JP2008278134A - Network control unit, network control method, and computer program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To easily detect and invalidate a connection of a terminal which is not permitted. <P>SOLUTION: A network control unit 40 is interposed between an authentication server 20 and an authentication switch 30 for authenticating a terminal device 10, and configured to intercept communication contents, based upon an authentication protocol, communicated between the authentication server 20 and terminal device 10. The network control unit 40 stores an identification address of the terminal device 10 approved by the authentication server 20 from the intercepted communication contents. Therefore, when an arbitrary terminal device tries to connect with the LAN and transmits an identification address, the identification address is compared with an identification address of an approved terminal device to check whether they are different, thereby easily detecting whether the connection is illegal. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

  The present invention relates to a network control technique used in a network authentication system in which only authorized terminal devices are connected to a predetermined LAN.

  In recent years, IEEE 802.1X has become widespread as a standard that defines a user authentication (terminal device authentication) method in a LAN. The IEEE 802.1X authentication system includes supplicant software (for example, IEEE 802.1X compatible supplicant) installed in a terminal device, an authentication device, and an authentication server (RADIUS server). When the terminal device tries to connect to the LAN, communication for authentication according to the authentication protocol (EAP protocol) is performed between the authentication server and the supplicant via the authentication device. Authentication is performed. When authorized by the authentication server, the terminal device can be connected to the LAN, and the administrator can easily control the connection of the terminal device to the LAN, which is effective for information security measures.

  However, even if an IEEE 802.1X authentication system is used, if a terminal device that is not authorized is connected to an empty port of a repeater HUB provided in the wired LAN, authentication is not performed and the LAN is used. In some cases, other networks may be accessible through other connected terminal devices or gateways provided in the LAN.

  The present invention has been made in view of the above, and quickly detects the presence of an unauthorized terminal device on a network and invalidates the connection of the unauthorized terminal device, and a network control method It is another object of the present invention to provide a computer program.

In order to solve the above problem, in the invention according to claim 1, an authentication target terminal device, an authentication server that receives authentication information of the terminal device and authenticates whether or not to permit connection to the LAN, and A network control device used in an authentication system including an authentication switch that relays communication between the terminal device and the authentication server,
Means for intercepting communication contents in accordance with an authentication protocol communicated between the authentication server and the terminal device between the authentication server and the authentication switch, and storing an identification address of the terminal device authorized by the authentication server;
Intercept data transmitted from an arbitrary terminal device, compare the identification address of the arbitrary terminal device included in the data with the identification address of the authorized terminal device stored by the means, and Determining whether or not the device has been authorized based on whether or not the identification address of the device matches the stored identification address and identifying the terminal device associated with the unauthorized identification address as an unauthorized connection terminal. A characteristic network control device is provided.
The invention according to claim 2 further comprises means for invalidating the connection to the LAN for the terminal device identified as the unauthorized connection terminal. provide.
According to a third aspect of the present invention, there is provided the network control apparatus according to the first aspect, wherein the LAN is a LAN using IEEE802.1X authentication.
According to a fourth aspect of the present invention, an authentication target terminal device, an authentication server that receives authentication information of the terminal device and authenticates whether or not to authorize connection to a LAN, and the terminal device and the authentication server A network control method in an authentication system comprising an authentication switch that relays communication between and
The network control device intercepts the communication contents according to the authentication protocol communicated between the authentication server and the terminal device between the authentication server and the authentication switch, and stores the identification address of the terminal device authorized by the authentication server. ,
The data transmitted from an arbitrary terminal device is intercepted, the identification address of the arbitrary terminal device included in this data is compared with the stored identification address of the authorized terminal device, and the identification of the arbitrary terminal device is performed. A network control method characterized by determining whether or not authorized based on whether or not an address matches a stored identification address and identifying a terminal device related to the unauthorized identification address as an unauthorized connection terminal provide.
According to a fifth aspect of the present invention, there is further provided the network control method according to the fourth aspect, wherein the connection of the terminal device identified as the unauthorized connection terminal to the LAN is invalidated.
The invention according to claim 6 provides the network control method according to claim 4 or 5, which is applied to a LAN using an authentication system using IEEE802.1X authentication.
In the invention of claim 7, the terminal device to be authenticated, the authentication server that receives the authentication information of the terminal device and authenticates whether or not the connection to the LAN should be authorized, the terminal device and the authentication server A computer program installed in a computer for network control that monitors an authentication system and detects unauthorized connection in an authentication system including an authentication switch that relays communication between and
Intercepting communication contents according to the authentication protocol communicated between the authentication server and the terminal device between the authentication server and the authentication switch, and storing the identification address of the terminal device authorized by the authentication server;
An identification address included in data transmitted from an arbitrary terminal device is received and compared with the identification address of the authorized terminal device stored by the step, and the identification address of the arbitrary terminal device is stored A computer program is provided, comprising: determining whether or not authorized based on whether or not the address matches, and identifying the terminal device related to the identification address that is not authorized as an unauthorized connection terminal.
The invention according to claim 8 further provides a computer program according to claim 7, further comprising the step of invalidating the connection of the terminal device identified as the unauthorized connection terminal to the LAN.

  In the present invention, in a LAN in which an authentication system is constructed, a network control device is interposed between an authentication server for authenticating a terminal device and an authentication switch, and the network control device communicates between the authentication server and the terminal device. This is a configuration for intercepting communication contents according to the authentication protocol. The network control device stores the identification address of the terminal device authorized by the authentication server from the intercepted communication content. Therefore, when an arbitrary terminal device tries to connect to the LAN and the identification address of the terminal device is transmitted to the LAN, whether or not the identification address is different from the identification address of the authorized terminal device is compared. Thus, it is possible to easily detect whether or not the connection is illegal. If it is determined that the connection is illegal, the connection of the terminal device can be invalidated by means for invalidating the connection to the LAN. For this reason, even if an unapproved terminal device is connected to an empty port such as a repeater HUB in the LAN to connect to the LAN, this can be easily detected and invalidated.

  Hereinafter, embodiments of the present invention will be described in more detail with reference to the drawings. FIG. 1 is a diagram showing an example of the overall configuration of a network authentication system 1 to which the present invention is applied. This uses an IEEE802.1X authentication system, and is interposed between each authorized terminal device (PC1, PC2) 10 and authentication server 20 to be authenticated, and between each terminal device 10 and the authentication server 20. IEEE802.1X compatible authentication switch 30. The network authentication system 1 is provided with a network control device 40 and unauthorized connection invalidation means 50. Reference numeral 60 denotes a gateway for connecting to another network from the LAN constituting the authentication system.

  The terminal device 10 includes a personal computer (an arithmetic processing unit constituted by an MPU (Micro Processing Unit), a main memory, and the like, a hard disk, and an input / output port as an input / output unit for these data) PC, etc., and a supplicant that supports IEEE 802.1X is installed as software.

  The supplicant transmits the authentication information of the terminal device 10. Although the authentication information is not limited, it is typically an electronic certificate of each terminal device 10, and the authentication server 20 determines whether or not the electronic certificate is authentic.

  The authentication server 20 is composed of a RADIUS server that is normally used in an IEEE 802.1X authentication system, and is connected to the authentication switch 30. The authentication server 20 stores a list of valid electronic certificates transmitted from the certification authority, compares the electronic certificate transmitted from the terminal device 10 with the electronic certificate placed in this list, and matches. To "authorize" the connection to the LAN.

  The authentication switch 30 relays the communication of the authentication process according to the authentication protocol performed between the terminal device 10 and the authentication server 20. When the terminal device 10 is authorized by the authentication server 20, the connection of the authorized terminal device 10 to the LAN is relayed, and access to other networks via the gateway 60 is also permitted. If it is not authorized, the connection to the LAN is not relayed.

  The network control device 40 is configured by a computer including a calculation unit 41 and a storage unit 42, and is arranged so that communication contents in an authentication process performed between the authentication server 20 and the authentication switch 30 can be intercepted. When the authentication switch 30 receives the authentication information from the terminal device 10, the authentication switch 30 transmits the authentication information to the authentication server 20, and the authentication server 20 determines whether the authentication information is valid or invalid. Information on the permitted authentication success (authorization) is returned to the authentication switch 30. Therefore, if the communication content is intercepted by the network control device 40, the terminal device 10 authorized by the authentication server 20 can be determined.

  Therefore, a means (computer program) for storing the identification address of the terminal device 10 whose authentication information is authorized in the storage unit 42 is set in the calculation unit 41 of the network control device 40. In addition, when data is transmitted from an arbitrary terminal device connected to the LAN constituting the authentication system 1, the identification address included in the data transmitted from the arbitrary terminal device is received, and the above-mentioned authorized Compared with the identification address of the terminal device 10, it is determined whether the identification address of an arbitrary terminal device matches the stored identification address or not, and the terminal device related to the unauthorized identification address A means (computer program) for identifying 10 as an unauthorized connection terminal is set. The network control device 40 stores the identification addresses of the authentication server 20, the authentication switch 30, and the like in advance in a storage unit (not shown) as regular ones so as not to exclude them.

  The unauthorized connection invalidating means 50 receives the identification address of the terminal device 10 related to the unauthorized connection specified by the network control device 40 from the network control device 40, and invalidates the connection of the terminal device 10 to the LAN. (Computer program). The unauthorized connection invalidation means 50 is configured by an independent device, is connected to the network control device 40 via a communication cable, and receives the identification address of the terminal device 10 related to the unauthorized connection from the network control device 40 via the communication cable. A configuration may be adopted, or a configuration in which the unauthorized connection invalidating means 50 is incorporated in the calculation unit 41 of the network control device 40 may be adopted. The “network control device” defined in the claims is meant to include any of these aspects. The means for invalidating the connection is not limited, and for example, means for rewriting the information of the identification address can be mentioned. Specifically, the transmission destination MAC address defined in the ARP table of the terminal device 10 related to the unauthorized connection is camouflaged (for example, the MAC address of the unauthorized connection invalidating means 50 is written as the camouflaged address).

  Next, an outline of the operation of the present embodiment will be described with reference to FIGS. In each terminal device 10 shown in FIGS. 1 to 3, PC1 and PC2 are regular terminal devices, and PCX, PCY, and PCZ are terminal devices related to unauthorized connection. PCX is connected to the authentication switch 30 via the repeater HUB 101, and PCY and PCZ are connected between the authentication server 20 and the authentication switch 30 via the repeater HUB 102.

  When the PC 1 which is the legitimate terminal device 10 tries to connect to the LAN, first, an authentication request is made to the authentication server 20 (A in FIG. 2). When authentication information is exchanged and authorization is obtained, information indicating that is transmitted from the authentication server 20 to the PC 1 (B in FIG. 2). The network control device 40 intercepts the communication during this time, and stores the identification address of the PC 1 that is the authorized terminal device in the storage unit 42. After authorization, the PC 1 can be connected to the LAN and connected to another network via the gateway 60 (C and D in FIG. 2).

  On the other hand, when the PCX connects to the LAN via the repeater HUB 102 and tries to connect to another network from the gateway 60 via the authentication switch 30, ARP packets are transmitted to and received from the gateway 60 ( E, F in FIG. At this time, the network control device 40 recognizes that the PCX is not an authorized identification address stored in the storage unit 42 and recognizes it as an unauthorized connection. The identification address of the PCX recognized as an unauthorized connection is sent to the unauthorized connection invalidation means 50, and a forged address (for example, the MAC address of the unauthorized connection invalidation means 50) is transmitted to the ARP table of the PCX recognized as an unauthorized connection. (G in FIG. 3).

  The above operation will be described more specifically with reference to FIG. First, when the PC 1 which is the regular terminal device 10 is activated, an EAP request is transmitted from the authentication switch 30 (S101). Upon receiving the EAP request, the PC 1 transmits the authentication information of the PC 1 to the authentication switch 30 by an EAP response (S102). The authentication switch 30 transmits this authentication information as a RADIUS request to the authentication server 20 (S103). The authentication server 20 confirms the validity of the electronic certificate related to the authentication information. If the electronic certificate is valid, the authentication server 20 authorizes the authentication information, transmits the authentication information as a RADIUS accept to the authentication switch 30 (S104), and the authentication switch 30. When the RADIUS accept is received, EAP success as an authentication success (authorization) command is transmitted to the PC 1 (S105). Thereby, the authentication process is completed, the port of the authentication switch 30 is opened, the connection from the authorized PC 1 to the LAN becomes possible, the ARP request is transmitted to the gateway 60 (S106), and the ARP reply is transmitted from the gateway 60. Is returned (S107), and access to another network becomes possible.

  The network control device 40 monitors the communication contents flowing between the authentication switch 30 and the authentication server 20 and stores the MAC address of the PC 1 to which the RADIUS accept is transmitted in the storage unit 42 as the regular terminal device 10. Further, the MAC address of the PC 1 is transmitted from the network control device 40 to the unauthorized connection invalidation means 50. The unauthorized connection invalidating means 50 further periodically sends and receives ARP requests and ARP replies to and from the PC 1 (S108, S109), and the MAC address of the PCX that is a terminal device related to unauthorized connection in the ARP table of the PC 1 Check if there is an entry. If there is an entry, the MAC address is rewritten to a forged address.

  On the other hand, when PCX tries to connect to the LAN, an ARP request is transmitted to the gateway 60 via the LAN (S201), and an ARP reply (S202) is returned from the gateway 60. At this time, since the PCX identification address is included in the PCX data flowing in the LAN, the network control device 40 determines that the PCX MAC address is not the authorized MAC address stored in the storage unit 42 from the ARP request. Is recognized as an unauthorized connection, and the PCX MAC address is sent to the unauthorized connection invalidating means 50.

  The unauthorized connection invalidation means 50 transmits an impersonation address (for example, the MAC address of the unauthorized connection invalidation means 50) to all entries in the ARP table of the PCX recognized as unauthorized connection by using an ARP request command to rewrite (S203). The ARP reply is received and the content is confirmed (S204). As a result, even if PCX sends a command addressed to a predetermined IP address according to the ARP table, the MAC address corresponding to the IP address has been rewritten to a camouflaged address. Cannot be connected to the LAN.

  As described above, in the present embodiment, even if an unauthorized terminal device is connected to a free port such as a repeater HUB in the LAN and connected to the LAN, this can be easily detected and invalidated. it can.

It is a block diagram which shows an example of the network authentication system used in order to demonstrate one Embodiment of this invention. It is a figure for demonstrating the outline | summary of operation | movement of the said embodiment. It is a figure for demonstrating the outline | summary of operation | movement of the said embodiment. It is a figure for demonstrating the specific process of the operation | movement of the said embodiment.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 Network authentication system 10 Terminal device 20 Authentication server 30 Authentication switch 40 Network control device 50 Unauthorized connection invalidation means 60 Gateway

Claims (8)

A terminal device to be authenticated, an authentication server that receives authentication information of the terminal device and authenticates whether or not to authorize connection to the LAN, and relays communication between the terminal device and the authentication server. A network control device used in an authentication system including an authentication switch for performing,
Means for intercepting communication contents in accordance with an authentication protocol communicated between the authentication server and the terminal device between the authentication server and the authentication switch, and storing an identification address of the terminal device authorized by the authentication server;
Intercept data transmitted from an arbitrary terminal device, compare the identification address of the arbitrary terminal device included in the data with the identification address of the authorized terminal device stored by the means, and Determining whether or not the device has been authorized based on whether or not the identification address of the device matches the stored identification address and identifying the terminal device associated with the unauthorized identification address as an unauthorized connection terminal. A network control device characterized.   2. The network control device according to claim 1, further comprising means for invalidating connection to the LAN for the terminal device identified as the unauthorized connection terminal.   2. The network control apparatus according to claim 1, wherein the LAN is a LAN using IEEE802.1X authentication. A terminal device to be authenticated, an authentication server that receives authentication information of the terminal device and authenticates whether or not to authorize connection to the LAN, and relays communication between the terminal device and the authentication server. A network control method in an authentication system comprising an authentication switch to perform,
The network control device intercepts the communication contents according to the authentication protocol communicated between the authentication server and the terminal device between the authentication server and the authentication switch, and stores the identification address of the terminal device authorized by the authentication server. ,
The data transmitted from an arbitrary terminal device is intercepted, the identification address of the arbitrary terminal device included in this data is compared with the stored identification address of the authorized terminal device, and the identification of the arbitrary terminal device is performed. A network control method characterized by determining whether or not authorized based on whether or not the address matches a stored identification address, and identifying a terminal device related to the unauthorized identification address as an unauthorized connection terminal.   5. The network control method according to claim 4, further comprising invalidating a connection of the terminal device identified as the unauthorized connection terminal to the LAN.   6. The network control method according to claim 4 or 5, wherein the network control method is applied to a LAN using an authentication system using IEEE802.1X authentication. A terminal device to be authenticated, an authentication server that receives authentication information of the terminal device and authenticates whether or not to authorize connection to the LAN, and relays communication between the terminal device and the authentication server. An authentication system comprising an authentication switch for performing a computer program installed in a network control computer for monitoring the authentication system and detecting unauthorized connection,
Intercepting communication contents according to the authentication protocol communicated between the authentication server and the terminal device between the authentication server and the authentication switch, and storing the identification address of the terminal device authorized by the authentication server;
An identification address included in data transmitted from an arbitrary terminal device is received and compared with the identification address of the authorized terminal device stored by the step, and the identification address of the arbitrary terminal device is stored A computer program comprising: determining whether or not authorization has been made based on whether or not the address matches, and identifying the terminal device associated with the unapproved identification address as an unauthorized connection terminal.   The computer program according to claim 7, further comprising a step of invalidating connection of the terminal device identified as the unauthorized connection terminal to the LAN.

Images