JP2004193988A - Centralized control system and method of network connecting means - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a centralized control system and method of network connecting means for realizing centralized control on a plurality of rooters. <P>SOLUTION: When a power supply is turned on, a router (205) is connected automatically to an initial server (202). The connected initial server obtains connection data of a user server (204), which takes charge of the connected router, from a data base (201) by using an identifier and returns it to the router. When the router is connected to the user server by using the received connection data, the user server obtains configuration data from a data base (203), and transmits it to the router. In this way automatic environment setting is completed. <P>COPYRIGHT: (C)2004,JPO&NCIPI

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates generally to a management system for a communication network including a router, and more particularly, to a system that enables centralized initialization, setting change, and management operation of a plurality of routers included in the communication network.
[0002]
Problems to be solved by the prior art and the invention
2. Description of the Related Art A router has been widely used as a connection device between networks. For example, when a router is used for connection between a LAN and the Internet, Ethernet (registered trademark) on the LAN side and a telephone line or a dedicated line on the Internet side are connected to terminals provided on the router. However, in order for the router to operate, simply connecting a cable to an appropriate terminal and turning on the power is not enough, and an environment setting (configuration) is required. That is, in the router, an initial setting suitable for an individual connection mode must be performed, the setting must be changed as necessary, and the operation must be performed while monitoring the operation state. This requires a lot of cost and time, since it requires individual work taking into account the individual situation of each router. For example, specifically, in order to set up a router, the conventional method is to log in to each target router using Telnet and send a necessary configuration file. Was. However, in such a conventional method, a technician having specialized knowledge has to perform individual work for each of a plurality of target routers.
[0003]
The conventional management model is schematically shown in FIG. That is, although four routers are shown in FIG. 1, in order to perform initial setting, setting change, and monitoring operation of these four routers, a specialist engineer performs all the steps at each stage. It was necessary to access the router individually and perform the necessary work. Not surprisingly, individual setup tasks require a lot of human resources and are inefficient.
[0004]
[Means for Solving the Problems]
On the other hand, in the centralized router management system realized by the present invention, the above-described problems in the related art are solved, and it becomes easier to manage a large number of routers much more efficiently than in the past. Further, in the centralized router management system according to the present invention, the router can operate irrespective of the type of the communication line connected.
[0005]
In order to achieve the above object, the centralized router management system according to the present invention performs automatic environment setting (auto configuration), firmware update and setting change, and management including operation monitoring for all routers. , Regardless of whether it is an Internet line or a WAN line.
[0006]
According to the present invention, there is provided a system for centrally managing a plurality of network connection means, wherein the first and second management means are connectable to the plurality of network connection means via a network, and are connected to the first management means. A first database storing correspondences between identifiers of the plurality of network connection means and a second management means in charge of management, and a plurality of network connections connected to the second management means. A second database in which the configuration data of the means is stored in a searchable manner using the identifier of the respective network connection means.
[0007]
Here, a typical example of the network connection means is a router that connects and routes an intra-company LAN having a large number of business bases that are geographically dispersed and the Internet or WAN, and performs routing. I have. However, the subject of centralized management according to the present invention does not need to be limited to a router in the sense of a routing device. Any hardware, firmware, software, or combination thereof that is connected to a network and whose configuration can be changed can be centrally managed using the system according to the present invention. For example, as completely different examples from a router, a personal computer such as a Windows (registered trademark) terminal or a Macintosh (registered trademark) terminal connected to a network, and a workstation such as a UNIX (registered trademark) terminal are also used as network terminals. It is a network connection means in the present invention in that it functions and requires some setting. However, in the following, for simplicity of description, the present invention will be described using only the case of a router as one embodiment.
[0008]
Further, the first and second management means are, for example, servers each having a function or a component described later. As for the database, it is assumed that each of the first and second management means has its own database. However, if security is taken into consideration, the first and second databases are integrated. It can also be realized as a single database.
[0009]
In the centralized router management system according to the present invention, (A) the plurality of routers each have (A1) first storage means storing first connection data necessary for connection to the first management means. (A2) means for automatically connecting to the first management means using the stored first connection data when the power is turned on, and providing an identifier of the router; When the second connection data required for connection to the second management means is received from the first management means, connection is made to the second management means using the received second connection data, and the identifier of the router is provided. Means to perform. (B) The first management means includes (B1) means for receiving identifiers from a plurality of routers, and (B2) connection to the second management means for managing a router identified using the received identifiers. (B3) means for transmitting the obtained second connection data to the router which has transmitted the identifier. (C) The second management means acquires (C1) means for receiving identifiers from a plurality of routers, and (C2) acquires configuration data of the router identified by using the received identifiers from the second database. Means for transmitting the identifier to the router which has transmitted the identifier. With the above configuration, centralized management of a plurality of routers is realized.
[0010]
Further, in the system according to the present invention, each of the plurality of routers first sends (A4) second connection data necessary for connection to the second management unit in charge of the management of the router from the first management unit. A second storage unit configured to store the received second connection data upon reception, whereby the plurality of routers are stored after the configuration data is transmitted from the second management unit. When the power is once turned off and then turned on again because at least one of the routers does not operate normally, the router that did not operate normally transmits a second command to the second management unit that is in charge of the management of the router. There is no need to obtain connection data again from the first management unit, and the second connection data stored in the second storage unit can be used.
[0011]
Still further, the system according to the present invention further comprises: (D) user interface means for updating the configuration data of the plurality of routers stored in the second database; and (E) stored in the second database. Transmitting the updated configuration data of the plurality of routers to the plurality of routers in a push-type manner even when there is no access from the plurality of routers. . Using this user interface, end users can update configuration data such as firmware. The configuration data can be updated at predetermined time intervals, for example, every month.
[0012]
The system according to the present invention further comprises means for monitoring the operating status of the plurality of routers and notifying the detected abnormal status to the user interface means when an error is detected, thereby alerting the end user. It is also possible to configure so as to give
[0013]
In the above, the present invention has been outlined as a system, but the present invention can also be seen as a centralized management method of a router. Further, it can be understood as a storage medium storing a computer program for realizing such a method, and further, as a computer program itself.
[0014]
BEST MODE FOR CARRYING OUT THE INVENTION
FIG. 2 shows basic components of a centralized router management system 200 according to one embodiment of the present invention. A plurality of routers 205 that are to be centrally managed by the system 200 respectively connect a network 206 such as the Internet to a LAN, and perform routing of data sent from the network 206 to the LAN. The LAN is, for example, a local network connecting a number of network terminals inside one company or public organization.
[0015]
In the system 200, two types of servers having different functions of an initial server 202 and a user server 203 are provided. The initial server 202 has an initial database 201, and the user server 203 has a user database 203. It is to be noted that the initial server 202 is physically constituted by one or a plurality of servers, and generally, only one is constructed and provided so as to control the entire system 200 functionally. On the other hand, the user server 203 is physically composed of one or a plurality of servers, and is functionally constructed and exists in the system 200 for each end user such as a company or a public institution. It is common. For example, a user server 203A is provided for the end user A, a user server 203B is provided for the end user B, and so on. The same applies to the user database, and it is practical and preferable to provide the database for each end user. Then, the end user can rewrite the data stored in the user database 203 using the user interface 207 provided for each user server 204. The user interface 207 can be in a form common to the entire system 200 or in a form customized for each end user. The customization here is performed in a form in which an end user uses a prepared application program interface (API) in combination for each purpose. An end user who wants to update data stored in the user database 203 accesses the user interface 207 to perform the update, and the updated content is written to the user database 203.
[0016]
In the following, it is assumed that one router 205 starts to be newly used as a device for connecting the LAN and the network 206. At the time of shipment from the factory, only the connection data to the initial server 202 is written in the storage device inside the router 205 in addition to general security-related data such as encryption and mutual authentication. The type of encryption used is irrelevant to the present invention. For example, if a general public key encryption is used, at least the secret key is embedded at the time of shipment. Further, all routers used in the system 200 are assigned in advance an identifier (ID) that enables unique identification, such as a serial number. The initial database 201 connected to the initial server 202 stores the identifier data of all the routers 205 used in the system 200. With such a configuration, in communication between the router 205 and the initial server 202, for example, encryption using SSL or SSH and mutual authentication using an appropriate electronic signature or the like are performed.
[0017]
The router 205 to be used is set to automatically access the initial server 202 when an appropriate cable is connected to a terminal and the power is turned on. Upon receiving the access from the router 205, the initial server 202 confirms that the access is not an unauthorized access, recognizes the accessing router 205 using the identifier, and manages the user server 203 in charge of the management. The connection data (e.g., URL) to the server is acquired from the initial database 201 and returned to the router 205. For example, as described above, the initial server 202 functions as a so-called operation inducing agency for the router 205 that has accessed it.
[0018]
Upon receiving the connection data of the corresponding user server 204 from the initial server 202, the router 205 accesses the user server 204 this time. In response to the access from the router 205, the user server 204 identifies the router 205 by using the identifier, and transmits from the user database 203 the configuration data necessary for the router 205 to actually operate as a router. Acquired and transmitted to the server 205. Upon receiving the configuration data, the router 205 completes the initial setting and starts operating. By using such an initial setting procedure according to the present invention, the initial setting by directly logging in to the router 205 at the start of operation, which is performed in the prior art, is completely unnecessary, and the router 205 simply connects the cable. As a result, all the initial settings are completed. As in the case of the communication with the initial server 202, the communication between the router 205 and the user server 204 is also performed by mutual authentication using, for example, SSL or SSH and an appropriate digital signature. Is made.
[0019]
If the above series of initial setting procedures fails for some reason, the power of the router 205 is turned off and then turned on again, and the router 205 starts to access the initial server 202 as described above. Repeat a series of steps. The configuration data once received from the user server 204 and failed to be set is not stored in the external storage device but exists only in the main memory of the router 205. The data will be erased, and new configuration data will be received from the user server 204 again to attempt initialization. At this time, the router 205 is provided with a non-volatile storage device for holding the connection data to the user server 204 once received, so that re-access to the initial server 202 can be omitted and the operation speed can be increased. It can also be configured so as to achieve the following.
[0020]
Similarly to the initial setting procedure described above, when the initial setting of the router 205 is completed and the operation is started, when the setting is to be changed or the firmware is to be updated, the above-described configuration according to the present invention is used. Can be. That is, the end user who intends to change the setting of the router 205 accesses the user interface 207 independent of the router, instead of performing the setting changing work individually for each router as in the related art. Update configuration data. The updated configuration data is written to the user database 203. As a result, the user database 203 always holds the latest configuration data. Then, the user server 204 reads the updated configuration data from the user database 203 at a time point determined by the end user, and transmits the updated configuration data to the router 205 in a push-type manner. In the communication between the user server 204 and the router 205, the communication between the router 205 and the initial server 202 and the user server 204 performs the above-described initial setting. For example, encryption using SSL or SSH and mutual authentication using an appropriate digital signature or the like are performed.
[0021]
In this case, there is no access to the user server 204 from the router 205 side, and thus no request is made, but the user server 204 side to the router 205 unilaterally updates the updated configuration.・ Data is sent. In this sense, this transmission is push-type, unlike pull-type initialization, in which configuration data is provided in response to a request from the router 205 to the user server 204. As described above, the setting change method in the system 200 does not require the time when the end user changes the setting in the user interface 207 and the time when the setting change actually occurs in the router 205 to be synchronized. The setting in is also possible.
[0022]
Such a change in the setting can be made at regular time intervals, for example, at 0:00 am on the first day of every month. For this purpose, as described above, the updated configuration data may be sent from the user server 204 in a push-type manner at regular time intervals. Alternatively, as already described in relation to the initial setting, the router 205 uses the fact that the previous setting is erased when the power is turned off, and updates the configuration data for the user interface 207. It is also possible to execute the update by writing in the user database 203 in advance via the PC and turning off the power at regular time intervals. Then, since the router 205 accesses the user server 204 again to obtain the configuration data, the router 205 can provide the updated configuration data in response thereto.
[0023]
In the system 200, the monitoring function of the router 205 can be realized by additionally using the third monitoring server 301 in addition to the initial server 202 and the user server 204 described above. The outline of the system 300 to which the monitoring server 301 is added is shown in FIG. The monitoring server 301 monitors whether the router is operating normally by transmitting a monitoring packet to the router 205 and checking a response thereto. The operation status of the router 205 is displayed on the user interface 207, and when an abnormality occurs, an alert is sent to the end user using various means including mail and fax. You. As described above, the operation status of the router 205 is displayed on the user interface used for setting change, so that the end user can also monitor the operation of the router 205 using the framework of the system 200.
[0024]
In FIG. 3, the user server 204 as the second server and the monitoring server 301 as the third server are distinguished from each other as separate servers. It is possible.
[0025]
Now that the components of the system 200 and the system 300 have been overviewed, the operation of the system 200 will be reconfirmed in time series with reference to FIG. . First, all that is required in the router 205 is to connect the terminals to the cable and turn on the power (step 401). Needless to point out, this is a work that can be done by anyone, unlike the prior art, where a specialized technician with considerable knowledge for initial setting of the router performed individual setting work. is there. When the power is turned on, the so-called white router 205, which has not been initialized yet, automatically accesses the initial server 202 (step 402). The accessed initial server 202 identifies the accessing router 205 by the identifier, acquires connection data to the user server 204 in charge of the router from the initial database 201, and transmits the data to the router 205. (Step 403).
[0026]
Next, the router 205 accesses the user server 204 in charge of management using the connection data to the user server 204 received from the initial server 202 (step 404). The accessed user server 204 identifies the accessing router 205 by the identifier, acquires configuration data necessary for the initial setting of the router from the user database 204, and transmits the configuration data to the router 205. (Step 405). The router 205 completes the initialization by receiving the configuration data, and starts operation (step 406). If the setting fails for some reason, the power of the router 205 may be turned off once (step 407), and then the processing may be repeated from the power on (step 401).
[0027]
Next, a procedure for changing the setting of the router 205 is shown in FIG. If a setting change is required, the end user makes necessary changes to the configuration data using the user interface 207, and the changed configuration data is written to the user database 203 (step 501). ). Then, at the time point determined by the end user, the user server 204 sends the changed configuration data to the router 205 in a push-type manner (step 502). However, in practice, it is sufficient to provide only the difference data between the existing configuration data and the updated configuration data. Thus, the setting of the router 205 is changed (Step 503). Even if the setting change by the above procedure fails for some reason, the power supply of the router 205 is once turned off (step 504) and then turned on again, whereby the same procedure at the time of the initial setting (FIG. 4) (Steps 401 to 404) are automatically performed, and the updated latest configuration data is provided to the router 205 (step 502), and as a result, the update is completed (503).
[0028]
FIG. 6 shows a procedure for monitoring the operation status of the router. The monitoring server 301 transmits a monitoring packet to the router 205 at a predetermined time interval (step 601), and checks a response from the router 205 (step 602), whereby the router 205 operates normally. Monitor if it is. The operation status of the router 205 is displayed on the user interface 207 (step 603). If an anomaly has occurred, an alert is sent to the end user (step 604).
[0029]
【The invention's effect】
As described above, by using the centralized router management system 200 according to the present invention, it is possible to perform initial setting, setting change, and monitoring operation of a large number of routers collectively, not individually. Specifically, by providing a protocol for realizing communication performed between the server and the router, an environment for constructing a unique centralized management system is provided.
[0030]
The use of the centralized router management system 200 makes it possible to reduce the costs required for installing and changing settings of thousands of base devices. The work to be performed at each site where the router is installed is only to insert the cable correctly and turn on the power, prepare an appropriate manual, adopt a style that prevents mistakes by LED sign and prompts retry instructions, "No manpower is used." According to a survey by the applicant, it is expected that initial costs such as setting costs and site adjustment costs per site can be reduced to about one tenth.
[0031]
In addition, the basic operation of push-type operation from the server side for initial setting, setting change, firmware update, and the like makes it possible to perform setting work on the user interface and setting update of the router itself asynchronously. . That is, in the related art, the work of installing and setting the router at the same time as the adjustment of the carrier line is performed. Occasionally, configuration data can flow from the server side to the router side. Even complicated tasks such as updating hardware can be performed collectively from the server side.
[0032]
The centralized router management system 200 enables management that takes into account the flow of notification and recovery when a problem is found in the network. For example, by renting a router used in the centralized router management system according to the present invention, it becomes possible to use a tool that can be operated and managed (ASP service). It is also possible to realize a service in which the user's contact information is registered in advance, and when a failure occurs, the service is automatically contacted using a mailing list or the like. The centralized router management system according to the present invention refers to a framework that provides an API, and is intended to complete a final system by interacting with a server customized for each user's purpose.
[Brief description of the drawings]
FIG. 1 is a diagram showing an outline of individual router management according to the related art.
FIG. 2 is a diagram showing basic components of a centralized router management system according to the present invention.
FIG. 3 is a diagram showing an outline when a monitoring server is added to the centralized router management system according to the present invention.
FIG. 4 is a diagram showing an outline of an initial setting procedure in the centralized router management system according to the present invention.
FIG. 5 is a diagram showing an outline of a procedure for changing settings in the centralized router management system according to the present invention.
FIG. 6 is a diagram showing an outline of a procedure for monitoring the operation of the router in the centralized router management system according to the present invention.

Claims (16)

A system for centrally managing a plurality of network connection means, comprising first and second management means connectable to a plurality of network connection means via a network, and said plurality of network connection means being connected to said first management means. A first database storing a correspondence between each identifier of the network connection means and a second management means in charge of management, and the plurality of network connection means connected to the second management means. A second database in which the configuration data is stored in a searchable manner using the identifier of each network connection means.
(A) Each of the plurality of network connection means includes:
First storage means for storing first connection data required for connection to the first management means;
Means for automatically connecting to the first management means using the stored first connection data when the power is turned on, and providing an identifier of the network connection means;
Upon receiving second connection data required for connection to the second management unit from the first management unit, the network unit connects to the second management unit using the received second connection data, and Means for providing an identifier of the connection means;
With
(B) The first management means includes:
Means for receiving an identifier from the plurality of network connection means;
Means for obtaining, from the first database, second connection data necessary for connection to the second management means which is in charge of management of the network connection means identified using the received identifier;
Means for transmitting the obtained second connection data to the network connection means having transmitted the identifier;
With
(C) The second management means includes:
Means for receiving an identifier from the plurality of network connection means;
Means for obtaining configuration data of the network connection means identified using the received identifier from the second database;
Means for transmitting the identifier to the network connection means that transmitted the identifier;
And a centralized management of the plurality of network connection units. 2. The system according to claim 1, further comprising means for performing mutual authentication at the time of communication between said plurality of network connection means and said first and second management means. In the system according to claim 1 or 2,
Each of the plurality of network connection units receives the second connection data required for connection to the second management unit in charge of management of the network connection unit once from the first management unit. It further comprises a second storage means for storing the second connection data,
When at least one of the plurality of network connection units does not operate normally after the configuration data is transmitted from the second management unit, the power supply is once turned off and then turned on again. The network connection means that did not operate normally does not need to obtain again the second connection data from the first management means to the second management means in charge of the management of the network connection means, A second connection data stored in the second storage means. The system according to any one of claims 1 to 3,
User interface means for updating configuration data of the plurality of network connection means stored in the second database;
The updated configuration data of the plurality of network connection means stored in the second database is stored in a push type at any time regardless of whether or not there is access from the plurality of network connection means. Means for transmitting to the plurality of network connection means in an aspect,
A system, further comprising: 5. The system according to claim 4, wherein the transmission of the updated latest configuration data in a push-type manner is performed at predetermined time intervals. In the system according to claim 4 or 5,
A system, further comprising: third management means for monitoring operation states of the plurality of network connection means and notifying the detected abnormal state when an abnormality is detected. 7. The system according to claim 1, wherein said network connection means is any device that can be connected to a network including a router and requires setting. First and second management means connectable to a plurality of network connection means via a network, and a first management means connected to the first management means and in charge of each identifier and management of the plurality of network connection means. A first database storing the correspondence relationship with the second management means, and the configuration data of the plurality of network connection means connected to the second management means and the identifiers of the respective network connection means. In a system comprising a second database stored in a searchable manner using the method, a method for centrally managing the plurality of network connection means,
(A) Each of the plurality of network connection units automatically connects to the first management unit using the first connection data stored in the first storage unit when the power is turned on. Providing an identifier of the network connection means;
(B) the first management means stores, in the first database, second connection data necessary for connection to the second management means in charge of management of the network connection means identified using the received identifier; And transmitting the identifier to the network connection means that has transmitted the identifier.
(C) connecting the network connection unit that has received the second connection data to the second management unit using the received second connection data, and providing an identifier of the network connection unit;
(D) receiving the identifier of the network connection unit, the second management unit acquires configuration data of the network connection unit identified using the received identifier from the second database, and transmits the identifier; Sending to the network connection means that has
And thus achieving centralized management of said plurality of network connection means. 9. The system according to claim 8, wherein mutual authentication is performed between each of said plurality of network connection means and said first and second management means in step (a) and step (c). The method further comprising the step of performing. The method according to claim 8 or claim 9, wherein
Each of the plurality of network connection units receives the second connection data required for connection to the second management unit in charge of management of the network connection unit once from the first management unit. A second storage unit for storing the second connection data;
When at least one of the plurality of network connection units does not operate normally after the configuration data is transmitted from the second management unit, the power supply is once turned off and then turned on again. The network connection means that did not operate normally does not need to obtain again the second connection data from the first management means to the second management means in charge of the management of the network connection means, 2. The method according to claim 1, wherein the second connection data stored in the second storage means can be used. The method according to any one of claims 8 to 10, wherein
Updating configuration data of the plurality of network connection means stored in the second database;
The updated configuration data of the plurality of network connection means stored in the second database is stored in a push type at any time regardless of whether or not there is access from the plurality of network connection means. Transmitting to the plurality of network connection means in an aspect;
A method further comprising: 12. The method of claim 11, wherein the transmission of the updated current configuration data in a push-type manner occurs at predetermined time intervals. A method according to claim 11 or claim 12, wherein
Monitoring the operation status of the plurality of network connection means;
Notifying the detected abnormal situation when an abnormality is detected;
A method further comprising: 14. The method according to any one of claims 8 to 13, wherein the network connection means is any device that can be connected to a network including a router and requires setting. A computer-readable storage medium storing a computer program comprising instructions for implementing each step in the method according to any one of claims 7 to 11. A computer program comprising instructions for implementing each step of the method according to any one of claims 7 to 11.

Images