JP2010049331A - Management device, method, and program for network equipment - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a network equipment management device, management method, and management program for reducing the labor of a network equipment manager and for maintaining robust security. <P>SOLUTION: A network equipment management device (1) includes a setting management means (11) for managing the setting of a plurality of network equipments (R) connected to a server (2). A password management means (13) periodically updates and stores a setting management password for making it possible to change the setting of each network equipment (R). An authentication information management means (12) stores authentication information for connecting a computer (4) for management to the setting management means (11). In this case, the authentication information management means (12) maintains the connection with the setting management means (11) to only the computer (4) for management which has transmitted the authentication information, and the setting management means (11) makes it possible for the computer (4) for management to change the setting of the network equipment (R) through the password management means (13). <P>COPYRIGHT: (C)2010,JPO&INPIT

Description

  The present invention relates to a network device management apparatus, management method, and management program, and more particularly to a network device management apparatus, management method, and management program for network infrastructure construction.

  In recent years, with the complication of network infrastructure such as in-house LANs, the number of network devices constituting the same has increased. The labor of network device managers who change the settings of such a large number of network devices as needed for the construction of network infrastructure and maintain them is also increasing.

For example, Patent Document 1 discloses a network device intended to reduce the management work of the network device. More specifically, user authentication information and a setting change command that can be used by the user are stored in advance in a network device that connects the service providing network and the user network. The network device allows a setting change within a range of a setting change command that can be used in accordance with the user authentication information.
JP 2004-7295 A

  Like the network device disclosed in Patent Document 1, by leaving the setting change to the user, the labor of the administrator of the network device is reduced. On the other hand, if the strictness of user authentication to network devices is lacking, the security of the network is lowered. In particular, when the network infrastructure becomes large and the number of users increases, the deterioration of security becomes more serious. Further, the administrator must always monitor the change of the network device setting so that the network device setting change not intended by the network administrator is not performed. Conversely, if the user's setting change conditions are severely limited so that such setting changes are not made, the dilemma that the administrator does not change the effort as if the administrator himself / herself manages the network equipment. It happens.

  The present invention has been made in view of such a situation, and an object of the present invention is to provide a network device management apparatus, a management method, and a management program that can reduce the labor of a network device administrator and maintain robust security. It is to be.

  The network device management apparatus according to the present invention is a network device management device including a setting management means for managing settings of a plurality of network devices, and periodically updates a setting management password that allows the setting of each network device to be changed. However, password management means for storing this, and authentication information management means for storing authentication information for connecting a management computer to the setting management means, wherein the authentication information management means transmits the authentication information The connection with the setting management unit is maintained only for the management computer, and the setting management unit allows the management computer to change the setting of the network device via the password management unit. And

  According to the above configuration, it is possible to ensure robust security by periodically updating the setting management password of the network device without modifying the network device. On the other hand, the administrator can change the settings of the network device without entering the settings management password one by one on the condition that the authentication information is confirmed. Can be reduced.

  Furthermore, it comprises change history management means for encrypting and storing a setting change history for each network device, and for decrypting and transmitting it in response to a request from the management computer connected to the setting management means. It is also good. According to such a configuration, the change history can be confirmed only by the management computer whose authentication information has been confirmed, the setting change of the network device can be monitored, and it can be confirmed whether fraud or the like has been performed.

  Further, the authentication information management means may store authentication information given to the management computer. According to this configuration, it is possible to change the setting of the network device only to a specific management computer, and to ensure robust security.

  Further, the authentication information management means may store authentication information given to an operator who operates the management computer. According to such a configuration, only a specific operator (administrator) can change the setting of the network device to ensure robust security.

  Furthermore, the network device may include a server. According to such a configuration, the setting of the server can be changed as with the network device. In other words, the administrator's effort can be reduced while maintaining robust security.

  The network device management method according to the present invention is a network device management method for managing settings of a plurality of network devices, and authentication for connecting a management computer to a setting management means for managing the settings of the network devices. Authentication information management step for storing information, and setting of the network device by the management computer that has transmitted the authentication information using a setting management password for each network device that is automatically updated and stored periodically. And a step of making the changeable.

  According to the above method, robust security can be ensured by periodically updating the setting management password of the network device. On the other hand, the administrator can change the settings of the network device without entering the setting management password every time, as long as the authentication information is confirmed. it can.

  The network device management method may further include a step of encrypting and storing a setting change history for each network device. Furthermore, the change history may be decrypted and returned in response to a request from the management computer that has transmitted the authentication information. According to such a method, the change history can be confirmed only by the management computer whose authentication information is confirmed, and the setting change of the network device can be monitored to check whether fraud or the like has been performed.

  In the above-described method, the network device may include a server. According to such a method, the setting of the server can be changed similarly to the network device. In other words, the administrator's effort can be reduced while maintaining robust security.

  Furthermore, a network device management program according to the present invention is a network device management program for managing settings of a plurality of network devices, and periodically updates a setting management password that allows the setting of each network device to be changed. However, a password management process for storing the authentication information, an authentication information management process for storing authentication information for permitting connection to the network device, and a management computer that transmits the authentication information using the setting management password And a setting management process for enabling the setting of the network device to be changed.

  According to the above program, it is possible to ensure robust security by periodically updating the setting management password of the network device. On the other hand, the administrator can change the settings of the network device without entering the setting management password every time, as long as the authentication information is confirmed. it can.

  The network device management program encrypts and stores the change history of the setting for each network device, and decrypts and returns the change history in response to a request from the management computer that has transmitted the authentication information. And a routine for executing the processing. According to such a program, the change history can be confirmed only by the management computer whose authentication information has been confirmed, the setting change of the network device can be monitored, and it can be confirmed whether fraud or the like has been performed.

  In the above program, the network device may include a server. According to such a method, the setting of the server can be changed similarly to the network device. In other words, the administrator's effort can be reduced while maintaining robust security.

  One embodiment of the present invention will be described in detail with reference to FIGS.

  First, a system including the network device management apparatus of this embodiment will be described.

  As shown in FIG. 1, the management computer 4 can be connected to the server 2 via the network 3. In addition, the server 2 is connected to a plurality of network devices R (R1 to Rn) via an in-facility network such as a LAN (Local Area Network).

  As will be described later, the management computer 4 is a computer operated by an administrator who manages the network device R. The management computer 4 includes a display device 41, a keyboard 42, and input devices such as a mouse and a scanner (not shown). Further, a biometric information scanner or the like that captures biometric information such as veins and retinas, which will be described later, as authentication information (not shown) may be included.

  The network 3 is a wide area network such as a WAN (Wide Area Network). The network 3 may be a public network such as the Internet or an in-facility network such as an in-house LAN.

  The network device R is a device that constructs a network infrastructure, and is specifically a repeater such as a repeater, hub, bridge, switch, switching hub, router, or wireless LAN access point. In addition to storage installed at the end of the network, various server devices can be included. By the way, the network device R can log in to this from an external computer and change settings such as permitting or restricting various functions. Here, in general, in order to log in to the network device R from an external computer, a setting management password for preventing unauthorized access from an external computer that is not intended to change the setting is required.

  The server 2 includes a CPU 101, a ROM 102, a RAM 103, a communication unit 6, and a management device 1, and is connected by a system bus 100 so that information can be exchanged among them as necessary.

  The management device 1 includes a setting management unit 11, an authentication information management unit 12, a password management unit 13, a change history management unit 14, and a storage device 15 having a CPU (not shown).

  The authentication information management means 12 maintains the connection with the setting management means 11 only for the external computer 4 that has transmitted authentication information, which will be described later, stored in advance in the storage device 15, and cuts off the connection if there is no such information. . Here, the authentication information is authentication information given to the management computer 4 and / or authentication information given to an administrator (operator) who manages the network device R. Thereby, only a specific management computer 4 and / or a specific administrator can connect to the setting management means 11.

  Examples of the authentication information given to the individual administrator include a password, a one-time password, matrix authentication, a PIN (Personal Identification Number) code, an electronic certificate, and authentication information using biometric information such as a vein or retina. When the management computer 4 is used, these are taken into the management computer 4 by a keyboard 42, an input device such as a mouse and a scanner (not shown), a biometric information scanner such as a vein and retina as biometric information scanner, and the like. Sent to.

  The authentication information given to the management computer 4 includes, for example, a password, a one-time password, and an individual identification code. These are given in advance to the management computer 4 and sent to the management apparatus 1 as they are.

  The password management means 13 logs in to each of the network devices R1 to Rn stored in advance in the storage device 15 according to a predetermined time schedule, and updates the setting management password. The updated setting management password is overwritten in the storage device 15. The automatic update history is encrypted by a change history management unit 14 to be described later and stored in the storage device 15 as a password update log. Further, the password management unit 13 sends a corresponding password to the management computer 4 so that the management computer 4 connected to the setting management unit 11 can log in to the desired network device Rx among the network devices R1 to Rn. Instead, it transmits to the network device Rx.

  The change history management unit 14 encrypts and stores an operation log including time information for login / logout of the management computer 4 to the network devices R1 to Rn, setting change content information, and the like in the storage device 15. In addition, the operation log and the password update log are decrypted as necessary.

  The storage device 15 includes the above-described authentication information, setting management password, password update log, operation log, and time schedule, a program for operating the management device 1, and a profile including the model name and model number of the network device R to be described later. Is a device for storing.

  The setting management unit 11 includes a CPU (not shown), and causes the above-described authentication information management unit 12, password management unit 13, and change history management unit 14 to be executed as necessary. The setting management unit 11 receives selection information of the network device Rx that is desired to be logged in from the management computer 4 that is connected by the authentication information management unit 12. In response to this, the setting management unit 11 logs in to the network device Rx via the password management unit 13 instead of the management computer 4 and relays between the management computer 4 and the network device Rx. The setting management unit 11 temporarily stores the contents of command transmission between the management computer 4 and the network device Rx in the storage device 15, and stores the operation log in the change history management unit 14 as setting change content information. Let it be created.

  Next, the network device management method will be described in detail with reference to FIGS.

  First, a method for automatically updating the setting management password of the network device R will be described.

  In particular, as shown in FIG. 2, the setting management unit 11 (see FIG. 1) causes the password management unit 13 to execute a password update routine S1 according to a predetermined time schedule. In the password management means 13, first, one of the network devices R is selected as a target, and a setting management password corresponding to this is acquired from the storage device 15 (S10). The setting management password is transmitted to the network device Rx to log in to the network device Rx (S11). Subsequently, a new setting management password is created as follows (S12).

  Referring also to FIG. 3, the setting management password for the network device R is created in accordance with the specifications for each network device R. The setting management password is generally composed of alphabets, numbers, and symbols, and is created by combining within a predetermined number of characters. This setting management password is created using a well-known algorithm in accordance with a policy predetermined in the password management means 13 within the specification range, for example, by setting the number of characters to 8 characters or mixing at least alphabets and numbers. Is done.

  The password management unit 13 updates the setting management password of the network device Rx to the created new setting management password (S13). At the same time, the password management means 13 overwrites the storage device 15 with the updated setting management password of the network device Rx (S14). Further, the password management unit 13 encrypts the time when the setting management password is updated via the change history management unit 14 and stores it in the storage device 15 as a password update log (S15). The password update log can be decrypted and output as an audit report as needed (S16).

  As described above, since the setting management password set for each network device R is periodically updated, access to the network device R from an unintended unauthorized external computer can be prevented from being changed. That is, security can be ensured.

  Next, a method for changing the setting of the network device R by an external computer will be described.

  Referring to FIGS. 1 and 4, the administrator first performs a connection request operation to connect the management computer 4 to the management apparatus 1 by operating an input device such as the keyboard 42 of the management computer 4 (S21). ). The above-described authentication information input to the management computer 4 and / or input to the management computer 4 in advance is transmitted to the management apparatus 1 (S22).

  The setting management unit 11 of the management device 1 causes the authentication information management unit 12 to collate the authentication information transmitted from the management computer 4 with the authentication information stored in the storage device 15. The authentication information management means 12 maintains the connection between the management computer 4 and the setting management means 11 only when they match, and cuts off the connection when they do not match. Further, the setting management unit 11 calls the information necessary for configuring the profiles of the network devices R1 to Rn and the management screen described later from the storage device 15 and returns the information to the management computer 4 (S23).

  Referring also to FIG. 5, the management computer 4 displays the management screen 20 on the display device 41 based on the information returned from the setting management means 11 (S24). The management screen 20 includes an operation log information column 22 for displaying operation log information including a list 21 of profiles of the network devices R1 to Rn and change information of individual setting contents of the network devices R1 to Rn, and a password change. And an update log information field 23 for displaying password update log information including a history and the like. Here, when the administrator operates the pointer 25 on the management screen 20 to select the network device Rx for which log information is to be displayed among the network devices R1 to Rn, this field is highlighted. In response to the selection of the network device Rx, the management computer 4 transmits an information request signal to the setting management means 11. In response to the information request signal, the setting management unit 11 causes the change history management unit 14 to call the operation log and the password update log corresponding to the network device Rx selected from the storage device 15, and decrypts the operation log and the password update log. The log information is returned to the management computer 4. The management computer 4 displays log information related to the operation log information column 22 and the update log information column 23 of the management screen 20. The password update log and operation log are encrypted and stored in the storage device 15 for a predetermined period (for example, the past three years). To be sent to the management computer 4.

  Next, when changing the setting of a specific network device Rx, the administrator selects the specific network device Rx by operating the pointer 25 in the same manner as described above (particularly, see FIG. 5), and this field is highlighted. . Subsequently, the button 24 is pressed by the pointer 25 to call a command input screen (S25). With this operation, the management computer 4 transmits a connection request to the network device Rx to the management apparatus 1 (S26). In response to the connection request, the management device 1 calls the setting management password corresponding to the network device Rx from the storage device 15 via the password management unit 13 and transmits it to the network device Rx. A login request is made (S27). In response to the login request, the network device Rx checks whether the transmitted setting management password matches the setting management password set in the network device Rx. If they match, the network device Rx permits login, and the connection between the management device 1 and the network device Rx is established (S28). When the setting management means 11 confirms that the user has logged in by receiving cookie information, that is, if the management computer 4 is allowed to change the setting of the network device Rx, the information necessary for configuring the command input screen Is transmitted from the storage device 15 to the management computer 4 (S29). Based on the transmitted information, the management computer 4 displays a command input screen (not shown) on the display device 41 separately from the management screen 20 (S30). By displaying the command input screen, the administrator can recognize the login of the setting management means 11 to the network device Rx.

  When the information necessary for configuring the command input screen is in the network device Rx, the command input screen is configured from the network device Rx after the connection between the management device 1 and the network device Rx (S28). Necessary information is transmitted to the management computer 4 and displayed on the display device 41.

  To change the setting of the network device Rx using the command input screen, the administrator inputs a setting change command to be executed by the network device Rx from the management computer 4 on the command input screen (S31). . The management computer 4 transmits this command to the management device 1 (S32). In the management apparatus 1, the setting management unit 11 transfers the command to the network device Rx (S33). In the network device Rx, the transferred command is executed (S34). The command execution result information is returned to the management apparatus 1 (S35), and the information is transferred to the management computer 4 by the setting management means 11 of the management apparatus 1 (S36). The management computer 4 displays the transferred information on a command input screen (not shown) (S37). Thus, the administrator can change the setting of the network device Rx by inputting a command on the command input screen. The change history management unit 14 encrypts the setting change content information of the network device Rx as an operation log and stores it in the storage device 15.

  When the administrator closes the command input screen after completion of necessary operations such as setting changes, a work end instruction (1) for the network device Rx corresponding thereto is issued (S38). In response to this work end instruction (1), the management computer 4 transmits an end instruction to the management apparatus 1 (S39). In response to the transmitted termination instruction, the setting management unit 11 of the management apparatus 1 issues a logout request to the network device Rx (S40), logs out of the network device Rx, and is disconnected (S41).

  After logout, the change history management means 14 encrypts logout time information for the network device Rx as an operation log and stores it in the storage device 15 (S42).

  It is also possible to log in to a plurality of network devices R at the same time. In this case, the procedure from S25 to S42 is repeated.

  When all the operations are completed, the administrator closes the management screen 20. As a result, a work end instruction (2) is obtained (S43). In response to the work end instruction (2), the management computer 4 requests disconnection of the connection with the management apparatus 1 (S44), and the connection with the management apparatus 1 is disconnected (S45).

  As described above, conventionally, the administrator logs in the network device while inputting the setting management password. In this case, especially when the number of network devices increases, management of the setting management password by the administrator becomes a heavy burden. Therefore, the security may be lowered by making the setting management password common to a plurality of network devices or continuing to use the setting management password without updating it for a long period of time.

  On the other hand, in this embodiment, an individual setting management password is given to each of the network devices R1 to Rn, and these are updated periodically. Further, the connection to the setting management means 11 of the external management computer is restricted by the authentication information. A legitimate administrator can transmit only authentication information from the external management computer and can perform the same operation as logging in directly without being aware of the setting management password of the network device R. Therefore, the administrator's labor can be reduced while ensuring robust security.

  In addition, the operation change and password update log encrypted by the change history management unit 14 and stored in the storage device 15 can be used to monitor the setting change of the network device R and confirm whether fraud or the like has been performed.

  Furthermore, the management apparatus 1 can store authentication information given to the management computer 4 and can change the setting of the network device via the setting management means 11 only for the management computer 4. Secure security.

  Further, the management device 1 can store authentication information given to an operator (administrator) who operates the management computer 4 and can change the setting of the network device only for the administrator. Robust security can be secured. If the authentication information is given to the administrator as described above, the administrator can change the setting of the network device R not only from the specific management computer 4 but also from another external computer.

  Although exemplary embodiments according to the present invention have been described above, the present invention is not necessarily limited thereto, and those skilled in the art will recognize various alternative embodiments and various embodiments without departing from the scope of the appended claims. Modification examples can be found. For example, not only the network device Rx but also the setting change of the server 2 can be similarly performed by the setting management device 1.

1 is a diagram of a system including a management device according to the present invention. 5 is a flowchart of a setting management method according to the present invention. It is a figure showing the setting management method by this invention. It is a figure which shows the procedure of the setting management method by this invention. It is a figure showing the setting management method by this invention.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 Management apparatus 2 Server 3 Network 4 Management computer 11 Setting management means 12 Authentication information management means 13 Password management means 14 Change history management means 15 Storage device 20 Management screen 21 Profile 22 Operation log information column 23 Update log information column R Network device

Claims (12)

A network device management apparatus including a setting management means for managing settings of a plurality of network devices,
Password management means for periodically updating a setting management password that enables the setting for each network device to be changed, and storing the password;
Authentication information management means for storing authentication information for connecting a management computer to the setting management means,
The authentication information management means maintains a connection with the setting management means only for the management computer that has transmitted the authentication information, and the setting management means is configured by the management computer via the password management means. A network device management apparatus characterized in that setting of a network device can be changed.   A change history management unit that encrypts and stores a change history of the setting for each network device and decrypts and transmits to the management computer connected to the setting management unit. The network device management apparatus according to claim 1.   The network device management apparatus according to claim 1 or 2, wherein the authentication information management unit stores authentication information given to the management computer.   The network device management apparatus according to claim 1, wherein the authentication information management unit stores authentication information given to an operator who operates the management computer.   The network device management apparatus according to claim 1, wherein the network device includes a server. A network device management method for managing settings of a plurality of network devices,
An authentication information management step for storing authentication information for connecting a management computer to a setting management means for managing settings of the network device;
Using the setting management password for each network device that is automatically updated and stored periodically to allow the management computer that has transmitted the authentication information to change the setting of the network device. A network device management method.   7. The network device management method according to claim 6, further comprising a step of encrypting and storing a setting change history for each network device.   8. The network device management method according to claim 7, further comprising a step of decrypting and returning the change history in response to a request from the management computer that has transmitted the authentication information.   9. The network device management method according to claim 6, wherein the network device includes a server. A network device management program for managing settings of a plurality of network devices,
A password management process that periodically updates a setting management password that enables the setting of each network device to be changed, and stores this;
Authentication information management processing for storing authentication information for allowing connection to the network device;
A network device management program, comprising: a routine that executes a setting management process that allows a management computer that has transmitted the authentication information to change the setting of the network device using the setting management password.   A routine for executing a process of encrypting and storing a setting change history for each network device and a process of decrypting and returning the change history in response to a request from the management computer that has transmitted the authentication information. The network device management program according to claim 10, further comprising: The network device management program according to claim 10 or 11, wherein the network device includes a server.