JP2001036561A - Tcp/ip network system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To improve security without revising a DHCP(dynamic host configuration protocol) and the hardware and the software of a terminal in a TCP/IP network system using a DHCP server. SOLUTION: The TCP/IP network system 10 is provided with hubs 12, 13 with a plurality of ports to which a terminal 16 is connected, a router 20 connected to the hubs 12, 13 and an external network 15, and a server 21 that is connected to the router 20 to serve various services to the terminal 16. The server 21 is provided with a DHCP server 23, the hubs 12, 13 are switching hubs that can section the network logically or physically, and each information wall socket 11 is set so as to belong to the sectioned network by the information wall socket 11 and the router 20.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

TECHNICAL FIELD The present invention relates to a TCP / IP (Tr
network system using the ansmission Control Protocol / Internet Protocol (hereinafter referred to as "T
CP / IP network ". ). Specifically, the present invention relates to improving security in the network system using a DHCP server.

[0002]

2. Description of the Related Art In recent years, in educational institutions and research institutions such as universities, an unspecified number of people use terminals, such as notebook personal computers, which are owned by each person, to study labs, libraries, and computers on premises. LAN (Local Area Network) from the information outlets installed in various places such as rooms
rk), and the LAN can be connected to an external network such as the Internet. Since various terminals are used in such a network system, TCP / IP suitable for multi-vendor use is used.
The protocol is being used. In the case of a TCP / IP network, an IP address, which is a 4-byte numerical address, is set for various devices (hereinafter, referred to as “nodes”) connected to the network. By transmitting an information packet including the original IP address and the destination IP address, information is transmitted and received between nodes.

Therefore, it is necessary to set an IP address for a terminal connected to the LAN. However,
In this case, each terminal that can be connected to the LAN has an individual I
Since it is necessary to set a P address, and it is almost impossible for all of the terminals to be connected to the LAN at the same time, IP address resources are wasted. Therefore, in such a network system, DHCP (Dynamic H
ost Configuration Protocol)
An appropriate IP address is automatically assigned to a terminal connected to the LAN.

FIG. 10 shows an outline of the LAN (90). Each information outlet (11) is connected to a hub (91), the hub (91) is connected to a router (92), and the router (92) is connected to an external network (15). In addition, various servers (93) that provide various services to terminals such as computers connected to the information outlet (11) are connected to the hub (91). The server (93) includes a DHCP server (94) that stores a plurality of IP addresses and assigns one of the IP addresses to a terminal connected to the network. The devices are connected by wire, such as an optical cable or a lead cable, or wirelessly, such as by electromagnetic waves. When the user connects the terminal to the information outlet (11) and sends an IP address assignment request over the network, the DHCP server (94)
Is sent to the terminal. The user can use resources on the LAN (90) and resources of the external network (15) using the IP address.

[0005]

As described above, TCP /
In the case of an IP network, information can be transmitted / received to / from each other if the IP address of the other party can be known. Also, DH
The CP server uses the ARP broadcast when transmitting the assigned IP address to the terminal, so that other terminals on the network can receive the IP address. Therefore, TCP using the DHCP protocol
In the case of the / IP network, a terminal can easily transmit and receive information to and from another terminal, but is not vulnerable to maliciously connecting and attacking another terminal.

As described above, when an unspecified number of people can use an information outlet, it is important from a security point of view to record when and who used which information outlet. is there. For this reason, it is desirable that authentication be performed when the terminal is connected to the information outlet to identify the user, and that only the user authorized by the authentication can use the network. However, DHCP
The protocol does not include a function to authenticate users. In order to solve this problem, work to add an authentication function to the DHCP protocol is in progress. However, this method requires changes in hardware and software in the terminal to support the added function, and thus increases the burden on the user, and is not immediately executable. hard.

[0007]

The object of the present invention is to use TCP using a DHCP server.
An object of the present invention is to provide a network system that realizes improved security without changing the DHCP protocol or hardware and software of a terminal in a / IP network system.

[0008]

SUMMARY OF THE INVENTION In order to solve the above problems, the present invention relates to a network system using a TCP / IP protocol, comprising: a hub having a plurality of ports to which terminals are connected; And a router connected to the external network, and a server connected to the router and providing various services to terminals connected to the network. The server stores a plurality of IP addresses, A DHCP server that assigns one of the IP addresses to a terminal connected to the hub, wherein the hub is a switching hub that can physically or logically partition a network, such as a VLAN management system, Is set so as to belong to a partitioned network composed of the port and the router.

The server includes an authentication server for authenticating a network user, and the router separates only a packet transmitted from a terminal having an IP address authorized by the authentication of the authentication server. Is set to be transmitted to the outside of the network.

[0010]

In the network system having the above configuration, the switching hub that can physically or logically partition the network is used so that the router and the ports of the hub are separately partitioned. Is done. Therefore, the terminals connected to the network belong to different partitioned networks, and the security between the terminals is improved.

When a packet is transmitted from a certain terminal to the outside of the partitioned network to which the terminal belongs, ie, to a server, another terminal or an external network, the packet must be transmitted via a router. Will be done. Therefore, by setting the router to transmit only the packet transmitted from the terminal having the IP address authorized by the authentication of the authentication server to the outside of the segmented network, the user can establish the network. In order to use it, it becomes necessary to be authenticated, and security on the network is improved.

[0012]

Embodiments of the present invention will be described below. FIG. 1 shows a TCP / I according to an embodiment of the present invention.
1 shows an outline of a P network system. The network system (10) includes a number of information outlets (11) to which terminals are connected, a plurality of department hubs (12) and (12) to which the information outlets (11) are connected, and the department hubs (12). ) (12) is connected to the central hub (13), and the central hub (13) is connected to the integrated server (14) connected to the external network (15).

The integrated server (14) includes a router (20) connected to a central hub (13) and an external network (15), and various servers (21). Various servers (21) of the present embodiment include:
A DHCP server (23) that stores a plurality of IP addresses and assigns one of the IP addresses to a terminal (16) connected to an information outlet (11), and an authentication server (authentication server) that authenticates a user 24) and a disconnection monitoring server (25) for monitoring the connection or disconnection state of each information outlet (11) with the terminal (16).

As described above, the terminal (16) newly connected to the information outlet (11) receives the IP address from the DHCP server (23).
DHCP server (23) when requesting address assignment
Sends out an appropriate IP address to be assigned by ARP broadcast. In this case, the IP address may be intercepted by another terminal (16). Therefore, it is desirable that the DHCP server (23) is set so as to transmit to the MAC address of the requesting terminal (16).

The authentication method by the authentication server (24) includes a method using a card, a method using an encrypted e-mail, and the like.
Various methods exist. In the present embodiment, the authentication tool is activated after the terminal (16) acquires the IP address, and authentication is performed via the network system (10). As this authentication tool, it is desirable to use a Web browser that is provided as a standard feature on the current terminal (16).
CGI (Common Gateway Interface) via eb browser
It is desirable to activate e) to perform authentication. In addition, the authentication server (24) usually has an ID for identifying the user.
The D code and the password are stored. However, if the ID code and the password are stored in a certain server on the external network (15), the authentication server (24) may use an NIS (Network Information Service).
It is not necessary to store the ID code and the password if the setting is made so that the ID code and the password can be queried by using. In addition, the authentication server (24)
In addition to the code and the password, access restriction information indicating up to which of the various servers (21), the external network (15) and the other terminals (16) access to the user of the ID code is permitted. Is desirably stored.

The router (20) has an IP filtering function for passing only information having an IP address assigned to the terminal (16) authenticated by the authentication server (24). In the present embodiment, the IP address assigned by the DHCP server (23) is a private IP address valid only on this network system (10), and the router (20) NAT (Network Address Translat) that translates while validating the global IP address
ion) function. Also, the router (20) of the present embodiment
Stores the combination of the IP address assigned to the terminal (16) and the MAC address of the terminal (16),
It has a function of rejecting communications that do not match the combination. The various servers (23), (24) and (25) are known servers, and a known router (20) having an IP filtering function and a NAT function is also used.

The central hub (13) comprises an upstream port (30) to which a router (20) is connected and a number of downstream ports (31) to which department hubs (12) and (12) are connected, Department Hub (12) (12)
Has an upstream port (32) to which the central hub (13) is connected and a number of downstream ports (33) to which the information outlet (11) is connected. Thus, when using a large number of information outlets (11), the hub is a central hub (13) and a department hub (1).
It is desirable to have a hierarchical structure with 2). In the present invention, a switching hub capable of setting a VLAN management system is used for the central hub 13 and the department hub 12.
In this case, the department hub (12) can set a VLAN group for the downstream port (33) connected to each information outlet (11), and the upstream port (32) connected to the central hub (13). Must be able to set all of the set VLAN groups. Similarly, the central hub (13) can set all of the VLAN groups set by the department hub (12) for the downstream port (31) connected to each department hub (12), and can set the router ( Upstream port (30) connected to (20)
VLAN set in all department hubs (12)
You need to be able to configure all of the groups. That is, the switching hub used for the central hub (13) and the department hub (12) needs to be able to set a plurality of VLAN groups on a single port. Examples of such a switching hub include a switching hub conforming to IEEE 802.1Q, MultiVLAN, or ISCP proposed by Cisco.

In this embodiment, the department hub (12) is a terminal
(16) is the MAC address of the downstream port (33) connected via the information outlet (11), and the DH for the terminal (16).
The combination with the IP address assigned by the CP server (23) is stored, and the source IP address included in the information packet transmitted from the terminal (16) and the downstream port ( If the combination with the MAC address of 33) is different from the stored combination, the device has a MAC filtering function for preventing transmission of the packet to the central hub (13).

The operation of the integrated server (14) in the network system (10) having the above configuration will be described with reference to FIGS. When the DHCP request is received from the terminal (16), the router (20) transfers the DHCP request to the DHCP server (23) as shown in FIG.
An IP address is received from the CP server (23) (step S11). Then, the IP address is transferred to the MAC address of the terminal (16) which has issued the DHCP request (step S).
12), end the processing for the DHCP request.

When the terminal (16) activates the authentication tool and receives an authentication request from the terminal (16), the router (20) sends the authentication request to the authentication server as shown in FIG. (24) (step S20), and authentication by the authentication server (24) is performed (step S21). A specific method of the authentication will be described later. If the authentication by the authentication server (24) is not successful, the process returns to step S21, and if it is successful, the following steps are executed (step S22). Under the control of the authentication server (24), the router (20) uses the IP address of the successful terminal (16) to send a message from the terminal (16) to the outside of the VLAN to which the terminal (16) belongs. , That is, access to various servers (21), other VLANs or external networks (15) (step S23). At this time, the accessible range can be restricted based on the access restriction information stored in the authentication server (24). Then, the router (20)
The authentication success page sent from (24) is transferred to the terminal (step S24), and the process related to the authentication request is ended.

When the router (20) receives an information packet transmitted from the terminal (16) to the various servers (21), other terminals (16), or the external network (15),
As shown in FIG. 5, the router (20) determines whether or not the source IP address included in the information packet has been authenticated (step S30). If not, the router (20) transmits the information packet. Is blocked. In this case, the router (20)
Discards the information packet and returns it, and the authentication server (24)
To the authentication server
(24) may be notified.

If the authentication has been completed, the router (20) determines from the destination IP address included in the information packet whether the information packet is addressed to the external network (15) (step S31). Network system (1
In the case of transmission to (0), it is determined whether the network system (10) is included in the accessible range for the source IP address (step S32). If not included, the transmission of the information packet is blocked in the same manner as described above, and if included, the information packet is transferred to the destination IP address (step S33). External network (1
In the case of transmission to 5), the IP address of the terminal (16)
In addition to storing the address and the IP address of the external network (15) to be the destination, the source IP
The address is converted to a global IP address of the router (20), the information packet is transferred to an external network (step S34), and the information packet transfer process ends.

When an information packet is received from the external network (15), as shown in FIG.
Refers to the IP addresses of the terminal (16) and the external network (15) stored in step S34 of FIG. 5, and refers to the source IP address of the external network (15) included in the information packet.
The private IP address of the terminal that transmitted the address is searched (step S40). Applicable private I
If the P address is not found (step S4
1) The information packet is discarded or sent back to the source, and if the corresponding private IP address is found, the information packet is transferred to the found IP address (step S42), and the external network ( 15)
Ends the information packet transfer process.

When the disconnection monitoring server (25) detects the disconnection of the terminal (16), the DHCP server (23) receives the instruction from the disconnection monitoring server (25) as shown in FIG. Release the IP address used by the terminal (16), and release the router (2
0) is set so that the IP address becomes unusable (step S50), and the department hub (12) is set to stop MAC filtering of the port used by the terminal (16). Then (step S51), the terminal disconnection process ends.

Next, the flow of operation in the terminal (16) will be described with reference to FIGS. First, the terminal 16 is connected to the information outlet 11 (step S80), and a DHCP request is transmitted to assign an IP address (step S81). At this time, the DHCP request is transmitted to the DHCP server (23) via the router (20). The DHCP server (23) transmits an appropriate IP address to the terminal via the router (20), so that the IP address is assigned to the terminal (16) (step S82).

Next, the authentication tool is activated and an authentication request is transmitted (step S83). At this time, the authentication request is transmitted to the authentication server (24) via the router (20). The authentication server (24) sends an authentication page to the terminal via the router (20).
By transmitting to (16), an authentication page is displayed on the screen of the terminal (16) (step S84). Next, the user:
An ID code and a password are input and transmitted from the terminal (16) (step S85). At this time, the ID code and the password are transmitted to the authentication server (24) via the router (20).
To be authenticated. If the authentication fails, the authentication page is transmitted again to the terminal via the router (20), and the process returns to step S84. If the authentication is successful, the authentication server (24) transmits a page of the authentication success to the terminal (16) via the router (20), thereby displaying the page of the authentication success on the screen of the terminal (16). Is displayed (step S86), and the use of the network system (10) from the information outlet (11) is started (step S87).

Then, the user connects the terminal to the information outlet.
After disconnecting from (11) (step S88), use of the network system (10) is terminated. At this time, the disconnection monitoring server
(25) detects the disconnection (step S89), and in response to an instruction from the disconnection monitoring server (25), the DHCP server (23) releases the IP address of the terminal (16) (step S9).
0).

Accordingly, the network system (10) of the present embodiment utilizes a switching hub capable of setting the VLAN management system, and as shown in FIG.
Are set to belong to the VLAN group (40) composed of the terminal (16) and the router (20). Therefore, the terminals (16) and (16) on the network system (10) belong to different VLAN groups (40) and (40).
The security between the terminals (16) is improved.

[0029] Also, from a certain terminal (16), the terminal (16)
When transmitting a packet outside the VLAN (40) to which it belongs, the packet is always transmitted via the router (20). Therefore, when the router (20) is authorized by the authentication server (24),
Since only the packet transmitted from the terminal (16) having the address is set to be transmitted to the outside of the VLAN (40), the user needs to be authenticated in order to use the network. Therefore, security on the network is improved.

The router (20) has a function of storing a combination of an IP address and a MAC address in the terminal (16) and rejecting communication that does not conform to the combination. Since the terminal has the MAC filtering function, an IP address assigned to a certain terminal (16) is used by another terminal (16).
Can be prevented. Also, since the router (20) has a NAT function, a global I
Only the router (20) having the P address can be referenced, and the terminal (1
6) cannot be referred directly. Therefore, the external network (15)
To attack the terminal (16). Also, DHCP
The server (23) assigns the IP address assigned to the DHCP request by DHCP instead of ARP broadcast.
Since the request is sent to the MAC address of the terminal (16) that made the request, it is possible to prevent the IP address from being intercepted by another terminal (16).

The description of the above embodiments is for the purpose of describing the present invention, and should not be construed as limiting the invention described in the claims or reducing the scope thereof.
Further, the configuration of each part of the present invention is not limited to the above-described embodiment, and it is needless to say that various modifications can be made within the technical scope described in the claims. For example, as a switching hub that can physically or logically partition a network, V
In addition to a switching hub in which a LAN management method can be set, a wireless hub that can be sectioned by a wireless channel can be used.

[Brief description of the drawings]

FIG. 1 is a schematic diagram showing a network system according to an embodiment of the present invention.

FIG. 2 is a schematic diagram showing logical connections in the network system of the present embodiment.

FIG. 3 is a flowchart illustrating a processing operation for a DHCP request in the integrated server of the embodiment.

FIG. 4 is a flowchart showing a processing operation for an authentication request in the integrated server of the embodiment.

FIG. 5 is a flowchart illustrating a processing operation for transmitting an information packet in the integrated server according to the embodiment;

FIG. 6 is a flowchart illustrating a processing operation for returning an information packet from an external network in the integrated server of the present embodiment.

FIG. 7 is a flowchart illustrating a processing operation for disconnection of a terminal in the integrated server of the present embodiment.

FIG. 8 is a flowchart illustrating an operation of a terminal according to the present embodiment.

FIG. 9 is a flowchart showing a continuation of FIG. 8;

FIG. 10 is a block diagram showing a conventional network system.

[Explanation of symbols]

 (10) TCP / IP network system (11) Information outlet (12) Department hub (13) Central hub (15) External network (16) Terminal (20) Router (23) DHCP server (24) Authentication server (25) Disconnection monitoring server (33) Port downstream of department hub (40) VLAN group

 ──────────────────────────────────────────────────続 き Continued on the front page (72) Yoshio Asano, Inventor 448-1-1428, Minamigasa-cho, Kusatsu-shi, Shiga (72) Inventor Hitoshi 53-1-805, Nishi-Iruri-Tanamachi, Sanjo-dori-Muromachi, Nakagyo-ku, Kyoto-shi, Kyoto (72) Inventor Yasuo Fujii 168-25, Shimogamo Miyazaki-cho, Sakyo-ku, Kyoto-shi, Kyoto (72) Inventor Junichi Nakamura 1-47-14 Shimosakamoto, Otsu-shi, Shiga F-term (reference) 5J104 AA07 KA02 MA01 PA07 5K030 GA15 HC14 HD03 HD07 LB05 5K033 CB08 DA05 DA15 DB18 EC03 9A001 CC03 CZ06 JJ25 LL03

Claims (6)

[Claims] 1. A network system using a TCP / IP protocol, comprising: a hub having a plurality of ports to which terminals are connected; a router connected to the hub and an external network; and a router connected to the router. And a server that provides various services to terminals connected to the network. The server stores a plurality of IP addresses, and provides one of the IP addresses to the terminals connected to the network. A DHCP server that assigns one to the network, wherein the hub is a switching hub that can physically or logically partition the network, such as a VLAN management method;
A network system in which each port of a hub is set to belong to a partitioned network consisting of the port and a router. 2. The server comprises an authentication server for authenticating a network user, and the router separates only packets transmitted from a terminal having an IP address authorized by the authentication of the authentication server. The network system according to claim 1, wherein the network system is set to transmit outside of the network. 3. The switching hub stores a combination of an IP address authorized by authentication of a network user and a MAC address of a port to which a terminal having the IP address is connected. If the combination of the source IP address and the MAC address of the port contained in the packet to be transmitted is different from the stored combination, it has a filtering function of preventing the packet from being transmitted to the router. , Claim 1 or Claim 2
The network system according to 1. 4. The IP address assigned to the terminal from the DHCP server is a private IP address valid only on the network system, and the router transmits the private IP address and a global IP address valid on the external network. The network system according to any one of claims 1 to 3, further comprising a NAT function for performing conversion while corresponding. 5. When a terminal requests allocation of an IP address from a terminal, the DHCP server transmits the MAC address of the requesting terminal.
The network system according to any one of claims 1 to 4, wherein the network system is set to transmit an appropriate IP address to the address. 6. The switching hub according to claim 1, wherein the switching hub has a hierarchical structure including a department hub to which terminals are connected, and a central hub to which a plurality of department hubs and routers are connected. The network system according to crab.