JP2010010872A - Access controller, access control method, and access control program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To efficiently and easily perform a filtering. <P>SOLUTION: The access controller 1 is communicable with a DHCP (Dynamic Host Configuration Protocol) server and a group of terminals communicable with the DHCP server, and has: a communication processing part 111 for transmitting a DHCP request to the DHCP server and receiving a DHCP offer including an address of the DHCP server and addresses of the group of terminals managed by the DHCP server from the DHCP server; a table processing part 113 for reflecting respective addresses included in the acquired DHCP offer to an access table 121 of a storage part 12; and an access control unit 114 for controlling accesses to the DHCP server and other terminals on the basis of information in the access control table 121. <P>COPYRIGHT: (C)2010,JPO&INPIT

Description

  The present invention relates to an access control apparatus, an access control method, and an access control program technique.

FIG. 9 is a diagram illustrating a configuration of a general wireless LAN (Local Area Network) system.
As shown in FIG. 9, the wireless LAN system 10d is a router 5 that is a device that communicates with a WAN (Wide Area Network) by connecting LANs to each other, and a concentrator in the LAN that is connected to the router 5 by wire. There is a certain hub 4 and an access point device (hereinafter referred to as AP (Access Point) 2d) that is connected to the hub 4 in a wired manner and performs wireless communication with the terminal 3. The terminal 3 can access the wireless LAN system 10d by performing wireless communication with the AP 2d (broken arrow in FIG. 9).
In such a wireless LAN system 10d, communication between terminals 3 can be performed freely.

However, in a network such as a wireless LAN, there is a case where it is desired to restrict access to a terminal or WAN in the LAN, and a technique for restricting access to such a terminal is disclosed (for example, see Patent Documents 1 and 2). ).
The technique described in Patent Literature 1 sets a filtering rule in advance, and when a packet arrives from a local device (terminal), determines whether the device information included in the packet matches the filtering rule. If they match, the source MAC (Media Access Control) address is registered in the filtering table. Then, when a packet arrives from this terminal after the next time, whether or not the packet is allowed to pass is controlled by whether or not the MAC address included in the packet is registered in the filtering table.

Further, the technology described in Patent Document 2 assigns a different subnet to each wireless LAN terminal (terminal) so that direct communication with each other cannot be performed, and communication between terminals can be performed only through an access restriction device designated as a default gateway. By enabling it, filtering of communication between terminals is enabled.
JP 2007-53703 A (Claim 1, Claim 4 and Claim 5) JP 2004-173176 A (paragraph 0029 and paragraph 0031)

  However, in the technique described in Patent Document 1, the filtering rule is a vendor code or device type information, and a person who does not have specialized knowledge cannot easily set it. Further, each time the first packet is transmitted from the terminal, the filtering rule is collated and the MAC address is registered in the filtering table, which is also inefficient.

  In the technique described in Patent Document 2, since different subnets are assigned to each terminal, the terminals belong to different networks, and the LAN characteristics cannot be utilized. Further, since it is necessary to change the setting every time the LAN configuration is changed, it is difficult to flexibly cope with the change in the LAN configuration.

  In view of the above problems, an object of the present invention is to perform filtering efficiently and easily.

  In view of the above problems, the present invention provides an access control apparatus capable of communicating with a DHCP server and a first device whose identification information is managed by the DHCP server, wherein the access control for the first device and A storage unit holding access control information for storing access control information for a second device that is a device other than the first device; a DHCP request to the DHCP server; and the DHCP server From the communication processing unit that receives the DHCP offer for the DHCP request, including the identification information about the first device, and the identification information included in the acquired DHCP offer, the storage unit Access information associated with access control information related to access control for the first device The destination information is determined according to whether the destination information of the information sent to the access control information is included in the identification information of the first device in the access control information. Whether the destination information is the destination information to the second device, and according to the determination result, the information about access control to the first device and the information about access control to the second device, And an access control unit that controls access to a device that is a transmission source of the transmitted information.

  By adopting such a configuration, the access control device can easily perform access restriction by reflecting the address included in the DHCP offer in the address control table.

  The transmission of the DHCP request may be performed each time the access control apparatus is turned on.

  By adopting such a configuration, even if the number of terminals in the network increases or decreases while the power of the access point device is turned off, it is possible to flexibly cope with it.

  Other means of the present invention are appropriately described in the embodiment.

  According to the present invention, filtering can be performed efficiently and easily.

  Next, an embodiment (this embodiment) of the present invention will be described in detail with reference to the drawings as appropriate.

(Configuration of wireless LAN system)
FIG. 1 is a diagram illustrating a configuration example of a wireless LAN system according to the present embodiment.
A wireless LAN system 10 includes a router 5 that is a device that communicates with a WAN (Wide Area Network) by connecting LANs to each other, a hub 4 that is connected to the router 5 and is a wire concentrator in the LAN, and a hub. 4 and an access point device (hereinafter referred to as AP2) that is connected to the terminal 4 and performs wireless communication with the terminal 3. The terminal 3 can access the wireless LAN system 10 by performing wireless communication with the AP 2 (broken line arrow in FIG. 1). The router 5 also has a function as a DHCP (Dynamic Host Configuration Protocol) server. Further, the AP 2 includes a function of the access control device 1 which will be described later with reference to FIG. The terminal 3, AP2 (access control device 1), etc. belong to a subnetwork (hereinafter referred to as the same subnet 31) whose address (in this embodiment, an IP (Internt Protocol) address) is managed by a DHCP server. Equipment. Further, the port of the router 5 connected to the same subnet 31 (LAN) side has an address belonging to the same subnet 31. That is, the same subnet 31 corresponds to a LAN, and other than the same subnet 31 corresponds to a WAN.
In the present embodiment, the function of the DHCP server is included in the router 5, but the present invention is not limited to this and may be an independent device. In the present embodiment, the access control device 1 is included in the AP 2, but is not limited thereto, and may be an independent device.

(Configuration of access control device)
FIG. 2 is a diagram illustrating a configuration example of the access control apparatus according to the present embodiment.
The access control apparatus 1 performs wireless communication with the terminal 3 and a processing unit 11 that processes information, a storage unit 12 that stores information, a wired communication unit 13 that performs wired communication with the hub 4 (FIG. 1), and the terminal 3. And a wireless communication unit 14.
The storage unit 12 stores an access control table 121 (access control information) which will be described later with reference to FIG.
The processing unit 11 includes a communication processing unit 111, an address acquisition unit 112, a table processing unit 113 (access information processing unit), and an access control unit 114.
The communication processing unit 111 has a function of processing information related to communication. The address acquisition unit 112 includes an address (identification information about the first device) assigned to the access control device 1 included in the DHCP offer acquired from the DHCP server (router 5 (FIG. 1)) via the wired communication unit 13, , And a function of acquiring a subnet mask (identification information relating to the first device). In this embodiment, the address of the router 5 and the address of the DHCP server are the same, but of course they may be different. The table processing unit 113 has a function of generating subnet information described later from the address acquired by the address acquisition unit 112 and reflecting it in the access control table 121 of the storage unit 12. The access control unit 114 has a function of controlling access to other devices by the terminals 3 belonging to the same subnet 31 according to the access control table 121. The communication processing unit 111, the address acquisition unit 112, and the table processing unit 113 are also functions as the DHCP client 115.

  Incidentally, in the processing unit 11 and each of the units 111 to 114 in FIG. 2, an access control program stored in a ROM (Read Only Memory) (not shown) or a HD (Hard Disk) (not shown) is stored in a RAM (Random Access Memory) (not shown). This is realized by being expanded and executed by a CPU (Central Processing Unit) (not shown).

(Access control table)
FIG. 3 is a diagram illustrating an example of an access control table according to the present embodiment.
Based on the information acquired from the DHCP server (FIG. 1), the access control table 121 includes the same subnet information (hereinafter referred to as “same subnet” as appropriate) and information other than the same subnet information (hereinafter referred to as “other than the same subnet” as appropriate). ”) And information indicating that communication is permitted (“ ◯ ”in FIG. 3) and“ x ”indicating that communication is not permitted (not permitted) are stored in correspondence with each other. . The specific meanings of “permission” and “non-permission” of communication will be described later with reference to FIGS.
The same subnet information is generated by multiplying the address assigned to the access control device 1 belonging to the same subnet 31 with the group of terminals 3 managed by the router 5 (DHCP server) shown in FIG. 1 and the subnet mask. Information. The same subnet information includes a subnet mask and an address assigned to the access control device 1.

(Access control setting process)
Next, the access control setting process according to the present embodiment will be described along FIG. 4 with reference to FIGS. 2 and 3. The process of FIG. 4 is a process performed every time the access control apparatus 1 is activated.
FIG. 4 is a flowchart showing a flow of access control setting processing according to the present embodiment.
First, when the access control device 1 is activated (S101), the communication processing unit 111 transmits a DHCP request to the router 5 (DHCP server) via the wired communication unit 13 (S102). The DHCP server that has received the DHCP request receives the DHCP offer including the address assigned to the access control device 1 belonging to the same subnet (same subnet 31) as the device (such as the group of terminals 3) managed by the DHCP server, the subnet mask, and the like. Send.

  When the wired communication unit 13 receives this DHCP offer (S103), the address acquisition unit 112 acquires an address assigned to the access control device 1 included in the received DHCP offer and a subnet mask. Subsequently, the same subnet information is generated from the address assigned to the access control device 1 acquired by the table processing unit 113 and the subnet mask, and the calculated same subnet information is reflected in the access control table 121 (S104). At this time, an access rule indicating whether access to other than the same subnet 31 via the router 5 is permitted or access to the same subnet 31 (such as the terminal 3 in the LAN) is predetermined by the user. In addition, a field for storing the same subnet information is also set in advance. Therefore, the table processing unit 113 registers the same subnet information generated according to the determined access rule in the corresponding column of the access control table 121. In this case, permission / non-permission of communication corresponding to the column in which the same subnet information is not registered becomes access rule information regarding a device (second device) other than the same subnet 31.

Depending on the actual network conditions, access rules (communication permission / disapproval) for the DHCP server address and DNS (Domain Name Server) server address installed independently of the router 5 are accessed. It may be additionally registered in the control table. In this case, access to the DHCP server or DNS server can be controlled using this access rule.
Note that broadcast and multicast packets need not be controlled regardless of whether or not they are in the same subnet.

Then, the access control unit 114 controls access of the terminal 3 according to the access control table 121 (S105). The access control unit 114 determines whether the destination address (destination information) of the transmitted packet is an address included in the same subnet information in the access control table 121. Based on this determination, the access control unit 114 determines whether the transmitted packet is applied to the terminal 3 in the same subnet 31 or applied to a device other than the same subnet 31. That is, if the destination address of the transmitted packet is not included in the same subnet information, the access control unit 114 determines that the destination of the packet is a device other than the same subnet. Then, the access control unit 114 selects whether to pass or discard the packet based on the result of the determination and the information of “permitted” / “not permitted” of the corresponding communication. To control.
Then, the processing unit 11 determines whether or not the power source of the access control device 1 is turned off (S106).
If the result of determination in step S <b> 106 is that the power supply has not been turned off (S <b> 106 → No), the processing unit 11 returns the processing to step S <b> 105.
If the result of determination in step S <b> 106 is that the power is turned off (S <b> 106 → Yes), the processing unit 11 ends the processing.

(Actual access control)
5 to 8 are diagrams for explaining the actual access control according to the present embodiment. 5 to 8, the same elements as those in FIG.
5 to 8, the terminals 3 are grouped into terminal groups 30a to 30c by APs 2 that are wirelessly connected.
First, as shown in FIGS. 5 and 6, in the access control table 121a of AP2 (access control device 1) connected to the terminal group 30a, access to addresses other than the same subnet 31 (other than the same subnet) is “◯”. A description will be given of a case where access to the same subnet address (same subnet) is “x” (not permitted). In this case, as shown in FIG. 5, access from the terminals 3 in the terminal group 30a via the router 5 (that is, access to the WAN: access to other than the same subnet 31) is permitted. Thus, the terminal 3 in the terminal group 30a cannot access the terminal 3 (the group of terminals 3 belonging to the same subnet 31) in the other terminal groups 30b and 30c.

  Thereby, for example, the terminal 3 in the terminal group 30a is installed in an internet space near the reception in the company and is in an environment where the customer can freely operate, and the terminal 3 in the terminal group 30b, 30c is installed in the company. Suppose you are. In such a case, the administrator permits access from the terminals 3 in the terminal group 30a to the Internet (WAN), but wants to prohibit access to the terminals 3 in the terminal groups 30b and 30c. According to the access control apparatus 1 according to the present embodiment, access via the router 5 (access to other than the same subnet 31) is permitted, but access to a device in the LAN (terminal 3 belonging to the same subnet 31) is permitted. The access control device 1 can easily restrict access by reflecting the address included in the DHCP offer in the address control table 121a only by determining a simple setting such as not permitting access.

  For example, when the terminal 3 is moved from the terminal group 30a to the terminal group 30b while the access control apparatus 1 is in operation, the moved terminal 3 is subjected to access control in the destination terminal group 30b. As described above, according to the present embodiment, it is possible to easily change the access control simply by moving the terminal 3.

  Next, as shown in FIGS. 7 and 8, in the access control table 121b of AP2 (access control device 1) connected to the terminal group 30a, access to other than the same subnet 31 is “x” (not permitted). A case where access to the same subnet 31 is “◯” (permitted) will be described. In this case, as shown in FIG. 7, the terminal 3 in the terminal group 30a can access the terminal 3 (the group of terminals 3 belonging to the same subnet 31) in the other terminal groups 30b and 30c. As shown in FIG. 8, access from the terminal 3 in the terminal group 30a via the router 5 (that is, access to the WAN: access to other than the same subnet 31) is not permitted.

Thereby, for example, it is possible to easily prohibit a person in the company from accessing the Internet during work with a simple setting.
Of course, in the access control table 121, by setting both the information other than the same subnet 31 and the same subnet information to “◯”, the access to the WAN (same subnet 31) also allows the terminal group 30 belonging to the same subnet 31. Access to can also be possible.

In the present embodiment, a wireless LAN is assumed. However, the present invention is not limited to this and may be used for a wired LAN. Further, the address of the access control device 1 may not be an address belonging to the same subnet 31, and the access control device 1 may not have an address. Further, when the access control device 1 is a device independent of the AP 2, it is a matter of course that the AP 2 in FIG. 1 is replaced with the access control device 1.
The access device 1 may be provided with a hardware switch, and the access control may be set by switching the switch.
In this embodiment, access to the terminal 3 is controlled. However, the present invention is not limited to this. Access to file servers, AV (Audio Visual) devices compliant with the Digital Living Network Alliance (DLNA), information appliances, etc. It may be a control target.

(effect)
According to this embodiment, access via the router 5 (access to other than the same subnet 31) is permitted, but access to a device (terminal 3) in the LAN (access to a device belonging to the same subnet 31). ) Is simply determined in advance, and after that, the access control device 1 can easily restrict access by reflecting information generated based on the address included in the DHCP offer in the address control table. Access control). That is, even those who have relatively no specialized knowledge can easily perform access restriction. In addition, since the information included in the DHCP offer for the DHCP request transmitted to the DHCP server is used, it is not necessary to perform complicated settings using a setting screen or the like.

  Further, by performing the processing shown in FIG. 4 every time the access control device 1 is activated, it is possible to cope with the change of the terminal 3 connected to the AP 2 due to the movement of the terminal 3, for example. That is, it is possible to flexibly cope with changes in the LAN configuration. Further, since it is not necessary to register in the table every time a new packet is transmitted from the terminal 3, access restriction (access control) can be set efficiently. In addition, the control target can be easily changed simply by changing the installation position of the access control device 1.

It is a figure which shows the structural example of the wireless LAN system which concerns on this embodiment. It is a figure which shows the structural example of the access control apparatus which concerns on this embodiment. It is a figure which shows the example of the access control table which concerns on this embodiment. It is a flowchart which shows the flow of the access control setting process which concerns on this embodiment. It is a figure for demonstrating the actual of the access control which concerns on this embodiment (the 1). It is a figure for demonstrating the actual of the access control which concerns on this embodiment (the 2). It is a figure for demonstrating the actual of the access control which concerns on this embodiment (the 3). It is a figure for demonstrating the actual of the access control which concerns on this embodiment (the 4). It is a figure which shows the structure of a general wireless LAN system.

Explanation of symbols

1 Access control device 2 AP
3 Terminal 4 Hub 5 Router 10 Wireless LAN System 11 Processing Unit 12 Storage Unit 13 Communication Unit 30, 30a-30c Terminal Group 31 Same Subnet (First Device)
111 Communication Processing Unit 112 Address Acquisition Unit 113 Table Processing Unit (Access Information Processing Unit)
114 Access control unit 121, 121a, 121b Access control table (access control information)

Claims (7)

An access control apparatus capable of communicating with a DHCP server and a first device whose identification information is managed by the DHCP server,
A storage unit that holds access control information in which information related to access control to the first device and access control to a second device that is a device other than the first device is stored;
A communication processing unit for transmitting a DHCP request to the DHCP server, and receiving a DHCP offer for the DHCP request, which includes identification information about the first device, from the DHCP server;
An access information processing unit that associates the identification information included in the acquired DHCP offer with information related to access control for the first device in the access control information of the storage unit;
Depending on whether or not the destination information of the information sent to the access control device is included in the identification information of the first device in the access control information, the destination information is the destination information to the first device. Or the destination information to the second device, and sent according to the determination result, information on access control for the first device and information on access control for the second device. An access control device comprising: an access control unit that controls access to a device that is a transmission source of information.   The access control apparatus according to claim 1, wherein the DHCP request is transmitted every time the access control apparatus is powered on.   The access control apparatus according to claim 1, wherein the access control apparatus is included in an access point in a wireless LAN.   The access control apparatus according to claim 1, wherein the identification information includes a subnet mask related to a terminal whose identification information is managed by the DHCP server, and an address of the access control apparatus.   The access control apparatus according to claim 1, wherein the access control apparatus includes a switch related to setting of the access control information. An access control method by an access control apparatus capable of communicating with a DHCP server and a first device whose identification information is managed by the DHCP server,
The access control device
The storage unit holds access control information in which information related to access control to the first device and access control to a second device that is a device other than the first device is stored,
Send a DHCP request to the DHCP server;
Receiving, from the DHCP server, a DHCP offer for the DHCP request that includes identification information about the first device;
Associating the identification information included in the acquired DHCP offer with information related to access control for the first device in the access control information of the storage unit;
Depending on whether or not the destination information of the information sent to the access control device is included in the identification information of the first device in the access control information, the destination information is the destination information to the first device. Or the destination information to the second device,
Controlling access related to a device that is a transmission source of the transmitted information, according to the determination result, information related to access control for the first device, and information related to access control for the second device. Access control method.   An access control program causing a computer to execute the access control method according to claim 6.

Images