JP2004104355A - Method and apparatus for managing network address and network address management system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To appropriately assign an address to each user and to achieve the appropriate management of the address. <P>SOLUTION: In a network address management system having a router 20 connected between a DHCP client 30 and a DHCP server 10, when the number of entries in a user address management table 25 exceeds the number of distribution IP addresses for each sub I/F, a registered old distribution IP address is deleted, an IP address in a response message is newly registered, access to a backbone network using the deleted IP address is refused even at an IP transmission source address filter section 23, and illegal access is prevented. <P>COPYRIGHT: (C)2004,JPO

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention provides a network address management method in which an ISP (Internet Service Provider) distributes and collects a network (for example, Internet Protocol: hereinafter, referred to as "IP") address for each user using a DHCP (Dynamic Host Configuration Protocol). The present invention relates to the management device and the network address management system.
[0002]
[Prior art]
The conventional network address management system is designed to enable a DHCP client, such as a user's PC (Personal Computer), to receive various Internet services from an ISP using a specific IP address. It is a system that distributes IP addresses, collects them, and manages the distributed addresses. As shown in the configuration diagram of FIG. 12, the network address management system comprises a DHCP server 10 provided in the backbone network of an ISP and a DHCP client 30 of each user, a router having a DHCP relay agent unit 21 inside. 20. The router 20 is configured by, for example, a PE (Provider Edge) router.
[0003]
In this network address management system, when the DHCP client 30 is activated, as shown in (1) of FIG. 12, a message of a request (BOOT REQUEST) for acquiring an IP address is transmitted to the router 20, and The DHCP relay agent unit 21 in the router 20 transfers the request message from the DHCP client 30 to the DHCP server 10 by the relay agent function of the router 20 as shown in (2) in FIG.
[0004]
When receiving the request message from the router 20, the DHCP server 10 creates a reply (BOOTREPLY) message including the IP address corresponding to the client, and transmits the reply message to the router 20. Upon receiving the reply message from the router 20, the DHCP relay agent unit 21 of the router 20 transmits the reply message from the router 20 to the DHCP client 30 by the relay agent function as shown in (3) of FIG. Had been transferred to.
[0005]
[Problems to be solved by the invention]
However, in the above conventional example, each time a request message for acquiring a network address is input from a DHCP client, the DHCP server allocates an IP address and returns the IP address. For example, there is a problem in that it is not possible to perform appropriate address distribution such as allocating one or several specified IP addresses to one user and proper management of IP addresses.
[0006]
SUMMARY OF THE INVENTION The present invention has been made in view of the above-described problems, and provides a network address management method, a management apparatus, and a network address management system that appropriately allocate addresses to respective users and enable appropriate management of the addresses. The purpose is to provide.
[0007]
[Means for Solving the Problems]
To achieve the above object, in the network address management method according to the first aspect, a request message for requesting distribution of a network address from a client is transmitted to an address distribution server in a backbone network via a relay device. Receiving a response message responding to the predetermined network address based on the distribution request from the address distribution server and managing the network address, wherein the physical port number of the relay device that has received the request message A registration step for registering an entry in an address management table on the basis of the VLAN number of the virtual network set for the physical port, and the address management based on the content of a response message from the address distribution server. The corresponding entry by searching the table, characterized in that it comprises a first setting step of registering setting the network address of the response message.
[0008]
According to the first aspect of the present invention, when a request message from a client is received, the physical port number of the relay device that has received the request message and the VLAN number set for this physical port are entered in the address management table. Then, the network address is registered and set in the corresponding entry of the address management table based on the contents of the response message from the address distribution server, thereby facilitating proper management of the network address.
[0009]
Further, in the network address management method according to claim 2, in the above invention, in the registration step, the received physical port number of the relay device and the VALN number set in the physical port are entered in the address management table. It is determined whether or not the physical port number and the VLAN number are registered in the address management table when the entry is not made.
[0010]
According to the second aspect of the present invention, when a new address is entered in the address management table, it is first determined whether or not the physical port number and the VALN number of the relay device that has received the request message are already entered. Only when it is not performed, the physical port number and the VALN number are registered in the address management table, and a network address is appropriately allocated to each user.
[0011]
Further, in the network address management method according to claim 3, in the above-mentioned invention, in the network address management method, an address number setting step of setting the number of network addresses to be distributed for each sub-interface in advance; On the other hand, a comparing step of comparing whether the number of entries of the corresponding address management table exceeds the number of network addresses set in the corresponding sub-interface, and the number of entries exceeds the set number of network addresses. And the first deletion step of deleting the entry of the oldest network address from the entries.
[0012]
According to the third aspect of the present invention, when the number of corresponding entries in the address management table exceeds the number of network addresses preset for each user in response to the request message, the corresponding entry in the address management table is used. Out of the oldest network addresses, add and delete entries in the address management table so that the number of entries is always equal to or less than the number of network addresses, so that an appropriate number of addresses can be set in advance. Is assigned to each user.
[0013]
In the network address management method according to a fourth aspect of the present invention, in the network address management method, a network address in the response message is registered and set in a source address filter means provided in the relay device. The method further includes a setting step of 2, wherein the transmission source address filtering means determines whether to permit the client to access the backbone network based on the registered and set network address.
[0014]
According to the fourth aspect of the present invention, the network address of each user is also registered and set in the source address filter means, and when the client accesses the backbone network, the source address filter means uses this network address. By judging whether to grant access based on the address, an address filtering function is realized.
[0015]
Further, in the network address management method according to claim 5, in the above-mentioned invention, in the network address management method, when the number of entries exceeds the set number of network addresses, the oldest of the entries is provided. A deletion requesting step of outputting a deletion request for deleting the registration of the network address, and a second deletion step of deleting the network address requested to be deleted from the network addresses registered and set in the source address filter means. Is further included.
[0016]
According to the fifth aspect of the present invention, when the number of corresponding entries in the address management table exceeds the number of network addresses set in advance for each user with respect to the request message, the source address filter means By deleting the oldest registered network address, add and delete the addresses registered in the source address filter means so that the number of registered addresses is always less than the set number of network addresses, Based on the appropriate network address set in this way, it can be determined whether to grant access.
[0017]
Further, in the network address management device according to claim 6, a request message provided in a relay device connected between a client and an address distribution server in a backbone network, for requesting distribution of a network address from the client. To the address distribution server, and receives a response message that responds to a predetermined network address based on the distribution request from the address distribution server, and manages the network address. The physical port number of the relay device that has received the request message, the VLAN number of the virtual network set for the physical port, and the network address in the response message from the address distribution server are entered. Receiving the request message, entering the physical port number and the VLAN number set for the physical port in the address management table, receiving the response message, A registration control unit that searches the address management table based on an address in the response message, and causes a network address in the response message to be entered in a corresponding entry of the address management table.
[0018]
According to this invention, the registration control means causes the physical port number of the relay device that has received the request message and the VLAN number set for this physical port to be entered in the address management table, and the entry is added. When a response message is received, the network address in the response message is registered in a corresponding entry of the address management table, thereby facilitating proper management of the network address.
[0019]
Further, in the network address management device according to claim 7, in the above-mentioned invention, the registration control unit may be configured so that the physical port number and the VALN number in the received request message are not entered in the address management table. Preferably, the physical port and the VLAN number are registered in the address management table.
[0020]
According to the invention of claim 7, in response to the network address distribution request, the registration control means is provided only when the physical port number and the VALN number of the relay device which has received the request message are not entered in the address management table. Makes the physical port number and the VALN number entry-registered in the address management table, and allocates a network address to each user appropriately.
[0021]
Further, in the network address management device according to claim 8, in the above invention, the network address management device includes: an address number setting table for registering the number of network addresses set for each sub-interface; And comparing means for comparing the number of network addresses of the corresponding sub-interface registered in the number-of-addresses setting table with the number of corresponding entries in the address management table, wherein the registration control means responds to the comparison result. , The entry of the oldest network address among the entries is deleted.
[0022]
According to the invention of claim 8, the comparison means compares the number of network addresses set for the corresponding user registered in the address number setting table with the number of corresponding entries registered in the address management table, If the number of entries exceeds the number of network addresses as a result of the comparison, the entry of the corresponding oldest network address is deleted by the registration control means, and the address management is performed so that the number of entries is always equal to or less than the number of network addresses. By deleting entries in the table, network addresses of an appropriate number set in advance are assigned to each user.
[0023]
In the network address management device according to the ninth aspect, in the above invention, the registration control means may be configured such that the number of corresponding entries registered in the address management table exceeds the set number of network addresses of the corresponding sub-interface. In this case, the oldest entry registered in the address management table is deleted, and the network address in the received response message is entered in the address management table.
[0024]
According to the ninth aspect of the invention, when the number of entries exceeds the number of network addresses, the entry of the corresponding oldest network address is deleted by the registration control means, and the new network address in the received response message is deleted. Is added to and deleted from the address management table so that the number of entries is always equal to or less than the number of network addresses. Assign to each user.
[0025]
Further, in the network address management device according to claim 10, in the above invention, the network address management device registers a network address for each sub-interface input from the registration control means, and transmits the input response message to the client. And a source address filter unit that determines permission of access to the backbone network from the client based on the registered network address.
[0026]
According to the tenth aspect of the present invention, the registration control means causes the source address filter means to register a network address for each user, and the source address filter means sends a response message including the network address to the client. An address filtering function is realized by determining whether or not to give an access permission based on the registered network address for transmission and access to the backbone network from a client.
[0027]
Further, in the network address management device according to claim 11, in the above invention, when the number of entries exceeds the set number of network addresses, the registration control means sets the oldest network address among the entries. A deletion request for deleting the registration is output, and the transmission source address filter unit deletes the corresponding network address from the registered and set network addresses based on the deletion request.
[0028]
According to the eleventh aspect of the present invention, when the number of corresponding entries in the address management table exceeds the number of network addresses set in advance for each user in response to a network address distribution request, the registration control means The source address filter means deletes the corresponding network address from the registered network addresses in response to the deletion request from, so that the registered address number of the source address filter means is always the set number of network addresses. As described below, it is possible to add or delete addresses registered in the source address filter means, and determine whether to grant access based on the appropriate network address set in this manner.
[0029]
13. The network address management system according to claim 12, wherein at least a plurality of clients, an address distribution server in a backbone network, and a relay device connected between the client and the address distribution server for relaying a packet. Wherein the relay device includes the network address management device according to any one of claims 6 to 11, wherein the network address management device requests distribution of a network address from the client. To the client, and to the client, a response message that replies a predetermined network address from the address distribution server to the client. Characterized in that it manages the birds.
[0030]
According to the twelfth aspect of the present invention, by connecting the relay device having the network address management device according to any one of the sixth to eleventh aspects between the client and the address distribution server, each client Network addresses can be distributed with a preset number of addresses for each user, and the network address for each user can be accurately determined based on the contents entered in the address management table and the address number setting table of the network address management device. to manage.
[0031]
BEST MODE FOR CARRYING OUT THE INVENTION
Hereinafter, preferred embodiments of a network address management method, a management device thereof, and a network address management system according to the present invention will be described with reference to the accompanying drawings of FIGS. In the following drawings, the same components as those in FIG. 12 are denoted by the same reference numerals for convenience of explanation.
[0032]
(Embodiment 1)
FIG. 1 is a configuration diagram showing a message flow according to the first embodiment of the network address management system of the present invention. 1 differs from the system of the conventional example shown in FIG. 12 in that an IP source address provided in a transmission / reception unit 22 for transmitting / receiving a BOOTP / DHCP message to / from a client 30 in a router 20 as a relay device. It has a filter unit 23, a per-user IP address management unit 24, and a user address management table 25.
[0033]
As shown in FIG. 2, the BOOTP / DHCP message is composed of op, htype, hlen, hops, xid, secs, flags, ciaddr, yadddr, siaddr, giaddr, chaddr, name, file, and options fields. Of the fields of this message, the fields of op, ciaddr, giaddr, chaddr, and options are particularly relevant in this embodiment.
[0034]
In these fields, the op field indicates whether the type of the message is BOOTREQUEST or BOOTREPLY. The ciaddr field indicates the IP address of the client. The siaddr field indicates the IP address of the DHCP server 10. The giaddr field indicates the IP address of the DHCP relay agent unit 21. The chaddr field indicates a hardware address of the DHCP client 30. For example, in the case of a LAN defined by IEEE 802.3, the chadr field includes a MAC address. The options field is a field for setting operation parameters, and the options field includes a field indicating whether the created message is DHCPACK or DHCPRELEASE.
[0035]
The DHCP relay agent unit 21 supports a relay agent function for relaying BOOTP and DHCP based on RFC2131, and checks a received message, changes a message accompanying the relay, and notifies and transmits a message content to a related device. The interface (hereinafter referred to as “transmission I / F”) is checked.
[0036]
That is, in checking the received message, the DHCP relay agent unit 21 checks whether the op field of the received BOOTP / DHCP message is BOOTREQUEST or BOOTREPLY, and the “dhcp hop- limit is checked, and if the received message is BOOTREPLY, it is checked that the giaddr field matches one of the interface addresses of the router. If the received message does not meet the above conditions, the message is recorded in a log and the message is discarded.
[0037]
Further, in the change of the message accompanying the relay, the DHCP relay agent unit 21 changes the content of the message when the op field in the received message is BOOTREQUEST or BOOTREPLY.
[0038]
When the DHCP relay agent unit 21 receives the BOOT REQUEST message, the DHCP relay agent unit 21 manages the physical port number, the VLAN number, and the address information of the chaddr in the message when receiving the BOOT REQUEST message for IP address management for each user. It functions to notify the unit 24. Also, when the DHCP relay agent unit 21 receives the BOOTREPLY message, the DHCP relay agent unit 21 functions to notify the IP address management unit 24 of each user of the address information of ciaddr, chaaddr, and siaddr in the message.
[0039]
Further, in checking the transmission I / F, when the IP destination address of the received BOOTREQUEST message is a broadcast, and when relaying to a broadcast, the relay agent unit 21 transmits the message from the interface that received the message. It is functioning not to send.
[0040]
For example, based on a request for adding or deleting a distribution IP address for each user from the per-user IP address management unit 24, the IP source address filter unit 23 sends an ip address range (pmd) to the pmd (eg, the engine of the filter unit). The registration setting of addition or deletion of the IP address to the ARP filter is performed. When the client accesses the ISP's backbone network or the ISP accesses the client, the IP source address filter unit 23 determines whether to permit or deny access based on the registered IP address. Is making a judgment.
[0041]
The per-user IP address management unit 24 determines the type of the received message, searches the user address management table 25 from the result of the determination, and performs data processing such as creation, update, or deletion of an entry in the management table 25. Is going. As shown in FIG. 3, the user address management table 25 has a physical port number, a VLAN number, a ciaddr, a chaddr, an unresolved flag, and an entry valid flag that have received the message. That is, the per-user IP address management unit 24 performs data processing, which will be described later, when receiving a BOOTREQUEST (DHCPREQUEST), a BOOTREPLY (DHCPACK), and a BOOTREQUEST (DHCPRELEASE) message. I have.
[0042]
As shown in FIG. 4, the per-user IP address management unit 24 has an address number setting table for setting the number of IP addresses to be distributed to each user. The address number setting table includes a setting range indicating the number of distributable IP addresses, a default value indicating the number of distributable IP addresses currently set between the ISP and the user, command information, and the like. Has been entered. In the address number setting table shown in this embodiment, a default value is set so that one IP address is assigned to a user connected to one interface (see FIG. 4). In this case, the IP address can be assigned to up to 16 users connected to one interface by storing the IP address.
[0043]
Next, the operation of the network address management system at the time of transmitting and receiving each message described above will be described with reference to FIGS. First, an operation for a BOOTREQUEST (DHCPREQUEST) message from the DHCP client 30 will be described.
[0044]
First, when the DHCP client 30 is activated, a BOOT REQUEST message for acquiring an IP address is transmitted to the router 20 as shown in (1) in FIG. In the router 20, the transmitting / receiving unit 22 receives the BOOT REQUEST message and outputs the received message to the DHCP relay agent unit 21. When the DHCP relay agent unit 21 receives the message, the DHCP relay agent unit 21 transmits the message to the DHCP server 10. For this purpose, the BOOT REQUEST message is processed by the DHCP relay agent function.
[0045]
That is, the DHCP relay agent unit 21 determines whether the message to be relayed is a BOOT REQUEST message. If the message is a BOOT REQUEST message, the DHCP relay agent unit 21 transmits this message to the DHCP server as shown in (2) in FIG. 10 as well as the received physical port and VLAN information of the transmitting / receiving unit 22 and the client hardware address information in the chadr field in this message, as shown in (3) of FIG. Notifying the unit 24.
[0046]
FIG. 5 is a flowchart showing the data processing operation of the IP address management unit 24 for each user when the message is BOOTREQUEST (DHCPREQUEST). The physical port and VLAN number notified of the BOOTREQUEST (DHCPLELEASE) are searched from the user address management table 25. Then, it is determined whether or not there is a matching entry in the user address management table 25 (step 102).
[0047]
Here, if there is a matching entry in the user address management table 25, it is determined that the entry has already been made, the timeout value of the entry is updated, and the process is terminated (step 103). If there is no matching entry, the number of entries in which the physical port matches the VLAN number is counted in the user address management table 25, and the sub-I / F set in advance in the address number setting table is counted. The number of distribution IP addresses is compared with the number of distribution IP addresses for each (tag I / F allocated to each user) (step 104). In the above state, it is determined whether the system is used (step 105).
[0048]
Here, if the number of entries is equal to or greater than the number of distribution IP addresses for each sub I / F, the oldest entry is deleted from the entries whose physical port and VLAN number match (step 106), and the number of entries is reduced. If the number of distribution IP addresses is less than the number of distribution IP addresses for each sub I / F, a new entry is created in the user address management table 25. Then, the per-user IP address management unit 24 stores the notified physical port, VLAN number, and chadr address in the user address management table 25, and indicates that the information in the user address management table 25 is in an unresolved state. An unsolved state flag is set (step 107).
[0049]
That is, as shown in the entry state of the user address management table 25 in FIG. 3, the per-user IP address management unit 24 causes the notified physical port and VLAN information to be entered in the user address management table 25, and the ciaddr and the chaddr. Field is in an unentry state, and an unresolved flag and an entry valid flag are set to an on state. Note that the user-specific IP address management unit 24 recognizes the hardware address of the client of the chaddr, but at this time, does not enter the chaddr field in the user address management table 25 but other information that has been entered. Recognize only the correspondence with.
[0050]
As described above, when the router 20 receives the BOOTREQUEST (DHCPREQUEST) message, the router 20 transmits the message to the DHCP server 10 by the relay agent function, and the user-specific IP address management unit 24 reduces the number of entries to the sub-I / F ( Until the number of distribution IP addresses for each user) is reached, a new entry can be created in the user address management table 25.
[0051]
Upon receiving the BOOTREQUEST (DHCPREQUEST) message from the router 20, the DHCP server 10 creates a BOOTREPLY (DHCPACK) message including the IP address corresponding to the client, and stores this message in (5) in FIG. As shown, it is transmitted to the router 20.
[0052]
When the DHCP relay agent unit 21 of the router 20 receives the BOOTREPLY (DHCP ACK) message from the router 20, the DHCP relay agent unit 21 converts the message by the relay agent function as shown in (6) of FIG. When the message is DHCPACK, as shown in (7) in FIG. 1, ciaddr (IP address of the client) and chaddr (hardware address of the client) in the message are provided for each user. Notify the IP address management unit 24.
[0053]
FIG. 6 is a flowchart showing the data processing operation of the per-user IP address management unit 24 when the message is BOOTREPLY (DHCPACK). The per-user IP address management unit 24 uses the notified chaddr address as a key to set the user address. The corresponding unresolved entry is searched from the management table 25 (step 201). That is, here, only the entry whose unsolved flag is on is searched. Then, it is determined whether or not an entry in an unsolved state exists in the user address management table 25 (step 202).
[0054]
If there is no corresponding entry, the notification is discarded and the data processing operation is terminated. If there is a corresponding entry, as shown in (8) in FIG. The address information of the ciaddr and the chaddr is stored in the corresponding entry 25 (step 203), the unresolved flag is turned off, and the corresponding entry is set in the resolved state (step 204), and the user address management table 25 is configured as shown in FIG. Make the state shown in the figure. Further, the per-user IP address management unit 24 makes an entry addition request to the IP transmission source address filter unit 23 as shown in (9) in FIG. 205).
[0055]
The IP source address filter unit 23 performs additional setting of a distribution IP address for each sub I / F (user) based on the addition request of the entry, so that data communication can be performed by each user from the IP address. To
[0056]
Next, the per-user IP address management unit 24 searches for an entry having the same physical port and VLAN number as the physical port and VLAN number included in the entry in the solved state (step 206). Then, it is determined whether or not the number of searched entries exceeds the number of distribution IP addresses for each sub I / F (step 207).
[0057]
Here, if the number of entries does not exceed the number of distribution IP addresses, the above operation is terminated. If the number of entries exceeds the number of distribution IP addresses, among the entries matched by the search, The oldest entry is deleted (step 208). Further, a request for deleting the old entry is sent to the IP source address filter unit 23 (step 209), and a BOOT REQUEST (DHCPLELEASE) message is sent to the DHCP server 10 as shown at (10) in FIG. Is transmitted (step 210).
[0058]
Upon receiving this deletion request, the IP source address filter unit 23 deletes the oldest distribution IP address set for the sub I / F (user). Further, when the DHCP server 10 receives the BOOT REQUEST (DHCP RELEASE) message, the DHCP server 10 determines that the IP address stored in ciaddr of the message is no longer used, and enables the IP address to be reused. Set recovery.
[0059]
With this configuration, for example, even if a malicious client attempts to access the ISP's backbone network using an old IP address, the number of entries in the user address management table will be the same as the number of distribution IP addresses for each sub I / F. If it exceeds, the old distribution IP address is deleted, so the IP source address filter unit can deny access to the backbone network using the deleted IP address, and can prevent unauthorized access. , Can increase the reliability of the system.
[0060]
Therefore, in this embodiment, if the number of IP addresses exceeds the number of IP addresses for each sub-I / F when distributing IP addresses, the oldest entry among the entries matched by the search is deleted. Can be assigned within the range of the number of distribution IP addresses set in the above, so that an IP address can be appropriately assigned to each user.
[0061]
Further, in this embodiment, the user IP address management unit manages the distribution and collection of IP addresses for each user by using the user address management table and the address number setting table. Can be made possible.
[0062]
Furthermore, in this embodiment, the router is provided with an IP source address filter unit and a per-user IP address management unit to perform IP address management, so that the DHCP server does not change the existing configuration without changing it. It can be used as it is, and the manufacturing cost can be reduced, and the above-mentioned enormous effects can be obtained by changing the minimum components.
[0063]
(Embodiment 2)
FIG. 8 is a configuration diagram showing a message flow according to the second embodiment of the network address management system of the present invention. In the figure, the DHCP client 30 may transmit a BOOT REQUEST (DHCP RELEASE) message. In this case, the DHCP client 30 sends a BOOT REQUEST (DHCP RELEASE) message to the router 20 as shown in (1) in FIG. 8 in order to make a request to release the IP address previously distributed from the DHCP server 10. Sending.
[0064]
In the router 20, the transmitting / receiving unit 22 receives the BOOT REQUEST (DHCP RELEASE) message and outputs it to the DHCP relay agent unit 21. When the DHCP relay agent unit 21 receives the message, the DHCP server 10 The BOOT REQUEST message is processed by the DHCP relay agent function for relaying to the server.
[0065]
That is, when the message to be relayed is a BOOT REQUEST message, the DHCP relay agent unit 21 transfers the message to the DHCP server 10 as shown in (2) of FIG. The physical port and VLAN information and the information of the chadr in this message are notified to the per-user IP address management unit 24 as shown in (3) in FIG.
[0066]
FIG. 9 is a flowchart showing the data processing operation of the per-user IP address management unit 24 when the message is BOOTREQUEST (DHCPRELEASE). A corresponding entry is searched from the management table 25 (step 301), and it is determined whether there is a matching entry in the user address management table 25 (step 302).
[0067]
Here, if there is no matching entry in the user address management table 25, it is determined that there is no entry, and the above operation is terminated. If there is a matching entry in the user address management table 25, the matching entry is deleted as shown in (4) of FIG. 8 (step 303), and then ( As shown in 5), a request to delete the entry is made to the IP source address filter unit 23 (step 304).
[0068]
That is, assuming that the entry state of the user address management table 25 before the entry is deleted is as shown in FIG. 10, the per-user IP address management unit 24 determines the entry of the user address management table 25 after the entry deletion in FIG. As shown in the state, the corresponding entry of the receiving port number, the receiving VLAN number, the ciaddr, and the chaddr are deleted, and the unresolved flag is set to the off state and is removed.
[0069]
As described above, when the router 20 receives the BOOT REQUEST (DHCPLEASE) message, the router 20 transmits this message to the DHCP server 10 by the relay agent function, and the per-user IP address management unit 24 applies the message from the user address management table 25. The entry can be deleted.
[0070]
Further, when the DHCP server 10 receives the BOOT REQUEST (DHCP RELEASE) message, the DHCP server 10 determines that the IP address stored in ciaddr of this message is no longer used, and enables the IP address recovery setting.
[0071]
Therefore, in this embodiment, even when each user's DHCP client issues an IP address release request, the user IP address management unit deletes the corresponding entry in the user address management table. In addition to this, the IP address that is no longer used is notified to the DHCP server and the recovery setting of the IP address is performed, so that the IP address can be reused.
[0072]
The present invention is not limited to these embodiments, and various modifications can be made without departing from the spirit of the present invention.
[0073]
【The invention's effect】
As described above, in the present invention, at the time of a network address distribution request, the physical port number of the relay device that has received the request message by the registration control unit and the VLAN number of the virtual network set to this physical port are: Only when the entry is not entered in the address management table, the physical port number and the VLAN number are registered in the address management table, and the network address in the received response message is made to correspond to these entries. Since the entry is registered in the corresponding entry, it is possible to appropriately assign a network address to each user, and it is possible to appropriately manage the address.
[0074]
Also, in the present invention, the comparing means compares the number of network addresses set for the corresponding user registered in the address number setting table with the number of corresponding entries registered in the address management table, and determines the number of entries in the network. If the number of addresses exceeds the number, the entry of the corresponding oldest network address is deleted from the address management table by the registration control means, and the received new network address is registered in the address management table, so that the number of entries is always set. The number of network addresses is equal to or less than the set number of network addresses, and network addresses of an appropriate number set in advance can be appropriately allocated to each user.
[0075]
Further, in the present invention, the network address of each user is also registered in the source address filter means, the source address filter means transmits a response message including the network address to the client, and the number of entries is changed to the network address. If the number exceeds the number, the oldest network address is deleted from the network addresses registered in the source address filter means, so that the number of registered addresses in the source address filter means always becomes equal to or less than the set network address number. The access permission can be given based on the appropriate network address thus set.
[0076]
Further, in the present invention, in the network address management system, the relay device provided with any one of claims 6 to 11 is connected between the client and the address distribution server. Can be appropriately assigned, and appropriate management of this address can be enabled.
[Brief description of the drawings]
FIG. 1 is a configuration diagram showing a message flow according to a first embodiment of a network address management system of the present invention;
FIG. 2 is a diagram showing a format of a message transmitted and received in the system shown in FIG. 1;
3 is a configuration diagram showing an example of the configuration of the user address management table shown in FIG. 1, in which only a reception port number and a reception VLAN number are entered.
4 is a configuration diagram showing an example of a configuration of an address number setting table provided in a per-user IP address management unit shown in FIG. 1;
FIG. 5 is a flowchart showing a data processing operation of a per-user IP address management unit when a message is BOOTREQUEST (DHCPREQUEST).
FIG. 6 is a flowchart showing a data processing operation of the IP address management unit for each user when a message is BOOTREPLY (DHCPACK).
7 is a configuration diagram showing an example of a state in which an entry has been changed in the example of the configuration of the user address management table shown in FIG. 1;
FIG. 8 is a configuration diagram showing a message flow according to a second embodiment of the network address management system of the present invention.
FIG. 9 is a flowchart showing a data processing operation of the per-user IP address management unit 24 when a message is BOOTREQUEST (DHCPLEASE).
FIG. 10 is a configuration diagram illustrating an example of a configuration of a user address management table illustrated in FIG. 8 before an entry is deleted.
11 is a configuration diagram showing an example of the configuration of the user address management table shown in FIG. 8 after the entry is deleted.
FIG. 12 is a configuration diagram showing an example of a configuration of a conventional network address management system.
[Explanation of symbols]
10 DHCP server
20 router
21 DHCP relay agent
22 Transceiver
23 IP source address filter
24 IP address management unit for each user
25 User address management table
30 DHCP client

Claims (12)

A request message for requesting distribution of a network address from a client is transmitted to an address distribution server in the backbone network via a relay device, and a predetermined network address based on the distribution request from the address distribution server is returned. A network address management method for receiving a response message to
A registration step of performing entry registration of an address management table based on a physical port number of the relay device that has received the request message and a VLAN number of a virtual network set for the physical port;
A first setting step of searching the address management table based on the content of the response message from the address distribution server and registering and setting a network address in the response message in a corresponding entry;
A network address management method comprising: In the registering step, it is determined whether the received physical port number of the relay device and the VALN number set in the physical port are entered in the address management table. 2. The network address management method according to claim 1, wherein a number and a VLAN number are registered as entries in the address management table. In the network address management method, an address number setting step of setting the number of network addresses to be distributed for each sub-interface in advance;
For the request message of the network address, a comparing step of comparing whether the number of entries of the corresponding address management table exceeds the number of network addresses set in the corresponding sub-interface,
When the number of entries exceeds the set number of network addresses, a first deletion step of deleting the entry of the oldest network address among the entries;
3. The network address management method according to claim 1, further comprising: The network address management method further includes a second setting step of registering and setting a network address in the response message in a source address filter unit provided in the relay device,
The method according to claim 1, wherein the source address filter unit determines whether to permit the client to access a backbone network based on the registered network address. Network address management method described. In the network address management method, when the number of entries exceeds the set number of network addresses, a deletion requesting step of outputting a deletion request for deleting the registration of the oldest network address among the entries,
A second deletion step of deleting the network address requested to be deleted from the network addresses registered and set in the source address filter means;
The network address management method according to claim 4, further comprising: A request message for requesting distribution of a network address from the client is provided to the relay server connected between the client and the address distribution server in the backbone network. A network address management device that receives a response message responding to a predetermined network address based on the distribution request from the distribution server and manages the network address.
An address management table in which at least a physical port number of the relay device that has received the request message, a VLAN number of a virtual network set for the physical port, and a network address in a response message from the address distribution server are entered. When,
Upon receiving the request message, the physical port number and the VLAN number set for the physical port are entered in the address management table, and the response message is received, based on the address in the response message. Registration control means for searching the address management table and causing a corresponding entry of the address management table to enter a network address in the response message;
A network address management device comprising: The registration control means, when the physical port number and the VALN number in the received request message are not entered in the address management table, registers the physical port and the VLAN number in the address management table. 7. The network address management device according to claim 6, wherein: The network address management device, an address number setting table for registering the number of network addresses set for each sub-interface,
For receiving the request message, comparing means for comparing the number of network addresses of the corresponding sub-interface registered in the address number setting table with the number of corresponding entries of the address management table,
Further comprising
The network address management device according to claim 6, wherein the registration control unit deletes an entry of an oldest network address among the entries according to the comparison result. The registration control means, when the number of corresponding entries registered in the address management table exceeds the set number of network addresses of the corresponding sub-interface, the oldest entry registered in the address management table. The network address management device according to claim 8, wherein the network address in the received response message is deleted and the network address is entered in the address management table. The network address management device further includes a source address filter unit for registering a network address for each sub-interface input from the registration control unit, and transmitting the input response message to the client,
The network according to any one of claims 6 to 9, wherein the transmission source address filter unit determines permission of access from the client to the backbone network based on the registered network address. Address management device. When the number of entries exceeds the set number of network addresses, the registration control unit outputs a deletion request for deleting the oldest network address registration among the entries,
11. The network address management device according to claim 10, wherein the source address filter unit deletes the corresponding network address from the registered network addresses based on the deletion request. In a network address management system comprising at least a plurality of clients, an address distribution server in a backbone network, and a relay device connected between the client and the address distribution server and relaying a packet,
The relay device includes the network address management device according to any one of claims 6 to 11,
The network address management device transmits a request message for requesting distribution of a network address from the client to the address distribution server, and transmits a response message responding to a predetermined network address from the address distribution server. A network address management system which transmits to a client and manages the network address by entry.

Images