JP4892745B2 - Apparatus and method for authenticating connection of authentication switch - Google Patents

Description

  The method for authenticating the connection of the authentication switch according to the present invention relates to an apparatus and method for authenticating the connection of the authentication switch that prevents the authentication switch having the connection from being illegally removed from the network and replaced with another switch.

  Network authentication uses the IEEE802.1x authentication function, and the IEEE802.1x supplicant software installed in the personal computer that is the terminal connected to the authentication switch executes the authentication, and only the personal computer that passes the authentication can connect to the network. is there.

  The IEEE 802.1x supplicant software is installed on a personal computer and is not a mechanism for authenticating the connection between switches. For this reason, the conventional method has a problem in that it can be connected to a network if it is replaced with an unauthorized switch.

  In the conventional IEEE802.1x authentication mechanism, a switch to which a personal computer is connected is used as an IEEE802.1x authentication switch to prevent unauthorized personal computers from being connected. It was not possible to prevent the switch for use from being replaced with an unauthorized switch. There was also no way to report that the switch was replaced by an unauthorized switch.

For this reason, Patent Document 1 that supports an authentication method other than IEEE 802.1x authentication, IEEE802. In a system having an x-compliant authentication switch, there is a technique related to Patent Document 2 regarding a technique for operating an authentication switch and Patent Document 3 for exchanging authentication information between the switches and performing authentication based on the exchanged authentication information. .
JP 2007-267315 A JP 2007-049709 A JP 2007-306369 A

  However, Patent Document 1 describes a multi-authentication function switch that supports an authentication method other than IEEE 802.1x authentication, but there is no description about preventing the multi-authentication switch itself from being exchanged illegally.

  Japanese Patent Application Laid-Open No. 2004-151867 has a problem that, when an authentication switch is exchanged with another switch, the client cannot be authenticated, but there is no means for preventing a vulnerability called “illegal exchange of authentication switch”.

  Patent Document 3 has a problem that although mutual ID authentication between wireless devices requires setting of an ID code, execution / non-execution of mutual authentication cannot be selected for each port.

  The present invention has been made in view of the above, and an object of the present invention is to provide an apparatus and method for authenticating connection of an authentication switch that can prevent an authentication switch from being illegally exchanged and that can be notified when the authentication switch is exchanged. To do.

In order to solve the above-described problem, an apparatus for authenticating connection of an authentication switch according to the present invention includes a first authentication switch having an IEEE 802.1x authentication function and a first authentication switch that is connectable to the first authentication switch. A second authentication switch and a terminal connected to the first authentication switch, the first authentication switch includes an ID of the first authentication switch, a password of the first authentication switch, wherein a port number to enable the first authentication switch connection authentication, stores the first authentication information including the second authentication switch of the ID of the second authentication switch, the second Storing second authentication information including a password of the authentication switch and a port number for enabling connection authentication of the second authentication switch , wherein the first authentication switch is connected to the second authentication switch; The second authentication information, the second authentication switch acquires the first authentication information from the first authentication switch, respectively, and stores the first authentication information in a storage unit in advance, and the first authentication switch includes: The second authentication switch compares the stored second authentication information with the current connection partner authentication information, and the second authentication switch compares the stored first authentication information with the current connection partner authentication information. Then, connection authentication is performed, and based on the connection authentication result, it is determined whether or not the terminal that has requested connection can transfer the packet .

In order to solve the above-described problem , a method for authenticating connection of an authentication switch according to the present invention includes a first authentication switch having an IEEE 802.1x authentication function and a first authentication switch that is connectable to the first authentication switch. In a system having two authentication switches and a terminal connected to the first authentication switch, the first authentication switch includes an ID of the first authentication switch and a password of the first authentication switch. , and port number to enable the connection authentication of the first authentication switch, a procedure of the first authentication information memorize including, the second authentication switch of the ID of the second authentication switch, wherein the second authentication switch password, and port number to enable the connection authentication of the second authentication switch, a procedure of the second remembers the authentication information including the first authentication Sui Pitch is, the procedure for saving acquires the second authentication information from the second authentication switch, the second authentication switch obtains the first authentication information from the first authentication switch a step of storing Te, the first authentication switch, by comparing the stored authentication information of the second authentication information and the current connection destination, the second authentication switch is first obtained by the storage The authentication information of the current connection partner and the authentication information of the current connection partner, respectively, and performing connection authentication, and determining the packet transfer availability of the terminal that has requested connection based on the connection authentication result. Features.

  The first switch acquires the second authentication information from the second switch, the second switch acquires the first authentication information from the first switch, and the first switch and the second switch The connection authentication function unit 5 determines that an unauthorized switch has been connected by determining connection requests based on the first authentication information and the second authentication information and reporting the determination results to the terminals. By reporting, it is possible to prevent the authentication switch from being illegally exchanged, and to obtain an apparatus and method for authenticating the connection of the authentication switch that can be notified when the authentication switch is exchanged.

  Next, embodiments of the present invention will be described in detail with reference to the drawings. FIG. 1 is a diagram showing an overall configuration of an apparatus for authenticating connection of an authentication switch according to an embodiment of the present invention.

  In FIG. 1, an apparatus for authenticating connection of an authentication switch according to an embodiment of the present invention includes an IEEE 802.1x authentication personal computer 1, a personal computer 2, an IEEE 802.1x authentication switch 3, a switch 6, and an authentication server 7. It consists of.

  The IEEE802.1x authentication switch 3 includes a connection authentication function unit 4 that performs connection authentication with other switches, and an I / O (input / output unit) 8 that is used for input / output of information between devices connected to the outside. The switch 6 includes a connection authentication function unit 5 that inputs and outputs authentication information, and I / Os 10 and 11 that are used to input and output information to and from externally connected devices. Yes.

  Next, a detailed configuration of the IEEE 802.1x authentication switch 3 according to the embodiment of the present invention and the switch 6 according to the embodiment of the present invention will be described with reference to FIG.

  As shown in FIG. 2, the IEEE 802.1x authentication switch 3 includes a connection authentication function unit 4 and I / Os 8 and 9. Of these, the connection authentication function unit 4 exchanges authentication information with the switch 6. Authentication information input / output unit 13 to be used, authentication information setting means 15 for setting authentication information, a storage device 16 for storing the set authentication information and authentication information exchanged with the switch 6, and authentication information relating to a connection request An authentication determination unit 14 that compares the authentication information stored in the storage device 16 and determines an authentication result; a connection unit 12 that performs a connection between the I / O 8 and the I / O 9 based on the authentication determination unit 14; An authentication result display unit 17 for displaying the authentication result and an authentication result report unit 18 for reporting the authentication result are provided.

  In FIG. 2, the switch 6 includes a connection authentication function unit 5 and I / Os 10 and 11. Of these, the connection authentication function unit 5 is similar to the connection authentication function unit 4, the connection unit 19, the authentication. An information input / output unit 20, an authentication determination unit 21, an authentication information setting unit 22, a storage device 23, an authentication result display unit 24, and an authentication result notification unit 25 are provided.

  First, the IEEE 802.1x authentication switch 3 and the switch 6 set their switch ID, password, and port number for enabling connection authentication, and store them in the storage devices 16 and 23, respectively.

  Next, the IEEE 802.1x authentication switch 3 and the switch 6 send their own switch ID and their password information stored in the storage devices 16 and 23 to the authentication information input / output unit 13 and the authentication information input / output unit, respectively. 20 to exchange each other.

  The connection authentication function unit 4 uses the switch ID and password of the switch 6 acquired by the exchange described above, and the switch ID, password, and port number for validating connection authentication in the format of the authentication information 26 shown in FIG. Is stored in the storage device 16. Here, FIG. 3 is a diagram showing an example of authentication information according to the embodiment of the present invention.

  In FIG. 3, the authentication information 26 includes the switch ID 1 of the IEEE 802.1x authentication switch 3 as “your switch ID”, the password 1 of the IEEE 802.1x authentication switch 3 as “your password”, and “validate connection authentication”. The port number of the I / O 9, the switch ID of the switch 6 as the connection partner, the switch ID 2, and the password 2 as the password of the switch 6 as the connection partner are included.

  Similarly, the connection authentication function unit 5 sets authentication information 27 and stores it in the storage device 23.

  In FIG. 3, authentication information 27 includes switch ID 2 of switch 6 as “your switch ID”, password 2 of switch 6 as “your password”, and I / O 10 as “port number for enabling connection authentication”. Of the port ID, switch ID 1 as the switch ID of the IEEE 802.1x authentication switch 3 that is the connection partner, and password 1 as the password of the IEEE 802.1x authentication switch 3 that is the connection partner.

  Subsequently, the authentication determination unit 14 and the authentication determination unit 21 store the authentication information 26 and authentication information 27 stored therein, and information such as the switch ID and password of the partner and the port number specified by the partner. Based on the processing shown in the flowchart of FIG. Here, FIG. 4 is a flowchart showing a procedure in which the authentication determination unit 14 authenticates the connection and permits packet transfer.

  First, in step S101, it is determined based on the authentication information 26 whether or not the I / O port designated by the connection partner is a port number for validating connection authentication (hereinafter referred to as “authentication target port”). Since the authentication target port in the authentication information 26 is I / O9, if the port number designated by the connection partner is, for example, I / O8, the determination is NO, it is determined that the port does not require authentication, and packet transfer is performed ( Step S102). On the other hand, when the I / O port designated by the partner corresponds to the authentication target port, the process proceeds to step S103.

  In step S103, it is determined whether authentication information is input from the authentication target port. For example, when the authentication target port is I / O9, the authentication information 27 is input from the authentication information input / output unit 20 via the I / O9 as shown in FIG. 2, so the determination is YES, and the procedure goes to step S104. Moving.

  On the other hand, if the authentication information is not input, the determination is no. Therefore, the packet transfer at the I / O 9 is rejected, the authentication result display means 17 displays that the switch is invalid, and the authentication result notifying means. In step S105, the terminal that has requested connection to the authentication server 7 is notified of the unauthorized switch connection (step S105).

  In step S104, it is determined whether the value of the switch ID in the authentication information input from the authentication target port is appropriate. If the input switch ID matches the value of the switch ID of the connection partner stored in the storage device 16, the determination is yes, and the procedure moves to step S106.

  On the other hand, if the switch IDs are different, the determination is no. Therefore, packet transfer at the authentication target port is rejected, switch ID mismatch is displayed on the authentication result display means 17, and switch ID is displayed on the authentication result report means 18. A mismatch is notified to the terminal that has requested connection to the authentication server 7 (step S107).

  In step S106, it is determined whether or not the password value in the authentication information input from the authentication target port is appropriate. If the input password matches the password of the connection partner of the storage device 16, the determination is YES. Therefore, packet transfer at the authentication target port is permitted, authentication OK is displayed on the authentication result display means 17, and authentication is performed. The result notifying means 18 notifies the terminal that has requested connection to the authentication server 7 that the authentication is OK (step S108), and the series of procedures ends.

  The series of processes shown in FIG. 4 is the same when the authentication determination unit 21 authenticates the connection and permits packet transfer.

  On the other hand, if the passwords are different, the determination is no, so packet transfer at the authentication target port is rejected, password mismatch is displayed on the authentication result display means 17, and password mismatch is detected on the authentication result report means 18. This is reported to the terminal that has requested connection to the authentication server 7 (step S109).

  Here, FIG. 5 is a diagram illustrating a case where the IEEE 802.1x authentication switch 3 of FIG. 1 is replaced with a switch 28 which is a normal switch. In this case, since the connection authentication function unit 5 of the switch 6 determines to reject the packet transfer, it is possible to prevent communication of the personal computer 2 that is not an IEEE 802.1x-authenticated personal computer.

  INDUSTRIAL APPLICABILITY The present invention is suitable for use in a network environment that determines whether access from a client is possible by authentication, and can be used in any industrial field that uses a network.

It is a figure which shows the whole structure of the apparatus which authenticates the connection of the authentication switch which concerns on embodiment of this invention. It is a figure explaining the detailed structure of the switch which concerns on embodiment of this invention. It is a figure which shows an example of the authentication information which concerns on embodiment of this invention. It is the flowchart which showed the procedure which an authentication determination means authenticates connection and permits transfer of a packet. It is a figure which shows the case where the IEEE802.1x authentication switch of FIG. 1 is replaced | exchanged for the normal switch.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 IEEE802.1x authentication personal computer 2 Personal computer 3 IEEE802.1x authentication switch 4, 5 Connection authentication function part 6 Switch 7 Authentication server 8, 9, 10, 11 I / O
DESCRIPTION OF SYMBOLS 12 Connection part 13 Authentication information input / output part 14 Authentication judgment means 15 Authentication information setting means 16 Storage device 17 Authentication result display means 18 Authentication result report means 19 Connection part 20 Authentication information input / output part 21 Authentication judgment means 22 Authentication information setting means 23 Storage device 24 Authentication result display means 25 Authentication result reporting means 26, 27 Authentication information 28 Switch

Claims (8)

A first authentication switch having an IEEE 802.1x authentication function; a second authentication switch provided to be connectable to the first authentication switch; and a terminal connected to the first authentication switch;
The first authentication switch of the ID of the first authentication switch, and the password of the first authentication switch, and a port number to enable the connection authentication of the first authentication switch, the first comprising Remember authentication information ,
The second authentication switch of the ID of the second authentication switch, the password of the second authentication switch, and the port number to enable the connection authentication of the second authentication switch, a second containing Remember authentication information ,
The first is authentication switch, the second the second authentication information from the authentication switch, said second authentication switch, the first authentication information from the first authentication switch, respectively to obtain Save in advance to storage means,
The first authentication switch compares the stored second authentication information with the current connection partner authentication information, and the second authentication switch compares the stored first authentication information with the current authentication information. A device for authenticating connection of an authentication switch, characterized in that connection authentication is performed by comparing with authentication information of a connection partner, and whether or not packet transfer is possible for the terminal that has requested connection based on the connection authentication result is determined. . The first authentication switch includes an I / O (input / output unit) used for input / output of information with an externally connected device, and a first connection authentication function unit that authenticates a connection request. ,
The first connection authentication function unit
First authentication information setting means for storing the first authentication information;
A first authentication information input / output unit for obtaining the second authentication information from the second authentication switch;
A first storage device for storing the first authentication information and the second authentication information;
A first that performs connection authentication by comparing the switch ID, password, and port number of the second authentication information with the switch ID of the current connection partner, the password, and the port number specified by the current connection partner ; Authentication determination means;
A first authentication result display means for displaying the result of connection authentication at the first authentication decision means,
A first authentication result reporting means for reporting a connection authentication result in the first authentication determination means to a terminal that has requested connection ;
A first connection determination unit that determines whether or not the packet transfer of the terminal that has requested the connection based on a connection authentication result of the first authentication determination unit ;
The second authentication switch includes an I / O (input / output unit) used for input / output of information with an externally connected device, and a second connection authentication function unit that authenticates a connection request. ,
The second connection authentication function unit
Second authentication information setting means for storing the second authentication information;
A second authentication information input / output unit that acquires the first authentication information from the first authentication switch; a second storage device that stores the first authentication information and the second authentication information;
A second that performs connection authentication by comparing the switch ID, password, and port number of the first authentication information with the switch ID of the current connection partner, the password, and the port number specified by the current connection partner ; Authentication determination means;
A second authentication result display means for displaying the result of connection authentication at the second authentication decision means,
A second authentication result reporting means for reporting the connection authentication result in the second authentication determination means to the terminal that has requested connection ;
A second connection determination unit that determines whether or not packet transfer is possible for a terminal that has requested the connection based on a connection authentication result of the second authentication determination unit ;
The apparatus for authenticating the connection of the authentication switch according to claim 1. Said first authentication determination unit, when having a port number to enable the connection authentication of the first authentication switch, the ID of the second authentication switch, and a password of the second authentication switch Allow packet transfer of the terminal ,
If the second authentication decision means, having a front Symbol port number to enable the second authentication switch connection authentication of the ID of the first authentication switch, and a password of the first authentication switch 3. The apparatus for authenticating connection of an authentication switch according to claim 1 or 2, wherein packet transfer of the terminal is permitted. The first storage device, among said first authentication information and the second authentication information, the ID of the first authentication switch, and the password of the first authentication switch, the first authentication storing the port number to enable the connection authentication of the switch, the ID of the second authentication switch, and password of the second authentication switch, the information including,
Said second storage device, among said first authentication information and the second authentication information, the ID of the second authentication switch, and password of the second authentication switch, the second authentication and port number to enable the connection authentication of the switch, the ID of the first authentication switch any of claims 1 to 3, characterized in that stores information including the password of the first authentication switch A device for authenticating the connection of the authentication switch according to claim 1. In a system having a first authentication switch having an IEEE 802.1x authentication function, a second authentication switch provided to be connectable to the first authentication switch, and a terminal connected to the first authentication switch ,
It said first authentication switch, the ID of the first authentication switch, said first authentication switch password, and port number to enable the connection authentication of the first authentication switch, the first comprising and procedures for the authentication information memorize,
The second authentication switch of the ID of the second authentication switch, the password of the second authentication switch, and the port number to enable the connection authentication of the second authentication switch, a second containing and procedures for the authentication information memorize,
The first authentication switch acquires and stores the second authentication information from the second authentication switch, and
The second authentication switch acquires and stores the first authentication information from the first authentication switch; and
The first authentication switch compares the stored second authentication information with the current connection partner authentication information, and the second authentication switch compares the stored first authentication information with the current authentication information. A procedure for performing connection authentication by comparing with authentication information of a connection partner, and determining whether or not to allow packet transfer of the terminal that has requested connection based on the connection authentication result;
A method for authenticating a connection of an authentication switch , comprising : In the procedure in which the first authentication switch performs the connection authentication by comparing the stored second authentication information with the authentication information of the current connection partner, the switch ID, the password, and the second authentication information Connection authentication is performed by comparing the port number with the switch ID and password of the current connection partner and the port number specified by the current connection partner,
In the procedure in which the second authentication switch compares the stored first authentication information with the authentication information of the current connection partner and performs connection authentication, respectively , the switch ID, password and port of the first authentication information 6. The authentication switch connection according to claim 5, wherein connection authentication is performed by comparing a number with a switch ID and password of a current connection partner and a port number designated by the current connection partner. How to authenticate. The said 1st authentication switch and said 2nd authentication switch are further provided with the procedure which displays that when connection is permitted, and when it does not permit connection, respectively. A method for authenticating connection of the authentication switch according to 5 or 6. The first authentication switch and the second authentication switch further comprise a procedure for notifying the terminal when the connection is permitted and notifying the terminal when the connection is not permitted, respectively. A method for authenticating connection of an authentication switch according to any one of claims 5 to 7.

Images