JP2008042735A - Management method of mac address learning function, and network device - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To prevent illegal communications by masquerading under a feigned MAC address, and to enable provision of a communication service only to network terminal units of which number of sets is declared in advance by an end user. <P>SOLUTION: Network terminal unit information, at least including MAC addresses of network tunnel units A, B for each connection position of network equipment 3, 7, is registered into MAC address management tables 31, 71. Even when any network terminal unit having the MAC address once registered is connected to another connection position, without modifying the contents of the MAC address management tables 31, 71, a new registration of network terminal unit information including a MAC address through relearning is inhibited. Also, the number of times of learning a proper MAC address included in each network terminal unit of the end user is managed, and the number of MAC addresses usable by the end user is limited. <P>COPYRIGHT: (C)2008,JPO&INPIT

Description

  The present invention relates to a MAC (Media Access Control) address learning function management method and a network device, and relates to the prevention of unauthorized communication based on the management of a MAC address learning function in an Internet connection service system and appropriate communication for a regular end user. It relates to technology that provides services.

  Currently, high-speed broadband communication services using optical fibers are rapidly spreading, and communication technology innovation enables end users to receive lower-speed and higher-speed communication services. For example, FTTH (Fiber To The Home) / FTTB ( As one of the fiber to the building (telecommunications) services, the number of telecommunications carriers providing services that incorporate additional services equivalent to fixed-line telephones to telephone function services based on VoIP (Voice over Internet Protocol) technology is increasing. It is important to enhance communication security by operators, and there is a demand for providing a paid communication service in which security is appropriately managed by a communication carrier to end users.

  In general, in order to realize connection to the Internet, an end user's network terminal device is first installed at a regional access point serving as an entrance to the Internet backbone using a protocol called PPP (Point-to-Point Protocol). Although a point-to-point connection is attempted to a BAS (Broadband-Access-Server), the IP address is used at that time, and therefore it is usually necessary to manually set the IP address in each network terminal device.

  However, when the number of installed network terminal devices is large, the work of setting the IP address for each terminal device becomes complicated. Therefore, by installing a server for managing the IP address, the IP address is automatically paid out. A certain Dynamic Host Configuration Protocol (DHCP) is used.

  DHCP is a protocol defined by RFC (Request For Comments) 2131. When a network terminal device such as a computer communicates using TCP / IP (Transmission Control Protocol / Internet Protocol), an IP address or a default gateway is used. This is a protocol that automatically sets the address of the server.

  In the DHCP server, an IP address and a default gateway address are registered in advance, and a client device such as a computer accesses the DHCP server at startup, and the DHCP server issues an IP address to the accessed client device. The client device acquires an IP address.

  However, since an automatic IP address issuing function by DHCP is provided, an IP address can be automatically issued and communication can be performed simply by connecting a network terminal device such as a computer or information appliance to a network device such as a modem. There is a possibility that unauthorized communication is performed. As a function for preventing such unauthorized communication, the DHCP server has a MAC filtering function for paying out an IP address only to a terminal device having a MAC address registered in advance.

  Further, as means for limiting the number of connections of end user terminal devices to the number of connections at the time of a contract, the following Patent Document 1 describes a connection terminal number management method for performing service management of an IP communication service. In the method for managing the number of connected terminals described in Patent Document 1, when a service provider provides an IP communication service by setting a fee according to the number of connected terminals to a customer, the customer connects terminals exceeding the number of contracts, In order to prevent unauthorized access, the MAC number of the terminal that enjoys the IP communication service is collected, and based on the collected MAC address, the actual number of terminals that a specific customer connects to the optical subscriber network terminating device The service provider can monitor the number of terminals to which the customer is actually connected and manage the number of connected terminals.

JP 2002-232445 A

  As described above, because of the mechanism of DHCP, any terminal device can obtain an IP address as long as it is physically connected to the network. By spoofing the MAC address for the MAC filtering function, A person other than the end user can easily receive the communication service, which is one of the causes of an internet crime by a malicious user.

  In a general LAN (Local Area Network), when data transfer is performed by a switching device of layer 2, the MAC address of the terminal device connected to the port of the switching device is learned for each port, and the MAC address is supported. An increase in traffic is prevented by sending data frames only to the ports. The MAC address is an address unique to each device set in each network terminal device. Therefore, network terminal devices with the same MAC address should normally not exist, and end users can be specified by managing MAC addresses.

  Normally, in a layer 2 switching device, when a network terminal device having the same MAC address as the MAC address corresponding to the port learned once is connected to another port, and the MAC address is input from another port, the network terminal device is relocated. The learned MAC address is transferred to another port. That is, the correspondence between the port and the MAC address is learned again, and overwritten with the priority of the later generation.

  However, in general, network terminal devices are rarely switched to another port for relocation, and the mismatch between the learned MAC address and its connection port deliberately spoofed the learned MAC address. There is a very high probability that the network terminal device has been connected to another port. In such a case, a malicious other person impersonates the original end user and receives a communication service, which may lead to the occurrence of an Internet crime.

  The present invention prevents unauthorized communication due to impersonation using a network terminal device that misrepresents a learned MAC address by managing the MAC address learning function, and the number of network terminal devices that an end user has previously declared at the time of contract It is possible to provide a communication service only with respect to the network terminal device, and it is possible to provide a communication service for the number of network terminal devices according to the contract fee.

  The management of the MAC address learning function of the present invention will be described with reference to FIG. 1. A network including at least the MAC addresses of the network terminal apparatuses A and B connected to the connection positions for each connection position of the network devices 3 and 7. The terminal device information is registered in the MAC address management tables 31 and 71, and a network terminal device having the same MAC address as the MAC address once registered in the MAC address management tables 31 and 71 is registered in the MAC address management tables 31 and 71. When it is detected that the connection position is different from the connected connection position, the association between the connection position of the network device once registered in the MAC address management tables 31 and 71 and the network terminal device information is changed. New network terminal device including the MAC address Characterized in that it prohibits the registration of information.

  Further, for each connection position of the network device, an upper limit number is set in advance for the number of times of learning by registering the network terminal device information in the MAC address management tables 31 and 71, and when the number of learning times is less than or equal to the upper limit number. The network terminal device information having a different MAC address is registered in the MAC address management tables 31 and 71 for each connection position of the network device, and when the learning count exceeds the upper limit count, the MAC address management table 31 and 71, registration of network terminal device information having a new MAC address at the connection position of the network device is prohibited.

  According to the present invention, it is possible to identify the end user based on the MAC address by fixing the learning result of the MAC address of the network terminal device to the end user who permits the communication service and prohibiting the relearning. In addition, by assigning an IP address only to a network terminal device having a MAC address registered by learning, it is possible to prevent an IP address from being issued to an unauthorized third party by impersonating a MAC address.

  Further, the number of MAC addresses that can be used by the end user can be limited by managing the number of times of learning the unique MAC address possessed by each network terminal device of the end user, whereby the network that can be used by the end user. The number of terminal devices can be limited, and a communication service based on a contract fee according to the number of network terminal devices that can be used by an end user can be provided to a regular number of network terminal devices. Become.

  FIG. 1 shows a configuration example of a network system according to an embodiment of the present invention. In the configuration example of FIG. 1, terminals A and B are network terminal devices such as end-user computers or set-top boxes, and terminal A has a GE-PON subscriber line terminal unit (ONU: Optical Network Unit) 4. Via the GE-PON line terminator (OLT) 7 of the in-station equipment of the communication carrier.

  On the other hand, the terminal B receives the GE-PON line termination device (OLT) of the telecommunications carrier's in-house equipment via the VDSL modem 1 in the end user's house, the collective VDSL device 3 and the GE-PON subscriber line termination device (ONU) 6. ) 7. The GE-PON line terminator (OLT) 7 is connected to the IP network 9 via the layer 2 switch 8, and is connected to the DHCP server 10 and various information database servers 11 of an Internet service provider (ISP) or a communication carrier. Connected.

  In addition to the above-described VDSL modem 1 in the end user's house, the collective VDSL apparatus 3 is connected to a number of VDSL modems (not shown) including the VDSL modem 2 in another end user's house. The collective VDSL device 3 stores in the MAC address management table 31 network terminal device information in which the connection position of the connected network terminal device, the terminal name, its MAC address and IP address are associated with each port. Remember. In the illustrated example, the connection location “VDSL-1”, the terminal name “terminal B”, the MAC address “MAC-B”, and the IP address “IP-B” are stored in association with each other.

  The GE-PON line terminator (OLT) 7 includes other GE-PON subscriber line terminators (ONU) 5 and 6 in addition to the GE-PON subscriber line terminator (ONU) 4 described above. A number of omitted GE-PON subscriber line termination units (ONUs) are connected. The GE-PON line terminator (OLT) 7 is a MAC address management table that stores network terminal information associated with the connection position, terminal name, MAC address, and IP address of the connected network terminal device corresponding to each port. 71 is stored and stored.

  In the illustrated example, the network terminal device information of the connection position “GEPON-4”, the terminal name “terminal A”, the MAC address “MAC-A”, the IP address “IP-A”, and the connection position “GEPON-6”, The terminal name “terminal B”, the MAC address “MAC-B”, and the network terminal device information of the IP address “IP-B” are stored.

  In the collective VDSL device 3 and the GE-PON line terminator (OLT) 7, it is prohibited to move a previously stored MAC address to another port by learning, and the MAC address once set is associated with the port. It is fixed and the change of the MAC address associated with each port is restricted.

  As a method for managing the MAC address of the end user by the communication carrier, the communication carrier distributes the network terminal device to the end user, and knows the MAC address of the network terminal device in advance and collects the collective VDSL device 3 or It is registered in the GE-PON line terminator (OLT) 7.

  Alternatively, when the network terminal device prepared by the end user is connected to the collective VDSL device 3 or the GE-PON line terminator (OLT) 7, the collective VDSL device 3 or the GE-PON line terminator (OLT) 7 The first recognized MAC address is registered as the unique address of the end user, and then the IP address associated with the MAC address is automatically issued from the DHCP server 10. The IP address and MAC address are managed by the function of the DHCP server 10, and end users are specified.

  FIG. 2 shows an example of operation when the MAC address is spoofed in the present invention. Now, it is assumed that the terminal A ′ spoofing the MAC address “MAC-A” of the terminal A is connected to the GE-PON line terminator (OLT) 7 via the GE-PON subscriber line terminator (ONU) 5. . The GE-PON line terminator (OLT) 7 confirms that the MAC address “MAC-A” of the terminal A is already registered in association with the connection position “GEPON-4”, and the MAC address “MAC” -Change registration of connection position by re-learning "A" is prohibited. Therefore, the MAC address “MAC-A” is not registered in the connection position “GEPON-5”, and communication by the terminal A ′ that spoofed the MAC address is blocked.

  Further, it is assumed that a terminal B ′ spoofing the MAC address “MAC-B” of the terminal B is connected to the collective VDSL apparatus 3 via the VDSL modem 2 in the home. The collective VDSL device 3 confirms that the MAC address “MAC-B” of the terminal B associated with the connection position “VDSL-1” has already been registered, and re-establishes the MAC address “MAC-B”. The registration of change of connection position by learning is prohibited.

  Therefore, the MAC address “MAC-B” is not registered in the connection position “VDSL-2”, and communication by the terminal B ′ that misrepresents the MAC address is blocked. As described above, even if the MAC address is spoofed, the MAC address learning result is fixed, so that a new learning is not performed again, and communication by a malicious third party is prevented.

  FIG. 3 shows an example of the operation of limiting the MAC address learning frequency in the present invention. In FIG. 3, the end user of terminal A concludes a contract for a low-cost communication service that can use only one terminal with a communication carrier, while the end user of terminal B uses two terminals. Assume that you have a contract with a telecommunications carrier for possible high-priced telecommunications services.

  The GE-PON line terminator (OLT) 7 limits the number of learning of the MAC address for the end user of the terminal A to one, and the network terminal apparatus information including the MAC address for the connection position “GE-PON4” of the terminal A Limit the number of registrations to one.

  In the collective VDSL apparatus 3, since the MAC address learning frequency for the end user of the terminal B is set to 2, the end user of the terminal B connects the terminal C other than the terminal B to the VDSL modem 1 in the home. When connecting to the collective VDSL device 3 through the terminal, the number of registered MAC addresses for the connection position “VDSL-1” of the terminal B is allowed up to two, and a new connection is made to the connection position “VDSL-1”. The network terminal device information of the terminal name “terminal C”, the MAC address “MAC-C”, and the IP address “IP-C” is newly registered.

  In addition, since the GE-PON line terminator (OLT) 7 has set the MAC address learning frequency to 2 times for the end users of the terminal B and the terminal C, after the MAC address registration of the terminal B, the terminal When C is connected via the collective VDSL device 3 and the GE-PON 6, the number of registered MAC addresses for the connection position “GEPON-6” of the terminal B is allowed up to two, and the connection position “GEPON-6”. On the other hand, the network terminal device information of the terminal name “terminal C”, the MAC address “MAC-C”, and the IP address “IP-C” of the newly connected terminal is newly registered.

  In this way, in the GE-PON line termination device (OLT) 7 or the collective VDSL device 3, by limiting the MAC address learning frequency to the number registered in advance for each end user at the time of the contract, the communication carrier can It is possible to manage the number of connected network terminal devices for each end user and provide a communication service by a plurality of network terminal devices according to the contract fee with the end user.

It is a figure which shows the structural example of the network system of embodiment of this invention. It is a figure which shows the operation example at the time of MAC address spoofing in this invention. It is a figure which shows the operation example of MAC address learning frequency restriction | limiting in this invention.

Explanation of symbols

1, 2 VDSL modem in the end user's home 3 Collective VDSL device 31 MAC address management table 4, 5, 6 GE-PON subscriber line termination unit (ONU)
7 GE-PON line terminator (OLT) for station facilities
71 MAC address management table 8 Layer 2 switch 9 IP network 10 DHCP server 11 Various information database servers

Claims (4)

A MAC address learning function management method for learning association between a MAC (Media Access Control) address of a network terminal device and a connection position of a network device to which the network terminal device is connected,
A network terminal device information registration step for registering network terminal device information including at least a MAC address of a network terminal device connected to the connection position in a MAC address management table for each connection position of the network device;
When it is detected that a network terminal device having the same MAC address as the MAC address once registered in the MAC address management table is connected to a connection position different from the connection position registered in the MAC address management table, Network terminal device information registration that prohibits registration of new network terminal device information including the MAC address without changing the association between the connection position of the network device once registered in the MAC address management table and the network terminal device information Forbidden steps,
A management method for a MAC address learning function. For each connection position of the network device, the network terminal device information is registered in the MAC address management table and learned in advance to determine the upper limit number of times,
When the learning number is less than or equal to the upper limit number, network terminal device information registration step of registering network terminal device information having a different MAC address for each connection position of the network device in the MAC address management table;
A network terminal device information registration prohibiting step for prohibiting registration of network terminal device information having a new MAC address to the connection position of the network device in the MAC address management table when the number of learning times exceeds the upper limit number;
The MAC address learning function management method according to claim 1, comprising: A network device having a MAC address learning function for learning a correspondence between a MAC (Media Access Control) address of a network terminal device and a connection position to which the network terminal device is connected,
Network terminal device information registration means for registering network terminal device information including at least the MAC address of the network terminal device connected to the connection location in the MAC address management table for each connection location;
When it is detected that a network terminal device having the same MAC address as the MAC address once registered in the MAC address management table is connected to a connection position different from the connection position registered in the MAC address management table, Network terminal device information registration that prohibits registration of new network terminal device information including the MAC address without changing the association between the connection position of the network device once registered in the MAC address management table and the network terminal device information Prohibited means,
A network device characterized by comprising: For each connection position, the network terminal device information is registered in the MAC address management table and learned in advance to determine the upper limit number of times,
When the learning number is equal to or less than the upper limit number, network terminal device information registration means for registering network terminal device information having a different MAC address for each connection position of the network device in the MAC address management table;
Network terminal device information registration prohibiting means for prohibiting registration of network terminal device information having a new MAC address to the connection position of the network device in the MAC address management table when the learning number exceeds the upper limit number;
The network device according to claim 3, further comprising:

Images