JP6106558B2 - Communication system and authentication switch - Google Patents

Description

The present invention relates to a communication system or a switch device that performs authentication processing.

Network authentication systems are used as means for enhancing the security of communication networks, regardless of whether they are wired networks or wireless networks. The network authentication system includes user terminals such as PCs and smart devices, wireless access points, authentication switches, and authentication servers. As a method of authentication, in a wireless network, a wireless access point mainly uses IEEE 802.1X authentication to inquire whether authentication information is registered with an authentication server. In the case of a wired network, the authentication switch uses MAC address authentication to inquire whether authentication information is registered.

Patent Document 1 discloses a technology for performing access control and QoS control on a user terminal simultaneously with authentication in order to further enhance security. Patent Document 2 discloses a method for snooping an authentication packet from a wireless access point and authenticating with an authentication switch for authentication processing cooperation. Patent Document 3 discloses a terminal identifier and an authentication flag in a terminal device registration information entry as information relating to authentication.

JP2004-32525A JP2010-062667 JP 2006-33206 A

  Here, in the case of a wireless user terminal, authentication is performed by a wireless access point. However, since an authentication switch performs authentication in a wired user terminal, settings related to an authentication sequence and authentication, such as a re-authentication interval and a maximum connection Time exists separately for wireless and wired networks.

  In addition, the wireless access point authenticates to the external network by making an inquiry to the authentication server. Even if the authentication is successful, the authentication switch on the path to the external network makes a separate authentication request and sends authentication information to the authentication server. Inquire whether is registered. The authentication server searches the authentication database, and when authentication information is registered, notifies the authentication switch of a successful authentication, and the wireless access point or authentication switch that has received the notification sends the authentication request to the user who sent the authentication request. The terminal is authenticated, and communication is possible.

  For the problem of controlling access to user terminals, if it is a single system, it is necessary to perform operation management with the same policy, but since it is built separately in the wireless network and the wired network, the functions supported by each device and If the specifications are different, it is necessary to have the same security policy, and network construction and management become complicated.

  In Patent Document 1, when this method is individually set for wireless access points, it is necessary to set the number of wireless access points. Therefore, in a large-scale network where there are several tens to several hundreds of wireless access points to be managed, it is necessary to perform the same setting change for all devices, which causes management to become complicated. Furthermore, when there are many wireless access points, a centralized operation management device called a wireless LAN switch may be introduced. However, if authentication processing is performed with the wireless LAN switch, the load on the wireless LAN switch increases. There is also a possibility of affecting communication processing.

  In Patent Literature 2, when an authentication packet is encrypted with an authentication server, the authentication state cannot be determined. Further, when authentication is performed by the authentication switch, it is necessary to delete old authentication information when the terminal moves the wireless access point.

  Further, although there is Patent Document 3, since this is only a terminal identifier and an authentication flag as a terminal device registration information entry, and there is no access control information, access control for an authenticated terminal based on an authentication result cannot be performed. In addition, there is no description about leaving the authenticated terminal from the network.

An object of the present invention is to distribute authentication processing and authentication status management in a communication system, and reduce the authentication processing load in each device.

In one aspect of the present invention, the authentication server and a first of the first row cormorants communication node an authentication process of the terminal connected by radio, a second terminal connected by wire to manage authentication information of the terminal An authentication switch for performing the second authentication process, wherein the first communication node transmits the authentication terminal registration information of the first terminal that has been authenticated as a result of the first authentication process to the communication The authentication terminal registration information of the second terminal that has been received from the node and held in the authentication terminal registration table and the second authentication process is executed for the second terminal, and has been authenticated as a result of the second authentication process. Is stored in the authentication terminal registration table, and communication to the external network is permitted to the authenticated first terminal or second terminal registered in the authentication terminal registration table.

As a more specific aspect, the authentication switch inquires of the authentication server whether the terminal can communicate with the external network, and not only updates the authentication state of the terminal according to the result, but also via the wireless terminal and the wireless communication. Authentication information of the wireless terminal authenticated by the wireless access point connected to the wireless access point is acquired from the wireless access point, and the authentication switch itself does not perform authentication processing to the external network of the wireless terminal authenticated by the wireless access point , Authentication information by the authentication process of the wireless access point is registered in the authentication terminal registration table with the authentication state of the authentication switch , and access from the wireless terminal to the external network is relayed.

  Other aspects are disclosed throughout this specification and the drawings.

  According to one embodiment of the present invention, authentication processing is distributed, and the efficiency of authentication processing for access from a terminal to a network is improved.

1 shows an overall configuration diagram of a network system in Embodiment 1. FIG. The block diagram of the user terminal registration table in Example 1 and Example 2 is shown. The access control information (ACL) registration table in Example 1 and Example 2 is shown. 10 shows a QoS information registration table 166 according to the first and second embodiments. It is a sequence diagram of the authentication process in Example 1. FIG. 6 is a sequence diagram when communication between the authentication switch 111 and the wireless access point 113 is lost in the first embodiment. The network configuration in Example 2 is shown. The sequence diagram of the authentication process in Example 2 is shown. 9 shows an authentication information deletion process according to the second embodiment.

A mode for carrying out the invention will be described with reference to the drawings.

Example 1 will be described. In the first embodiment, by synchronizing the authentication information between the wireless access point and the authentication switch, the access control of the user terminal can be collectively managed by the authentication switch, and the burden on the administrator can be reduced. Yes, in the first embodiment, the synchronization of authentication information is realized by transmitting from the wireless access point to the authentication switch using the HTTP (Hyper Text Transfer Protocol) POST method.
When the user terminal is connected, the wireless access point inquires of the authentication server whether authentication is possible. When the wireless access point receives the authentication success notification from the authentication server and the user terminal is successfully authenticated, the wireless access point notifies the authentication switch of authentication success information using HTTPS (Hyper Text Transfer Protocol Secure). Synchronize authentication success information with the switch. In this case, the wireless access point adds an identifier for performing access control as additional information to the authentication success information, and by using the identifier, access control information or QoS information preset in the authentication switch is used. And user terminals are linked to enable access control and QoS control in units of user terminals.

  When logout of the user terminal is detected by the wireless access point, the wireless access point notifies the authentication switch of terminal logout information using HTTPS. The authentication switch deletes the authentication success information of the user terminal based on this information.

  According to the present embodiment, since authentication success information is notified from the wireless access point to the authentication switch using HTTPS, the communication path is encrypted, and flexible additional information can be easily expanded.

  FIG. 1 is an overall view of a network system. In the network system of FIG. 1, an authentication switch 111 is connected to a network 115, a wireless access point 113 and a switching hub 112 are connected to the authentication switch 111, and a wireless terminal 114 is connected to the wireless access point 113 via radio. Yes. Among the users, the wireless terminal 114 is connected to the wireless access point 113 by wireless communication, authentication processing is performed at the wireless access point 113, and the wireless terminal 114 is connected to the network 115 via the authentication switch 111. A terminal 118 is connected to the switching hub 112 via a wire. Of the user terminals, the wired terminal 118 is connected to the switching hub 112 by wired communication, and the authentication switch 111 performs authentication processing to perform communication. Hereinafter, the components of the network will be described.

  Among the user terminals, the wireless terminal 114 is a wireless communication device for performing communication with the network 115, and among the user terminals, the wired terminal 118 is a wired communication device for performing communication with the external network 115. The authentication server 110 functions when network authentication is activated when user terminals (wireless terminal 114 and wired terminal 118) connect to the network. User terminals (wireless terminal 114 and wired terminal 118) and user information are registered in the authentication server 110 in advance, and only users registered in the authentication server 110 are determined as regular users and allowed to connect to the network. It is possible to use a security function such that the user terminal 114 and the user terminal 118 and the user who have not been used are determined to be unauthorized users and the connection to the network is not permitted.

  The switching hub 112 functions as a connection point when the user terminal 118 performs network connection using wired communication.

Authentication switch 11 1 is provided with CPU 11, a port 12, memory 13, authentication terminal registration table 14, the authentication information processing unit 15, the access control information (ACL) table 16 / QoS information registration table 166.

Port 12, wireless AP 11 3, switch Nguhabu 112, the authentication server 110 are connected to any external network 115.

The packet transmission / reception unit 17 is a relay unit that holds information on the ACL 16, QoS 166, and FDB 168 and determines whether or not to output a packet received via the port 12 and an output destination.
The ACL 16 is a registration table of access control information (ACL). The ACL 16 is one of the filters in which conditions for controlling a network that can be accessed by the user terminal (the wireless terminal 114 or the wired terminal 118) after successful authentication are set, and the packet transmission / reception unit 17 is used at the time of packet relay. The QoS 166 is also one of the filters that the packet transmitting / receiving unit 17 performs at the time of packet relay, and conditions for performing QoS control of the user terminal after successful authentication are set. An FDB (Forwarding Data Base) 168 holds information for determining a port that outputs a received packet , and holds a correspondence between a terminal address (MAC address, IP address) and a port. The packet transmitting / receiving unit 17 refers to the FDB 168, refers to the destination address of the received packet, and outputs the packet from the corresponding port 12. Wireless AP 1 of the 13 address and port 12 of the association and authentication server 110 and port 12 corresponding Dzu only may be included in FDB168. Referring to FDB168 may send a request from the authentication switch 11 1 in the radio AP, may identify the port for outputting the request.

  The authentication switch 111 has a network authentication function for preventing unauthorized users from connecting when user terminals (wireless terminal 114 and wired terminal 118) connect to the network. The operation when the authentication switch 111 performs authentication processing will be described below.

The memory 13 holds an authentication terminal registration table 14 and an authentication information processing unit 15. The authentication terminal registration table 14 stores combinations of MAC addresses and IP addresses of user terminals that have been authenticated. The authentication information processing unit 15 is a program, and the CPU 11 reads the program and executes the authentication information processing unit 15.

  In the authentication switch 111, the authentication function is set for each port 12. When an arbitrary packet is received at the port 12 for which the authentication function is set, the authentication information processing unit 15 determines whether the received packet is a communication from an authenticated user terminal. The source MAC address and the source IP address are read from the address and it is confirmed whether or not the corresponding address is registered in the authentication terminal registration table 14.

  If the corresponding address is registered in the authentication terminal registration table 14, the authentication information processing unit 15 determines that the communication is from a legitimate user, performs transmission processing of the received packet from the packet transmitting / receiving unit 17 to the port of the destination network, If the corresponding address is not registered in the authentication terminal registration table 14, a request for authentication information is made to the corresponding user terminal (wireless terminal 114 or 118) in order to perform user authentication (MAC authentication).

  When the authentication switch 111 receives a packet for transmitting authentication information from the user terminal, the authentication switch 111 transfers the authentication information to the authentication server 110 and requests authentication. When the authentication switch 111 receives a notification of successful authentication from the authentication server 110, the user is registered in the authentication terminal registration table 14 as an authenticated user, and the user can access the network 115. When the authentication switch 111 receives a notification of authentication failure from the authentication server 110, the user is regarded as an unauthorized user and is not registered in the authentication terminal registration table 14, and the user cannot access the network. Note that the authentication switch 111 may use a MAC address authentication method in which the authentication server 110 is inquired of whether authentication is possible using a MAC address. In that case, the authentication server 110 has the MAC address of the terminal and user information in advance.

  The authentication information processing unit 15 also updates the authentication terminal registration table 14 and is authenticated by the authentication process of the wireless AP (113) when receiving a notification of the result of the authentication process by the wireless access point (AP) 113. The authentication status of the terminal is assumed to be authenticated. In this way, the authentication information processing unit 15 updates the authentication terminal registration table, and manages the authentication state using the authentication result at the wireless access point and the authentication result at the authentication switch itself. As a result, the authentication switch 111 skips the process of making an authentication request to the authentication server 110, refers to the updated authentication terminal registration table 14, and permits communication from the terminal to the network 115. The wireless access point (AP) 113 functions as a connection point when the user terminal 114 performs network connection using wireless communication. Further, the wireless access point (AP) 113 uses the authentication method such as IEEE802.1X authentication to make an inquiry to the authentication server 110 as to whether authentication is possible, and performs network authentication.

  When the user terminal 114 is connected to the network, the user terminal 114 transmits an authentication packet, and the wireless access point 113 that has received the authentication packet inquires of the authentication server whether authentication information is registered. The authentication server searches the authentication database. When authentication information is registered, the authentication success notification is notified to the wireless access point or the authentication switch, and the wireless access point or authentication switch that receives the notification sends the authentication request. It is assumed that the user terminal that has transmitted is authenticated, and communication is enabled.

The wireless AP 113 includes a wireless transmission / reception unit 11 10 , a packet transmission / reception unit 1120, a CPU 1160, and a memory 11 30 . The memory 1150 is connected to the CPU 1160. The memory 11 30 has an authentication terminal registration table 1140 and an authentication information registration unit 1150. The authentication information registration unit 1150 is a program and is read and executed by the CPU 1160. The authentication information registration unit 1150 inquires the authentication server about whether or not the terminal accessing the wireless AP 113 can be authenticated, and sets the authentication enable / disable in the authentication terminal registration table 1140 according to the inquiry result, in the same manner as the authentication registration with the authentication switch. To do. When the authentication is possible, the wireless AP 113 transmits information on the terminal that can be authenticated to the authentication switch 111 by the POST method of HTTP (HTTPS). The CPU 1160 is connected to the memory 1130, executes the authentication information registration unit 1150, and updates or refers to the authentication terminal registration table 1140. The CPU 1160 is connected to the packet transmission / reception unit 1120 and the wireless transmission / reception unit 1110 and controls them. For example, the CPU 1160 sets a transfer destination address and an output port in the packet transmission / reception unit according to the processing of the authentication information registration unit 1150.

The wireless transmission / reception unit 1110 wirelessly receives a signal transmitted from the wireless terminal 114 via an antenna, and transmits the signal to the wireless terminal 114 wirelessly. The packet transmission / reception unit 1120 receives the packet transmitted from the authentication switch 111 and transmits the packet to the wireless terminal 114 via the wireless transmission / reception unit 1110. The packet transceiver unit 1120 transmits the packet from the authenticated wireless terminal 114 via a port 11 7 0 to authentication switch 1 11. For packets from authenticated non wireless terminal 114, the packet according to the processing of the authentication information registration unit 1150 is transmitted to the authentication switch 1 11.

The wireless AP has a port 11 70 and is connected to the authentication switch 111 and other nodes via a wired network. The port 11 70 has the wireless AP 113 connected to the authentication switch 111, the authentication server 110, and the network 115. an interface for communicating with. The wireless AP 11 3 has a plurality of ports 11 70 . Each port 11 70 is assigned a unique identifier and is managed by the CPU 1160.

  FIG. 2 shows the configuration of the authentication terminal registration table 14. The authentication terminal registration table 1140 has the same configuration. The authentication terminal registration table 14 indicates the association between the MAC address, IP address, belonging VLAN, access control identifier, user name, and authentication state of the user terminal (wireless terminal 114 or wired terminal 118). Note that network devices such as the authentication switch 111 and the wireless access point 113 are not limited to the table format shown in FIG.

  Upon receiving the authentication request packet from the user terminal (wireless terminal 114), the wireless access point 113 (authentication information registration unit 1150) records the reception port number in the authentication terminal registration table 1140, and from the authentication request packet, The MAC address, IP address, belonging VLAN number, and user name are read and recorded in the authentication terminal registration table 1140.

  At this time, the authentication request packet is transmitted to the authentication server 110, assuming that the identifier column is not filled in and the status column is being authenticated. The wireless access point 113 (authentication information registration unit 1150) receives the authentication result notification from the authentication server. When the authentication is successful, the wireless access point 113 (authentication information registration unit 1150) reads the user identifier described in the authentication result notification, and authenticates the terminal registration table 1140. The read identifier is written, and the state is changed to authenticated and updated. Then, the wireless access point 113 (authentication information registration unit 1150) transmits the MAC address, IP address, VLAN number, user name, and identifier of the authenticated terminal from the wireless access point to the authentication switch by the HTTP POST method. To do.

  On the other hand, the authentication switch 11 (authentication information processing unit 15) stores the authentication terminal registration table 14 in the authentication terminal registration table 14 using the port number that received the packet from the wireless access point and the information notified by the POST method. The other authentication information is registered in the authentication terminal registration table 14 by reading from the packet received by the POST method.

  When the wireless access point receives an authentication failure notification from the authentication server, the user information whose authentication status is “authenticating” is deleted from the authentication terminal registration table 1140.

  In the first embodiment, when authentication is performed at the wireless access point 113, authentication information is transmitted from the wireless access point 113 to the authentication switch 111 using an HTTP POST method, and the authentication information is synchronized. In FIG. 1, when the authentication switch 111 receives authentication information from the wireless access point 113 using the HTTP POST method, the authentication switch 111 reads the information of the MAC address, IP address, belonging VLAN, and identifier of the authentication successful terminal from the received packet by the authentication information processing. The read information is registered in the entry of the authentication terminal registration table 14. As the port number to be registered in the authentication terminal registration table 14, the port number that received the HTTP packet from the wireless access point 113 is registered, and the authentication state is registered as authenticated. Further, the authentication switch 111 updates the ACL table 16 or the QoS registration table 166 using the authentication information notified by the process 206.

In the network system of the form shown in FIG. 1, in the form in which the terminal 114 accesses the network 115 via the wireless access point 113, authentication that makes an inquiry to the authentication server 116 in the authentication switch 111 is performed if the wireless access point 113 performs authentication processing. Processing is not necessary. In the form in which the user terminal 118 connected by wire accesses the network 115 via the hub 112, the authentication switch 111 may perform the authentication process. Thus, either the wireless access point 113 and authentication switch 111 may be implemented authentication process by querying the authentication server 11 0. The authentication process in the authentication switch 111 is as described above.

  In the present embodiment, in particular, an authentication process is performed at the wireless access point 113, and the authentication success information is synchronized with the authentication success information of the authentication switch 111 to reduce the load on the authentication switch 111 and the authentication server 110. Yes. Therefore, a mode in which the user terminal 114 logs into the domain to which the user terminal 114 belongs via the wireless access point 113 will be described below.

  FIG. 5 is a sequence diagram of authentication processing in the present embodiment.

  When the wireless access point 113 receives an arbitrary packet from the wireless user terminal 114 at the wireless access point 113, the wireless access point 113 refers to the authentication terminal registration table 1140, and the wireless access point 113 (authentication information registration unit 1150) receives the received arbitrary packet. A process 201 is performed to identify whether or not is from an authenticated user terminal.

  If the wireless access point 113 (authentication information registration unit 1150) determines that the packet is from an authenticated user terminal, the wireless access point 113 (authentication information registration unit 1150) permits terminal communication and forwards the received packet to the authentication switch.

  If the wireless access point 113 (authentication information registration unit 1150) determines that the packet is from the user terminal before authentication as a result of the process 201, the wireless access point 113 (authentication information registration unit 1150) requests the user terminal 114 to request authentication information (user ID, password) 202. I do. The user terminal 114 that has received the authentication information request from the wireless access point 113 performs processing 203 for transmitting the authentication information to the wireless access point 113. When the authentication information is received from the user terminal 114, the wireless access point 113 (authentication information registration unit 1150) performs processing 204 for transmitting an authentication request to the authentication server 110.

  The authentication server 110 that has received the authentication request from the wireless access point 113 identifies whether or not the user information included in the authentication request has been registered in the user database in the authentication server 110 in advance, and has been registered. Determines that the authentication result is authentication success, and if not registered, determines that the authentication result is authentication failure, and performs processing 205 for transmitting the authentication result to the wireless access point 113.

The wireless access point 113 (authentication information registration unit 1150) receives the authentication result from the authentication server 110 via the authentication switch 111. The wireless access point 113 (authentication information registration unit 1150) refers to the authentication result and determines whether the authentication has succeeded or failed. When the received authentication result indicates successful authentication, the wireless access point 113 (authentication information registration unit 1150) registers the information of the user terminal that has succeeded in authentication in the authentication terminal registration table 1140 managed in the memory 1130. The Then, the wireless access point 113 (authentication information registration unit 1150) performs processing 206 for notifying the authentication switch 111 of authentication success information using the HTTP POST method. The authentication information POSTed from the wireless access point 113 to the authentication switch 111 is the MAC address, IP address, VLAN number, user name, identifier, and authentication state at the wireless access point of the user terminal 114.

  When the authentication switch 111 (authentication information processing unit 15) receives the authentication success information from the wireless access point 113, the authentication switch 111 (authentication information processing unit 15) registers the information of the terminal successfully authenticated in the user terminal registration table 14 in the authentication switch 111, and Allow communication.

  An access control information registration table 16 and a QoS control information registration table 166 are set in advance in the authentication switch 111. Using the identifier notified from the wireless access point 113 by the POST method of HTTPS in the process 206, the authentication switch 111 associates the identifier of the user terminal corresponding to the identifier with access control information or QoS information, and the table 16 (or 166) is updated to enable access control and QoS control in units of user terminals.

  The wireless access point 113 performs communication processing of the user terminal that enables communication to the network 115 of the user terminal 114 that has been successfully authenticated and the response processing 207 of the authentication result to the user terminal. The user terminal 114 is a domain to which the user terminal 114 belongs. Login to is possible.

  An example in which the authentication switch 111 updates the table using the authentication information included in the notification received in the process 206 will be described with reference to FIGS.

  The access control information (ACL) registration table shown in FIG. 3 sets conditions for controlling a network that can be accessed by a user terminal after successful authentication. Each entry of the access control information (ACL) registration table 16 includes items of an identifier, an access condition, and a behavior to be controlled. The identifier is information associated with the user ID, the association information is registered in advance in the authentication server, and the information associated with the authentication terminal registration table 14 is managed for the authenticated terminal. Therefore, access control conditions are set for each identifier, and access control for each user is set. In the embodiment, the user registered in the identifier 100 is permitted to communicate with the destination 192.1688.10.0/24 after successful authentication, but access is restricted to other networks. It becomes operation.

  FIG. 3 shows an example of the ACL 16 (access control information table). The ACL 16 holds an association between an identifier, an access condition, and a behavior to be controlled when the access condition is met. The “identifier” is a uniquely identifiable identifier for linking with other information as stored in the authentication terminal registration table 14. In the case of an entry that does not require a link, the identifier field is blank. The “access condition” is set with the destination of the packet. In the “behavior to be controlled”, what kind of control is to be performed by the packet transmitting / receiving unit 17 for the packet that matches the “access condition” is set.

  FIG. 4 shows an example of QoS 166 (QoS information registration table 166). In the QoS information registration table 166, conditions for performing QoS control of the user terminal after successful authentication are set. Similar to FIG. 3, each entry of the QoS 166 includes items of an identifier, an access condition, and a behavior to be controlled. 3 is different from the access control information (ACL) registration table 16 in that the contents of access conditions are set according to QoS conditions. In the embodiment, the communication of the user registered in the identifier 300 to the destination network 192.1688.10.0 is performed by changing the CoS value by five.

  When QoS information as shown in FIG. 4 is set, in the communication from the user terminal associated with the identifier 200 to the destination network 192.1688.20.0, the authentication switch 111 performs the CoS value rewriting process. In addition, DSCP value rewriting processing is performed for communication of the user terminal associated with the identifier 300 to the destination network 192.1688.20.0. By using the identifier in this way, it becomes possible to apply the access control information and QoS information set in the authentication switch 111 to the user terminal that has performed the authentication processing via the wireless access point 113, and the integrated management of the setting information Is possible.

  The authentication switch 111 sets the access control information and the QoS control information in advance, and uses the identifier notified from the wireless access point 113 to the authentication switch 111. QoS information is linked to enable access control and QoS control in units of user terminals.

  Next, a sequence when the user terminal 114 that has succeeded in the authentication logs out from the domain to which the user terminal 114 belongs will be described. When logout of the user terminal 114 is detected by the wireless access point 113, the authentication success information deletion processing 208 of the user terminal 114 is performed from the user terminal registration table 1140 managed in the wireless access point 113 (authentication information registration unit 1150). . Then, the wireless access point 113 (authentication information registration unit 1150) performs logout information notification processing 209 of the user terminal 114 to the authentication switch 111 using the POST method of HTTPS.

Upon receiving the logout information from the wireless access point 113, the authentication switch 111 (authentication information processing unit 15) performs processing 210 for deleting the authentication success information of the user terminal 114 from the user terminal registration table 14 in the authentication switch 111, and the user terminal The logout process 114 is completed. The logout may be detected by the wireless access point 113 periodically monitoring the access status from the wireless terminal 114, and may be determined to log out when there is no access for a predetermined time. Even authentication switch 11 1, similarly to the wireless access point 113, it performs a logout detection processing, deletion of the user information determined to have logged out from the authentication terminal registration table 14, performs updating of the ACL16 and QoS166 table May be. When the authentication switch 111 detects logout of the user terminal by a communication monitoring function or an administrator setting, logout processing may be performed by the authentication switch. In this case, the wireless access point 113 from the authentication switch 111 performs a logout request processing of the user terminal. The wireless access point 113 that has received the logout request processing from the authentication switch 111 deletes the authentication information of the user terminal.

  In the above embodiment, authentication is performed at the wireless access point, and authentication success information at the authentication switch and access control and QoS control can be centrally managed by synchronizing the authentication success information between the authentication switch and the wireless access point. It is what.

FIG. 6 shows a sequence diagram when communication between the authentication switch 111 and the wireless access point 113 is lost in the first embodiment. In FIG. 6, when the communication between the authentication switch 111 and the wireless access point 113 is lost due to a network failure, the authentication switch 111 considers that the wireless access point 113 has left the network and the authentication information registration table 14 in the authentication switch 111 performs processing to delete the authentication information of the user terminal obtained from the wireless access point 113 to process 206.

  When the authentication switch 111 is restarted, the registration information in the authentication information registration table 14 in the authentication switch 111 is wiped out. At this time, since the authentication information registration table in the wireless access point 113 remains held, a difference occurs in the authentication state between the wireless access point 113 and the authentication switch 111, and login processing has already been performed under the wireless access point 113. A problem that a completed terminal cannot access the network 115 occurs. Therefore, in the present embodiment, when the authentication switch 111 confirms the wireless access point again in the communication confirmation process 302 to the wireless access point 113, the authentication switch 111 performs the authentication information request process 303 from the authentication switch 111 to the wireless access point 113. . The wireless access point 113 that has received the authentication request from the authentication switch 111 transmits authentication information to the authentication switch 111 using the POST method of HTTPS based on the information in the authentication information registration table in the wireless access point 113. 304 is performed.

  The authentication switch 111 that has received the authentication information from the wireless access point 113 performs a process 305 for registering the authentication information in the user terminal registration table 14 in the authentication switch 111.

  As described above, when the authentication switch port is linked down or when the authentication switch is restarted, there is a possibility that the authentication success information may not match between the wireless access point and the authentication switch. In this case, the authentication switch notifies the wireless access point of a request for retransmission of authentication success information when the port is linked up from link down. As a result, authentication success information is exchanged only between the wireless access point and the authentication switch instead of the user terminal performing the authentication operation again, so that authentication information can be synchronized without making the user terminal aware of it.

  The above is the description of the first embodiment.

  The second embodiment has an advantage that the authentication control is synchronized between the wireless access point and the authentication switch, so that the access control of the user terminals can be collectively managed by the authentication switch, and the burden on the administrator can be reduced. In the second embodiment, authentication information synchronization is realized by operating the authentication switch as a RADIUS proxy server.

If the wireless access point 1 13 the user terminal is connected, it queries the authentication switch authentication whether using the RADIUS protocol. In this case, even if the communication path is encrypted between the wireless access point and the authentication switch, the authentication switch is terminated, so that authentication information can be determined. The authentication switch operates as a RADIUS proxy and makes an inquiry to the authentication server as a proxy for the wireless access point. When the authentication switch receives the authentication success notification from the authentication server and the user terminal is successfully authenticated, the authentication switch stores the authentication success information in its own user terminal registration table and is preset with an identifier included in the authentication information. The access control information and QoS information that are present are associated with the user terminal, and access control and QoS control are performed in units of user terminals. Also, the authentication success information is transferred to the wireless access point. The wireless access point also stores authentication success information in the user terminal registration table. In this embodiment, since an authentication inquiry is made from the wireless access point to the authentication switch using RADIUS, the processing load is reduced.

FIG. 7 shows a network configuration in the second embodiment. As shown in FIG. 7, the second embodiment is a network configuration that requires an authentication process for the user terminal 114 to access the network 115, as in the first embodiment. The authentication information in the second embodiment with the wireless access point 113 authentication switch 11 7 utilizing RADIUS proxy server functions as a method to synchronize. As shown in FIG. 7, a configuration having a RADIUS proxy server 18 inside the authentication switch 117 is described. The other configuration of the authentication switch 117 is the same as the configuration of the authentication switch 111 of the first embodiment.

The authentication switch (RADIU proxy server) 117 operates with the RADIUS proxy server. Therefore, the wireless access point 114 operates by recognizing the RADIUS proxy server 18 in the authentication switch (RADIU proxy server) 117 as a RADIUS server, and transmits an authentication request packet to the authentication switch (RADIU proxy server) 117. When the authentication switch (RADIU proxy server) 117 receives the authentication request packet from the wireless access point 113, the authentication information processing unit 15 reads the authentication requesting user's MAC address, IP address, belonging VLAN, and user ID from the authentication request packet. Then, registration is performed in the authentication terminal registration table 14. At this time, the port number of the authentication terminal registration table 14 is registered as the port number that received the authentication request packet, the identifier is not filled in, and the authentication state is being authenticated. When the information registration process by the authentication information processing unit 15 is completed, the authentication request packet is transferred to the RADIUS server 116. When the authentication result notification packet from the RADIUS server is received by the authentication switch ( RADIUS proxy server) 117 and the information of the authentication result notification packet is read by the authentication information processing unit 15 and the authentication result is successful, the authentication terminal registration table In 14, the identifier of the user and the authentication status are updated to “authenticated”. If the authentication result is authentication failure, the entry of the corresponding user registered in the authentication terminal registration table 14 is deleted.

  FIG. 8 is a sequence diagram of authentication processing according to the second embodiment. When the wireless access point 113 receives an arbitrary packet from the user terminal 114, the wireless access point 113 performs a process 401 for identifying whether the received arbitrary packet is from an authenticated user terminal. When it is determined that the packet is from an authenticated user terminal, the wireless access point 113 transfers the received packet, and when it is determined that the packet is from an unauthenticated user terminal, the user terminal In 114, authentication information request processing 402 is performed. The user terminal 114 that has received the authentication information request from the wireless access point 113 performs processing 403 for transmitting the authentication information to the wireless access point 113. The wireless access point 113 that has received the authentication information from the user terminal 114 performs processing 404 for transmitting an authentication request to the authentication switch (RADIU proxy server) 117. The processes 401, 402, 403, and 404 are the same as the processes 201, 202, 203, and 204 in the first embodiment. When receiving an authentication request from the wireless access point 113 to the RADIUS server, the authentication switch (RADIUS proxy server) 117 acquires the MAC address, IP address, VLAN number, and user name of the user terminal from the RADIUS packet, and the identifier is blank. The authentication state at the wireless access point is registered in the user terminal registration table 1140 as being authenticated, and the authentication request transmission process 405 is performed to the RADIUS server 116.

  When the RADIUS server 116 receives the authentication request from the authentication switch (RADIUS proxy server) 117, the RADIUS server 116 identifies whether or not the user information for which the authentication request has been made is registered in the user database in the RADIUS server 116 in advance. If the authentication result has been registered, the authentication result is determined to be successful, and if not registered, the authentication result is determined to be authentication failure, and processing 406 for transmitting the authentication result to the authentication switch (RADIUS proxy server) 117 is performed.

  When the authentication switch (RADIUS proxy server) 117 that has received the authentication result from the RADIUS server 116 receives the result of the authentication success, the authentication result is indicated in the user terminal registration table 14 managed in the authentication switch (RADIUS proxy server) 117. The information of the user terminal that has become is registered, and the communication of the user terminal is permitted. The authentication switch (RADIUS proxy server) 117 also registers an identifier included in the authentication result received from the RADIUS server in the user terminal registration table. As in the first embodiment, the authentication switch (RADIUS proxy server) 117 uses the identifier to set the identifier of the user terminal in the registration table of access control information and QoS control information preset in the authentication switch (RADIUS proxy server) 117. In association with each other, access control and QoS control are performed in units of user terminals. Then, the authentication switch 117 performs processing 407 for notifying the wireless access point 113 of the result of successful authentication via the port 12.

  When the wireless access point 113 receives a notification of successful authentication from the authentication switch (RADIUS proxy server) 117, the wireless access point 113 performs processing 408 for permitting communication with the user terminal 114.

  Further, when logout of the user terminal is detected at the wireless access point 113, processing 409 for deleting the authentication information of the corresponding user terminal from the user terminal registration table in the wireless access point 113 is performed, and an authentication switch (RADIUS proxy server) A process 410 for issuing a STOP notification to the 117 by a RADIUS Accounting-Request is performed. When the authentication switch (RADIUS proxy server) 117 receives a STOP notification from the wireless access point 113, the authentication switch (RADIUS proxy server) 117 performs processing 411 for deleting the authentication information of the corresponding user terminal from the user terminal registration table 14. Then, the authentication switch (RADIUS proxy server) 117 performs processing 412 for transferring a STOP notification to the RADIUS server 116.

FIG. 9 shows an authentication information deletion process in the second embodiment. When the communication between the authentication switch (RADIUS proxy server) 117 and the wireless access point 113 is lost due to a network failure, the authentication switch (RADIUS proxy server) 117 considers that the wireless access point 113 has left the network and the authentication information registration table 14 of, it performs processing to delete the authentication information of the user terminal learned from wireless access point 113. When the authentication switch (RADIUS proxy server) 117 is restarted, the registration information in the authentication information registration table 14 in the authentication switch (RADIUS proxy server) 117 is wiped out. At this time, as in FIG. 5 of the first embodiment, the authentication information registration table in the wireless access point 113 is kept, so that the authentication state is established between the wireless access point 113 and the authentication switch (RADIUS proxy server) 117. A difference occurs, and a terminal that has already completed the login process under the wireless access point 113 cannot access the network 115. Therefore, in this embodiment, when the authentication switch (RADIUS proxy server) 117 confirms the wireless access point in the communication confirmation process 502 to the wireless access point 113, the authentication switch (RADIUS proxy server) 117 transfers to the wireless access point 113. Authentication information request processing 503 is performed.

Furthermore, in this embodiment, the wireless access point 113 that has received the authentication request from the authentication switch (RADIUS proxy server) 117 re-requests authentication from the RADIUS proxy server based on the information in the authentication information registration table in the wireless access point 113. Processing 504 is performed.
The authentication switch (RADIUS proxy server) 117 that has received the authentication request from the wireless access point 113 confirms the information of the authentication request and performs processing 505 for transferring the authentication request to the RADIUS server 116. The RADIUS server 116 that has received the authentication request from the authentication switch (RADIUS proxy server) 117 performs processing 506 for notifying the authentication switch (RADIUS proxy server) 117 of the authentication result based on the user database in the apparatus.

  Upon receiving the authentication result from the RADIUS server 116, the authentication switch (RADIUS proxy server) 117 updates the user terminal registration table 14 in the apparatus based on the authentication result, and transfers the authentication result to the wireless access point 113 507. I do. When receiving the authentication result, the wireless access point 113 only updates the information in the authentication information registration table in the wireless access point 113 and does not notify the user terminal.

  According to the various embodiments described above and the following aspects, at least one of the following effects is achieved.

  User terminal access from a wireless access point is authenticated by the wireless access point, authentication success information is synchronized with the authentication switch, and access from a wired user terminal is authenticated by the authentication switch. Can be distributed between each wireless access point and the authentication switch.

  By synchronizing the authentication success information between the wireless access point and the authentication switch, the setting information related to authentication can be centrally managed by the authentication switch.

  By synchronizing the authentication success information between the wireless access point and the authentication switch, while managing the setting information related to access control and QoS control in a unified manner, based on the information added to the authentication success information, Access control and QoS control can be performed centrally by the authentication switch.

  Synchronizing authentication success information between the wireless access point and the authentication switch without making the user terminal aware of it by requesting retransmission of authentication success information to the wireless access point upon port-up (link-up) of the authentication switch Can do.

In response to the administrator's authentication information deletion setting for the authentication switch, the authentication network requests the wireless access point to delete the authentication success information from the authentication switch. The user terminal authentication success information can be deleted from above.
In each of the above embodiments, part of the configuration realized by hardware may be replaced with software, and conversely, part of the configuration realized by software may be replaced with hardware.

As described above, in this embodiment, the authentication processing of the wireless access point and the authentication switch is synchronized, the authentication processing is performed at the wireless access point with the wireless access point setting kept to a minimum, and the authentication switch Then, settings related to authentication, individual access control and QoS control are performed for each authenticated user.
As mentioned above, although this invention was demonstrated based on the Example and the modification, Embodiment mentioned above is for making an understanding of this invention easy, and does not limit this invention. The present invention can be changed and improved without departing from the spirit and scope of the claims, and equivalents thereof are included in the present invention.

11 CPU, 12 ports, 13 memory, 14 authentication terminal registration table, 15 authentication information processing unit, 16 access control information (ACL), 166 QoS information registration table, 17 packet transmission / reception unit, 110 authentication server, 111 authentication switch, 112 switching Hub, 113 wireless access point, 114 (wireless) user terminal, 115 network, 116 RADIUS server, 117 authentication switch with built-in RADIUS proxy server function, 118 (wired) user terminal

Claims (14)

A communication system,
An authentication server that holds authentication information terminus,
An authentication request connected to the first terminal via the wireless network and received from the first terminal for access to the external network is transmitted to the authentication server, and the first authentication is performed based on the authentication result for the authentication request. A communication node for processing;
The communication node, the authentication server, and the second terminal are connected via a wire, and the authentication terminal information of the first terminal that has been authenticated as a result of the first authentication process is received from the communication node. An authentication request that is held in the authentication terminal registration table and that is received from the second terminal and that is related to access to the external network is transmitted to the authentication server, and the second is based on the authentication result for the authentication request received from the second terminal. The authentication terminal information of the second terminal that has been authenticated as a result of the second authentication process is stored in the authentication terminal registration table, and the authenticated terminal registered in the authentication terminal registration table is stored. An authentication switch that allows the first terminal or the second terminal to communicate with the external network. The communication system according to claim 1,
The communication node, the aforementioned first receiving an authentication request for the access via the wireless network from the terminal, to the authentication server via the authentication switch from the communication node, received from the first terminal If an authentication request is sent and the response to the authentication request indicates successful authentication, the communication node notifies the authentication switch of the authentication terminal information of the first terminal,
The communication system, wherein the authentication switch updates the authentication terminal registration table in response to the notification. A communication system according to claim 2, wherein said communication node, by the HTTPS POST method, MAC address of the terminal, the IP address notified authentication terminal information including the first terminal, the authentication switch, A communication system, wherein the authentication terminal registration table is updated according to a notification according to the POS T method. A communication system according to claim 2,
The authentication switch includes an authentication proxy that performs a proxy response of the authentication server,
The communication node executes the first authentication process via the authentication proxy, and the authentication proxy transmits the authentication result to the communication node and updates the authentication terminal registration table .
A communication system characterized by the above. The communication system according to claim 4, wherein
The communication system, wherein the authentication server is a RADIUS server. A communication system according to claim 2,
The communication node transmits authentication terminal information managed by the communication node by a POST method of HTTPS in response to a request from the authentication switch. A communication system according to claim 2,
The communication node performs authentication by IEEE 802.1x authentication in response to an authentication request related to access to the external network from the unauthenticated first terminal, and the authentication switch receives the authentication from the unauthenticated second terminal. A communication system, wherein MAC address authentication is performed for an authentication request related to access to an external network . An authentication server that holds the end end authentication information for communicating with an external network, a communication node performing a first authentication processing for the first terminal connected through a wireless network, and the external network, a wired An authentication switch connected to the second terminal via
An authentication terminal registration table that holds authentication terminal information for each terminal for authenticated or authenticated terminals ,
And registers in the authentication terminal registration table receives the authentication terminal information of a first terminal that resulted authenticated the first authentication processing from the communication node, said from the second terminal not authenticated according to the authentication request from the terminal for communicating with an external network, the authentication terminal information of the second terminal of the second authentication process shows the results of the authentication success on line without the second authentication process to the authentication server an authentication information processing unit to be registered in the authentication terminal registration table,
A relay processing unit that relays access to an external network from a terminal permitted to communicate according to the authentication terminal registration table ;
An authentication switch characterized by comprising: The authentication switch according to claim 8 , comprising a plurality of ports,
The first port is connected to the communication node via a wire , the second port is connected to the second terminal via a wire , the third port is connected to an authentication server, and the fourth port is Connected to the external network ,
The relay processing unit forwards a response to a first authentication request transmitted to the communication node via a wireless network from the first terminal to the communication node via the first port;
The authentication information processing unit, transmits the second authentication request from the second terminal receives via said second port, said second authentication request to the authentication server via the third port And
The authentication switch, wherein the authentication information processing unit receives information included in a response to the first authentication process from the communication node via the first port. The authentication switch according to claim 8, wherein
The relay processing unit holds a filter including at least one of an access control list or a QoS control table in which conditions regarding access to an external network are set,
The authentication information processing unit sets an identifier included in a response to the first and second authentication processes in the authentication terminal registration table, and performs access control or QoS control of the terminal under a condition corresponding to the identifier. An authentication switch characterized by. The authentication switch according to claim 8, wherein
The authentication switch, wherein the authentication management unit skips an authentication process including transmission of a second authentication request if it is updated as authenticated in the first authentication request. An authentication switch according to claim 8, wherein the authentication switch, received by the HTTPS POST method from the communication node, MAC address of the terminal, the first terminal, including IP address information indicating the authentication success And updating the authentication terminal registration table . 12. The authentication switch according to claim 8, wherein the first authentication request is in accordance with 802.1x authentication, and the second authentication is in accordance with MAC address authentication. The authentication switch according to claim 8, wherein
And a proxy unit acting as a proxy for the authentication server,
The authentication switch, wherein the authentication information processing unit updates an authentication state of a terminal using an authentication result in the proxy unit for the first authentication request.

Images