Network-based single sign-on architecture for IP-VPN

In using IP-VPN services, users are assumed to need not only to connect LANs distributed over a wide area securely, but also to access multiple Web servers from locations remote from VPNs using mobile terminals, or from home-networks via the Internet, for their business. Such Web servers usually require procedures for authentication of each user, and authentication at each Web server. In addition to that for VPN access, makes the management of users' passwords complicated, and may cause a deterioration in security. In this paper, we propose a network-based single sign-on architecture linking identities of VPN access and Web access in an IP-VPN service network, which makes it possible to access multiple Web servers in a VPN by a onetime authentication procedure when connecting to a VPN from outside the VPN.