JP2006013732A - Routing device and authentication method of information processor - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To reduce network traffic, and to increase speed for processing authentication. <P>SOLUTION: A routing device 3 comprises an authentication table in which logic and physical addresses are registered; a reception means for receiving data from a terminal unit 4; and an authentication means for determining whether the transmission source logic address and transmission source physical address of a transmission source terminal unit 4 exist or not in the authentication table, and for determining whether the destination logic address and destination physical address of a device to be set to a destination exist in the authentication table. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention relates to an authentication technique for an information processing apparatus connected to a network.

  Patent Document 1 discloses a terminal device authentication method in which a management server requests address information from a terminal device and a routing device to determine validity of the terminal device.

JP 2003-303174 A

  In the authentication method described in Patent Document 1, as a first step, the management server requests address information of the terminal device from the terminal device, and determines whether the requested address information is valid. Then, as a second stage, the management server requests the routing device connected to the terminal device for the address information of the routing device, and determines whether the requested address information is valid. As described above, in the authentication method disclosed in Patent Document 1, authentication processing is performed on one terminal device via a two-stage network between the management server and the terminal device and between the management server and the routing device. For this reason, as the number of terminal devices increases, the network traffic for authentication processing increases, causing a problem of squeezing the logical bandwidth speed of the network. Further, as the number of terminal devices increases, the management server performance (processing capability) problem arises.

  The present invention has been made in view of the above circumstances, and an object of the present invention is to provide an authentication technique that reduces network traffic and speeds up authentication processing of an information processing apparatus such as a terminal apparatus.

  In order to solve the above problems, in the present invention, the routing device authenticates the information processing device using the authentication table.

  For example, in the present invention, a first storage unit that stores an authentication table in which a logical address and a physical address of at least one information processing device are registered, a receiving unit that receives data from the information processing device, and the data are included in the data It is determined whether the transmission source logical address and the transmission source physical address of the transmission source information processing apparatus exist in the authentication table, and the destination logical address and the destination physical address of the destination information processing apparatus included in the data are stored in the authentication table. And authentication means for determining whether or not it exists. Then, when the transmission source logical address and the transmission source physical address do not exist in the authentication table, or when the destination logical address and the destination physical address do not exist in the authentication table, the authentication unit discards the data received by the reception unit. In addition, when the transmission source logical address and the transmission source physical address exist in the authentication table, or when the destination logical address and the destination physical address exist in the authentication table, the authentication unit sends the data received by the reception unit.

  According to the present invention, network traffic can be reduced and authentication processing of the information processing apparatus can be further speeded up.

  Hereinafter, embodiments of the present invention will be described.

  FIG. 1 is a schematic diagram of a terminal authentication system to which an embodiment of the present invention is applied. As illustrated, this system includes an information server 1, a management device 2, at least one routing device 3, and at least one terminal device 4. The information server 1 and the routing device 3 are connected by a backbone network 5 such as the Internet or a LAN. The management device 2 and the routing device 3 are connected by a management network 6 such as the Internet or a LAN. The routing device 3 and each terminal device 4 accommodated in the routing device 3 are connected by a terminal subnet 7.

  The information server 1 is an information processing device that provides various services (data, functions, etc.) to the terminal device 4 (client). The management device 2 is an information processing device that creates a management authentication table 23 (to be described later) and distributes it to each routing device 3. As illustrated, the management device 2 includes an update processing unit 21, a communication processing unit 22, and a management authentication table 23. The update processing unit 21 creates or updates the management authentication table 23. The communication processing unit 22 transmits / receives data to / from the routing device 3 via the management network 6.

  The routing device 3 is an information processing device that relays data flowing on a network to another network. Details of the routing device 3 will be described later. The terminal device 4 is a client of the information server 1 and is an information processing device that requests various services provided by the information server 1.

  In the terminal authentication system according to the present embodiment, one information server 1 is connected to the backbone network 5, but a plurality of information servers 1 may be provided. Further, the location where the information server 1 is installed may be in a company or organization that manages the information server 1 or may be another location. Further, as illustrated, the number of routing devices 3 and the number of terminal devices 4 connected to the routing device 3 are at least one, and the number is not limited. In the present embodiment, a backbone network 5 and a management network 6 are provided. However, the backbone network 5 and the management network 6 may be integrated. In this case, it is assumed that the information server 1 and the management apparatus 2 are connected to the same network.

  Next, the routing device 3 will be described.

  FIG. 2 shows the configuration of the routing device 3. As shown, the routing device 3 includes a routing processing unit 31, a physical address search unit 32, a transmission / reception authentication unit 33, a line control unit 34, a table management unit 35, a configuration definition table 36, a routing table 37, A physical address table 38 and a router authentication table 39.

  The routing processing unit 31 refers to the routing table 37 and performs transfer processing (path selection) in the network layer of the OSI reference model. The physical address search unit 32 searches the physical address of the data link layer with reference to the physical address table 38. The transmission / reception authentication unit 33 refers to the router authentication table 39 and performs authentication processing of the terminal device 4. The line control unit 34 transmits and receives a frame or packet (hereinafter referred to as “frame”) which is a data transmission unit. The table management unit 35 receives the authentication data distributed from the management device 2 and creates or updates the router authentication table 39.

  In the present embodiment, the routing processing unit 31, the physical address search unit 32, the transmission / reception authentication unit 33, the line control unit 34, and the table management unit 35 described above are realized by software. However, these processing units 31 to 35 may be realized by hardware.

  The configuration definition table 36 is a table for determining whether or not the port (line) of the routing device 3 that transmits and receives a frame is a port to be authenticated. Although not shown, the configuration definition table stores at least one port number to be authenticated. In the present embodiment, it is assumed that the port number of at least one port connected to the terminal subnet 7 is stored in the configuration definition table 36 in order to perform authentication processing of the terminal device 4.

  The routing table 37 is a table in which route information related to a frame transfer destination (relay destination) is stored. In other words, the routing table 37 has a destination logical address and a transfer destination logical address and a transfer destination port number associated with the destination logical address. The logical address is a network layer address, and in this embodiment, an IP (Internet Protocol) address is used as the logical address.

  The physical address table 38 is the next transfer destination device (for example, the routing device 3, terminal, etc.) based on the IP address (logical address) set in the network layer in the data link layer located in the lower layer of the network layer. It is a table for managing a physical address that is a physical destination of the device 4, the information server 1, and the like. The physical address is a data link layer address, and in this embodiment, a MAC (Media Access Control) address is used. The MAC address is a physical address of the device itself and an ID number unique to the network interface card. Although not shown, the physical address table 38 has an IP address (logical address) and a MAC address (physical address) corresponding to the IP address. The physical address search unit 32 acquires a MAC address corresponding to each IP address by ARP (Address Resolution Protocol) or the like, and stores the MAC address in the physical address table 38 for a certain period of time.

  The router authentication table 39 is a table in which the IP address and MAC address of a legitimate terminal device 4 that permits connection to the network are stored. That is, the terminal device 4 registered in the router authentication table 39 is determined to be a legitimate terminal device 4, and the terminal device 4 not registered in the router authentication table is determined to be an unauthorized terminal device. Is done. The router authentication table 39 will be described later.

  The information server 1, the management device 2, the routing device 3, and the terminal device 4 described above all include a CPU 901 as shown in FIG. 3, a memory 902 such as a RAM, and an external storage device 903 such as an HDD. A general-purpose computer including an input device 904 such as a keyboard and a mouse, an output device 905 such as a display and a printer, a communication control device 906 for connecting to a network, and a bus 907 for connecting these devices. The system can be used. In this computer system, the CPU 901 executes a predetermined program loaded on the memory 902, thereby realizing each function of each device.

  For example, each function of the information server 1, the management device 2, the routing device 3, and the terminal device 4 is managed by the CPU 901 of the information server 1 in the case of a program for the information server 1 and in the case of a program for the management device 2. When the CPU 901 of the device 2 is a program for the routing device 3, the CPU 901 of the routing device 3 executes the program. When the program for the terminal device 4 is executed, the CPU 901 of the terminal device 4 executes the program. The management authentication table 23 of the management apparatus 2 uses the memory 902 or the external storage device 903 of the management apparatus 2. In addition, the memory 902 or the external storage device 903 of the routing device 3 is used for the configuration definition table 36, the routing table 37, the physical address table 38, and the router authentication table 39 of the routing device 3.

  Next, the management authentication table 23 of the management apparatus 2 will be described.

  FIG. 4 is a diagram illustrating an example of the management authentication table 23. The management authentication table 23 includes a terminal ID 231, a terminal IP address 232, a terminal MAC address 233, and a router IP address 234 of a valid terminal device 4 (permitting connection to the network). The terminal ID 231 is identification information for identifying the terminal device 4. The terminal IP address 232 is the IP address of the terminal device 4. The terminal MAC address 233 is the MAC address of the terminal device 4. The router IP address 234 is an IP address of the routing device 3 (default router) that accommodates the terminal device 4. In the example illustrated in FIG. 4, for the terminal device 4 whose terminal ID 231 is “TERM61” 401, the terminal IP address 232 is “192.168.1.21” and the terminal MAC address 233 is “00: 00: 01: ff: ff: 61”. The router IP address 234 is “10.150.10.31”.

  Next, the router authentication table 39 of the routing device 3 will be described.

  FIG. 5 shows an example of the router authentication table 39. The router authentication table 39 includes the terminal IP address 391 of the terminal device 4 which is accommodated in the routing device 3 (connected as a default router) and which is valid (permitted to connect to the network). The terminal MAC address 392 is stored. In the router authentication table 39 shown in FIG. 5, for example, the terminal device 4 having the terminal IP address 391 of “192.168.1.21” and the terminal MAC address 392 of “00: 00: 01: ff: ff: 61” 501 , It is set as a legitimate terminal device 4.

  Next, processing for creating the management authentication table 23 and the router authentication table 39 will be described. This process is performed in advance before the terminal authentication process described later.

  FIG. 6 is a process flow diagram of the authentication table creation process. First, the update processing unit 21 of the management device 2 receives registration data input from the input unit 904 (S61). The registration data is data for registration in the management authentication table 23. The network administrator uses the input unit 904 to input various information (FIG. 4: 231 to 234) of each legitimate terminal device 4 that is permitted to connect to the network.

  Then, the update processing unit 21 stores the received registration data of each terminal device 4 in the management authentication table 23 and creates the management authentication table 23 (S62). Then, for each router IP address 234, the update processing unit 21 extracts a record (terminal device 4) having the same router IP address 234 from the management authentication table 23 and groups it (S63). Then, the update processing unit 21 transmits (distributes) each record grouped for each router IP address 234 to each routing device 3 as authentication data (S64). That is, the update processing unit 21 transmits each authentication data to each routing device 3 via the communication processing unit 22 with the router IP address 234 as a destination. The authentication data includes the terminal IP address 232 and the terminal MAC address 233 of each grouped record.

  The table management unit 35 of the routing device 3 receives the authentication data transmitted from the management device 2 (S65). Then, the table management unit 35 stores the received authentication data in the router authentication table 39, and creates the router authentication table 39 (S66).

  In the above authentication table creation process, when the management authentication table 23 and the router authentication table 39 are created and then these tables 23 and 39 are updated, only the update data is distributed to the routing device 3. That is, the update processing unit 21 of the management device 2 receives registration data of the terminal device 4 to be newly registered or changed (S61), and updates the management authentication table 23 (S62). And the update process part 21 transmits only the updated record to the said routing apparatus 3 as authentication data (S64). The table management unit 35 of the routing device 3 receives the authentication data and updates the router authentication table 39 based on the authentication data.

  Next, terminal authentication processing performed by the routing device 3 will be described. The routing device 3 performs this terminal authentication process when the terminal device 4 requests various services from the information server 1 or when the information server 1 provides various services to the terminal device 4.

  FIG. 7 is a processing flowchart of terminal authentication processing. First, the line control unit 34 of the routing device 3 receives a frame transmitted from another device such as the terminal device 4 or the information server 1 (S71). Then, the transmission / reception authentication unit 33 refers to the configuration definition table 36 and determines whether or not the reception port (line) that received the frame is set in the configuration definition table 36 (that is, whether or not the port is an authentication target port). Is discriminated (S72). In this embodiment, the port connected to the terminal subnet 7 is stored in the configuration definition table 36 in order to perform the authentication process of the terminal device 4. That is, the reception port in the case of communication from the terminal device 4 to the information server 1 (hereinafter “uplink communication”) is set in the configuration definition table 36 and is an authentication target. On the other hand, the reception port in the case of communication from the information server 1 to the terminal device 4 (hereinafter “downlink communication”) is not set in the configuration definition table and is not subject to authentication.

  If the reception port is not set in the configuration definition table 36, that is, if it is not an authentication target (S72: NO), the process proceeds to S74 described later. On the other hand, when the reception port is set in the configuration definition table 36, that is, when it is an authentication target (S72: YES), the transmission / reception authentication unit 33 transmits the transmission source IP address and the transmission source MAC address included in the header of the reception frame. Is present in the router authentication table 39 (S73).

  For example, in the case of the router authentication table 39 shown in FIG. 5, the IP address and MAC address of the terminal device 4 that is the transmission source are “192.168.1.21” and “00: 00: 01: ff: ff”. : 61 ”. In this case, since the transmission source IP address and the transmission source MAC address of the terminal device 4 exist in the first record 501 of the router authentication table 39, the transmission / reception authentication unit 33 regards the terminal device 4 as a valid terminal device. It discriminate | determines (S73: YES).

  If it exists in the router authentication table 39, that is, in the case of the legitimate terminal device 4 (S73: YES), the routing processing unit 31 refers to the routing table 37 to determine a transfer destination (transmission destination) device. (S74). That is, the routing processing unit 31 specifies the IP address and transfer destination port number of the next transfer destination device corresponding to the destination IP address included in the header of the received frame.

  Then, the physical address search unit 32 acquires the MAC address of the transfer destination device based on the identified IP address of the transfer destination device (S75). That is, the physical address search unit 32 reads the physical address table 38 and searches whether or not the MAC address corresponding to the IP address of the transfer destination device is registered. When the MAC address corresponding to the IP address of the transfer destination device is registered in the physical address table 38, the physical address search unit 32 acquires the MAC address. On the other hand, when the MAC address corresponding to the IP address of the transfer destination device is not registered in the physical address table 38, the physical address search unit 32 uses the IP address of the transfer destination terminal by ARP (Address Resolution Protocol) or the like. Get the MAC address corresponding to the address.

  Then, the transmission / reception authentication unit 33 refers to the configuration definition table 36 and determines whether or not the transfer destination port specified in S74 is set in the configuration definition table 36 (that is, whether or not the port is an authentication target port). (S76). When the transfer destination port is not registered in the configuration definition table 36, that is, when it is not an authentication target (S76: NO), the line control unit 34 transmits (sends) the received frame received in S71 to the transfer destination device ( S78).

  On the other hand, when the transfer destination port is set in the configuration definition table 36, that is, in the case of authentication (S76: YES), the transmission / reception authentication unit 33 determines the destination IP address and the destination MAC included in the header of the received frame. It is determined whether or not the address exists in the router authentication table 39 (S77). If it exists in the router authentication table 39, that is, if it is a legitimate terminal device 4 (S77: YES), the line control unit 34 transmits (sends) the received frame received in S71 to the transfer destination device (S78). . For example, in the case of uplink communication from the terminal device 4 to the information server 1, the routing device 3 transmits the frame received from the terminal device 4 to the information server 1 (or another routing device 3). Then, the information server 1 performs processing for providing various services requested from the terminal device 4. In the case of downlink communication from the information server 1 to the terminal device 4, the routing device 3 transmits the frame received from the information server 1 to the terminal device 4 (or another routing device 3). The terminal device 4 can acquire various services provided by the information server 1.

  When the source IP address and the source MAC address do not exist in the router authentication table 39 (S73: NO), or when the destination IP address and the destination MAC address do not exist in the router authentication table 39 (S77: NO) The transmission / reception authentication unit 33 discards the received frame received in S71 (S79). That is, the transmission / reception authentication unit 33 discards a frame transmitted / received to / from an unauthorized terminal device 4 that is not registered in the router authentication table 39. In addition, the transmission / reception authentication unit 33 may not only discard the frame but also transmit a warning message that urges the management apparatus 2 to warn. As a result, a warning message is output to the output device 905 of the management device 2, and the network administrator can detect an unauthorized access to the network by the terminal device 4.

  The embodiment of the present invention has been described above.

  In the present embodiment, authentication processing of the terminal device 4 is performed in the routing device 3. That is, in this embodiment, the authentication process of the terminal device 4 is realized without going through the network. Thereby, network traffic can be reduced and the authentication process can be further accelerated.

  Further, since the authentication process is performed in the routing device 3, it is not necessary to incorporate functions necessary for the authentication process in each terminal device 4 and the information server 1. That is, the terminal device 4 and the information server 1 can be applied as devices of the terminal authentication system of the present embodiment without changing the currently running program. Further, since it is not necessary for the terminal device 4 to notify the IP address and the MAC address each time authentication processing is performed, security can be ensured.

  Further, as described above, the terminal device 4 and the information server 1 do not need to incorporate functions necessary for the authentication process, so that the system can be easily expanded. That is, this embodiment can be applied even when each device constituting the terminal authentication system such as the information server 1 and the terminal device 4 is managed by different companies. Specifically, with the spread of the Internet, the authentication processing of this embodiment can be performed even by a plurality of information servers 1 having different management policies (platforms, etc.) such as external servers.

  In addition, this invention is not limited to said embodiment, Many deformation | transformation are possible within the range of the summary.

  For example, in this embodiment, an IP address is used as a logical address and a MAC address is used as a physical address. However, the present invention is not limited to this, and other addresses may be used.

  In the present embodiment, authentication processing of the terminal device 4 is performed. However, not only the terminal device 4 but also the information server 1 or the routing device 3 may be authenticated. In this case, in the management authentication table 23 and the router authentication table 39, the IP address and MAC address of the information server 1 or the routing device 3 to be authenticated are registered. In addition, the configuration definition table stores the port numbers of ports to be authenticated other than the terminal subnet 7.

FIG. 1 is a schematic diagram of a terminal authentication system to which an embodiment of the present invention is applied. FIG. 2 is a diagram illustrating a functional configuration of the routing device. FIG. 3 is a diagram illustrating a hardware configuration example of each device. FIG. 4 is a diagram illustrating an example of the data structure of the management authentication table. FIG. 5 is a diagram illustrating an example of the data structure of the router authentication table. FIG. 6 is a process flow diagram of the authentication table creation process. FIG. 7 is a processing flowchart of terminal authentication processing.

Explanation of symbols

1: Information server 2: Management device 21: Update processing unit 22: Communication processing unit 23: Management authentication table 3: Routing device 31: Routing processing unit 32: Physical address search unit 33: Transmission / reception Authentication unit, 34: line control unit, 35: table management unit, 4: terminal device, 5: backbone network, 6: management network, 7: terminal subnet

Claims (5)

A routing device,
First storage means for storing an authentication table in which a logical address and a physical address of at least one information processing apparatus are registered;
Receiving means for receiving data from the information processing device;
It is determined whether or not a transmission source logical address and a transmission source physical address of a transmission source information processing apparatus included in the data exist in the authentication table, and a destination logical address and a destination of a destination information processing apparatus included in the data Authentication means for determining whether a physical address exists in the authentication table,
The authentication means includes
When the source logical address and the source physical address do not exist in the authentication table, or when the destination logical address and the destination physical address do not exist in the authentication table, the data received by the receiving unit is discarded. ,
When the source logical address and the source physical address exist in the authentication table, or when the destination logical address and the destination physical address exist in the authentication table, the data received by the receiving unit is transmitted. A routing device characterized by the above. The routing device according to claim 1, wherein
At least one port for connecting to the network;
A second storage unit that stores a configuration definition table in which port identification information of a port to be authenticated is stored among the ports;
The authentication means includes
It is determined whether or not the port identification information of the reception port that has received the data exists in the configuration definition table, and when the port identification information of the reception port exists in the configuration definition table, the source logical address and Determining whether the source physical address is present in the authentication table;
It is determined whether or not port identification information of a transmission port for transferring the data exists in the configuration definition table. When the port identification information of the transmission port exists in the configuration definition table, the destination logical address and the A routing device characterized by determining whether or not a destination physical address exists in the authentication table. The routing device according to claim 1, wherein
Table management means for receiving registration data including a logical address and a physical address of at least one information processing device connected to the routing device from an external system, and creating the authentication table based on the registration data A routing device characterized by the above. The routing device according to claim 1, wherein
The routing device, wherein the logical address is an IP address and the physical address is a MAC address. An authentication method for an information processing apparatus connected to a network performed by a routing apparatus,
The routing device includes a storage unit that stores an authentication table in which a logical address and a physical address of at least one information processing device are registered, and an arithmetic processing unit.
The arithmetic processing unit includes:
A receiving step for receiving data transmitted from the information processing device;
It is determined whether or not a transmission source logical address and a transmission source physical address of a transmission source information processing apparatus included in the data exist in the authentication table, and a destination logical address of a destination information processing apparatus included in the data and Performing an authentication step of determining whether a destination physical address exists in the authentication table;
In the authentication step,
When the source logical address and the source physical address do not exist in the authentication table, or when the destination logical address and the destination physical address do not exist in the authentication table, the data received in the reception step is discarded. ,
When the transmission source logical address and the transmission source physical address exist in the authentication table, or when the destination logical address and the destination physical address exist in the authentication table, the data received in the reception step is transmitted. thing,
An authentication method for an information processing apparatus.

Images