JP2010187223A - Authentication server - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To trace the state of a user with an authentication server. <P>SOLUTION: A trace information management part 36 having a user tracing function is provided within a RADIUS server (authentication server) 31 for storing, for each user, an IP address and an MAC address of a user terminal, an IP address and a port number of a packet repeater connected with the user terminal, log-in time and log-out time to a trace information management DB 60. An authentication server 31 obtains these pieces of information for authentication and accounting from attribute of each user stored in a user attribute management DB 50, an ARP table of the packet repeater, and an authentication log. With collation of these pieces of information, it is possible to trace where each user exits at the desired time and with which terminal access is made. <P>COPYRIGHT: (C)2010,JPO&INPIT

Description

  The present invention relates to an authentication server, and more particularly to an authentication server that traces the position of a user based on the attributes of a managed user terminal (supplicant).

When a user terminal connects to a LAN (Local Area Network), a format for authenticating a user using IEEE 802.1X authentication (hereinafter referred to as 802.1X authentication) and controlling whether or not the network can be used is widely used. .
A user authentication method using 802.1X authentication includes a user terminal equipped with authentication client software called a supplicant, a packet relay device functioning as a NAS (Network Access Server), and an authentication server. As an authentication server, a RADIUS (Remote Authentication Dial In User Service) server and a TACACS (Terminal Access Controller Access System) server are generally used. However, only the RADIUS server will be used for the sake of simplicity. .

  The procedure for authenticating whether or not the user can use the LAN starts when the user terminal issues an EAP (Extended Authentication Protocol) start packet to the packet relay apparatus. The packet relay apparatus that has received the EAP start packet transmits an EAP request packet to the user terminal, and the user terminal returns an EAP response packet. The packet relay apparatus that has received the EAP response packet places the EAP response packet on the RADIUS request packet and transmits it to the RADIUS server. When the RADIUS server receives the RADIUS request packet, the authentication process starts between the user terminal and the RADIUS server. There are a plurality of authentication processing methods, and there are EAP-MD5 (Message Digest 5) that authenticates with an ID and password, and EAP-TLS (Transport Layer Security) that authenticates using an electronic certificate.

  When the authentication is established, the RADIUS server writes the authentication result in the EAP success packet, further puts it in the RADIUS accept packet, and transmits it to the packet relay device. On the other hand, if the authentication fails, the RADIUS server writes the authentication result in the EAP failure packet, and further puts it in the RADIUS reject packet and transmits it to the packet relay device. When receiving the RADIUS accept packet, the packet relay device permits in-house LAN access from the port connected to the user terminal. Also, the RADIUS header is removed from the received RADIUS accept packet, only the EAP success packet is transferred to the user terminal, and the user terminal is notified of the successful authentication. Thereby, the user terminal recognizes that the access request to the in-house LAN is authorized. On the other hand, when the packet relay apparatus receives the RADIUS reject packet, the internal LAN access from the port connected to the user terminal is not permitted. Also, the RADIUS header is removed from the received RADIUS reject packet, only the EAP failure packet is transferred to the user terminal, and the user terminal is notified of the authentication failure. Thereby, the user terminal recognizes that the access request to the in-house LAN is rejected.

At this time, in the RADIUS server, for authentication and accounting, the user name and password of each user, the port number of the packet relay apparatus connected to the user terminal, and the like are centrally managed in the form of user attributes. Such information can be acquired when the RADIUS server receives a RADIUS request packet from the packet relay apparatus.
For example, Patent Document 1 and Patent Document 2 are known documents that describe a method of managing a user name, a MAC address and an IP address of a user terminal in combination.

JP 2004-242142 A JP 2003-348114 A

  The reason why the user is authenticated using the authentication server is to eliminate the use of the network from the impersonated unauthorized user or the unauthorized terminal. However, the user attributes currently managed by the authentication server have been used only for authentication and accounting at the time of login. There was no function to continuously check information such as where a user is at an arbitrary time and which terminal is used to access the network. Also, which IP address the user terminal is assigned to is not managed in time series. For this reason, even if a user terminal having a certain IP address as a transmission source address performs unauthorized access at a certain specific time and recognizes it, the user cannot be identified.

  In view of the above, the present invention acquires the IP address of the user terminal, the logout time information of the user, and the like, and the IP address of the user terminal, the MAC address, and the user terminal are connected for each user. It is intended to log the IP address and port number of the packet relay device, login time information, and logout time information. The present invention sorts the log information (hereinafter referred to as trace information management DB or trace information) according to the login time and logout time for each user, so that the user terminal first passes through which packet relay device. One of the purposes is to trace a user's behavior such as logging in and logging out and logging in again through any packet relay device. Further, the present invention uses this trace information management DB to warn of an access by a fraudulent terminal or impersonation when there is a user whose MAC address is frequently different even though the user ID is the same. Is one of the purposes. Another object of the present invention is to specify a user from a time and an IP address when it is detected that a user using a specific IP address illegally uses a network at an arbitrary time. One of them.

  In order to solve the above problems, a trace information management unit is provided in the authentication server, and an ARP (Address Resolution Protocol) table acquisition unit and an authentication log acquisition unit are provided in the trace information management unit. The ARP table acquisition unit acquires and stores the ARP table in the packet relay device. Then, IP address information is provided based on the MAC address information in accordance with a request from the trace information management unit. The authentication log acquisition unit acquires authentication log information in the packet relay device and stores it in the authentication log DB. Then, in accordance with a request from the trace information management unit, logout time information is provided based on the user ID information.

Processing for generating a trace information management DB by the trace information management unit will be described. First, the trace information management unit, from the existing authentication log information (user attribute) of the authentication server, the ID information of the authenticated user, the MAC address of the terminal used by the authenticated user, the IP of the packet relay device to which the terminal is connected Retrieves address, port number and login time information.
Next, through the ARP table management unit, the corresponding IP address is searched and acquired based on the MAC address corresponding to the existing user ID information (the MAC address of the terminal used by the user).

Next, authentication logout time information corresponding to the existing user ID information is acquired through the authentication log acquisition unit.
Next, the information is stored in the trace information management DB for each user. That is, in the trace information management DB, for each user, the IP address and MAC address of the terminal used by the user, the IP address and port number of the packet relay apparatus connected to the terminal, the login time, and the logout time information are stored. Since it is recorded, it is possible to trace where each user is present at an arbitrary time and at which terminal.

The authentication server is, for example, an authentication server composed of a packet processing unit and a line interface,
The packet processing unit has a user attribute control unit and a trace information management unit,
The user attribute control unit has a user attribute management DB, and the trace information management unit has a trace information management DB.
The trace information management unit records the IP address of the user terminal, the MAC address, the IP address of the packet relay device to which the user terminal is connected, the port number, the user login time, and the logout time for each user.

Moreover, the above-mentioned RADIUS server is, for example,
The trace information management unit has a MAC-IP table acquisition unit and a MAC-IP table, an authentication log acquisition unit and an authentication log,
When the MAC-IP table is acquired from the DHCP server, the MAC-IP table is searched using the MAC address of the logged-in user terminal held in the user attribute management DB as a search key, and the corresponding user terminal is supported by the search. Obtaining an IP address and additionally registering the IP address in the trace information management DB,
When the authentication log is periodically acquired from the packet relay device, the authentication log is searched using the user name of the logged-in user held in the user attribute management DB and the MAC address of the user terminal as a search key. The logout information of the user is acquired, and the time is additionally registered in the trace information management DB.

According to the first solution of the present invention,
One or a plurality of packet relay apparatuses having an address resolution table in which the MAC address of the connected user terminal and the IP address of the user terminal are stored correspondingly, and managing a log for authentication or communication with the user terminal And the authentication server in a system including an authentication server that performs user authentication by communicating with the user terminal via the packet relay device,
Corresponding to the user identifier, the MAC address of the user terminal, the IP address of the user terminal, the IP address of the packet relay device, the port identifier of the port of the packet relay device to which the user terminal is connected, and the user A trace information storage unit for storing the login time or logout time of the terminal;
From information received in user authentication with the user terminal, at least a user identifier, a MAC address of the user terminal, an IP address of the packet relay device, and a port of the packet relay device to which the user terminal is connected. An authentication control unit that acquires a port identifier and stores the acquired information in the trace information storage unit correspondingly;
With reference to the address resolution table of the packet relay device to which the user terminal is connected, based on the MAC address of the user terminal acquired by the authentication control unit, obtain the IP address of the corresponding user terminal, An address resolution unit that stores the acquired IP address of the user terminal in the trace information storage unit corresponding to a user identifier;
The log management unit that obtains a logout time of the user terminal with reference to the log in the packet relay device, and stores the obtained logout time in the trace information storage unit corresponding to a user identifier A server is provided.

According to the second solution of the present invention,
An address management device having an address correspondence table in which the MAC address of the user terminal and the IP address of the user terminal are stored in correspondence with each other, and one or a plurality of packet relay devices for managing a log of authentication or communication with the user terminal And the authentication server in a system including an authentication server that performs user authentication by communicating with the user terminal via the packet relay device,
Corresponding to the user identifier, the MAC address of the user terminal, the IP address of the user terminal, the IP address of the packet relay device, the port identifier of the port of the packet relay device to which the user terminal is connected, and the user A trace information storage unit for storing the login time or logout time of the terminal;
From information received in user authentication with the user terminal, at least a user identifier, a MAC address of the user terminal, an IP address of the packet relay device, and a port of the packet relay device to which the user terminal is connected. An authentication control unit that acquires a port identifier and stores the acquired information in the trace information storage unit correspondingly;
With reference to the address correspondence table of the address management device, based on the MAC address of the user terminal acquired by the authentication control unit, the corresponding IP address of the user terminal is acquired, and the acquired IP of the user terminal An address resolution unit for storing an address in the trace information storage unit corresponding to a user identifier;
The log management unit that obtains a logout time of the user terminal with reference to the log in the packet relay device, and stores the obtained logout time in the trace information storage unit corresponding to a user identifier A server is provided.

  Conventionally, the authentication log information held by the authentication server includes user ID information, the MAC address of the terminal used by the user, the IP address and port number of the packet relay apparatus connected to the terminal, and the login time information. There was no IP address or user logout time information.

  On the other hand, the present invention provides a trace information management unit in the authentication server, controls the ARP table acquisition unit and the authentication log acquisition unit, and the authentication server acquires the IP address of the user terminal and the logout time information of the user. It is possible to log the IP address and MAC address of the user terminal, the IP address and port number of the packet relay apparatus connected to the user terminal, login time information, and logout time information for each user. According to the present invention, the log information is sorted according to the log-in and log-out times for each user, so that the user terminal first logs in via which packet relay device, and then logs out to determine which packet relay device. It is possible to trace the user's behavior because it is known whether or not the user has logged in again. Further, according to the present invention, by using this trace information management DB, for example, when there is a user whose MAC address is frequently different even though the user ID is the same, an access by an unauthorized terminal or impersonation is warned. be able to. In addition, according to the present invention, when it is detected that a user using a specific IP address illegally uses the network at an arbitrary time, the user can be specified from the time and the IP address. it can.

It is a figure which shows the network structure in which the user terminal, packet relay apparatus, and RADIUS server in 1st Embodiment are installed. It is a figure which shows the structure of the RADIUS server in 1st Embodiment. It is explanatory drawing of the user attribute hold | maintained at the RADIUS server in 1st Embodiment. It is explanatory drawing of the trace information management database which memorize | stored the trace information for every user hold | maintained at the RADIUS server in 1st Embodiment. It is a figure which shows the sequence which produces the trace information in 1st Embodiment. It is a figure which shows the structure of the RADIUS server in 2nd Embodiment. It is a figure which shows the sequence which produces the trace information in 2nd Embodiment.

1. First Embodiment An embodiment in which an authentication server is a RADIUS server will be described with reference to FIGS.
FIG. 1 shows a network configuration diagram in the present embodiment.
The network system includes, for example, a plurality of packet relay devices a21 and b22, a RADIUS server (authentication server) 31, and a DHCP (Dynamic Host Configuration Protocol) server (address distribution server) 44. The packet relay device a21 is connected to a plurality of user terminals a11 and b13. The packet relay device a21 and the user terminals a11 and b13 are, for example, sub-networks corresponding to internal departments (hereinafter referred to as departments for convenience). ) 41 is configured. Similarly, the packet relay device b22 is connected to the user terminals a12 and c14 and constitutes a sub-network 42. User terminals a11 and a12 indicate that the same terminal has moved.

In this network system, there are a plurality of departments, and the departments are connected to each other via an in-house LAN 43. The RADIUS server 31 centrally manages the user attributes of a plurality of departments, and is placed on a network different from the in-house LAN 43, for example. In each department, packet relay devices a21 and b22 are placed, respectively. When user terminals (supplicants) a11, a12, b13 and c14 connect to the in-house LAN 43, first, RADIUS is transmitted via the packet relay devices a21 and b22. It is necessary to access the server 31 and ask for permission to access the in-house LAN 43. The DHCP server 44 assigns IP addresses to the authenticated user terminals a11, a12, b13, and c14.
The authentication server is not limited to the RADIUS server 31, and an appropriate authentication server may be used. The user terminals a11, a12, b13, and c14 may be connected via a switch or the like in addition to being directly connected to the packet relay devices a21 and b22.

  The packet relay device a21 has an ARP table (address resolution table) in which the MAC addresses of the connected user terminals a11 and a12 and the IP addresses of the user terminals a11 and a12 are stored in correspondence with each other, and the user terminal a11 , A log about authentication or communication with a12 is managed. The same applies to the packet relay device b22. The RADIUS server 31 communicates with the user terminals a11, a12, b13, and c14 via the packet relay devices a21 and b22 to perform user authentication.

FIG. 2 is a diagram illustrating the configuration of the RADIUS server according to the first embodiment.
The RADIUS server 31 includes, for example, a packet processing unit 33 and a line interface 32. The packet processing unit 33 includes a packet transmission / reception unit 34, a RADIUS control unit (authentication control unit) 35, and a trace information management unit 36. The RADIUS control unit 35 has a user attribute management database (hereinafter referred to as DB) 50. The trace information management unit 36 includes an ARP table acquisition unit (address resolution unit) 45, an authentication log acquisition unit (log management unit) 46, and a trace information management DB (trace information storage unit) 60. The ARP table acquisition unit 45 has an ARP table 37, and the authentication log acquisition unit 46 has an authentication log DB 38. Each database and table may be collected in an appropriate storage device.

  The line interface 32 is an interface for communicating with external devices such as the packet relay devices a21 and b22, for example. The packet processing unit 33 controls packet transmission / reception and the like. For example, the packet transmitting / receiving unit 34 transfers the received packet to the RADIUS control unit 35 and the trace information management unit 36, and transfers the packet from the RADIUS control unit 35 and the like to the line interface 32. The RADIUS control unit 35 manages user attributes necessary for authentication and accounting.

The trace information management unit 36 acquires the user name, the MAC address of the user terminal, the IP address and port number of the packet relay apparatus to which the user terminal is connected from the user attribute management DB 50 in the RADIUS control unit 35, and performs RADIUS control. When the login time information is acquired from the unit 35, the IP address of the user terminal is acquired from the ARP table 37, and the logout time is acquired from the authentication log DB 38, the information is stored in the trace information management DB 60. The ARP table acquisition unit 45 acquires the ARP table from the packet relay devices a21 and b22, and searches for the corresponding IP address based on the MAC addresses of the user terminals a11, a12, b13, and c14. The authentication log acquisition unit 46 acquires the authentication log from the packet relay devices a21 and b22, and searches for the logout time of the corresponding user based on the user name or the like. The authentication log DB 38 stores, for example, a user identifier (for example, a user name), a MAC address of the user terminal, generated log contents, and a time when the log is generated. Note that the generated log content includes, for example, user login and logout.
Note that the RADIUS server 31 may further include an output unit that is a management screen for displaying trace information or an output unit 70 that outputs trace information for display on an external device.

FIG. 3 is an explanatory diagram of user attributes held in the RADIUS server according to the first embodiment.
The user attributes are, for example, for each user, a user name (User-Name), an IP address (NAS-IP-Address) of the packet relay apparatus to which the user terminal is connected, and a port number of the packet relay apparatus to which the user terminal is connected. (NAS-Port) and the MAC address (Calling-Station-Id) of the user terminal. These user attributes are acquired by the trace information management unit 36 when a RADIUS request packet is received and stored in the trace information management DB 60. On the other hand, the user attribute management DB 50 stores the above-described user attributes and other attributes defined by RADIUS (for example, refer to RFC 2865) (for example, user password (User-Password)).

FIG. 4 is an explanatory diagram of a trace information management database that stores trace information for each user held in the RADIUS server according to the first embodiment.
The trace information management DB 60, for example, corresponds to one user ID 61, the MAC address 62 of the user terminal, the IP address 63 of the user terminal, the IP address 64 of the packet relay device to which the user terminal is connected, and the user terminal One or a plurality of combinations 68 of the port number 65 of the packet relay apparatus to be connected, the user login time 66 and the user logout time 67 are stored.

  The information stored in the trace information management DB 60 can be referred to from, for example, the management screen of the RADIUS server 31 and a remote terminal. When the administrator refers to these data, each information may be displayed in time series. it can. As a result, the administrator can grasp the MAC address and IP address of the terminal used by the user, the IP address and port number of the packet relay apparatus to which the user terminal is connected, and user trace in the RADIUS server 31 can be performed. It becomes possible.

FIG. 5 is a diagram illustrating a sequence for creating trace information according to the first embodiment.
The sequence when the user terminal a11 connects to the in-house LAN 43 will be described in detail, assuming that the user terminal a11 was initially in the department A41.
When the user terminal a11 connects to the packet relay device a21 (procedure S11), the packet relay device a21 transmits an EAP request packet to the user terminal a11 (procedure S12), and the user terminal a11 returns an EAP response packet (step S12). Procedure S13). In the EAP response packet, for example, information necessary for authentication such as the user name and the MAC address of the user terminal a11 is described, and the packet relay device a21 that has received the EAP response packet adds a RADIUS header to the packet. Further, attributes such as the IP address of the packet relay device a21 and the port number of the packet relay device a21 are added and transmitted to the RADIUS server 31 as a RADIUS request packet (step S14). At this time, the port 01 of the packet relay device a21 connected to the user terminal a11 is set to pass only the RADIUS packet.

  The RADIUS server 31 that receives the RADIUS request packet transmitted from the packet relay device a21 has the configuration shown in FIG. 2 in the present embodiment. The RADIUS request packet is received by the line interface 32 of the RADIUS server 31. Thereafter, the RADIUS request packet reaches the RADIUS control unit 35 via the packet transmission / reception unit 34 in the packet processing unit 33. The RADIUS control unit 35 holds a user attribute management DB 50 and manages user attributes 51 (see FIG. 3) necessary for authentication and accounting. When the RADIUS control unit 35 acquires these attributes, the RADIUS control unit 35 executes an authentication sequence (step S15). There are a plurality of authentication processing methods, such as EAP-MD5 that authenticates using an ID and password, and EAP-TLS that authenticates using an electronic certificate.

  When the authentication is established, the RADIUS server 31 creates an EAP success packet describing the authentication result. Next, a RADIUS header is added to the packet to form a RADIUS accept packet, which is transmitted to the packet relay device a21 (step S16). The packet relay device a21 that has received the RADIUS accept packet sets the port 01 connected to the user terminal a11 as a port accessible to the in-house LAN 43 (step S17). Further, the RADIUS header is removed from the received RADIUS accept packet, and the extracted EAP success packet is transferred to the user terminal a11 (step S18). When receiving the EAP success packet, the user terminal a11 recognizes that its own terminal has been successfully authenticated.

  The user terminal a11 that has succeeded in authentication can subsequently access other than the RADIUS server 31. When this state is reached, the user terminal a11 first transmits a DHCP discover to the DHCP server 44, and requests an IP address that the user terminal a11 should use as a transmission source address (step S19). When the source IP address is assigned from the DHCP server 44 (procedure S20), the user terminal a11 can subsequently access the in-house LAN 43 using the IP address as the source IP address (procedure S21). The assigned IP address is stored in the ARP table of the packet relay device a21 corresponding to the MAC address of the user terminal a11.

  At this time, the trace information management unit 36 in the RADIUS server 31 holds the trace information management DB 60 shown in FIG. 4, and stores information necessary for user trace by performing the following three steps. Note that the process of storing information necessary for the user trace is not limited to three stages, and may be divided into appropriate stages or may be summarized.

  First, user attribute registration processing at the time of user login. When the RADIUS control unit 35 receives the RADIUS request packet, among the attributes obtained by the RADIUS request packet, User-Name (user name), NAS-IP-Address (packet relay apparatus to which the user terminal is connected) as shown in FIG. ), NAS-Port (port number of the packet relay device to which the user terminal is connected), Calling-Station-Id (MAC address of the user terminal) are notified to the trace information management unit 36 (step S22). At this time, for example, the time when the RADIUS accept packet is issued is notified to the trace information management unit 36 as the time when the user logged in. Note that an appropriate login time may be set in addition to the time when the RADIUS accept packet is issued. In this embodiment, the value of each attribute and the login time are “user name: user a”, “IP address: 10.10.10.1”, “port number: 01”, “MAC address: 00: 11: 22: 33: 44: 55 ”and“ login time: 08/04/01 09: 0 ”, and these pieces of information are registered in the trace information management DB 60 of FIG. (Step P1).

  Next, the process of registering the IP address of the user terminal a11 in the trace information management DB 60 continues. The trace information management unit 36 holds the ARP table acquisition unit 45. When the step P1 ends, the trace information management unit 36 requests the ARP table acquisition unit 45 to acquire the IP address of the user terminal a11. At the time of this request, the ARP table acquisition unit 45 is notified of “MAC address 62: 00: 11: 22: 33: 44: 55” of the user terminal a11 registered in the trace information management DB 60. The ARP table acquisition unit 45 that has received the request from the trace information management unit 36 uses, for example, SNMP (Simple Network Management Protocol) or NETCONF (NETWORK Configuration) to hold the ARP held by the packet relay device a21 to which the user terminal a11 is connected. A table acquisition request is issued (step S23). The packet relay device a21 to which the user terminal a11 is connected can be identified from the IP address 64 of the packet relay device corresponding to the MAC address 62 of the user terminal based on the trace information management DB 60. When the ARP table acquisition unit 45 acquires the ARP table from the packet relay device a21 (step S24), the acquired information is stored in the ARP table 37.

  Subsequently, the ARP table acquisition unit 45 searches the ARP table 37 using “MAC address 62: 00: 11: 22: 33: 44: 55” of the user terminal a11 received from the trace information management unit 36 as a search key, and the user The IP address of the terminal a11 is acquired. In this embodiment, “IP address: 10.10.0.2” is returned as a result. The ARP table acquisition unit 45 notifies the trace information management unit 36 of the “IP address: 10.10.10.2”, and the trace information management unit 36 corresponds to the user ID 61 (“user a”). An IP address (“10.10.10.2”) is additionally registered in the trace information management DB 60 of FIG. 4 (step P2).

  The ARP table acquisition unit 45 transmits the MAC address 62 of the user terminal registered in the trace information management DB 60 to the packet relay device a21 to which the user terminal a11 is connected, and the packet relay device a21 searches the ARP table. The corresponding IP address obtained in this way may be received from the packet relay device a21.

  Next, the process of registering the user logout time in the trace information management DB 60 continues. The trace information management unit 36 holds the authentication log acquisition unit 46, and requests the authentication log acquisition unit 46 to acquire the logout time of the user a when the stage P2 ends. At the time of this request, “User ID 61: User a” and “MAC address 62: 00: 11: 22: 33: 44: 55” of the user terminal a11 registered in the trace information management DB 60 are sent to the authentication log acquisition unit 46. Notice. Upon receiving the request from the trace information management unit 36, the authentication log acquisition unit 46 periodically acquires the authentication log information in the packet relay device a21 and stores it in the authentication log DB 38. When the packet relay device a21 detects that the connection with the user terminal a11 is interrupted (step S25), the packet relay device a21 notifies the trace information management unit 36 in the RADIUS server 31 of the log up to that time (step S26). . The trace information management unit 36 stores the notified log in the authentication log DB 38.

  Subsequently, the authentication log acquisition unit 46 uses “user ID 61: user a” and “MAC address 62: 00: 11: 22: 33: 44: 55” of the user terminal a11 received from the trace information management unit 36 as keys. The accumulated authentication log DB 38 is searched. For example, the authentication log may include a log generation time and a log content in which the log content indicates “logout” for the set of the user ID and the MAC address of the user terminal, or based on the time of the last log A logout time may be set. In the case of this embodiment, “logout time: 08/04/01 12:00” is returned as a result. The authentication log acquisition unit 46 notifies the “logout time: 08/04/01 12:00” to the trace information management unit 36, and the trace information management unit 36 corresponds to the user ID 61 (“user a”). The logout time 67 (“08/04/01 12:00”) is additionally registered in the trace information management DB 60 of FIG. 4 (step P3). Information stored in the trace information management DB 60 can be referred to from the management screen of the RADIUS server 31 or a remote terminal, and the administrator can easily understand the behavior of the user.

  Here, it is assumed that the user a has moved to the department B42. At this time, after the same sequence has been run, the trace information is stored in the trace information management DB 60 of FIG. In this embodiment, the values are “user ID 61: user a”, “user terminal MAC address 62: 00: 11: 22: 33: 44: 55”, and “user terminal IP address 63:10: 10: 20: 2 ”,“ IP address of the packet relay device 64: 10.10.20.0.1 ”,“ Port number of the packet relay device 65:02 ”,“ Login time 66: 08/04/01 13:00 "Logout time 67: 08/04/01 17:00". For example, the packet relay device to which the user terminal a is connected from the IP address 64 or the port number 65 of the packet relay device is the packet relay device a21. It turns out that it changed from packet relay apparatus b22. As described above, whenever the user terminal a asks the RADIUS server 31 for authentication, the trace information management unit 36 stores the above information of the user a in the trace information management DB 60 of FIG. Can be traced.

  On the other hand, in the case of the user b shown in FIG. 4, although the user ID 61 is the same, the MAC address 62 of the user terminal is “00: 12: 34: 56: 78:” at the first login and at the next login. 9a "is changed to" 00: 66: 77: 88: 99: aa ". This suggests the possibility that user b is accessing the in-house LAN 43 using an unauthorized terminal that is not authorized, and that a user other than user b may illegally obtain and impersonate the password of user b. ing. In this way, by monitoring the MAC address 62 of the user terminal by the trace information management unit 36, it is possible to detect impersonation.

  The RADIUS server 31 sorts each piece of information stored in the trace information management DB 60 for each user ID 61 in chronological order by the login time 66 or the logout time 67 to trace (track) the user's actions. May be obtained and displayed or output on the output unit 70. In addition, the RADIUS server 31 uses the trace information sorted in chronological order for each user to identify locations where the MAC address 62 and the IP address 63 of the user terminal, the IP address 64 and the port number 65 of the packet relay device, etc. have changed. You may identify and highlight that part.

  In addition, for example, at 10 am on April 12, 2008, a large amount of DoS (Denial of Service) attack packets are transmitted from a terminal whose source IP address is 10.10.10.3. Assume that the packet relay apparatus a21 detects the packet. In this case, the RADIUS server 31 refers to the trace information management DB 60 of FIG. 4 (for example, the IP address 63 of the user terminal, the login time 66, the logout time 67, etc.), and transmits the DoS attack time and the DoS attack. The DoS attack sender can be identified from the IP address of the terminal that has been used. In the case of the present embodiment, the RADIUS server 31 can determine that the user b is a DoS attack sender. For example, such a user name of the user b can be displayed on the output unit 70, or access from the user b to the network can be denied. In addition, the usage of the trace information memorize | stored in trace information management DB60 is not restricted to the above-mentioned example, A proper usage can be performed.

  As described above, the trace information management unit 36 is newly provided in the RADIUS server 31, and the MAC address of the terminal used by the user and the user terminal are connected from the user attribute management DB 50 in the RADIUS control unit 35. Obtain the IP address and port number of the packet relay device, obtain the user login time from the RADIUS control unit 35, and obtain the IP address and logout time of the user terminal from the ARP table and the authentication log in the packet relay device, respectively. . By grasping these pieces of information, the RADIUS server 31 can provide a user trace function.

2. Second Embodiment The IP address of a user terminal can also be obtained from a DHCP server (address management device).
The DHCP server according to the present embodiment has, for example, an address correspondence table in which a MAC address of a user terminal and an IP address assigned to the user terminal are stored correspondingly.
Since acquisition of user attributes other than the IP address of the user terminal is the same as the stage P1 and the stage P3 of the first embodiment, the configuration of the RADIUS server and the sequence of the stage P2 of this embodiment are shown in FIGS. Are described in detail below, and others are omitted.

FIG. 6 shows a configuration diagram of the RADIUS server in the present embodiment.
For example, the RADIUS server 310 of this embodiment includes a MAC-IP table acquisition unit 47 instead of the ARP table acquisition unit 45 included in the RADIUS server 31 of the first embodiment. The MAC-IP table acquisition unit 47 has a MAC-IP table (address correspondence table) 39. The MAC-IP table acquisition unit 47 acquires an address correspondence table including a pair of a MAC address and an IP address from the DHCP server 44, stores it in the MAC-IP table 39, and searches for a corresponding IP address based on the MAC address. . The line interface 32, the packet transmission / reception unit 34, the RADIUS control unit 35, the authentication log acquisition unit 46, the trace information management DB 60, and the output unit 70 are the same as those in the first embodiment.

FIG. 7 is a diagram illustrating a sequence for creating trace information according to the second embodiment.
Note that the processes (steps T11 to T22, T25, T26, P1, and P3) other than steps T23, T24, and P2 correspond to the processes (steps S11 to S22, S25, S26, P1, and P3). Therefore, the processes of steps T23, T24, and P2 will be described below, and description of other steps will be omitted.

  The trace information management unit 36 holds the MAC-IP table acquisition unit 47, and when the stage P1 ends, requests the MAC-IP table acquisition unit 47 to acquire the IP address of the user terminal a11. At the time of this request, the MAC-IP table acquisition unit 47 is notified of “MAC address 62: 00: 11: 22: 33: 44: 55” of the user terminal a11 registered in the trace information management DB 60. The MAC-IP table acquisition unit 47 that has received the request from the trace information management unit 36 issues an acquisition request for an address correspondence table in which a pair of MAC address and IP address is written to the DHCP server 44 (procedure T23). When the address correspondence table describing the MAC address and IP address pair is acquired from the DHCP server 44 (procedure T24), the acquired information is stored in the MAC-IP table 39.

  Subsequently, the MAC-IP table acquisition unit 47 uses the MAC-IP table 39 using the “MAC address 62: 00: 11: 22: 33: 44: 55” of the user terminal a11 received from the trace information management unit 36 as a search key. Search and obtain the IP address of the corresponding user terminal a11. In this embodiment, “IP address: 10.10.0.2” is returned as a result. The MAC-IP table acquisition unit 47 notifies the trace information management unit 36 of the “IP address: 10.10.0.2”, and the trace information management unit 36 corresponds to the user ID 61 (“user a”). The IP address (“10.10.10.2”) is additionally registered in the trace information management DB 60 of FIG. 6 (step P2).

The MAC-IP table acquisition unit 47 transmits the MAC address 62 of the user terminal a11 registered in the trace information management DB 60 to the DHCP server 44, and the DHCP server 44 retrieves the address correspondence table. A corresponding IP address may be received from the DHCP server 44.
The apparatus that manages the IP address is not limited to the DHCP server 44, and an appropriate address management apparatus may be used.

3. Modification of First and Second Embodiments An example where the authentication server is a TACACS server will be described.
Similarly to the case where the authentication server is a RADIUS server, a trace information management unit is provided in the TACACS server. The trace information management unit includes an ARP table acquisition unit and an authentication log acquisition unit. The trace information management unit acquires the user name, the MAC address of the user terminal, the IP address and the port number of the packet relay apparatus connected to the user terminal from the TACACS attribute management DB in the TACACS control unit, and logs in from the TACACS control unit When the time information is acquired, the IP address of the user terminal is acquired from the ARP table, and the logout time is acquired from the authentication log, the information is stored in the trace information management DB.

Information stored in the trace information management DB can be referred to from the management screen of the TACACS server or a remote terminal, and the administrator can easily understand the behavior of the user.
The specific configuration and operation of the TACACS server are the same as those of the RADIUS server of the first and second embodiments.

  The present invention can be applied to, for example, an authentication server using 802.1X authentication.

11 User terminal a before moving
12 User terminal a after moving
13, 14 User terminal 21, 22 Packet relay device 31, 310 RADIUS server 32 Line interface 33 Packet processing unit 34 Packet transmission / reception unit 35 RADIUS control unit 36 Trace information management unit 37 ARP table 38 Authentication log DB
39 MAC-IP table 41, 42 Subnetwork (department)
43 Internal LAN
44 DHCP server 45 ARP table acquisition unit 46 Authentication log acquisition unit 47 MAC-IP table acquisition unit 50 User attribute management DB
60 Trace information management DB
70 Output section

Claims (10)

One or a plurality of packet relay apparatuses having an address resolution table in which the MAC address of the connected user terminal and the IP address of the user terminal are stored correspondingly, and managing a log for authentication or communication with the user terminal And the authentication server in a system comprising an authentication server that performs user authentication by communicating with the user terminal via the packet relay device,
Corresponding to the user identifier, the MAC address of the user terminal, the IP address of the user terminal, the IP address of the packet relay device, the port identifier of the port of the packet relay device to which the user terminal is connected, and the user A trace information storage unit for storing the login time or logout time of the terminal;
From information received in user authentication with the user terminal, at least a user identifier, a MAC address of the user terminal, an IP address of the packet relay device, and a port of the packet relay device to which the user terminal is connected. An authentication control unit that acquires a port identifier and stores the acquired information in the trace information storage unit correspondingly;
With reference to the address resolution table of the packet relay device to which the user terminal is connected, based on the MAC address of the user terminal acquired by the authentication control unit, obtain the IP address of the corresponding user terminal, An address resolution unit that stores the acquired IP address of the user terminal in the trace information storage unit corresponding to a user identifier;
The log management unit that obtains a logout time of the user terminal with reference to the log in the packet relay device, and stores the obtained logout time in the trace information storage unit corresponding to a user identifier server. An address management device having an address correspondence table in which the MAC address of the user terminal and the IP address of the user terminal are stored in correspondence with each other, and one or a plurality of packet relay devices for managing a log of authentication or communication with the user terminal And the authentication server in a system including an authentication server that performs user authentication by communicating with the user terminal via the packet relay device,
Corresponding to the user identifier, the MAC address of the user terminal, the IP address of the user terminal, the IP address of the packet relay device, the port identifier of the port of the packet relay device to which the user terminal is connected, and the user A trace information storage unit for storing the login time or logout time of the terminal;
From information received in user authentication with the user terminal, at least a user identifier, a MAC address of the user terminal, an IP address of the packet relay device, and a port of the packet relay device to which the user terminal is connected. An authentication control unit that acquires a port identifier and stores the acquired information in the trace information storage unit correspondingly;
With reference to the address correspondence table of the address management device, based on the MAC address of the user terminal acquired by the authentication control unit, the corresponding IP address of the user terminal is acquired, and the acquired IP of the user terminal An address resolution unit for storing an address in the trace information storage unit corresponding to a user identifier;
The log management unit that obtains a logout time of the user terminal with reference to the log in the packet relay device, and stores the obtained logout time in the trace information storage unit corresponding to a user identifier server.   The authentication server according to claim 2, wherein the address management device is an address distribution server that assigns an IP address to the user terminal.   The authentication server according to any one of claims 1 to 3, wherein the authentication control unit stores a time when the user terminal is authenticated as a login time, and stores the time in the trace information storage unit corresponding to a user identifier.   The authentication server according to claim 1, wherein the authentication server is a RADIUS server or a TACACS server.   The address resolution unit acquires the address resolution table from the packet relay device, searches the address resolution table acquired using the MAC address of the logged-in user terminal acquired by the authentication control unit as a search key, The authentication server according to claim 1, wherein an IP address corresponding to the user terminal is acquired.   The authentication server according to claim 6, wherein the address resolution unit acquires the address resolution table from the packet relay device using SNMP or NETCOMF. The authentication management unit
The log is periodically acquired from the packet relay device, the log is searched using the user identifier stored in the trace information storage unit and the MAC address of the user terminal as a search key, and the logout time of the corresponding user is acquired. The authentication server according to any one of claims 1 to 7.   The authentication according to any one of claims 1 to 8, wherein each piece of information stored in the trace information storage unit is sorted by login time or logout time for each user identifier to obtain trace information obtained by tracing user behavior. server.   The authentication server according to claim 1, further comprising an output unit that displays or outputs the obtained trace information.

Images