1. Field of the Invention
The present invention generally relates to access management methods and access management servers, and more particularly to an access management method in a network system including a packet communication apparatus for conducting a routing and an access management server having an authentication function, and the access management server.
2. Description of the Related Art
Recently, a personal computer has been widely used, and functions and performance of the personal computer and a network have been improved. In an organization, as a tool to smoothly operate a business, the network becomes more important and also important data are transmitted through the network. In order to secure the data, a security device such as a firewall system is provided against attacks of illegal access and viruses.
Japanese Laid-open Patent Application No. 2003-249944 discloses that an organization secures safety of a new base station arranged by a general user by conducting an authentication mutually between an authentication server and the new base station and the authentication is mutually conducted between the base station and a new radio terminal. In addition, Japanese Laid-open Patent Application No. 2003-249944 discloses that the base station first when the new radio terminal accesses and the base station does not transmit a packet being sent by the new radio terminal to a network at an organization side until the authentication succeeds mutually between the base station and the radio terminal, so as to prevent from a DoS (Denial of Service) attack which pretends an authentication.
Japanese Laid-open Patent Application No. 2003-8660 discloses that a permission list of IP addresses is provided to a router after a user is authenticated.
Recently, since it has been desired to provide means against problems such as a data leak, an attack by a virus to the network, various methods are proposed. However, those methods are not sufficient to solve the problems.
In the invention disclosed in Japanese Laid-open Patent No. 2003-8660, the permission list of IP addresses is provided to the router after the user is authenticated. Accordingly, the list of IP addresses is just one way of managing the list of IP addresses. In addition, since information showing a communication permission is set to an access management server and the information is just one way of managing the communication permission, it is impossible to manage the communication permission on a case-by-case basis in that one communication partner temporarily denies a communication with another communication partner or it is impossible to flexibly manage the communication permission in a case of determining a communication permission corresponding to a detail condition such a condition for each session. Since the communication permission cannot be dynamically managed, when a communication partner being regularly permitted infects with a virus and attacks to other communication partners, it is impossible to prevent from the attack. Moreover, when the number of terminals is increased, the list of IP addresses becomes greater and then performance of the router is degraded. Accordingly, it is difficult to realize a larger scale.
As the authentication for each session, a technology such as SSL (Secure Socket Layer) can be generally used. However, since this technology is used at an end system, it is impossible to prevent from an attack such as the attack by DoS passing through a regular procedure.
The above-described problems in a conventional system can be summarized as follows:    (1) Since only a member can-be authenticated, it is impossible to authenticate a user over a different network being managed by another manager.    (2) Since the communication permission is managed based on information showing the communication permission for each communication partner, which is fixed, it is impossible to prevent from an attack by a terminal when the terminal temporarily becomes an attacker.    (3) Even if a session authentication is conducted at the end system and a filter is provided, when the attack of DoS, the attack achieves the end system. Accordingly, it is not sufficient to prevent from the attack.