JP2014192611A - Authentication device - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an authentication device that authenticates a communication device connected with a network without relying on a network configuration.SOLUTION: An authentication device holds correspondence information indicating correspondence relation between an address in a first layer and an address in a second layer, an upper-level layer of the first layer. If the address in the first layer of a received packet is not included in the correspondence information, the authentication device inquires of a communication device using the address in the first layer of the received packet the address in the second layer of the communication device to update the correspondence information. If the correspondence information includes the address in the second layer of the received packet as an address in the second layer corresponding to the first layer of the received packet, the authentication device performs first authentication processing that is performed by transmitting and receiving a packet in the first layer to/from a communication device of the transmission source of the received packet. Otherwise, the authentication device performs second authentication processing different from the first authentication processing.

Description

  The present invention relates to an authentication technique for a communication device.

  For example, consider a case where a company's corporate network and another company's corporate network are connected by a virtual private network (VPN) to exchange information between the companies. In this case, it is necessary to perform control so as to allow communication via a VPN only between specific communication devices, instead of permitting communication between arbitrary communication devices connected to different corporate networks. For this reason, when a certain communication device requests communication via VPN, it is necessary to authenticate whether the communication device is permitted to communicate via VPN.

  Here, for example, Patent Document 1 gives a temporary IP address when a communication device requests an Internet Protocol (IP) address, and then displays an authentication screen when communication from the communication device occurs. A configuration is disclosed in which authentication is performed based on an input from a user of a communication device that is displayed on the communication device. Further, in Non-Patent Document 1, when an authentication device receives an Ethernet (registered trademark) frame from a newly connected communication device, authentication processing is performed based on authentication information stored in the communication device in advance. The configuration is disclosed.

JP 2005-286558 A

IEEE802.1X

  However, in the configuration described in Patent Document 1, in order to proceed with the authentication process after the IP address is assigned, the enterprise networks are connected via VPN using an Ethernet network such as a wide area Ethernet service. Not available if you are. In addition, the configuration described in Non-Patent Document 1 is based on the premise that the authentication target communication device and the authentication device can directly transmit and receive a layer 2 frame such as an Ethernet (registered trademark) frame. This is not applicable when there is a router that terminates the layer 2 frame between the authentication devices.

  In view of the above problems, the present invention provides an authentication device that authenticates a communication device connected to a network without depending on the network configuration.

  According to one aspect of the present invention, there is provided an authentication device for one or more communication devices connected to a network, wherein an address of a first layer and an address of a second layer, which is an upper layer of the first layer, If the correspondence information indicating the correspondence relationship of the received packet is not included in the correspondence information, the communication device using the first layer address of the received packet is notified to the communication device. Updating means for inquiring the address of the second layer of the device and updating the correspondence information; and as the second layer address corresponding to the first layer of the received packet in the correspondence information, If a second layer address is included, a first authentication process is performed by transmitting and receiving a first layer packet to and from a communication device that is a transmission source of the received packet. When the correspondence information does not include the address of the second layer of the received packet as the address of the second layer corresponding to the first layer of the received packet, the second authentication process is different from the first authentication process. And a control means for executing the second authentication process.

  Authentication of a communication device connected to the network can be performed without depending on the network configuration.

1 is a schematic configuration diagram of an authentication device according to an embodiment. FIG. The flowchart which shows the process in the authentication apparatus by one Embodiment. The system block diagram by one Embodiment.

  Hereinafter, exemplary embodiments of the present invention will be described with reference to the drawings. In the following drawings, components that are not necessary for the description of the embodiments are omitted from the drawings.

  FIG. 3 is an exemplary system configuration diagram including the authentication device 1 according to the present embodiment. In FIG. 3, the network 5 is, for example, a VPN, and the authentication apparatus 1 authenticates whether or not the terminals 41 and 42 can communicate with other corporate networks via the network 5 that is a VPN. Thus, only the terminals that can communicate with other corporate networks are permitted. More specifically, only packets from terminals that can communicate with other corporate networks are transferred to the network 5 side. The L2SW is a layer 2 frame transfer device, and the router 3 is an IP packet transfer device. For example, when the VPN is configured on the Internet, the authentication device 1 also functions as a transfer device when the terminals 41 and 42 access the Internet. In this case, for example, even if the terminal 41 cannot communicate via VPN, the authentication device 1 permits access to the Internet.

  In the configuration of FIG. 3, the layer 2 frame from the terminal 41 reaches the authentication device 1, but the layer 2 frame from the terminal 42 does not reach the authentication device 1 because it is terminated at the router 3. Note that the IP packet from the terminal 42 reaches the authentication device 1. In the present embodiment, both the terminals 41 and 42 can be authenticated. The configuration of FIG. 3 is an example, and the installation position of the authentication device 1 is not limited to the boundary between the network 5 and the corporate network as shown in FIG. In this embodiment, communication between terminals connected to different intra-company networks is taken as an example. However, the present invention can also be applied to communication between terminals connected to different networks within the same company. .

  FIG. 1 is a schematic configuration diagram of an authentication device 1 according to the present embodiment. The transmission / reception unit 11 transmits / receives a packet, and the address resolution protocol (ARP) information holding unit 14 holds an ARP table indicating the correspondence between the MAC address and the IP address. The control unit 12 controls the entire processing in the authentication device 1, and the authentication information management unit 13 manages and holds the authenticated information. The authenticated information is information including the MAC address or IP address of a communication device that has already been authenticated.

  Hereinafter, an authentication process executed by the authentication device 1 will be described with reference to FIG. When receiving the packet in S11, the control unit 12 of the authentication device 1 determines whether either the transmission source MAC address or the transmission source IP address of the received packet is included in the authenticated information held by the authentication information management unit 13. judge. If the transmission source MAC address or the transmission source IP address of the received packet is included in the authenticated information, the terminal of the transmission source of the reception packet has already been authenticated, and the reception packet is transferred in S13. On the other hand, when both the transmission source MAC address and the transmission source IP address of the received packet are not included in the authenticated information, the control unit 12 determines whether the transmission source MAC address exists in the ARP table in S14. If it does not exist, in step S15, ARP resolution processing for inquiring about the IP address of the device is executed for the device using the source MAC address, and the source MAC address is used in the ARP table. The device and the IP address of the device are added to the ARP table, and the process proceeds to S16. On the other hand, when it exists in S14, it progresses to S16 as it is.

  In S16, the control unit 12 determines whether the combination of the transmission source MAC address and the transmission source IP address of the received packet matches the combination of the MAC address and the IP address of the ARP table. The coincidence in S16 is that the terminal of the received packet and the authentication device 1 are connected at the layer 2 level, that is, the terminal of the received packet and the authentication device 1 are directly connected to the layer 2 frame. It shows that can be sent and received. On the other hand, the fact that they do not match in S16 indicates that the terminal of the transmission source of the received packet and the authentication device 1 are connected at the layer 3 level via the router 3. Therefore, if they match in S16, the control unit 12 performs the authentication process described in Non-Patent Document 1 with the transmission source terminal of the received packet in S17, and determines whether the authentication is successful or unsuccessful in S18. to decide. Note that information necessary for authentication described in Non-Patent Document 1 is stored in the authentication device 1 in advance. However, information necessary for authentication is stored in an external device, and the control unit 12 transfers the authentication information received from the terminal that is the transmission source of the received packet to the external device. The configuration may be such that the authentication result is received from.

  If the authentication is successful in S18, the control unit 12 adds the MAC address of the received packet to the authenticated information and transfers the received packet in S27. On the other hand, there are two possibilities that the authentication is not successful in S18: the case where the terminal that is the source of the received packet is an unauthenticated terminal, and the case where the authentication process described in Non-Patent Document 1 is not implemented. There is. Therefore, if the authentication in S18 is unsuccessful, the control unit 12 determines in S19 whether the received packet is an IP address allocation request based on the dynamic host configuration protocol (DHCP). In the case of an IP address request, the control unit 12 performs authentication processing defined by DHCP with the terminal that is the transmission source of the received packet in S20, and determines whether authentication is successful or unsuccessful in S21. Note that the storage of information for authentication of the transmission source terminal and the comparison between the authentication information received from the transmission source terminal of the received packet may be performed by the authentication device 1 as in the case of S17. May go.

  If the authentication is successful in S21, the control unit 12 adds the MAC address of the received packet to the authenticated information in S27. In this case, since the received packet is an IP address assignment request, there is no need to transfer the received packet. On the other hand, if the authentication is not successful in S21, the control unit 12 ends the process in S25.

  In S16, the combination of the source MAC address and the source IP address of the received packet does not match the pair of the MAC address and the IP address in the ARP table, as described above. It shows that the authentication apparatus 1 is connected at the layer 3 level via the router 3. Therefore, if they do not match in S16, the control unit 12 determines in S22 whether the received packet is a packet including a message conforming to HTTP (hereinafter referred to as an HTTP packet). If the packet is an HTTP packet, the control unit 12 In step S23, a login screen is displayed on the terminal that is the transmission source of the received packet, and authentication by login processing is performed. Specifically, for example, the login screen displayed on the terminal of the transmission source of the received packet in S23 allows the user of the terminal to input the account name and password pair, and obtains authentication information from the terminal of the transmission source for authentication. I do. Note that the storage of information for authentication of the transmission source terminal and the comparison between the authentication information received from the transmission source terminal of the received packet may be performed by the authentication device 1 as in the case of S17. May go.

  If the authentication in S24 is successful, the control unit 12 adds the IP address of the received packet to the authenticated information and transfers the received packet in S27. On the other hand, if the authentication in S24 is unsuccessful, the control unit 12 discards the received packet in S26 and ends the process.

  In S19, the fact that the received packet is not an IP address assignment request may mean that the source terminal of the received packet is using a static IP address, for example. In this case, as described above, the control unit 12 performs the processing from S22 to S24 and performs authentication using the login screen. If the process at S19 is “Nо” and the authentication is successful at S24, the MAC address of the received packet is added to the authenticated information and the received packet is transferred at S27. This is because the processing in S 19 is performed because the authentication device 1 and the terminal that is the transmission source of the received packet are connected without going through the router 3. The authentication device 1 buffers the received packet until the authentication is completed, and transfers the buffered received packet after successful authentication. This prevents unnecessary packet retransmission.

  With the above configuration, authentication can be performed regardless of the configuration between the authentication device 1 in the network and the terminal that is the communication device to be authenticated.

Claims (7)

An authentication device for one or more communication devices connected to a network,
Correspondence information indicating a correspondence relationship between the address of the first layer and the address of the second layer that is an upper layer of the first layer is held, and the address of the first layer of the received packet is included in the correspondence information. If not included, an update unit that inquires the communication device that uses the address of the first layer of the received packet for the address of the second layer of the communication device and updates the correspondence information;
When the correspondence information includes the address of the second layer of the received packet as the address of the second layer corresponding to the first layer of the received packet, the communication device that is the transmission source of the received packet And a first authentication process performed by transmitting and receiving the first layer packet, and the correspondence information includes the second layer address corresponding to the first layer of the received packet as the second layer address corresponding to the first layer of the received packet. Control means for executing a second authentication process different from the first authentication process when the address of the second layer is not included;
An authentication device comprising: A management unit for managing authenticated information indicating the address of the first layer or the address of the second layer of the authenticated communication device;
When the authentication is successful in the first authentication process, the control unit adds the address of the first layer of the communication device that is the transmission source of the received packet to the authenticated information, and the authentication is performed in the second authentication process. If successful, the second layer address of the communication device that is the transmission source of the received packet is added to the authenticated information, and the first layer address or the second layer address of the received packet is added to the authenticated information. 2. The authentication apparatus according to claim 1, wherein if it is included, the authentication is determined to be successful without executing the first authentication process and the second authentication process.   When the authentication in the first authentication process is unsuccessful, the control unit executes the second authentication process with the communication device that is the transmission source of the received packet, and the first authentication process is unsuccessful. When the authentication is successful in the second authentication process after becoming, the address of the first layer of the communication device that has been successfully authenticated is added to the authenticated information. 2. The authentication device according to 2.   4. The authentication apparatus according to claim 1, wherein the second authentication process is executed when a received packet includes a message according to a predetermined protocol. 5.   5. The method according to claim 1, wherein the first authentication process includes an authentication process based on IEEE802.1X and an authentication process performed when assigning a second layer address to the communication apparatus. The authentication device described in 1.   6. The second authentication process includes a process of displaying an authentication screen on a communication device that is a transmission source of the received packet and allowing a user of the communication device to input authentication information. The authentication device according to any one of the above.   The control unit holds the received packet until authentication of the communication device is completed when the received packet is addressed to a communication device other than the authentication device. The authentication device according to any one of the above.

Images