JP2009272693A - Connection control system, connection control method and connection control program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To prevent deterioration in the filtering performance of a packet filter. <P>SOLUTION: When receiving a packet from a customer's terminal, a packet filter device retrieves an IP address range (e.g. "ADR1") including an IP address indicating a transmission source of the packet received from the customer's terminal out of IP address ranges prestored as "transmission source IP address range-transfer policy pair information", and controls whether the packet received from the customer's terminal is to be transferred or not on the basis of the transfer policy stored correspondingly to the retrieved IP address range. <P>COPYRIGHT: (C)2010,JPO&INPIT

Description

  The present invention relates to a connection control system for controlling communication to an external network by a visitor terminal connected to a visitor LAN installed in the company (inside a company or the like), and a connection control method realized by the connection control system And a connection control program corresponding to the connection control method.

  2. Description of the Related Art Conventionally, there is a technique for controlling communication from a LAN to an external network based on a predetermined rule for a user who connects to an LAN (Local Area Network) from an access point installed in a building or the like (non-patent document). 1).

  For example, every time an IP address is paid out to a user who has succeeded in LAN connection authentication, a transfer policy that specifies whether or not to permit transfer of a packet having the IP address as a transmission source to an external network is A technique is known in which packets are added to a packet filter for filtering packets according to a user group to which a user who has succeeded in authentication belongs.

RFC 2979 “Behavior of and Requirements for Internet Firewalls”, 2000

  However, since the conventional technique described above adds a transfer policy to the packet filter every time an IP address is issued to a user who has succeeded in LAN connection authentication, the number of entries recorded as a transfer policy in the packet filter is There is a problem that the filtering performance of the packet filter deteriorates due to swelling.

  Accordingly, the present invention has been made to solve the above-described problems of the prior art, and provides a connection control system, a connection control method, and a connection control program capable of preventing deterioration of filtering performance of a packet filter. The purpose is to do.

  In order to solve the above-described problems and achieve the object, the invention according to claim 1 is a connection control system for controlling communication to an external network by a visitor terminal connected to a visitor LAN installed in the company. A permission group information storage means for storing the MAC address of the visitor terminal in association with the permission group information to which the user of the visitor terminal permitted to connect to the visitor LAN belongs. For each permission group information to which a user of the visitor terminal permitted to connect to the visitor LAN is associated, a range of IP addresses that can be assigned to the visitor terminal is stored in association with each other. In relation to a packet having the address range storage means and the IP address that can be assigned to the visitor terminal as a source, the external network Transfer policy storage means for storing a transfer policy indicating conditions that can be transferred to a network, and permission group information stored by the permission group information storage means when there is an IP address assignment request from the visitor terminal Among the obtaining means for obtaining the permission group information corresponding to the MAC address of the visitor terminal of the allocation request source, and the obtaining of the IP address range for each permission group stored by the address range storage means. An allocation unit that determines and allocates an IP address to be allocated to the allocation request source visitor terminal from a range of IP addresses corresponding to the permitted group information acquired by the unit, and a packet received from the visitor terminal, From the IP address range stored in the transfer policy storage means, the visitor A range of IP addresses including an IP address indicating a transmission source of a packet received from the end is searched, and based on the transfer policy stored in the transfer policy storage unit in association with the searched IP address range, Transfer control means for controlling whether or not to transfer a packet accepted from the visitor terminal.

  According to a second aspect of the present invention, in the above invention, the transfer policy storage means uses the visitor terminal as a transmission source in association with a range of IP addresses that can be assigned to the visitor terminal. With respect to the packet, the destination IP address and destination port number that can be transferred to the external network are stored as the transfer policy, and the transfer control means stores the transfer policy storage means when receiving the packet from the visitor terminal The IP address range including the IP address indicating the transmission source of the packet received from the visitor terminal is searched from the IP address range that has been received, and is associated with the searched IP address range. Based on the destination IP address and destination port number stored as the transfer policy by the transfer policy storage means And controlling whether to forward the packet that has been received from the visitor terminal.

  Further, in the invention according to claim 3, in the above invention, when there is a connection request from the visitor terminal to the visitor LAN, the connection request is made using the permission group information included in the connection request. Authentication means for authenticating whether or not the user of the original visitor terminal belongs to a group permitted to connect to the visitor LAN, and the visitor terminal of the connection request source to the visitor LAN If the authentication means authenticates that the user belongs to a group that permits the connection, the permission group information associated with the MAC address of the visitor terminal is associated with the permission group. The connection control system according to claim 1, further comprising registration means for registering in the storage means.

  The invention according to claim 4 is a connection control method for controlling communication to an external network by a visitor terminal connected to a visitor LAN installed in the company, wherein an IP address is assigned from the visitor terminal. A storage that stores the MAC address of the visitor terminal in association with the permission group information to which the user of the visitor terminal to which connection to the visitor LAN is permitted when requested. Obtaining the permission group information corresponding to the MAC address of the visitor terminal of the allocation request source, and the permission to which the user of the visitor terminal permitted to connect to the visitor LAN belongs For each group information, referring to a storage unit that stores a range of IP addresses that can be assigned to the visitor terminal in association with each other, the permission acquired by the acquisition step is stored. An assignment step for determining and assigning an IP address to be assigned to the assignment requesting visitor terminal from the IP address range corresponding to the group information, and when receiving a packet from the visitor terminal, With reference to a storage unit that stores a transfer policy indicating a condition that can be transferred to the external network with respect to a packet whose source is the visitor terminal in association with an assignable IP address range, the visitor Transfer control for controlling whether or not to transfer the packet received from the visitor terminal based on the transfer policy corresponding to the IP address range including the IP address indicating the transmission source of the packet received from the terminal And a step.

  The invention according to claim 5 is a connection control program for causing a computer to execute processing for controlling communication to an external network by a visitor terminal connected to a visitor LAN installed in the company, wherein the visitor When there is an IP address assignment request from the terminal, the MAC address of the visitor terminal is set for each permission group information to which the user of the visitor terminal permitted to connect to the visitor LAN belongs. An acquisition procedure for acquiring permission group information corresponding to the MAC address of the visitor terminal that is the assignment request source from the storage unit that is associated and stored, and a user of the visitor terminal that is permitted to connect to the visitor LAN For each permission group information to which the user belongs, refer to the storage unit that stores the range of IP addresses that can be assigned to the visitor terminal in association with An assignment procedure for determining and assigning an IP address to be assigned to the assignment requesting customer terminal from the IP address range corresponding to the permitted group information obtained by the obtaining procedure, and when receiving a packet from the visitor terminal, A storage unit that stores a transfer policy indicating a condition that can be transferred to the external network with respect to a packet that is transmitted from the visitor terminal in association with a range of IP addresses that can be assigned to the visitor terminal. With reference to whether the packet received from the visitor terminal is transferred based on the transfer policy associated with the IP address range including the IP address indicating the transmission source of the packet received from the visitor terminal And a transfer control procedure for controlling whether or not the computer is executed.

  According to the present invention, since the transfer policy for filtering packets transmitted from the visitor terminal connected to the visitor LAN to the external network can be aggregated for each group to which the visitor belongs, It is possible to prevent deterioration of filtering performance.

  Exemplary embodiments of a connection control system, a connection control method, and a connection control program according to the present invention will be described below in detail with reference to the accompanying drawings. In the following, Example 1 will be described as an embodiment for implementing the connection control system according to the present invention, and then another example will be described as another embodiment included in the present invention.

  In the following first embodiment, the outline and characteristics of the connection control system according to the first embodiment, the configuration and processing of the connection control system will be described in order, and finally the effects of the first embodiment will be described.

[Outline and Features of Connection Control System (Example 1)]
First, the outline and characteristics of the connection control system according to the first embodiment will be described with reference to FIGS. 1 and 2. FIG. 1 and FIG. 2 are diagrams for explaining the outline and features of the connection control system according to the first embodiment.

  The outline of the connection control system according to the first embodiment is to control communication to an external network by a visitor terminal connected to a visitor LAN installed in the company (inside a company or the like).

  The connection control system according to the first embodiment aggregates transfer policies for filtering packets transmitted from a visitor terminal connected to a visitor LAN to an external network for each group to which the visitor belongs. The main feature is that the deterioration of the filtering performance of the packet filter is prevented.

  Hereinafter, the main features will be specifically described. For example, as illustrated in FIG. 1, the connection control system according to the first embodiment installed in the company Y includes a MAC-realm pair information storage device, a RADIUS server, a DHCP server, and a packet filter device.

  When a RADIUS server receives a connection request from a visitor terminal carried by a visitor of company A who visits company Y to a company IP network of company Y such as a LAN installed for visitor Y, a connection request is received. Is used to authenticate whether the user of the visitor terminal that is the connection request source belongs to a group that is permitted to connect to the visitor LAN.

  When the authentication is successful, the RADIUS server, for example, as shown in FIG. 2, the MAC address (eg, “A”) of the visitor terminal that is the connection request source, and the realm in the certificate included in the connection request (For example, “a”) is associated and registered in the MAC-realm pair information storage device as “MAC-realm pair information”, and then an authentication result notification indicating that the authentication has been successful is transmitted to the customer terminal.

  Here, the realm is information for identifying a group (company, etc.) to which a visitor permitted to connect to the visitor LAN belongs, and is distributed in advance from the Y company to each group, or Each group notifies the Y company in advance.

  When receiving the authentication result notification from the RADIUS server, the visitor terminal transmits an IP address assignment request to the connection control system.

  When the DHCP server receives the IP address assignment request from the visitor terminal, for example, as shown in FIG. 2, the assignment request is sent from the “MAC-realm pair information” stored in the MAC-realm pair information storage device. A realm (for example, “a”) corresponding to the MAC address (for example, “A”) of the original visitor terminal is acquired.

  Then, the DHCP server, for example, as shown in FIG. 2, among the assigned IP address ranges for each realm stored in advance as “realm-assigned IP address range pair information”, the realm (for example, “ a ”), an IP address to be allocated to the visitor terminal that is the IP address allocation request source is determined and notified from the IP address range (for example,“ ADR1 ”).

  When receiving the notification of the IP address from the DHCP server, the visitor terminal transmits a packet having the IP address as the transmission source address to the connection control system.

  When the packet filter device receives the packet from the visitor terminal, for example, as shown in FIG. 2, the packet filter device receives from the IP address range stored in advance as “source IP address range-forwarding policy pair information”. The IP address range (for example, “ADR1”) including the IP address indicating the transmission source of the packet received from the subscriber terminal is searched, and based on the transfer policy stored in association with the searched IP address range Control whether to transfer the packet received from the visitor terminal.

  For this reason, the connection control system according to the first embodiment has a transfer policy for filtering packets transmitted from the visitor terminal connected to the visitor LAN to the external network, as in the main feature described above. Aggregation can be performed for each group to which a visitor belongs, and deterioration of the filtering performance of the packet filter can be prevented.

[Configuration of Connection Control System (Example 1)]
Next, the configuration of the connection control system according to the first embodiment will be described with reference to FIGS. FIG. 3 is a block diagram illustrating the configuration of the connection control system according to the first embodiment. FIG. 4 is a diagram illustrating a configuration example of “MAC-realm pair information”. FIG. 5 is a diagram illustrating a configuration example of “realm-assigned IP address range pair information”. FIG. 6 is a diagram illustrating a configuration example of “source IP address range-forwarding policy pair information”.

  As illustrated in FIG. 3, the connection control system 200 according to the first embodiment includes a MAC-realm pair information storage device 210, a RADIUS server 220, a DHCP server 230, and a packet filter device 240.

  The connection control system 200 according to the first embodiment can communicate with the visitor terminal 100 via the visitor LAN 1, and the company A company IP network 3 and B via the external IP network 2. Communication with the private company IP network 4 is possible.

  The MAC-realm pair information storage device 210 accepts registration from a RADIUS server 220, which will be described later. For example, as shown in FIG. 4, the user of the visitor terminal 100 to which connection to the visitor LAN 1 is permitted belongs. For each realm (for example, “a.com”), which is information for identifying a group, the MAC address (Media Access Control address, for example, “12: 34: 56: AB: CD: EF ”) in association with each other and stored as“ MAC-realm pair information ”.

  In addition, the realm is distributed in advance to a group (company, etc.) to which a visitor permitted to connect to the visitor LAN 1 belongs, or notified in advance to each company from each group.

  In addition, in order to verify a certificate (for example, x.509 certificate) presented at the time of connection authentication of the visitor LAN 1 from a terminal used by a user of each group, a route for each group including a realm The certificate is set in the RADIUS server 220 of the installation company (for example, company Y).

  The MAC-realm pair information storage device 210 corresponds to the “permitted group information storage unit” recited in the claims.

  The RADIUS (Remote Authentication Dial-In User Service) server 220 uses, for example, an EAP-TLS (Extensible Authentication Protocol-Transport Layer Security) authentication method based on IEEE.802.1X to connect to the visitor LAN 1. For the user of the visitor terminal 100 requesting, connection authentication via a wireless access point is performed.

  More specifically, when the RADIUS server 220 receives a connection request from the visitor terminal 100 to the visitor LAN 1, the certificate received together with the connection request from the visitor terminal 100 (for example, an x.509 certificate). Based on the above, it is authenticated whether or not the user of the visitor terminal 100 that is the connection request source belongs to a group that is permitted to connect to the visitor LAN.

  If the authentication is successful, the RADIUS server 220 sends the MAC address (eg, “12: 34: 56: AB: CD: EF”) of the visitor terminal 100 that is the connection request source and the certificate included in the connection request. In association with the realm (for example, “a.com”) in the MAC-realm pair information storage device 210 as “MAC-realm pair information”.

  Then, the RADIUS server 220 transmits an authentication result notification indicating that the authentication is successful to the customer terminal 100.

  The RADIUS server 220 corresponds to “authentication means” and “registration means” described in the claims.

  A DHCP server (Dynamic Host Configuration Protocol) 230 assigns an IP address to the visitor terminal 100 that requests assignment of an IP address.

  More specifically, for example, as shown in FIG. 5, the DHCP server 230 has a realm (e.g., a group to which the user of the visitor terminal 100 permitted to connect to the visitor LAN 1 belongs). For each “a.com”), a range of IP addresses that can be assigned to the visitor terminal 100 (for example, “192.168.1 / 24”) is associated with each other as “realm-assigned IP address range pair information”. Store in advance.

  When the DHCP server 230 receives the IP address assignment request from the visitor terminal 100, the visitor of the assignment request source from the “MAC-realm pair information” stored in the MAC-realm pair information storage device 210. A realm (for example, “a.com”) corresponding to the MAC address of the terminal 100 (for example, “12: 34: 56: AB: CD: EF”) is acquired.

  After acquiring the realm, the DHCP server 230 determines the realm (for example, “a.com”) that has been previously acquired from the allocated IP address range for each realm stored in advance as “realm-allocated IP address range pair information”. ) Is determined and notified from the IP address range (for example, “192.168.1 / 24”) corresponding to the client terminal 100 of the IP address allocation request source.

  The DHCP server 230 corresponds to “address range storage means”, “acquisition means”, and “allocation means” described in the claims.

  The packet filter device 240 filters packets transmitted from the visitor terminal 100 to the external IP network 2.

  Specifically, as shown in FIG. 6, for example, the packet filter device 240 associates the visitor terminal 100 with the transmission source IP address range (for example, “192.168.1 / 24”) as the transmission source. The destination IP address and the destination port number are stored as a transfer policy as a condition for transferring the packet to the external IP network 2.

  When the packet filter device 240 receives the packet from the visitor terminal 100, the packet filter device 240 receives the packet from the visitor terminal 100 from the source IP address range stored in advance as “source IP address range-transfer policy pair information”. A source IP address range (for example, “192.168.1 / 24”) including the IP address indicating the source of the received packet is searched.

  When the search of the source IP address range is completed, the packet filter device 240 associates with the searched source IP address range, and stores the transfer policy (stored as “source IP address range-transfer policy pair information”). Based on the destination IP address and destination port number), the packet received from the visitor terminal 100 is transferred to the external IP network 2 if the packet matches this transfer policy.

  For example, the packet filter device 240 stores “vpn-gw.a.com (the host name of the VPN gateway of company A) in which the destination IP address and the destination port number of the packet received from the visitor terminal 100 are stored as the transfer policy. ), The packet received from the visitor terminal 100 is transferred to the external IP network 2.

  The packet filter device 240 corresponds to “transfer policy storage unit” and “transfer control unit” described in the claims.

  The visitor terminal 100 is an information processing device such as a personal computer, for example, and the MAC-realm pair information storage device 210, the RADIUS server 220, and the DHCP server 230 are known information processing devices such as a personal computer and a workstation. In addition, it can be realized by mounting the above-described functions. The packet filter device 240 can be applied to a gateway or the like installed in the connection control system 200.

[Processing of Connection Control System (Example 1)]
Subsequently, processing by the connection control system according to the first embodiment will be described with reference to FIG. FIG. 7 is a diagram illustrating a flow of processing by the connection control system according to the first embodiment.

  As shown in the figure, when the RADIUS server 220 receives a connection request from the visitor terminal 100 to the visitor LAN 1, the certificate received together with the connection request from the visitor terminal 100 (for example, an x.509 certificate). ), L2 (Layer 2) connection authentication is performed to determine whether or not the user of the visitor terminal 100 that is the connection request source belongs to a group that is permitted to connect to the visitor LAN (step S701). .

  When the authentication is successful (step S702), the RADIUS server 220 is included in the connection request and the MAC address (for example, “12: 34: 56: AB: CD: EF”) of the visitor terminal 100 that is the connection request source. The realm in the certificate (for example, “a.com”) is associated and registered as “MAC-realm pair information” in the MAC-realm pair information storage device 210 (step S703).

  Then, the RADIUS server 220 transmits an authentication result notification indicating that the authentication was successful to the customer terminal 100 (S step S704).

  When an IP address assignment request is transmitted from the visitor terminal 100 (step S705) and the DHCP server 230 receives the IP address assignment request, the “MAC-realm pair” stored in the MAC-realm pair information storage device 210 is received. The realm (for example, “a.com”) corresponding to the MAC address (for example, “12: 34: 56: AB: CD: EF”) of the visitor terminal 100 that is the allocation request source is acquired from “information”. (Step S706).

  After acquiring the realm, the DHCP server 230 determines the realm (for example, “a.com”) that has been previously acquired from the allocated IP address range for each realm stored in advance as “realm-allocated IP address range pair information”. ) Is determined from the IP address range (for example, “192.168.1 / 24”) corresponding to the IP address allocation requester (step S707) and notified to the customer terminal 100. (Step S708).

  Upon receiving the IP address notification from the DHCP server, the visitor terminal transmits a packet having this IP address as the source address (step S709).

  When the packet filter device 240 receives a packet from the visitor terminal 100, the packet filter device 240 receives the packet from the visitor terminal 100 from the source IP address range stored in advance as "source IP address range-transfer policy pair information". A source IP address range (for example, “192.168.1 / 24”) including an IP address indicating the source of the packet is searched, and a transfer policy stored in association with the searched source IP address range ( If the packet received from the visitor terminal 100 matches the transfer policy based on the destination IP address and the destination port number), the packet is transferred to the external IP network 2 (step S710).

[Effects of Example 1]
As described above, according to the first embodiment, the transfer policy for filtering packets transmitted from the visitor terminal 100 connected to the visitor LAN 1 to the external IP network 2 is set for each group to which the visitor belongs. Since they can be aggregated, it is possible to prevent deterioration of the filtering performance of the packet filter.

  That is, by linking the realm that identifies the group to which the user of the visitor terminal 100 permitted to connect to the visitor LAN 1 belongs, the IP address range assigned to the visitor terminal 100, and the transfer policy The transfer policy of packets transmitted from the customer terminal 100 connected to the customer LAN 1 to the external IP network 2 is aggregated for each group to which the customer belongs.

  Therefore, unlike the conventional case, there is no need to add a transfer policy to the packet filter every time an IP address is issued to a user who has succeeded in LAN connection authentication, and the deterioration of the filtering performance of the packet filter can be prevented. it can.

  Although the embodiments of the present invention have been described so far, the present invention may be implemented in various different forms other than the embodiments described above. In the following, other embodiments included in the present invention will be described.

(1) “MAC-realm pair information” is managed in advance In the above embodiment, the MAC address and realm of the customer terminal 100 that has been successfully authenticated by the RADIUS server 220 are associated with each other in the MAC-realm pair information storage device 210. Explained the case of registration.

  However, the present invention is not limited to this. For example, the MAC address and realm of the visitor terminal 100 that is expected to be frequently connected to the visitor LAN 1 are managed in advance. When there is a connection request from the visitor terminal 100, if the combination of the MAC address and the realm is correct, connection to the visitor LAN 1 may be permitted.

  In this way, for the customer terminal 100 that is expected to be frequently connected to the visitor LAN 1, it is not necessary to perform connection authentication by the RADIUS server 220 every time there is a connection request. It is possible to easily execute IP address assignment and the like.

(2) System Configuration, etc. Each component of the connection control system 200 shown in FIG. 3 is functionally conceptual and does not necessarily need to be physically configured as illustrated. That is, the specific form of distribution / integration of the connection control system 200 is not limited to the one shown in the figure, and all or a part of the connection-control system 200 such as integrating the MAC-realm pair information storage device 210 and the DHCP server 230 can be combined with various loads It can be configured to be functionally or physically distributed / integrated in an arbitrary unit according to the usage situation. Each processing function performed in each device included in the connection control system 200 may be integrated in one device.

  In addition, each processing function (see, for example, FIG. 7) performed by each device included in the connection control system 200 described above is a CPU or a program that is analyzed and executed by the CPU. It can be realized or can be realized as hardware by wired logic.

(3) Connection Control Program In addition, various processes (for example, see FIGS. 1 to 4) of the devices included in the connection control system 200 described in the first embodiment are connected control devices (see FIG. This can be realized by executing a program prepared in advance on a computer system such as a personal computer or a workstation. In the following, an example of a computer that executes a connection control program having the same function as that of the first embodiment will be described with reference to FIG. FIG. 8 is a diagram illustrating a computer that executes a connection control program.

  As shown in the figure, a computer 200 as a connection control device is configured by connecting a communication control unit 310, an HDD 320, a RAM 330, and a CPU 340 via a bus 400.

  Here, the communication control unit 310 controls communication related to various types of information exchanged via the visitor LAN 1 and the external IP network 2. The HDD 320 stores information necessary for executing various processes by the CPU 340. The RAM 330 temporarily stores various information. The CPU 340 executes various arithmetic processes.

  As shown in FIG. 8, the HDD 320 stores in advance a connection control program 321 that exhibits the same function as each device of the connection control system shown in the first embodiment and connection control processing data 322. Has been. Note that the connection control program 321 may be appropriately distributed and stored in a storage unit of another computer that is communicably connected via a network.

  The CPU 340 reads out the connection control program 321 from the HDD 320 and develops it in the RAM 330, so that the connection control program 321 functions as a connection control process 331 as shown in FIG. Then, the connection control processing process 331 reads the connection control processing data 322 and the like from the HDD 320, expands them in the area allocated to itself in the RAM 330, and executes various processes based on the expanded data and the like. The connection control process 331 is a process executed in each device (the MAC-realm pair information storage device 210, the RADIUS server 220, the DHCP server 230, and the packet filter device 240) included in the connection control system shown in FIG. Each corresponds.

  The connection control program 321 described above does not necessarily need to be stored in the HDD 320 from the beginning. For example, a flexible disk (FD), a CD-ROM, a DVD disk, a magneto-optical disk, an IC inserted into the computer 300 can be used. Each program is stored in a “portable physical medium” such as a card, or “another computer (or server)” connected to the computer 300 via a public line, the Internet, a LAN, a WAN, or the like. The computer 300 may read and execute each program from these.

(3) Connection Control Method The following connection control method is realized by the connection control system described in the first embodiment.

  That is, a connection control method for controlling communication to an external network by a visitor terminal connected to a visitor LAN installed in the company, and when a visitor terminal requests an IP address assignment, For each permission group information (realm) to which a user of a visitor terminal permitted to connect to a private LAN belongs, a storage unit (see FIG. 4) that stores the MAC address of the visitor terminal in association with each other. An acquisition step of acquiring permission group information (realm) corresponding to the MAC address of the visitor terminal of the allocation request source (see step S706 in FIG. 7), and the user of the visitor terminal permitted to connect to the visitor LAN The IP address range (assigned IP address range) that can be assigned to the visitor terminal is associated with each permission group information (realm) to which the user belongs. Referring to the storing unit (see FIG. 5), the IP address assigned to the allocation request source visitor terminal is determined from the IP address range corresponding to the permission group information (realm) acquired in the acquisition step. An assigning step (see step S707 in FIG. 7), and when a packet is received from the visitor terminal, the visitor terminal is set as a transmission source in association with a range of IP addresses that can be assigned to the visitor terminal. Referring to a storage unit (see FIG. 6) that stores a transfer policy indicating a condition that can be transferred to an external network with respect to a packet to be transmitted, an IP address indicating a transmission source of the packet received from the visitor terminal is included. Based on the transfer policy associated with the IP address range, whether or not to transfer the packet received from the visitor terminal is controlled. Transfer control step (see step S710 in FIG. 7), connection control method including the to is realized.

  As described above, the connection control system, the connection control method, and the connection control program according to the present invention communicate with an external network by a visitor terminal connected to a visitor LAN installed in the company (inside a company or the like). Is particularly useful for controlling the degradation of the filtering performance of the packet filter.

BRIEF DESCRIPTION OF THE DRAWINGS FIG. 1 is a diagram for explaining an overview and characteristics of a connection control system according to a first embodiment. BRIEF DESCRIPTION OF THE DRAWINGS FIG. 1 is a diagram for explaining an overview and characteristics of a connection control system according to a first embodiment. 1 is a block diagram illustrating a configuration of a connection control system according to a first embodiment. It is a figure which shows the structural example of "MAC-realm pair information." It is a figure which shows the structural example of "realm-assignment IP address range pair information". It is a figure which shows the structural example of "source IP address range-forwarding policy pair information." It is a figure which shows the flow of a process by the connection control system which concerns on Example 1. FIG. It is a figure which shows the computer which performs a connection control program.

Explanation of symbols

1 Visitor LAN
2 External IP network 3 A company IP network 4 B company IP network 100 Visitor terminal 200 Connection control system 210 MAC-realm pair information storage device 210
220 RADIUS server 230 DHCP server 240 Packet filter device 300 Computer (connection control device)
310 Communication control unit 320 HDD (Hard Disk Drive)
321 Connection control program 322 Connection control processing data 330 RAM (Random Access Memory)
331 Connection control processing process 340 CPU (Central Processing Unit)
400 bus

Claims (5)

A connection control system for controlling communication to an external network by a visitor terminal connected to a visitor LAN installed in the company,
Permission group information storage means for storing the MAC address of the visitor terminal in association with each of the allowance group information to which the user of the visitor terminal allowed to connect to the visitor LAN is associated;
An address that associates and stores a range of IP addresses that can be allocated to the visitor terminal for each permitted group information to which a user of the visitor terminal that is permitted to connect to the visitor LAN belongs. Range storage means;
A transfer policy storage for storing a transfer policy indicating a condition that can be transferred to the external network for a packet originating from the visitor terminal in association with a range of IP addresses that can be assigned to the visitor terminal Means,
When there is an IP address assignment request from the visitor terminal, the permission group information corresponding to the MAC address of the visitor terminal of the assignment request source from the permission group information stored in the permission group information storage means Obtaining means for obtaining
Of the IP address range for each permitted group stored by the address range storage unit, the allocation is made from the IP address range corresponding to the permitted group information acquired by the acquiring unit to the allocation requesting customer terminal An assigning means for determining and assigning an IP address;
When a packet is received from the visitor terminal, an IP including an IP address indicating the transmission source of the packet received from the visitor terminal is selected from the range of IP addresses stored by the transfer policy storage unit Search for a range of addresses, and control whether or not to transfer a packet accepted from the visitor terminal based on the transfer policy stored in the transfer policy storage means in association with the searched IP address range Transfer control means to
A connection control system comprising: The transfer policy storage means relates to a range of IP addresses that can be allocated to the visitor terminal, and relates to a packet having the visitor terminal as a transmission source, a destination IP address and a destination that can be transferred to the external network Store the port number as the forwarding policy,
When the transfer control unit receives a packet from the visitor terminal, the transfer control unit indicates a transmission source of the packet received from the visitor terminal from the IP address range stored in the transfer policy storage unit. The IP address range including the IP address is searched, and the visitor is associated with the searched IP address range based on the destination IP address and the destination port number stored as the transfer policy by the transfer policy storage unit. The connection control system according to claim 1, wherein whether or not to transfer a packet received from a user terminal is controlled. When there is a connection request from the visitor terminal to the visitor LAN, the user of the visitor terminal that is the connection request source connects to the visitor LAN using the permission group information included in the connection request. An authentication means for authenticating whether the user belongs to a permitted group,
When the authentication means authenticates that the connection requesting visitor terminal belongs to a group that permits connection to the visitor LAN, permission group information included in the connection request; The connection control system according to claim 1, further comprising: a registration unit that registers the MAC address of the visitor terminal in association with the permission group storage unit. A connection control method for controlling communication to an external network by a visitor terminal connected to a visitor LAN installed in the company,
When there is an IP address assignment request from the visitor terminal, for each permission group information to which the user of the visitor terminal allowed to connect to the visitor LAN belongs, An acquisition step of acquiring permission group information corresponding to the MAC address of the visitor terminal of the allocation request source from the storage unit that stores the MAC address in association with each other;
Storage that associates and stores a range of IP addresses that can be allocated to the visitor terminal for each permitted group information to which a user of the visitor terminal that is permitted to connect to the visitor LAN belongs An allocation step of determining and allocating an IP address to be allocated to the allocation request source customer terminal from an IP address range corresponding to the permitted group information acquired by the acquisition step,
When a packet is received from the visitor terminal, it can be transferred to the external network with respect to a packet originating from the visitor terminal in association with a range of IP addresses that can be assigned to the visitor terminal. Based on the transfer policy associated with the IP address range including the IP address indicating the transmission source of the packet received from the visitor terminal with reference to the storage unit storing the transfer policy indicating the condition, A transfer control step for controlling whether or not to transfer a packet received from the visitor terminal;
The connection control method characterized by including. A connection control program for causing a computer to execute processing for controlling communication to an external network by a visitor terminal connected to a visitor LAN installed in the company,
When there is an IP address assignment request from the visitor terminal, for each permission group information to which the user of the visitor terminal allowed to connect to the visitor LAN belongs, An acquisition procedure for acquiring permission group information corresponding to the MAC address of the visitor terminal of the allocation request source from the storage unit that stores the MAC address in association with each other,
Storage that associates and stores a range of IP addresses that can be allocated to the visitor terminal for each permitted group information to which a user of the visitor terminal that is permitted to connect to the visitor LAN belongs An allocation procedure for determining and allocating an IP address to be allocated to the allocation requesting customer terminal from an IP address range corresponding to the permitted group information acquired by the acquisition procedure,
When a packet is received from the visitor terminal, it can be transferred to the external network with respect to a packet originating from the visitor terminal in association with a range of IP addresses that can be assigned to the visitor terminal. Based on the transfer policy associated with the IP address range including the IP address indicating the transmission source of the packet received from the visitor terminal with reference to the storage unit storing the transfer policy indicating the condition, A transfer control procedure for controlling whether or not to transfer a packet received from a visitor terminal;
A connection control program for causing a computer to execute.

Images