from which the second message is acquired with respect to the higher layer protocol;
• and
• when the authentication with respect to the higher layer protocol is successful, setting the filtering unit so as to pass the second packets sent from the terminal device.

A network access authentication system having a terminal device which receives authentication according to a certain authentication protocol with respect to both an IEEE 802.1X protocol that is defined in a data link layer in a protocol stack and a higher layer protocol that is defined in a higher layer than a UDP(User Datagram Protocol)/IP(Internet Protocol) layer or a TCP(Transmission Control Protocol)/IP(Internet Protocol) layer in the protocol stack, the certain authentication protocol being operable on both of the IEEE 802.1X protocol and the higher layer protocol,

• the authentication device comprising:
• a first acquisition unit configured to acquire a first message required for the terminal device to be subject to authentication with respect to the IEEE 802.1X protocol, from the terminal device;
• a sending-back unit configured to send-back a success message to the terminal device to notify the terminal that the authentication with respect to the IEEE 802.1X protocol is successful without performing IEEE 802.1X protocol authentication when a predetermined authentication identifier is contained in the first message;
• a data link establishing unit configured to establish a data link of the data link layer with the terminal device to which the success message has been sent-back;
• a filtering unit configured to perform filtering on packets of the UDP/IP or the TCP/IP received from the terminal device through the data link;
• a first filter setting unit configured to set the filtering unit so as to pass a first packet required for the terminal device to be subjected to authentication with respect to the higher layer protocol from among the packets from the terminal device and to block second packets different from the first packet, when the authentication identifier is contained in the first message;
• a second acquisition unit configured to acquire a second message carried by the first packet from the terminal device, the second message being required for authentication with respect to the higher layer protocol;
• an authentication unit configured to authenticate the terminal device from which has the second message is acquired, with respect to the higher layer protocol;
• and
• a second filter setting unit configured to set the filtering unit so as to pass second packets from the terminal device when the authentication with respect to the higher layer protocol is successful,
• the terminal device comprising;
• a transmitting unit configured to transmit the first message required for the terminal device to be subjected to the authentication with respect to the IEEE 802.1X protocol, including the predetermined authentication identifier to the authentication device.

An authentication device for authenticating a terminal device according to a certain authentication protocol with respect to both a Link Layer Authentication Protocol that is defined in a data link layer in a protocol stack and a higher layer protocol that is defined in a higher layer than a UDP(User Datagram Protocol)/IP(Internet Protocol) layer or a TCP(Transmission Control Protocol)/IP(Internet Protocol) layer in the protocol stack, the certain authentication protocol being operable on both of the Link Layer Authentication Protocol and the higher layer protocols, comprising:

• a first acquisition unit configured to acquire a first message required for the terminal device to be subject to authentication with respect to the Link Layer Authentication Protocol, from the terminal device;
• a sending-back unit configured to send-back a success message to the terminal device to notify the terminal that the authentication with respect to the Link Layer Authentication Protocol is successful without performing Link Layer Authentication Protocol authentication when a predetermined authentication identifier is contained in the first message;
• a data link establishing unit configured to establish a data link of the data link layer with the terminal device to which the success message has been sent-back;
• a filtering unit configured to perform filtering on packets of the UDP/IP or the TCP/IP received from the terminal device through the data link;
• a first filter setting unit configured to set the filtering unit so as to pass a first packet required for the terminal device to be subjected to authentication with respect to the higher layer protocol from among the packets from the terminal device and to block second packets different from the first packet, when the authentication identifier is contained in the first message;
• a second acquisition unit configured to acquire a second message carried by the first packet from the terminal device, the second message being required for authentication with respect to the higher layer protocol;
• an authentication unit configured to authenticate the terminal device from which has the second message is acquired, with respect to the higher layer protocol;
• and
• a second filter setting unit configured to set the filtering unit so as to pass second packets from the terminal device when the authentication with respect to the higher layer protocol is successful.

A device for communicating with a terminal device to be subjected to authentication according to a certain authentication protocol with respect to both a Link Layer Authentication Protocol defined in a data link layer in a protocol stack and a higher layer protocol defined in a higher layer than a UDP(User Datagram Protocol)/IP(Internet Protocol) layer or a TCP(Transmission Control Protocol)/IP(Internet Protocol) layer in the protocol stack, the certain authentication protocol being operable on both of the Link Layer Authentication Protocol and the higher layer protocol, comprising:

• a first acquisition unit configured to acquire a first message required for the terminal device to be subjected to authentication with respect to the Link Layer Authentication Protocol, from the terminal device;
• a sending-back unit configured to send-back a success message to the terminal device to notify the terminal device that the authentication with respect to the Link Layer Authentication Protocol is successful without performing Link Layer Authentication Protocol authentication;
• a data link establishing unit configured to establish a data link of the data link layer with the terminal device to which the success message has been sent-back;
• a filtering unit configured to perform filtering on packets of the UDP/IP or the TCP/IP received through the data link from the terminal device;
• a first filter setting unit configured to set the filtering unit so as to pass a first packet required for the terminal device to be subjected to authentication with respect to the higher layer protocol and to block second packets different from the first packet among the packets, when the authentication identifier is contained in the first message;
• a second acquisition unit configured to acquire a second message carried by the first packet from the terminal device, the second message being required for the terminal device to be subjected to authentication with respect to the higher layer protocol;
• an authentication request unit configured to, based on the second message, send to an authentication device a request message to request authenticating the terminal device with respect to the higher layer protocol, the authentication device performing authentication with respect to the higher layer protocol;
• and
• a second filter setting unit configured to set the filtering unit so as to pass the second packets from the terminal device when the authentication by the authentication device is successful.

A non-transitory computer readable medium storing a program for communicating with a terminal device to be subjected to authentication according to a certain authentication protocol with respect to both a Link Layer Authentication Protocol that is defined in a data link layer in a protocol stack and a higher layer protocol that is defined in a higher layer than a UDP/IP layer or a TC/IP layer in the protocol stack, the certain authentication protocol being operable on both of the Link Layer Authentication Protocol and the higher layer protocol, the program causing a computer to execute the steps of:

• acquiring a first message required for the terminal device to be subject to authentication with respect to the Link Layer Authentication Protocol, from the terminal device;
• when a predetermined authentication identifier is contained in the first message acquired from the terminal device, sending-back to the terminal device a success message to notify the terminal device that the authentication with respect to the Link Layer Authentication Protocol is successful without performing Link Layer Authentication Protocol authentication;
• establishing a data link of the data link layer with the terminal device to which the success message has been sent-back;
• filtering packets of the UDP/IP or the TCP/IP received from the terminal device through the data link, using a filtering unit which filters the packets;
• when the authentication identifier is contained in the first message, setting the filtering unit so as to pass a first packet required for the terminal device to be subjected to authentication with respect to the higher layer protocol from among the packets sent from the terminal device and to block second packets different from the first packet;
• acquiring a second message carried by the first packet by the filtering unit from the terminal device, the second message being required for the terminal device to be subject to authentication with respect to the higher layer protocol;
• sending, based on the second message, to a authentication device a request message to request authenticating the terminal device with respect to the higher layer protocol, the authentication device performing authentication with respect to the higher layer protocol;
• and
• setting the filtering unit so as to pass the second packets sent from the terminal device when the authentication by the authentication device is successful.