JP2016051439A - Control server, control method, control system, and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To perform access control corresponding to the fine situation of a user even when an access control list is not mounted on a network under control of a terminal or a proxy server.SOLUTION: A control server (1) includes: a determination part (12) for, on the basis of a situation determination logic for determining a connection destination Web server from presence information, determining the connection destination Web server of a user terminal (2) from the presence information of the user of the user terminal (2); and a communication part (13) for transmitting the IP address of the user terminal (2) and the IP address of the determined connection destination Web server to a network controller (3) for controlling a network to which the user terminal (2) is connected.SELECTED DRAWING: Figure 1

Description

  The present invention relates to a control server, a control method, a control system, and a program.

  2. Description of the Related Art Conventionally, a method for restricting websites that a user can access using an access control list stored in a terminal or a proxy server is known. There are also known a method of defining a route between nodes by a routing table in the node and a method of setting a route between nodes by a server or the like that supervises control between nodes. In relation to this, Patent Document 1 discloses a method in which an end user sets control contents regarding traffic destined for his / her own address in a network node.

JP2012-120154A

  When performing control using an access control list stored in a terminal or a proxy server, the following problems occur. That is, the first problem is that control by the access control list can be performed only by a terminal in which the access control list is implemented or a network under a proxy server. The second problem is that access control according to a user's detailed situation (for example, working, going out, or using the terminal for a long time) cannot be performed.

  An object of the present invention made in view of such points is a control server capable of performing access control according to a user's detailed situation even if an access control list is not implemented in a terminal or a network under a proxy server, A control method, a control system, and a program are provided.

  In order to solve the above problem, the control server according to the present invention determines the connection destination Web server of the user terminal from the presence information of the user of the user terminal based on the situation determination logic for determining the connection destination Web server from the presence information. A determination unit for determining, and a communication unit for transmitting the IP address of the user terminal and the determined IP address of the connection destination Web server to a network controller that controls a network to which the user terminal is connected. Features.

  In order to solve the above-described problem, the control method according to the present invention is based on the situation determination logic in which the determination unit determines the connection destination Web server from the presence information, based on the presence information of the user of the user terminal. A network controller that controls a network to which the user terminal is connected, by determining a connection destination Web server, and by using a communication unit, the IP address of the user terminal and the determined IP address of the connection destination Web server. And transmitting.

  In order to solve the above problems, a control system according to the present invention includes a control server, a network controller, and a network switch, and the control server uses a situation determination logic for determining a connection destination Web server from presence information. Based on the presence information of the user of the user terminal, the determination unit that determines the connection destination Web server of the user terminal, the IP address of the user terminal, and the determined IP address of the connection destination Web server A communication unit that transmits to a network controller that controls a network to which the terminal is connected, wherein the network controller includes an IP address of the user terminal and an IP address of the connection destination Web server, respectively, a source IP address and a connection destination As the IP address, the first IP address A storage unit that associates and stores the source IP address with the network switch, and a communication unit that transmits the source IP address to the network switch. The network switch stores the source IP address and the user. When receiving a packet from the terminal, a rewriting unit that rewrites the destination IP address of the packet with the connection destination IP address received from the network controller, and the rewritten packet to the network to which the connection destination Web server is connected. And a communication unit for transmission.

  In order to solve the above-described problem, the program according to the present invention connects the user terminal to the computer from the presence information of the user of the user terminal based on the situation determination logic for determining the connection destination Web server from the presence information. The procedure for determining the destination Web server and the communication unit transmit the IP address of the user terminal and the determined IP address of the destination Web server to a network controller that controls the network to which the user terminal is connected. And execute the procedure.

  According to the control server, the control method, the control system, and the program according to the present invention, even if the access control list is not implemented in the terminal or the network under the proxy server, the access control according to the detailed situation of the user is performed. Is possible.

It is a figure showing a schematic structure of a control system concerning one embodiment of the present invention. (A) is a functional block diagram of the control server in the control system of FIG. 1, (b) is a functional block diagram of the user terminal in the control system of FIG. It is a functional block diagram of the network controller in the control system of FIG. It is a functional block diagram of the network switch in the control system of FIG. It is a figure which shows the condition determination logic which the control server 1 which concerns on one Embodiment of this invention performs. It is a figure which shows the operation | movement flow of the control system which concerns on one Embodiment of this invention. It is a figure which shows the operation | movement flow of the control system which concerns on the modification of this invention.

  Hereinafter, an embodiment of the present invention will be described with reference to the drawings.

  FIG. 1 is a diagram showing a schematic configuration of a control system according to an embodiment of the present invention. The schematic configuration illustrated in FIG. 1 is an example, and each configuration can be arbitrarily combined. A storage unit described as being inside each configuration may be provided outside each configuration and referred to by each device when necessary. Each function of the control system according to the present invention will be described, but it is not intended to exclude other functions of the control system.

  In one embodiment, a control server 1, a user terminal 2, a network controller 3, and a network switch 4 are connected as shown in FIG. The network switch 4 is connected to the first Web server 5 via the network NW1. The network switch 4 is connected to the second Web server 6 via the network NW2, and is connected to the third Web server 7 via the network NW3.

  Although FIG. 1 discloses one user terminal 2, the number of user terminals 2 connected to the control server 1 is not limited. The user terminal 2 may be a stationary terminal or a portable terminal.

  A plurality of network switches 4 may be connected to the network controller 3. A plurality of user terminals 2 may be connected to one network switch 4. Furthermore, a plurality of network switches 4 may be connected to one network.

  In FIG. 1, three networks and three Web servers are connected to the network switch 4, but the number of networks and Web servers is not limited.

  FIG. 2A is a functional block diagram of the control server 1 in the control system of FIG. The control server 1 includes a control unit 11, a determination unit 12, a communication unit 13, and a storage unit 14.

  The control unit 11 is a processor such as a CPU (Central Processing Unit) and controls various operations of the control server 1.

  For example, based on the situation determination logic, the determination unit 12 determines the connection from the presence information such as the user ID, the login time when the user terminal 2 logged into the control server 1, the location information of the user terminal 2, and the IP address of the user terminal 2. Determine the previous Web server. Presence information is user-related information indicating a user's state and situation. The situation determination logic is a logic for determining a connection destination Web server from presence information. The user ID is a unique ID that the control server 1 gives to the user of the user terminal 2. Moreover, the determination part 12 can determine a connection destination Web server again, when the new presence information of the user terminal 2 is acquired.

  The communication unit 13 transmits and receives information between the user terminal 2 and the network controller 3 by at least one of wired or wireless.

  The storage unit 14 stores a correspondence table in which the source IP address and the connection destination IP address are associated with each other. When the association is updated by the determination unit 12, the storage unit 14 updates the correspondence table.

  FIG. 2B is a functional block diagram of the user terminal 2 in the control system of FIG. The user terminal 2 includes a control unit 21 and a communication unit 22, and the user terminal 2 has an IP address assigned by an ISP (Internet Service Provider).

  The control unit 21 is a processor such as a CPU, and controls various operations of the user terminal 2.

  The communication unit 22 transmits and receives information between the control server 1 and the network switch 4 by at least one of wired or wireless. The communication unit 22 communicates with the first Web server 5 via the network NW1. Further, the communication unit 22 may communicate with the second Web server 6 via the network NW2, and may communicate with the third Web server 7 via the network NW3. The communication unit 22 receives services from the first web server 5, the second web server 6, or the third web server 7.

  FIG. 3 is a functional block diagram of the network controller 3 in the control system of FIG. The network controller 3 controls the network to which the user terminal 2 is connected. The network controller 3 includes a control unit 31, a search unit 32, a communication unit 33, and a storage unit 34.

  The control unit 31 is a processor such as a CPU and controls various operations of the network controller 3.

  For example, in response to an inquiry from the network switch 4, the search unit 32 searches for a connection destination IP address corresponding to the source IP address in a first IP address correspondence table 34 a described later.

  The communication unit 33 transmits and receives information between the control server 1 and the network switch 4 by at least one of wired or wireless. For example, the communication unit 33 receives a source IP address and a connection destination IP address from the control server 1. In addition, the communication unit 33 transmits the source IP address to the network switch 4.

  The storage unit 34 stores a first IP address correspondence table 34a in which the source IP address and the connection destination IP address received by the communication unit 33 are associated with each other. For example, when the communication unit 33 receives a new source IP address and connection destination IP address, the storage unit 34 updates the first IP address correspondence table 34a.

  FIG. 4 is a functional block diagram of the network switch 4 in the control system of FIG. The network switch 4 includes a control unit 41, an inspection unit 42, a rewrite unit 43, a communication unit 44, and a storage unit 45.

  The control unit 41 is a processor such as a CPU, and controls various operations of the network switch 4.

  When receiving the packet from the user terminal 2, the checking unit 42 checks whether or not the source IP address of the packet matches a source IP address stored in a second IP address correspondence table 45a described later.

  The rewriting unit 43 rewrites the destination IP address of the packet with the connection destination IP address stored in the second IP address correspondence table 45a based on a second IP address correspondence table 45a described later.

  The communication unit 44 transmits and receives information between the user terminal 2 and the network controller 3 by at least one of wired or wireless. The communication unit 44 communicates with the first Web server 5 via the network NW1. The communication unit 44 may communicate with the second Web server 6 via the network NW2 and communicate with the third Web server 7 via the network NW3. Further, the communication unit 44 transmits the packet after the rewrite unit 43 rewrites the destination IP address to the Web server determined by the determination unit 12 via the network.

  Further, the communication unit 44 corresponds to the source IP address after the inspection unit 42 determines that the source IP address of the packet matches the source IP address stored in the second IP address correspondence table 45a described later, for example. The network controller 3 is inquired about the connection destination IP address.

  The storage unit 45 stores the source IP address received by the communication unit 44 in the second IP address correspondence table 45a. When the communication unit 44 receives a new source IP address, the storage unit 45 updates the second IP address correspondence table 45a. Further, when the storage unit 45 receives the connection destination IP address from the network controller 3, the storage unit 45 stores the connection destination IP address in association with the source IP address stored in the second IP address correspondence table 45a.

  The first Web server 5, the second Web server 6, and the third Web server 7 are conventionally known Web servers, and communicate with the user terminal 2 via the network NW1, the network NW2, and the network NW3, respectively. The first Web server 5, the second Web server 6, and the third Web server 7 have unique IP addresses, and transmit Web page information in response to a request from the user terminal 2.

  Hereinafter, an access control process performed by the control system according to the embodiment of the present invention will be described.

[Access control processing]
In the control system, the user terminal 2 logs into the control server 1. The control server 1 records the time when the user terminal 2 logs into the control server 1. At the same time or after the login, the user terminal 2 transmits the user ID, the location information (for example, GPS information) of the user terminal 2 and the IP address (for example, 123.455.67.8) of the user terminal 2 as presence information. To do. Presence information is not limited to these.

  Specifically, the user terminal 2 acquires and transmits a user ID by, for example, user input. Further, the user terminal 2 may automatically acquire and transmit the position information after login, for example, or may acquire and transmit the position information by a user operation. For example, the user terminal 2 acquires the IP address of the user terminal 2 from the storage unit of the user terminal 2 and transmits it.

  FIG. 5 is a diagram illustrating an example of the situation determination logic executed by the control server 1 according to an embodiment of the present invention. The situation determination logic will be described below.

  In addition to the presence information received from the user terminal 2, the control server 1 acquires the login time as presence information (step S1). In the present embodiment, since the situation determination logic is provided for each user, the control server 1 determines which situation determination logic is to be executed from the user ID included in the presence information (step S2). Next, the control server 1 determines whether or not the login time is in the morning (step S3). When it is determined that it is not in the morning (that is, when it is determined that it is afternoon) (No in step S3), the control server 1 sets the connection destination Web server of the user terminal 2 to the third Web server 7 (for example, IP The address is determined to be 192.168.0.3) (step S4).

  On the other hand, if it is determined that the login time is in the morning (Yes in step S3), the control server 1 determines whether or not the user terminal 2 is present at the user's home from the position information included in the presence information. Is determined (step S5). The storage unit 14 stores the home of the user of the user terminal 2 in advance. When it is determined that the user terminal 2 does not exist at home (No in Step S5), the control server 1 sets the connection destination Web server of the user terminal 2 as the second Web server 6 (for example, the IP address is 192.168.8.0). .2) (step S6).

  On the other hand, when it is determined that the user terminal 2 is at home (Yes in step S5), the control server 1 sets the connection destination web server of the user terminal 2 as the first web server 5 (for example, the IP address is 192.168 .. 0.1) (step S7).

  Next, the control server 1 transmits the IP address (source IP address) of the user terminal 2 and the IP address (connection destination IP address) of the Web server determined as the connection destination to the network controller 3 (step S8).

  Thus, the control server 1 determines the Web server to which the user terminal 2 is connected by executing the situation determination logic. The situation determination logic may be common among users. In the following description, as an example, it is assumed that the control server 1 determines the first Web server 5 as the Web server to which the user terminal 2 is connected.

  Upon receiving the source IP address (123.455.67.8) and the destination IP address (192.168.0.1), the network controller 3 associates them with the first IP address correspondence table 34a. Store. After receiving these IP addresses, the network controller 3 transmits the source IP address to the network switch 4 simultaneously with the storage or before and after the storage.

  When receiving the source IP address, the network switch 4 stores it in the second IP address correspondence table 45a.

  When a plurality of source IP addresses are received, the network switch 4 stores them in the second IP address correspondence table 45a.

  When the network switch 4 receives the packet, the network switch 4 confirms the source IP address of the packet. The network switch 4 checks whether or not the confirmed source IP address matches the source IP address stored in the second IP address correspondence table 45a. When it is determined that they match, the network switch 4 inquires of the network controller 3 about the connection destination IP address corresponding to the transmission source IP address. On the other hand, if it is determined that they do not match, the network switch 4 does not perform subsequent processing for the packet.

  In the present embodiment, as an example, the following description will be made assuming that the source IP address of the packet received by the network switch 4 is the IP address of the user terminal 2. As described above, in this embodiment, since the IP address of the user terminal 2 is already stored in the second IP address correspondence table 45a, the network switch 4 instructs the network controller 3 to connect to the IP address corresponding to the IP address. Inquire.

  Upon receiving the inquiry, the network controller 3 searches the first IP address correspondence table 34a for the connection destination IP address corresponding to the transmission source IP address, and transmits it to the network switch 4 after the search.

  The network switch 4 that has received the connection destination IP address associates the connection destination IP address (192.168.0.1) with the transmission source IP address (123.455.67.8) and supports the second IP address. Store in Table 45a.

  The network switch 4 rewrites the destination IP address of the packet received from the user terminal 2 with the connection destination IP address received from the network controller 3, and transmits the packet to the network NW1.

  When the network NW1 receives the packet, the network NW1 transmits the packet to the first Web server 5 that is the destination of the packet by using a conventionally known IP address routing method.

[Operation flow]
FIG. 6 is a diagram showing an operation flow of the control system according to the embodiment of the present invention.

  The user terminal 2 logs in to the control server 1 (step S11). Simultaneously with or after the login, the user terminal 2 transmits the user ID, the location information of the user terminal 2, and the IP address (source IP address) of the user terminal 2 as presence information to the control server 1 (step S12). After the transmission, the control server 1 determines a connection destination Web server according to the situation determination logic described with reference to FIG. 5 (step S13). As an example, the following description will be made assuming that the control server 1 determines the first Web server 5 as a connection destination Web server.

  Next, the control server 1 transmits the transmission source IP address and the connection destination IP address (the IP address of the Web server determined in step S13) to the network controller 3 (step S14). The network controller 3 receives the source IP address and the connection destination IP address, and stores them in the first IP address correspondence table 34a (step S15). The network controller 3 transmits the source IP address to the network switch 4 (step S16). The network switch 4 receives the source IP address and stores it in the second IP address correspondence table 45a (step S17).

  When receiving the packet (step S18), the network switch 4 confirms the source IP address of the packet. The network switch 4 checks whether or not the confirmed source IP address matches the source IP address stored in the second IP address correspondence table 45a (step S19). If it is determined that they match (Yes in step S19), the network switch 4 inquires of the network controller 3 about the connection destination IP address corresponding to the source IP address (step S20). On the other hand, if it is determined that they do not match (No in step S19), the network switch 4 does not perform subsequent processing for the packet.

  In the following description, as an example, the following description will be made assuming that the source IP address of the packet received in step S18 is the IP address of the user terminal 2. The IP address of the user terminal 2 is already stored in the second IP address correspondence table 45a in step S17. Therefore, the network switch 4 inquires of the network controller 3 about the connection destination IP address corresponding to the IP address.

  Upon receiving the inquiry, the network controller 3 searches the first IP address correspondence table 34a for the connection destination IP address corresponding to the source IP address (step S21), and transmits it to the network switch 4 after the search (step S22). .

  Next, the network switch 4 stores the connection destination IP address received in step S22 in the second IP address correspondence table 45a in association with the source IP address received in step S16 (step S23). Further, the network switch 4 rewrites the destination IP address of the packet received in step S18 with the connection destination IP address received in step S22 (step S24). Next, the network switch 4 transmits the packet via the network NW1 to the first Web server 5 that is the destination of the packet after rewriting in step S24 (step S25).

  According to the embodiment described above, access control according to the detailed situation of the user can be performed even if the access control list is not implemented in the terminal or the network under the proxy server.

  Further, according to the embodiment described above, the network controller 3 that has received the source IP address and the connection destination IP address from the control server 1 sends the connection destination IP address to the network switch 4 unless it receives an inquiry from the network switch 4. Do not send. The network switch 4 receives the packet and checks whether or not the source IP address of the packet matches the source IP address stored in the second IP address correspondence table 45a. If the network switch 4 determines that they match, the network switch 4 inquires the network controller 3 and receives the connection destination IP address. With this configuration, the network switch 4 can receive the latest connection destination IP address even when the connection destination IP address corresponding to the transmission source IP address is changed afterwards by the control server 1.

[Modification]
A modification of the present invention will be described. Descriptions of parts common to the above-described embodiment are omitted.

  In the modification, the network controller 3 that has received the source IP address and the connection destination IP address transmits the connection destination IP address to the network switch 4 in addition to the source IP address without receiving an inquiry. The network switch 4 stores the received source IP address and connection destination IP address in the second IP address correspondence table 45a.

  Therefore, in the modified example, after checking whether the source IP address of the received packet matches the source IP address stored in the second IP address correspondence table 45a, the network switch 4 Do not inquire. After the inspection, the network switch 4 rewrites the destination IP address of the packet received from the user terminal 2 with the connection destination IP address stored in the second IP address correspondence table 45a.

  FIG. 7 is a diagram showing an operation flow of the control system according to the modification of the present invention.

  Steps S31 to S35 are the same as steps S11 to S15 described above, and a description thereof will be omitted.

  The network controller 3 transmits the source IP address and the connection destination IP address to the network switch 4 (step S36). The network switch 4 receives the transmission source IP address and the connection destination IP address, and stores them in the second IP address correspondence table 45a (step S37).

  When receiving the packet (step S38), the network switch 4 confirms the source IP address of the packet. The network switch 4 checks whether or not the confirmed source IP address matches the source IP address stored in the second IP address correspondence table 45a (step S39). If it is determined that they match (Yes in step S39), the network switch 4 rewrites the destination IP address of the packet received in step S38 with the connection destination IP address stored in step S37 (step S40). Next, the network switch 4 transmits the packet via the network NW1 to the first Web server 5 that is the destination of the rewritten packet in step S40 (step S41).

  When the control server 1 according to the present invention is configured by a computer, a program describing processing contents for realizing each function is stored in an internal or external storage unit of the computer, and the central processing of the computer is performed. This can be realized by reading and executing this program by a device (CPU). In addition, such a program can be distributed by selling, transferring, or lending a portable recording medium such as a DVD or a CD-ROM, and such a program is stored in a storage unit of a server on a network, for example. And the program can be distributed by transferring the program from the server to another computer via the network. In addition, a computer that executes such a program can temporarily store, for example, a program recorded on a portable recording medium or a program transferred from a server in its storage unit. As another embodiment of the program, the computer may directly read the program from a portable recording medium and execute processing according to the program, and each time the program is transferred from the server to the computer. In addition, the processing according to the received program may be executed sequentially. Therefore, the present invention is not limited to the above-described embodiments, and various modifications can be made by combining or partially deleting them without departing from the spirit of the present invention.

DESCRIPTION OF SYMBOLS 1 Control server 11 Control part 12 Determination part 13 Communication part 14 Storage part 2 User terminal 21 Control part 22 Communication part 3 Network controller 31 Control part 32 Search part 33 Communication part 34 Storage part 34a 1st IP address correspondence table 4 Network switch 41 Control unit 42 Inspection unit 43 Rewriting unit 44 Communication unit 45 Storage unit 45a Second IP address correspondence table

Claims (7)

A determination unit for determining the connection destination Web server of the user terminal from the presence information of the user of the user terminal based on the situation determination logic for determining the connection destination Web server from the presence information;
A control server comprising: a communication unit that transmits an IP address of the user terminal and an IP address of the determined connection destination Web server to a network controller that controls a network to which the user terminal is connected. The control server according to claim 1,
The control server, wherein the presence information includes at least one of a user ID of the user, a time when the user terminal logs into the control server, location information of the user terminal, and an IP address of the user terminal. In the control server according to claim 1 or 2,
The control server, wherein the determination unit can determine again the connection destination Web server when receiving the new presence information of the user. Determining a connection destination Web server of the user terminal from presence information of the user of the user terminal based on status determination logic for determining a connection destination Web server from the presence information by a determination unit;
The communication unit includes a step of transmitting the IP address of the user terminal and the determined IP address of the connection destination Web server to a network controller that controls a network to which the user terminal is connected. Control method. In a control system comprising a control server, a network controller, and a network switch,
The control server
A determination unit for determining the connection destination Web server of the user terminal from the presence information of the user of the user terminal based on the situation determination logic for determining the connection destination Web server from the presence information;
A communication unit that transmits an IP address of the user terminal and an IP address of the determined connection destination Web server to a network controller that controls a network to which the user terminal is connected;
The network controller
A storage unit that stores the IP address of the user terminal and the IP address of the connection destination Web server as a source IP address and a connection destination IP address, respectively, in association with the first IP address correspondence table;
A communication unit that transmits the source IP address to the network switch,
The network switch is
A storage unit for storing the source IP address;
When receiving a packet from the user terminal, a rewriting unit that rewrites the destination IP address of the packet with the connection destination IP address received from the network controller;
A control system comprising: a communication unit that transmits the rewritten packet to a network to which the connection destination Web server is connected. The control system according to claim 5,
The rewrite unit, after receiving the packet from the user terminal, receives the connection destination IP address from the network controller, and rewrites the destination IP address of the packet. On the computer,
A procedure for determining the connection destination Web server of the user terminal from the presence information of the user of the user terminal based on the situation determination logic for determining the connection destination Web server from the presence information;
A program for causing the communication unit to execute a procedure of transmitting the IP address of the user terminal and the determined IP address of the connection destination Web server to a network controller that controls a network to which the user terminal is connected.

Images