JP3570987B2 - Router configuration setting information transfer method, control terminal, host terminal, and recording medium - Google Patents

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to a method for transferring configuration setting information of a router, and a control terminal, a host terminal, and a recording medium that execute the method, and more particularly, to a configuration setting information transfer method that can authenticate a transfer request for configuration setting information.
[0002]
[Prior art]
The router is a local area network (LAN) for processing the lower three layers (physical layer, data link layer, and network layer) of a seven-layer model of OSI (Open Systems Interconnection) defined by ISO (International Organization for Standardization). And a WAN (Wide Area Network). The router configuration setting information includes address information of each protocol between routers, filtering information for limiting a communication range of a network, routing information indicating route information between routers, and the like.
In recent years, with the spread of the Internet, the number of routers connecting between LANs and WANs has been increasing. In large-scale networks, maintenance work such as adding routers and replacing faulty routers is performed on a daily basis. I have.
[0003]
To facilitate the maintenance work of the router, install a host terminal and transfer the configuration setting information from each router to the host terminal, and input the configuration setting information from the host terminal to each router as necessary The method is adopted. As a method of transferring the configuration setting information from the router to the host terminal, a method of collectively transferring all the configuration setting information of the router using a transfer protocol such as TFTP is widely used.
On the other hand, as a method of inputting configuration setting information from a host terminal to a router, for example, a method of connecting a control terminal to the router and manually inputting the information using a configuration setting command is used.
Also, a control terminal is connected to the router via a serial interface, and only the minimum settings for connecting to a remote host terminal are manually input. Other configuration setting information is transmitted from the host terminal to the TFTP. A method of batch transfer using a transfer protocol such as this is also used.
[0004]
An example of such a conventional technique is disclosed in, for example, Japanese Patent No. 2771437. The outline is described below.
FIG. 7 is a block diagram showing a conventional network.
In the network disclosed in Japanese Patent No. 2771437, the configuration setting information of each of the routers 2a and 2b is intensively input in advance to the network storage unit 13h of the host terminal 1h when the network is constructed.
Each of the routers 2a and 2b sends a request packet 101p to the host terminal 1h as a request for reading the configuration setting information. Upon receiving the request packet 101p sent from each of the routers 2a and 2b, the host terminal 1h automatically reads the configuration setting information of the source address from the network storage unit 13h and returns a response packet 102p. Then, each of the routers 2a and 2b stores the received response packet 102p in the configuration storage units 23a and 23b.
[0005]
The network disclosed in the above publication can automatically input configuration setting information to all routers by performing the above-described series of operations in the order in which the routers 2a and 2b are close to the host terminal 1h. I have to.
[0006]
[Problems to be solved by the invention]
The configuration setting information transfer method disclosed in Japanese Patent No. 2771437 automatically transmits a response packet to a read request for configuration setting information transmitted from each router to a host terminal. That is, there is a problem that the host terminal has not performed authentication.
If the host terminal does not authenticate the write request transmitted by each router, the configuration setting information of each router may be lost or falsified. Further, if the host terminal does not authenticate the read request transmitted by each router, the configuration setting information of each router may be leaked to an unauthorized user.
The present invention has been made in view of the above circumstances, and provides a configuration setting information transfer method capable of protecting configuration setting information of a router managed by a host terminal from loss or destruction and preventing leakage. The purpose is to:
[0007]
[Means for Solving the Problems]
In order to achieve the above object, a first aspect of the present invention provides a plurality of routers for mutually connecting networks, a plurality of routers connected to the plurality of routers via the network, and a configuration setting for each of the routers. In a system comprising a host terminal that stores information and performs maintenance of each router, and a control terminal that is connected to each router and inputs a control command to each router, according to the control command, from the host terminal In a method of transferring configuration setting information of a router, the configuration setting information is read and transferred to any router, and the configuration setting information is transferred and written from any router to the host terminal. Has been taken.
[0008]
That is, prior to reading or writing the configuration setting information, the host terminal transmits identification information for identifying the router that created the transfer request to a transfer request including information of a transfer partner, and transmits the transfer request from the router. The host terminal is caused to determine whether or not the identification information and the information of the transfer partner match, thereby determining whether the transfer request is valid.As a result of the determination, the transfer request is determined to be valid. Only in such a case, the configuration setting information is transferred between the host terminal and the router.
[0009]
According to a second aspect of the present invention, the configuration setting information transfer method for a router according to the first aspect has the following configuration.
That is, the control terminal causes the control terminal to create the identification information as a transfer file name, attaches the transfer file name to the control command, and sends the control command to the router. A transfer request transmission process for creating the transfer request according to an instruction, adding the transfer file name to the transfer request, and transmitting the transfer request to the host terminal; and transmitting the transfer file name and the transfer request received from the router to the host terminal. An authentication process for determining whether or not the information of the transfer partner included in the transfer request matches, and determining whether the transfer request is valid, and when the transfer request is determined to be valid in the authentication process. And a transfer control process for transferring the configuration setting information between the router and the host terminal.
[0010]
In a third aspect based on the router configuration setting information transfer method according to the first or second aspect, the control terminal creates the identification information based on an address of the router in the network.
According to the first to third aspects, the configuration setting information transfer method of the router is configured as described above. Therefore, before the start of the transfer of the configuration setting information, the transfer request of the router that created the transfer request is transmitted. The identification information is added and transmitted to the host terminal. The host terminal verifies the validity of the transfer request based on the identification information. After the authentication is completed, the configuration setting information is transferred. For this reason, since it is possible to authenticate whether the request is from a legitimate router, it is possible to prevent the destruction or falsification of the configuration setting information of each router managed by the host terminal.
[0011]
According to a fourth aspect, in the configuration setting information transfer method for a router according to any one of the first to third aspects, the control terminal encrypts the identification information, and the host terminal encrypts the encrypted identification information. The decryption is performed, and it is determined whether or not the transfer request is valid based on the decryption result and the information of the transfer partner.
According to the fourth aspect, since the configuration setting information transfer method of the router is configured as described above, the transfer file name is encrypted. Therefore, it is possible to prevent the information of the router included in the transfer file name from being known to others, and to prevent the leakage of the configuration setting information.
[0012]
A fifth invention adopts the following method in the configuration setting information transfer method for a router according to the fourth invention.
That is, the identification information is added with time information indicating the time at which the identification information is created, encrypted and transmitted to the host terminal, and based on the time information, the host terminal A duplication elimination process for eliminating a transfer request to which identification information is added is performed.
According to the fifth aspect of the present invention, since the configuration setting information transfer method of the router is configured as described above, the time information is added and the transfer file name is given to the host terminal. Authentication is performed based on the name. Therefore, since the information authenticated by the host terminal changes every time, security can be maintained even when the transfer file name is leaked.
[0013]
According to a sixth aspect of the present invention, a configuration command is provided between a host terminal connected to the network and storing configuration setting information of the router and a control command given to a router connecting the networks. The following configuration is used in the control terminal that transfers.
That is, a transfer file name including identification information for identifying the router is created and given to the router together with the control command, and information on a transfer partner given to the host terminal before transferring the configuration setting information to the router. And a transfer file name generation unit for adding the transfer file name to the transfer request including the above and transmitting the request to the host terminal.
[0014]
According to a seventh aspect, in the control terminal according to the sixth aspect, the identification information is an address of the router.
According to an eighth aspect, in the control terminal according to the sixth or seventh aspect, the transfer file name generation unit forms the transfer file name by encrypting the identification information.
According to a ninth aspect, in the control terminal according to the eighth aspect, the transfer file name generation unit encrypts time information of a time at which the address of the router is encrypted, and stores the encrypted time information in the transfer file name. The point is that it has a time insertion processing unit that inserts the time into the data.
[0015]
According to the sixth to ninth aspects, since the control terminal is configured as described above, the control terminal causes the router to transmit a transfer request with identification information. Together, the method for transferring configuration setting information of the router according to the first to fifth inventions can be implemented.
A tenth aspect of the present invention includes a setting information storage unit connected to a plurality of routers connecting the networks via the network and storing configuration setting information of the routers, and performs maintenance of the plurality of routers. For this purpose, the following configuration is used in a host terminal that transfers the configuration setting information between the routers and reads and writes the configuration setting information stored in the setting information storage unit. .
[0016]
That is, a transfer created from the transfer request including information of a transfer partner transmitted from the arbitrary router via the network before the read or write and identification information for identifying a router that created the transfer request. A transfer request authentication unit that inputs a file name and determines whether the transfer request is valid based on the transfer file name and the information of the transfer partner; and that the transfer request authentication unit determines that the transfer request is valid. And a setting information transfer control unit that accesses the setting information storage unit and transfers the configuration setting information to and from the router that created the transfer request only when it is determined that there is a setting request.
[0017]
According to an eleventh aspect, in the host terminal according to the tenth aspect, the identification information is formed from an address of the router.
A twelfth aspect of the present invention is the host terminal according to the tenth or eleventh aspect, wherein the transfer file name is formed by encrypting the identification information.
According to a thirteenth aspect, in the host terminal according to the twelfth aspect, the transfer file name includes time information of a time at which the address of the router is encrypted in addition to the identification information. Is to judge whether the transfer request is valid based on the encrypted identification information and the time information, and to exclude a transfer request given with the same identification information in the past. And
[0018]
According to the tenth to thirteenth aspects, since the host terminal is configured as described above, a transfer request and a transfer file name transmitted from an arbitrary router are input before reading or writing. It is determined by the transfer request authentication unit whether or not it is valid. Only when the transfer request authentication unit determines that the transfer request is valid, the configuration setting information is transferred to and from the router that created the transfer request by accessing the setting information storage unit. Therefore, for example, the method for transferring configuration setting information of the router according to the first to fifth aspects can be implemented in combination with the control terminal according to the sixth to ninth aspects.
[0019]
According to a fourteenth aspect, in a recording medium, a control command is given to a router that connects networks, and a host terminal that is connected to the network and stores configuration setting information of the router is connected between the router and the router. A transfer file name including identification information for identifying the router is created in a computer for transferring the configuration setting information, and the program is provided on the recording medium in which a program to be given to the router together with the control command is recorded.
In a fifteenth aspect based on the recording medium according to the fourteenth aspect, the identification information is an address of the router.
[0020]
In a sixteenth aspect based on the recording medium of the fourteenth or fifteenth aspect, the transfer file name is formed by encrypting the identification information.
According to a seventeenth aspect, in the recording medium according to the sixteenth aspect, time information of a time at which the address of the router is encrypted is encrypted, and the encrypted time information is inserted into the transfer file name.
[0021]
An eighteenth invention is a recording medium, comprising: a setting information storage unit connected to a plurality of routers connecting between networks via the network and storing configuration setting information of the routers; In order to perform maintenance, the computer reads and writes the configuration setting information stored in the configuration information storage unit by transferring the configuration setting information between the routers. Before, input a transfer request including information of a transfer partner transmitted from the arbitrary router via the network and a transfer file name created from identification information for identifying a router that created the transfer request, It is determined whether or not the transfer file name matches the information of the transfer partner, and if the transfer request is valid. A transfer request authentication process for determining whether or not, and only when the transfer request is determined to be valid, by the transfer request authentication process, a router that accesses the setting information storage unit and creates the transfer request. And a setting information transfer control process for transferring the configuration setting information between the storage media.
[0022]
According to a nineteenth aspect, in the recording medium according to the eighteenth aspect, the identification information is formed from an address of the router.
According to a twentieth aspect, in the recording medium according to the eighteenth or nineteenth aspect, the transfer file name is formed by encrypting the identification information.
According to a twenty-first aspect, in the recording medium according to the twentieth aspect, in the transfer file name, time information of a time at which the address of the router is encrypted is inserted in addition to the identification information, Thus, the gist of the present invention is to judge whether the transfer request is valid based on the encrypted identification information and the time information, and to exclude a transfer request to which the same identification information has been added in the past.
According to the fourteenth to twenty-first aspects, since the recording medium is configured as described above, the program stored in the recording medium is read by the control terminal and the host terminal, whereby the router according to the first to the fifth aspects is read. Is carried out.
[0023]
BEST MODE FOR CARRYING OUT THE INVENTION
[First Embodiment]
FIG. 1 is a block diagram illustrating a configuration of a system according to the first exemplary embodiment of the present invention.
This system comprises a host terminal 1 operated by program control, a router 2, a control terminal 3 operated by program control or operator's operation, and a network 4.
The host terminal 1 is connected to the router 2 via the network 4, transfers configuration setting information in accordance with a transfer request RQ transmitted from the router 2, and inputs and outputs signals to and from the network 4. It includes a network interface unit 10, a transfer request authentication unit 11, a setting information transfer control unit 12, and a setting information storage unit 13.
[0024]
The transfer request authentication unit 11 holds a decryption key for decryption that is updated regularly or irregularly, decrypts the transfer request RQ using the decryption key, and determines that the given transfer request RQ is valid. It has a function to determine whether it is a request. The setting information transfer control unit 12 has a function of instructing the router 2 to start data transmission by transmitting a transfer response in accordance with the transfer request RQ transmitted from the router 2. The setting information transfer control unit 12 has a function of writing configuration setting information to the setting information storage unit 13 and reading configuration setting information from the setting information storage unit 13.
[0025]
The router 2 is connected to the control terminal 3 via the serial interface 5. Note that the router 2 may be connected to the control terminal 3 via the network 4 using, for example, a Telnet protocol instead of the serial interface 5.
The router 2 is also connected to the host terminal 1 via the network 4 using, for example, a TFTP protocol, and receives a control command CM from the control terminal 3 and sends a transfer request RQ to the host terminal 1 via the network 4. It is supposed to. The transfer request RQ is added with a transfer file name described later specified by the control command CM. Further, the router 2 has a function of transmitting / receiving configuration setting information to / from the host terminal 1 via the network 4, detecting completion of the transfer of the configuration setting information, and transmitting a transfer result to the control terminal 3. ing.
[0026]
The control terminal 3 has a function of assembling a control command CM according to an instruction to start transfer from an operator (operator) or a program, and sending the control command CM to the router 2 via the serial interface 5. And a name generation unit 31. The transfer file name generation unit 31 encrypts the IP address and the like of the router 2 using an encryption key for encryption that is updated in synchronization with the decryption key for decryption held by the host terminal 1 to obtain the transfer file name. Generate. Note that this system employs an encryption method that cannot easily forge a ciphertext.
FIG. 2 is a flowchart illustrating a transfer method when writing the configuration setting information to the host terminal. The operation of the entire system will be described with reference to FIG.
[0027]
The first processing step S21 is a transfer file name generation process, in which the control terminal 3 generates a transfer file name in the transfer file name generation unit 31 according to a transfer start instruction from an operator or a program. Then, the generated transfer file name is given to the control command CM and sent to the router 2 via the interface unit 30 and the serial interface 5. In step S23, the router 2 creates a transfer request RQ according to the instruction of the control command CM received from the control terminal 3, and transmits the transfer request RQ to the host terminal 1 via the network 4. That is, step S23 constitutes a transfer request transmission process.
[0028]
The transfer request authentication unit 11 in the host terminal 1 authenticates the transfer request RQ received from the router 2 via the network interface unit 10 in the authentication processing in step S24. Step S25 is a transfer control process, in which the setting information transfer control unit 12 in the host terminal 1 returns a transfer response to the router 2 and instructs to start data transmission. The router 2 receives the transfer response, and transfers the configuration setting information to the host terminal 1 in step S26.
[0029]
The setting information transfer control unit 12 of the host terminal 1 writes the configuration setting information received from the router 2 to the setting information storage unit 13 in step S27. In the last step S28, when detecting the completion of the transfer of the configuration setting information, the router 2 transmits the transfer result to the control terminal 3.
FIG. 3 is a flowchart illustrating a transfer method when the transfer request RQ is a read request.
When the configuration setting information is read from the host terminal 1 and transferred to the router 2, steps S31 to S37 in FIG. 3 are performed. Steps S31 to S34 in FIG. 3 are the same processes as steps S21 to S24 in FIG. 2, respectively. In steps S31 to S34, the read transfer request RQ is transmitted to the host terminal 1 together with the transfer file name. Is done. Hereinafter, only the differences from FIG. 2 will be described.
[0030]
If the transfer request RQ is a read request, the setting information transfer control unit 12 of the host terminal 1 reads the configuration setting information from the setting information storage unit 13 in step S35. Then, in step S36, the setting information transfer control unit 12 transmits the read setting information to the router 2 as a transfer response. If the configuration setting information is large, it is divided into a plurality of messages and transmitted to the router 2. Finally, in step S37, the router 2 that has detected the completion of the transfer of the configuration setting information reports the transfer result to the control terminal 3.
[0031]
Next, the authentication method of this system will be described using a specific example.
4 and 8 are explanatory diagrams showing specific examples of the authentication method. With reference to FIGS. 4 and 8, an encryption method that combines exclusive OR and transposition will be described.
For example, the IP address, which is the identification information of the router 2, is “1.2.3.4”, and the encryption key and the decryption key are 0x12345678. First, the transfer file name generation unit 31 of the control terminal 3 replaces the IP address “1.2.3.4” of the router 2 with an integer value 010202004, converts this into a 32-bit column, and adjusts the lower eight digits of the encryption key. The numerical value 12345678 is used as a 32-bit column, and the exclusive OR of the two is obtained as shown in FIG. As a result of the exclusive OR calculation, a 32-bit integer value 1336557c is obtained.
[0032]
The lower 8-digit integer value 12345678 of the encryption key is set to a 32-bit column 0 001 001 000 110 100 010 101 100 100 111 100 0. Five sets of integers (1, 1), (0, 6), (4, 2), (5, 4), and (7, 4), each excluding both ends of the column, are 8 digits. Are represented by the 0th to 7th integer values, and transposition is performed by replacing the x coordinate and the y coordinate of each set. For example, the set (4, 2) represents replacing the fourth and second 8-digit integer values. As described above, when the 32-bit integer value 1336557c obtained from the exclusive OR is sequentially transposed five times, an integer value 7356c315 is obtained as shown in FIG. 8B.
[0033]
The transfer file name generation unit 31 generates a transfer file name “t7356c315” by adding an alphabetic character “t” to the beginning of the integer value 7356c315 obtained from the exclusive OR and transposition.
The control terminal 3 logs in to the router 2 via the serial interface 5, specifies the address of the transfer destination host terminal 1 and the transfer file name, and inputs the control command CM for transferring the configuration setting information. The router 2 that has received the control command CM transmits a transfer request message to the host terminal 1 using, for example, the TFTP protocol. At this time, the transfer file name “t7356c315” specified by the control command RQ is added to the transfer request message.
[0034]
The transfer request authentication unit 11 of the host terminal 1 uses the decryption key 0x12345678 to perform the reverse of the encryption process performed by the transfer file name generation unit 31 of the control terminal 3, thereby obtaining the encrypted router 2. Restore the IP address. If the IP address restored by the transfer request authentication unit 11 matches the IP address of the transfer request source specified in the transfer request message, the authentication of the transfer request RQ succeeds.
If the transfer request RQ is successfully authenticated, the transfer request authenticating unit 11 generates a storage file name “s01020304” by prefixing the restored IP address with hexadecimal notation “s”, and generating the transfer request source IP address. The information is transferred to the setting information transfer control unit 12 together with the address and the port number.
Hereinafter, the operation from the start of the transfer of the configuration setting information by the setting information transfer control unit 12 to the completion of the transfer is the same as the above-described operation of the entire system, and thus the description is omitted.
[0035]
As described above, in the router configuration setting information transfer method performed in the system of the first embodiment, the transfer transmitted by the router 2 before the router 2 starts writing the configuration setting information to the host terminal 1. The request RQ is authenticated by the host terminal 1, and when the authentication is successful, the configuration setting information is transferred. Therefore, destruction and tampering of the configuration setting information of each router 2 managed by the host terminal 1 can be prevented.
Further, in this system, before the host terminal 1 starts reading and transferring the configuration setting information to the router 2, the transfer request authentication unit 11 of the host terminal 1 authenticates the transfer request RQ transmitted by the router 2. It is configured. Therefore, leakage of the configuration setting information of each router 2 can be prevented.
[0036]
[Second embodiment]
FIG. 5 is a block diagram showing the configuration of the system according to the second embodiment of the present invention.
This system comprises a host terminal 1a, a router 2, a control terminal 3a, and a network 4 which operate under program control, similarly to the system of the first embodiment. However, the transfer file name generation unit 31 of the control terminal 3a includes a time insertion processing unit 31a, and the transfer request authentication unit 11 of the host terminal 1 includes a deduplication processing unit 11a.
The time insertion processing unit 31a of the control terminal 3a encrypts the current time with the encryption key, and adds the encrypted current time to the transfer file name. The deduplication processing unit 11a of the host terminal 1a extracts the time added to the transfer file name by the time insertion processing unit 31a using the decryption key. Further, the duplication elimination processing unit 11a excludes transfer requests that are older than a preset threshold value, and further excludes transfer requests having the same transfer file name as the accepted transfer file name.
[0037]
The overall operation of the system according to the second embodiment of the present invention is basically the same as that of the system according to the first embodiment, and the flow of the transfer process is represented by the flowchart shown in FIG. 2 or FIG. Is done.
However, the control terminal 3a generates the transfer file name and the time information by the transfer file name generation unit 31 and the time insertion processing unit 31a, and adds the information to the control command CM. Further, the host terminal 1a authenticates the transfer request RQ received from the router 2 via the network interface unit 10 by the transfer request authentication unit 11 and the deduplication processing unit 11a.
Next, the operation of this system will be described using a specific authentication example.
As shown in FIG. 6, the IP address of the router is “1.2.3.4”, the current time (GMT) in Greenwich Mean Time is 0x386dec40, the encryption key and the decryption key are 0x12345678, and the exclusive OR and transposition are performed. Adopt a combined encryption method. This encryption method is the same as the encryption method of the system according to the first embodiment.
[0038]
The transfer file name generation unit 31 of the control terminal 3a replaces the IP address “1.2.3.4” and the current time 0x386dec40 with an integer value of 32 bits, and takes an exclusive OR with the encryption key 0x12345678, respectively. The integer values 1336557c and 2a59ba38 are obtained from the tables shown in FIGS. 8A and 9A. When five sets of transpositions extracted from the encryption key are applied to each of them, an integer value 7356c315 and an integer value 3ab9852a are obtained from the tables shown in FIGS. 8B and 9B.
The transfer file name generation unit 31 connects the integer value 7356c315 and the integer value 3ab9852a obtained by the encryption method combining the exclusive OR and the transposition with a hyphen, and adds an alphabetic character 't' to the head, and The name “t7356c315-3ab9852a” is generated. After that, until the host terminal 1 authenticates the transfer request, the same processing as the authentication example of the system according to the first embodiment is performed.
[0039]
The transfer request authentication unit 11 of the host terminal 1a reversely calculates the encryption process performed by the transfer file name generation unit 31 of the control terminal 3 using the decryption key 0x12345678, thereby obtaining the encrypted router 2 The IP address and the current time GMT are restored.
The transfer request authentication unit 11 determines whether the restored IP address matches the IP address of the transfer request source specified in the transfer request RQ message. If both IP addresses match, and the GMT restored by the deduplication processing unit 11a is within one minute before and after the current GMT and does not match any transfer file names received within the past one minute Then, the authentication of the transfer request succeeds.
If the transfer request authentication is successful, the transfer request authentication unit 11 generates a storage file name “s01020304” by prefixing the restored IP address with hexadecimal notation “s01020304”, and generates the IP address of the transfer request source. It is passed to the setting information transfer control unit 12 together with the port number. Thereafter, this system performs the same processing as the system according to the first embodiment from the start of the transfer of the configuration setting information by the setting information transfer control unit 12 to the completion of the transfer.
[0040]
As described above, in the second embodiment, the same router is configured to change the transfer file name each time. Therefore, security can be maintained even if the transfer file name is leaked due to eavesdropping or the like.
[0041]
【The invention's effect】
As described above in detail, according to the present invention, the configuration information is transferred after adding the identification information of the router to the transfer request and giving the information to the host terminal to determine the validity of the transfer request. For example, when writing the configuration setting information to the host terminal, it is possible to prevent the destruction or tampering of the configuration setting information of each router stored in the host terminal. When the configuration setting information is read from the host terminal, the validity is similarly determined and then transferred, so that it is possible to prevent the configuration setting information of each router from being leaked due to fraud.
[Brief description of the drawings]
FIG. 1 is a block diagram showing a configuration of a system according to a first embodiment of the present invention.
FIG. 2 is a diagram showing a flow of a message in the system according to the first embodiment (write request).
FIG. 3 is a diagram showing a flow of a message in the system according to the first embodiment (read request).
FIG. 4 is a diagram for explaining a specific example of the operation of the system according to the first embodiment.
FIG. 5 is a block diagram illustrating a configuration of a system according to a second embodiment of the present invention.
FIG. 6 is a diagram illustrating a specific example of the operation of the system according to the second embodiment.
FIG. 7 is a block diagram for explaining a conventional technique.
FIGS. 8A and 8B are tables for explaining an IP address encryption process; FIGS.
FIGS. 9A and 9B are tables for explaining the current time encryption processing.
[Explanation of symbols]
1 Host terminal
2 router
3 control terminal
4 Network
5 Serial interface
10 Network interface
11 Transfer request authentication unit
11a Deduplication processing unit
12 setting information transfer control unit
13 Setting information storage
30 Interface section
31 Transfer file name generator
31a Time insertion processing unit
RQ transfer request
CM control command

Claims (21)

A plurality of routers for mutually connecting networks, a host terminal connected to the plurality of routers via the network, storing configuration setting information of each router and maintaining each router, and In a system comprising a control terminal connected to a router and inputting a control command to each router, in accordance with the control command, reads the configuration setting information from the host terminal and transfers it to any router, A configuration setting information transfer method for a router that transfers and writes the configuration setting information from the router to the host terminal,
Prior to reading or writing the configuration setting information, the host terminal adds identification information for identifying the router that created the transfer request to a transfer request including information of a transfer partner, and causes the host terminal to transmit the information.
The host terminal is caused to determine whether the identification information and the information of the transfer partner match or not, and determine whether the transfer request is valid,
A configuration setting information transfer method for a router, wherein the configuration setting information is transferred between the host terminal and the router only when the transfer request is determined to be valid as a result of the determination. A transfer file name generation process for causing the control terminal to create the identification information as a transfer file name, adding the transfer file name to the control command, and sending the control command to the router;
A transfer request transmission process for causing the router to create the transfer request according to the instruction of the control command, adding the transfer file name to the transfer request, and transmitting the transfer file name to the host terminal;
An authentication process for allowing the host terminal to determine whether or not the transfer file name received from the router matches the information of the transfer partner included in the transfer request and determine whether the transfer request is valid; ,
A transfer control process for transferring the configuration setting information between the router and the host terminal only when the transfer request is determined to be valid in the authentication process. Item 2. The method for transferring configuration setting information of a router according to Item 1. The method according to claim 1, wherein the control terminal creates the identification information based on an address of the router in the network. The control terminal encrypts the identification information,
4. The host terminal according to claim 1, wherein the encrypted identification information is decrypted, and whether the transfer request is valid is determined based on a result of the decryption and the information of the transfer partner. 2. The method for transferring configuration setting information of a router according to item 1. To the identification information, added to the time information indicating the time to create the identification information, encrypted and transmitted to the host terminal,
5. The router configuration setting information according to claim 4, wherein the host terminal performs, based on the time information, a deduplication process for eliminating a transfer request to which the same identification information received in the past is added. Transfer method. A control terminal for providing a control command to a router connecting the networks and transferring the configuration setting information between the host terminal connected to the network and storing the configuration setting information of the router and the router; ,
A transfer file name including identification information for identifying the router is created and provided to the router together with the control command, and the transfer file includes information of a transfer partner given to the host terminal before the router transfers the configuration setting information A control terminal having a transfer file name generation unit for adding the transfer file name to a request and transmitting the request to the host terminal. The control terminal according to claim 6, wherein the identification information is an address of the router. The control terminal according to claim 6, wherein the transfer file name generation unit encrypts the identification information to form the transfer file name. The transfer file name generation unit includes a time insertion processing unit that encrypts time information of a time at which an address of the router is encrypted, and inserts the encrypted time information into the transfer file name. Item 9. The control terminal according to Item 8. A setting information storage unit connected to the plurality of routers connecting the networks via the network and configured to store configuration setting information of the routers; A host terminal that reads and writes the configuration setting information stored in the setting information storage unit by transferring the configuration setting information between the
A transfer file name created from the transfer request including information of a transfer partner transmitted from any router via the network before the read or write and identification information for identifying a router that created the transfer request And a transfer request authentication unit that determines whether the transfer file name matches the information of the transfer partner and determines whether the transfer request is valid.
Only when the transfer request authentication unit determines that the transfer request is valid, setting information for accessing the setting information storage unit and transferring the configuration setting information to and from the router that created the transfer request A host terminal, comprising: a transfer control unit. The host terminal according to claim 10, wherein the identification information is formed from an address of the router. 12. The host terminal according to claim 10, wherein the transfer file name is formed by encrypting the identification information. In the transfer file name, time information of the time when the address of the router is encrypted is inserted in addition to the identification information,
The transfer request authentication unit determines whether the transfer request is valid based on the encrypted identification information and the time information, and determines a transfer request given with the same identification information added in the past. 13. The host terminal according to claim 12, wherein the host terminal is excluded. A computer that gives a control command to a router that connects the networks and transfers the configuration setting information between the router and the host terminal that is connected to the network and stores the configuration setting information of the router;
A computer-readable storage medium storing a program for creating a transfer file name including identification information for identifying the router and giving the transfer file name to the router together with the control command. The computer-readable recording medium according to claim 14, wherein the identification information is an address of the router. 16. The computer-readable recording medium according to claim 14, wherein the transfer file name is formed by encrypting the identification information. 17. The computer-readable recording medium according to claim 16, wherein time information of a time at which the address of the router is encrypted is encrypted, and the encrypted time information is inserted into the transfer file name. A setting information storage unit connected to the plurality of routers connecting the networks via the network and configured to store configuration setting information of the routers; A computer that transfers the configuration setting information between and reads and writes the configuration setting information stored in the setting information storage unit,
Before the reading or writing, a transfer request including information of a transfer partner transmitted from any router through the network and a transfer file name created from identification information for identifying a router that created the transfer request A transfer request authentication process for determining whether the transfer file name matches the information of the transfer partner and determining whether the transfer request is valid;
A setting for accessing the setting information storage unit and transferring the configuration setting information to and from the router that created the transfer request only when the transfer request authentication processing determines that the transfer request is valid. A computer-readable recording medium on which a program for performing an information transfer control process is recorded. 19. The computer-readable recording medium according to claim 18, wherein the identification information is formed from an address of the router. 20. The computer-readable recording medium according to claim 18, wherein the transfer file name is formed by encrypting the identification information. In the transfer file name, time information of the time when the address of the router is encrypted is inserted in addition to the identification information,
In the transfer request authentication process, it is determined whether the transfer request is valid from the encrypted identification information and the time information,
21. The computer-readable recording medium according to claim 20, wherein an exclusion process for excluding a transfer request given with the same identification information added in the past is performed.

Images