JP2001230783A - Network unit and authentication server - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a network unit that can connect a device of a 3rd party other than members of a LAN to the LAN with security. SOLUTION: An address conversion function block 10a converts a destination address (IP address) in a communication packet sent by a terminal 14 into an IP address of a terminal and a server in an existing LAN. According to the operation above, a terminal 14 can utilize the existing LAN 12 even when a user of the terminal 14 does not know the address of a server or the like in the existing LAN. As a result, having only to connect the terminal 14 to the existing LAN allows the terminal 14 to easily utilize the facility of the existing LAN 12. Since the terminal 14 accesses the existing LAN 12 via the network unit 10, the terminal 14 cannot obtain a concrete IP address in the existing LAN 12. Thus, leakage of the IP address can be prevented and the security can be maintained.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

The present invention relates to an apparatus for connecting various devices and other LANs to a LAN.

[0002]

2. Description of the Related Art In recent years, with the development of information technology, LANs have been widely used. Each terminal connected to the LAN can transmit and receive data and the like through the LAN. Of course, from devices not connected to LAN,
It is not possible to access a terminal or the like connected to the LAN.

[0003] However, there is a demand for temporarily connecting a device of a person who is not a member of the LAN to the LAN. Many have actually occurred.

[0004] For example, when it is desired to temporarily transmit and receive data to and from an employee of an affiliated company such as an organization where a LAN is installed, or to a member of an organization having some kind of association such as a business partner. If it is possible to temporarily grant access to the LAN to a third party, for example, when it is desired to temporarily use a printer provided in the LAN, business can proceed smoothly.

[0005]

SUMMARY OF THE INVENTION However, LAN
In many cases, it is difficult to temporarily connect a device other than the members described above to a LAN.

[0006] If simply connecting physically,
What is necessary is just to set an unused address on the network and connect with that address. However, connecting third-party devices other than members of the LAN to the LAN without any restrictions is extremely dangerous in terms of security. This is because there is no danger of data being stolen or destroyed.

[0007] Because of this danger, a general company or the like generally does not have a LAN connection port in a department where anyone can enter, such as a reception room or a conference room. If a department that anyone can access has a connection to the company LAN, a malicious third party can easily enter the company LAN and steal corporate secrets.

[0008] Unless such a security problem is solved, a third party device cannot be easily connected to the LAN.

The present invention has been made in view of the above problems, and an object of the present invention is to provide an apparatus for safely connecting a device of a third party other than a member of a LAN to the LAN. .

[0010]

According to the present invention, there is provided a network apparatus for connecting a network to a predetermined terminal, comprising: access control means for controlling access between the terminal and the network. And a network device.

By performing access control, access from the terminal to the network can be restricted, so that the terminal can be safely connected to the existing network.

Further, according to the present invention, the access control means checks a destination address of communication data transmitted from the terminal to the network, and if the destination is a destination for which access is not permitted, A network device comprising filtering means for stopping transmission.

By performing so-called filtering, it is possible to prevent the terminal from accessing an unauthorized destination. Note that communication data means data to be communicated, and is a concept including, for example, a communication packet as described in an embodiment described later.

Further, the present invention is the network device, wherein the access control means includes address conversion means for rewriting a destination address of communication data transmitted from the terminal to the network.

[0015] With such a configuration, it is possible to make the address in the network invisible from the terminal,
Secret leakage can be prevented.

According to another aspect of the present invention, there is provided a network apparatus comprising: an authentication unit that obtains an ID of the terminal and obtains information on access control to the terminal based on the ID.

With such a configuration, it is possible to automatically set access control based on the terminal ID.

Further, according to the present invention, the authentication means preferably comprises the I
A network device for transmitting D to an external authentication server and receiving information related to access control transmitted from the authentication server.

With such a configuration, it is possible to automatically receive access control information based on the terminal ID from an external authentication server.

Further, according to the present invention, the network device receives the ID transmitted from the network device, reads information on access control corresponding to the ID from a database, and transmits the read information on access control to the network device. Authentication communication means;
And a database means for storing information relating to access control corresponding to D.

According to such a configuration, information of access control based on the terminal ID can be automatically transmitted to the network device.

According to another aspect of the present invention, there is provided a network device for connecting a first network and a second network, wherein the first network and the second network are connected to each other.
An access control unit that controls access to a network.

By performing access control, access between the first network and the second network can be restricted, so that a network laid in an insecure area can be safely connected to an existing network. .

Further, according to the present invention, the access control means checks a destination address of communication data transmitted from the first network to the second network, and if the destination address is not permitted to be accessed, A network device comprising filtering means for stopping transmission of the communication data.

By performing so-called filtering, access to an unauthorized destination can be prevented.

Further, the present invention is the network device, wherein the access control means includes address conversion means for rewriting a destination address of communication data transmitted from the first network to the second network. .

With such a configuration, it is possible to make the address in the first network invisible from the second network, and it is possible to prevent the secret from being leaked.

Further, the present invention is a network device comprising an authentication unit for acquiring an ID of a terminal included in the first network, and acquiring information on the access control based on the ID. .

With such a configuration, access control can be automatically set based on the terminal ID.

Further, according to the present invention, the authentication means preferably comprises the I
A network device for transmitting D to an external authentication server and receiving information related to access control transmitted from the authentication server.

According to such a configuration, access control information based on the terminal ID can be automatically received from an external authentication server.

Further, the present invention receives the ID transmitted by the network device, reads information on access control corresponding to the ID from a database means, and transmits the read information on access control to the network device. Authentication communication means;
And a database means for storing information relating to access control corresponding to D.

With this configuration, it is possible to automatically transmit access control information based on the terminal ID to the network device.

[0034]

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Preferred embodiments of the present invention will be described below with reference to the drawings.

Embodiment 1 FIG. 1 shows that a third-party terminal 14 is connected to an existing LAN 12 by using a network device according to a preferred embodiment of the present invention.
Is shown in FIG. As shown in this figure, the network device 10 is connected between the existing LAN 12 and a third-party terminal 14 and controls the flow of data between the existing LAN 12 and the terminal 14. .

FIG. 2 is a functional block diagram of the network device 10. As shown in this figure, the network device 10 includes an address translation function block 10
a, filtering function block 10b, communication protocol function block 10c, network management block 10
d, each means of the authentication function block 10e.

The network device 1 according to the present embodiment
0 has a frame control block 10f and a transmission line interface 10g.

Address conversion function block The address conversion function block 10a is a means for rewriting an IP address in a communication packet. In this embodiment, dedicated hardware is used to secure a communication speed. Of course, in applications where the communication speed may be slow, it is also preferable to realize the function of this block by software.

A feature of the present embodiment is that the address conversion function block 10a sets the destination address (IP address) in the communication packet transmitted by the terminal 14 to the existing L.
This is to convert to the IP address of the terminal or server in the AN. Due to such an operation, the terminal 14 establishes an existing LA
Even if you do not know the value of the address of the server in N, the existing L
The AN 12 can be used. As a result, the facilities of the existing LAN 12 can be easily used from the terminal 14 only by connecting the terminal 14 to the existing LAN.

Of course, in order to realize this, it is necessary that the address conversion rules in the network device 10 be automatically changed according to the terminal 14. Such a setting change operation will be described later in detail.

Further, the terminal 14 sends the network device 1
Since the existing LAN 12 is accessed via the “0”, the specific value of the IP address in the existing LAN 12 cannot be known from the terminal 14. As a result, it is possible to prevent a specific IP address value in the existing LAN 12 from leaking. If a specific IP address value is leaked, if the existing LAN 12 is connected to the Internet, for example, unauthorized access to the existing LAN 12 via the Internet to an unspecified number of persons using the leaked IP address is performed. This is because they may forgive.

As described above, according to the present embodiment, it is possible to realize easy access to the existing LAN 12, prevent leakage of the IP address, and secure security.

Further, the address conversion function block 10a
Rewrites the destination address and the source address (IP address) in the communication packet transmitted from the server or the like in the existing LAN 12 to the terminal 14.

As a result, it is possible to make settings so that the terminal 14 always looks as if it has a fixed address from a server or the like in the existing LAN 12. For example,
From within the existing LAN 12, the terminal 14 is always "10.1.
The network device 10 is set so as to have the address “0.10.10”. The address conversion function block 10a transmits the destination address "10.10.
10.10 ”is rewritten to the actual address of the terminal.

Further, the address conversion function block 10a
Rewrites the source address with a certain translation rule. This is because the source address is rewritten and the existing L
This is to prevent the actual address in the AN 12 from being seen from the external terminal 14. By such an operation, as described above, the terminal 14 can be easily connected to the existing LAN 12 while preventing the leakage of the IP address in the existing LAN 12.

The setting of the address conversion rule in the address conversion function block 10a is performed when the terminal 14 is connected to the existing LAN 12 through the network device 10.
The authentication is performed by the authentication server 12a in the existing LAN 12 transmitting information on the address conversion to the network device 10. The detailed operation of the authentication server 12a will be described later.

In the present embodiment, the address conversion function block 10a is realized by hardware, but if the speed may be low, it is preferable to realize it by software.

The address conversion function block 10
“a” corresponds to the address conversion means of the present invention.

Filtering Function Block The filtering function block 10b filters communication packets. The address of the communication packet transmitted by the terminal 14 is rewritten by the address conversion function block 10a.
With b, it is checked whether the destination is a permitted place. As a result, if the access is not permitted, the filtering function block 10b stops transmitting the communication packet and deletes the communication packet.

That is, the filtering function block 1
0b restricts the destination that can be transmitted from the terminal 14, and the like.

On the other hand, the source address of the communication packet transmitted from the existing LAN 12 is checked, and
If the source is not permitted to access the communication packet 4, the transmission of the communication packet is stopped and the communication packet is deleted.

By performing so-called filtering in this manner, it is possible to prevent unauthorized access from the terminal 14. Therefore, according to the present embodiment, terminal 14 can be connected to existing LAN 12 with confidence.

The filtering function block 10b performs a filtering operation based on the filtering information. This filtering information is set by the authentication server 12a in the existing LAN 12. Authentication server 1
The specific setting operation of 2a will be described later.

The filtering information is information that describes information about what kind of communication packet is to be passed. Such information is also used, for example, in a conventional firewall or the like. The filtering information will be described again when the setting operation of the filtering information is described.

By the way, in this embodiment, in order to secure the communication speed, the filtering function block 10 is used.
b is also configured by hardware. However, in applications where the speed may be low, it is also preferable to configure this block with software.

The filtering function block 1
0b corresponds to the filtering means of the present invention.

Communication Protocol Function Block The communication protocol function block 10c is a so-called protocol stack, and is constituted by software.

Network Management Block The network management block 10d is a means for mainly processing network troubles, and is a means for monitoring network traffic. This block is also mainly composed of software.

[0059] authentication function block authentication function block 10e, when new terminal 14 is connected to the existing LAN 12 via the network device 10, informs the fact that the connection to the authentication server 12a in the existing LAN 12, the terminal 14 This is means for receiving predetermined information regarding the authentication from the authentication server 12a. This information is the above-described filtering information, information related to address conversion, and other information. This information will be described again later.

The authentication function block 10e sets the information received from the authentication server 12a in the address conversion function block 10a and the like. Thus, the network device 10 can set filtering information and the like so as to match the connected terminal 14.

The detailed operation of the authentication function block 10e will be described later.

Frame Control Block The frame control block 10f is means for reconstructing a communication packet. As described above, the address conversion function block 14a rewrites an address. Therefore, it is necessary to recalculate the CRC and the like in the communication packet. The frame control block 10f uses such a C
Recalculation of RC and the like are performed to reconstruct the packet.

Transmission Line Interface The transmission line interface 10g is a connection interface with an external device. First, the transmission line interface 10g is an interface between the network device 10 and the existing LAN 12. Further, the transmission line interface 10g is also an interface between the network device 10 and the terminal 14.

With such an interface, the network device 10 appears as one terminal when viewed from the existing LAN 12, and the network device appears as a LAN when viewed from the terminal 14.

Initial Setting Operation As described above, the network device 10 must set filtering information and information relating to address conversion for each terminal 14. These pieces of information will be different if the terminal 14 is different.
If the address is different, the addresses that can be used are naturally different, and the information on the address conversion is also different.

In the present embodiment, these settings are executed when the terminal 14 is connected to the existing LAN 12 via the network device 10. Hereinafter, this setting operation will be described. The description will be made assuming that the network device 10 itself is already connected to the existing LAN 12. FIG. 3 is a flowchart showing the setting operation.

First, in step S3-1, the terminal 1
When 4 is connected to the network device 10, the authentication function block 10e of the network device 10 detects the connection operation and obtains the ID of the terminal 14 from the terminal 14. This I
D may be any ID as long as the type of the terminal can be identified. For example, MAC (Media Access Control)
l) It is also preferable to use an address as this ID.
Further, in addition to the terminal 14, for example,
It is also preferable to store D. A person who intends to use the terminal 14 inserts the IC card into the terminal 14, and the terminal 14 transmits the ID stored in the IC card to the network device 10 based on a request from the network device 10.

Then, in step S3-2, the authentication function block 10e transmits this ID to the authentication server 12a. In step S3-3, the authentication server 12a receives the ID and transmits corresponding setting information to the network device 10 based on the received ID.

FIG. 4 is a block diagram showing the configuration of the authentication server 12a. As shown in this figure, the authentication server 12a includes a database unit 12a-1 that stores the type of the terminal 14 and setting information corresponding to the type. In addition, the authentication server 12a
Authentication communication means 12a-2 for transmitting and receiving data.

The database means 12a-1 includes a table storing various setting information, and further includes software for managing the table.

The authentication communication unit 12a-2 is a unit for communicating with the network device 10, and is composed of communication hardware and software.

FIG. 5 is a flowchart showing the operation of the authentication server 12a.

First, in step S5-1, the authentication communication unit 12a-2 receives the ID transmitted by the network device 10.

Next, in step S5-2, the setting information corresponding to the terminal 14a of the type represented by the received ID is read from the database means 12a-1.

Then, in step S5-3, the read setting information is transmitted to the network device 10.

This setting information is, so to speak, setting information for access control, and includes various information on access control in addition to the filtering information and the information on address conversion. In the present embodiment, as the setting information,
For example, it contains the following information:

(1) Filtering information (2) Address conversion information (3) Information for specifying a time zone in which the terminal 14 can use the existing LAN (4) Available application types In addition to the above, the person who uses the terminal 14 And the MAC address when the network device 10 is operated in the same IP subnet. The ID of the person mentioned here
It is also preferable to use, for example, an employee number or a visitor number.

[0086] Of course, the information related to the address conversion includes the address (IP address) given to the terminal 14.

A feature of the present embodiment is that the authentication server 12a automatically transmits setting information (information related to access control) corresponding to the type of the terminal 14 to the network device 10 according to the type of the terminal 14. As a result, simply by connecting the terminal 14 to the network device 10, information on access control is automatically set in the network device 10. Therefore, according to the present embodiment, terminal 14 can be connected to existing LAN 12 safely and easily.

Now, when the authentication server 12a transmits the predetermined setting information to the network device 10,
In step S3-4, the network device 10 receives this information. Then, in step S3-5, the network device 10 performs various settings based on this information.

First, the authentication function block 10e of the network device 10 sets filtering information in the filtering function block 10b based on the information sent from the authentication server 12a. As a result, the filtering function block 10b executes the above-described filtering operation.

The authentication function block 10e sets information on address conversion in the address conversion function block 10a based on the information sent from the authentication server 12a. Thereby, the address translation function block 10
a executes the above-described address conversion operation based on the address conversion rule represented by the information.

Further, based on the received information, the authentication function block 10e sets the authentication function block 10e such as the application permitted to the connected terminal 14 and the time permitted to use. As a result, the authentication function block 10e rejects the access when the terminal 14 tries to access the existing LAN 12 at a time other than the permitted time. If the terminal 14 attempts to use an application that is not permitted, the use is rejected.

As described above, according to the present embodiment, since access control such as filtering of communication data is performed, the terminal 14 can be connected to the existing LAN 12 safely and easily. Therefore, according to the present embodiment, LAs are temporarily provided to persons other than those configuring the LAN.
N resources can be used.

Embodiment 2 The network device 10 is connected to an existing LAN 12 by a terminal 1
4 as well as a use form for connecting LANs to each other.

FIG. 6 shows the network device 10 connected to the existing LA.
It is explanatory drawing showing the example connected between N12 and other LAN22, such as a reception room. When the network device 10 is connected as shown in FIG.
From the terminal 24 connected to the AN 22 side, the existing LAN
Twelve resources are available.

In the second embodiment, the terminal 14 to be connected is only the first terminal in the first embodiment. However, in the second embodiment, since the other LAN 22 is connected to the network Terminal 24 can be connected.

If such another LAN is provided, for example, in the reception room, even if a third party enters the reception room, access to the LAN can be restricted. Absent.

As described above, in the second embodiment, it is possible to lay a LAN in a reception room or the like, which has been difficult in the past.

Embodiment 3 In Embodiments 1 and 2, both the existing LAN
12 is to prevent unauthorized access to the server 12. On the contrary, there is a case where it is desired to prevent an unauthorized access from the existing LAN 12. For example, a server having data relating to personal privacy such as personnel data in a company corresponds to this. Such a server is generally located in a section called a secure room (SECURE ROOM).

In such a case, the network device 10
FIG. 7 is an explanatory diagram of a configuration in which the device is provided between the LAN 32 laid in the secure room and the existing LAN 12.

According to such a configuration, the existing LAN 12
Can restrict access to the secure room LAN.

[0093]

As described above, according to the present invention, since access control is performed between a terminal and a network, a terminal and other networks can be safely connected to the network.

If address conversion is performed as access control, addresses in the network cannot be seen from the outside, so that secret leakage can be prevented and secure connection can be made.

By performing so-called filtering as access control, unauthorized access to the network can be prevented, so that secret leakage can be prevented and a secure connection can be made. As a result, a terminal such as a third-party personal computer can be easily connected to a network such as a LAN,
Third parties can also use LAN resources.

Also, since the access control information is automatically set based on the ID, the access control can be automatically set by simply connecting. as a result,
ADVANTAGE OF THE INVENTION According to this invention, in addition to being secure, there exists an effect that connection to a network can be easily realized.

[Brief description of the drawings]

FIG. 1 is an explanatory diagram showing a state where a terminal is connected to an existing LAN using a network device according to a preferred embodiment 1 of the present invention;

FIG. 2 is a configuration block diagram illustrating a configuration of a network device.

FIG. 3 is a flowchart illustrating an operation of a network device when a terminal is connected.

FIG. 4 is a configuration block diagram illustrating a configuration of an authentication server.

FIG. 5 is a flowchart illustrating an operation of the authentication server.

FIG. 6 is an explanatory diagram showing a state in which another LAN is connected to an existing LAN using the network device according to the preferred embodiment 2 of the present invention;

FIG. 7 is an illustration of an LA installed in a secure room or the like using a network device according to a preferred embodiment 3 of the present invention;
FIG. 9 is an explanatory diagram illustrating a state in which an existing LAN is connected to N.

[Explanation of symbols]

 DESCRIPTION OF SYMBOLS 10 Network device 10a Address conversion function block 10b Filtering function block 10c Communication protocol function block 10d Network management block 10e Authentication function block 10f Frame control block 10g Transmission path interface 12 Existing LAN 12a Authentication server 12a-1 Authentication communication means 12a-2 Database means 14 terminal 22, 32 other LAN 24, 34 terminal

Continued on the front page F-term (reference)

Claims (12)

[Claims] 1. A network device for connecting a network to a predetermined terminal, the network device comprising: access control means for controlling access between the terminal and the network. 2. The network device according to claim 1, wherein the access control unit checks a destination address of communication data transmitted from the terminal to the network, and if the destination address is not permitted to be accessed. A filtering device for stopping transmission of the communication data. 3. The network device according to claim 2, wherein said access control means includes address conversion means for rewriting a destination address of communication data transmitted from said terminal to said network. 4. The network device according to claim 1, further comprising: an authentication unit that obtains an ID of the terminal, and obtains information related to access control for the terminal based on the ID. apparatus. 5. The network device according to claim 4, wherein the authentication unit transmits the ID to an external authentication server, and receives information related to access control transmitted from the authentication server. apparatus. 6. An authentication server for transmitting information related to access control to a network device according to claim 5, wherein the authentication server receives the ID transmitted from the network device and transmits information related to access control corresponding to the ID. Authentication, comprising: authentication communication means for reading from the database means and transmitting the read information on access control to the network device; and the database means for storing information on access control corresponding to the received ID. server. 7. A network device for connecting a first network and a second network, comprising: access control means for controlling access between the first network and the second network. . 8. The network device according to claim 7, wherein the access control unit checks a destination address of communication data transmitted from the first network to the second network, and checks a destination address to which access is not permitted. Filtering means for stopping transmission of the communication data in some cases. 9. The network device according to claim 8, wherein the access control unit includes an address conversion unit that rewrites a destination address of communication data transmitted from the first network to the second network. Network device to do. 10. The network device according to claim 7, wherein an ID of a terminal included in the first network is obtained.
An authentication unit for acquiring information on the access control based on the ID. 11. The network device according to claim 10, wherein the authentication unit transmits the ID to an external authentication server, and receives information related to access control transmitted from the authentication server. apparatus. 12. An authentication server for transmitting information related to access control to the network device according to claim 11, wherein the authentication server receives the ID transmitted from the network device and transmits information related to access control corresponding to the ID. Authentication, comprising: authentication communication means for reading from the database means and transmitting the read information on access control to the network device; and the database means for storing information on access control corresponding to the received ID. server.