JP3717855B2 - Network system, network identifier setting method, network information management device, network information management device setting method, wireless access point, wireless access point network identifier setting method, edge switch, edge switch Network identifier setting method, program, and recording medium - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to a network system, an in-network identifier setting method, an in-network information management device, an in-network identifier setting method in an in-network information management device, a wireless access point, an in-network identifier setting method in a wireless access point, and an edge switch. In particular, the present invention relates to edge switch network identifier setting methods, programs, and recording media, and can be used particularly in an information communication network that provides a plurality of different access means (wireless LAN technology or wired LAN technology). A public network based on Ethernet technology that allows communication terminals to access any IP service network system or other terminals in the same information communication network, and allows communication terminals to arbitrarily select the priority for data frame transmission. The present invention relates to a technology effective when applied to a network system.
[0002]
[Prior art]
Conventionally, when a communication terminal is an access system constructed with Ethernet technology and VLAN settings are made for each connection, user authentication is performed when the communication terminal is connected, and the user is confirmed that the authentication is an authorized user. A VLAN using a user ID as authentication information and a VID (Virtual LAN Identifier) associated with a physical port of a wireless access point (hereinafter referred to as AP) or a wired edge switch (hereinafter referred to as SW). This is realized by setting or setting a VLAN using a VID associated with a MAC address.
Service selectivity is realized by using a protocol such as PPP (Point-to-point Protocol) together.
[0003]
[Problems to be solved by the invention]
However, when VLAN setting is performed for each connection by the above-described method, there is a problem that dynamic VID assignment cannot be performed when connecting to a network (hereinafter referred to as an information communication network).
That is, according to the method as described above, (1) the VID in the unused state cannot be used effectively, and therefore there is a problem that the numerically limited VID (4094) cannot be effectively used, and (2) the information communication network side It is necessary to associate the physical port of the VID and the AP or the wired edge SW in the network, or associate the VID and the MAC address of the communication terminal on the information communication network side. (3) When PPP is used to realize service selectivity when a user wishes to connect to an arbitrary IP service network, before PPPDicoveryStage starts, Since the broadcast domain is shared by multiple communication terminals, security such as not being able to attack other communication terminals and impersonating IP addresses The problems that the bell is degraded, by using the PPP, for state management traffic is increased, there is a problem to waste traffic resources in the network.
[0004]
The present invention has been made to solve the problems of the prior art, and an object of the present invention is to enable a communication terminal to access an arbitrary IP service network or another communication terminal in the same network. Ethernet technology that allows users to select services, allows communication terminals to arbitrarily select the priority for data frame transmission, and to maintain service continuity during movement by maintaining the same VID within the same network It is to provide a network system.
Another object of the present invention is to provide a method for setting an in-network identifier in the network system.
Another object of the present invention is to provide an in-network information management apparatus applied to the network system, and an in-network identifier setting method in the in-network information management apparatus.
Another object of the present invention is to provide a program for causing an in-network information management computer applied to the network system to execute an in-network identifier setting method.
Another object of the present invention is to provide an access point or edge switch applied to the network system.
Another object of the present invention is to provide a program for causing a computer functioning as an access point or an edge switch applied to the network system to execute an in-network identifier setting method.
Another object of the present invention is to provide a recording medium on which the aforementioned program is recorded.
The above and other objects and novel features of the present invention will become apparent from the description of this specification and the accompanying drawings.
[0005]
[Means for Solving the Problems]
Of the inventions disclosed in this application, the outline of typical ones will be briefly described as follows.
That is, the present invention provides a communication terminal, a wireless access point that is wirelessly connected to the communication terminal, or an edge switch that is connected to the communication terminal by wire, a router that is connected to an IP service network, and the wireless An access point or a relay Layer 2 switch that connects between the edge switch and the router; an access authentication information management database that manages user authentication information for each user ID that can uniquely identify the communication terminal in the network; An in-network information management device having an in-network identifier management database for managing a VID for distinguishing data frames for each communication terminal, the wireless access point or the edge switch, and the relay Layer 2 switch, A VLAN is set for each user with the router. In the network system, when the communication terminal is connected, the in-network information management device compares the authentication information notified from the communication terminal with the authentication information stored in the access authentication information management database, and After confirming that the terminal is a legitimate user (hereinafter referred to as access authentication), the VID in the idle state is set as an in-network identifier, and the wireless access point or edge switch is set by the communication terminal having the user ID. The VID is registered in the data frame.
In addition, when the communication terminal is disconnected, the wireless access point or the edge switch deletes the VID setting and notifies the in-network information management device of the release of the VID. The information management apparatus sets the VID registered in the in-network identifier management database to an empty state.
[0006]
According to the present invention, it is possible to assign a VID in an unused state, and it is possible to effectively use VIDs (4094) that are numerically limited.
In addition, there is no need to associate the VID and the wireless access point or the physical port of the wired edge switch on the network (information communication network) side, or the VID and the MAC address of the communication terminal on the network. Since the user's usage environment is not limited by location or terminal, convenience can be improved.
In addition, at the same time as access authentication, a wireless access point or a wired edge switch can be used to assign a VID to each user and restrict the broadcast domain, so that the security level can be improved.
Furthermore, an in-network information management apparatus having an access authentication information management database and an in-network identifier management database of the communication terminal is provided for remote authentication and in-network identifier of a wireless access point or a wired edge switch. Since the remote registration request is performed, it is possible to reduce user information management and network identifier management operations.
[0007]
Further, in the present invention, in the network system described above, when the communication terminal is connected, the in-network information management device sets a VID that is idle in cooperation with access authentication as an in-network identifier, and a wireless access point or In addition to restricting the broadcast domain by registering the VID in the data frame from the communication terminal having the user ID by the edge switch, the in-network information management device allows the user to connect to each connection destination desired by the user. A predetermined service identifier is set as an in-network identifier, a wireless access point or an edge switch registers the service identifier in a data frame from a communication terminal having the user ID, and the router IP service network router interface associated with And wherein the transfer of user data frames to scan.
Further, when the communication terminal is disconnected, the wireless access point or the edge switch deletes the setting of the VID and the service identifier, and the VID and the service identifier of the in-network information management device are deleted. A release notification is performed, and the in-network information management device sets the VID and the service identifier registered in the in-network identifier management database to a free state.
According to the present invention, since a broadcast domain is not shared among a plurality of communication terminals, it is possible to improve service selectivity without deteriorating the security level such as the inability to attack other communication terminals and the impersonation of IP addresses. It becomes possible.
Further, since no state management traffic is generated, traffic resources in the network can be used effectively.
[0008]
Further, according to the present invention, in the network system described above, when the communication terminal is connected, the in-network information management device sets a VID that is idle in cooperation with access authentication as an in-network identifier, and a wireless access point or In addition to restricting the broadcast domain by registering the VID in the data frame from the communication terminal having the user ID by the edge switch, the in-network information management device allows the user to connect to each service class desired by the user. A predetermined service class identifier is set as an in-network identifier, and a wireless access point or edge switch registers the service class identifier in a data frame from a communication terminal having the user ID, and the relay Layer 2 switch and The router is assigned by the service class identifier. It determines the priority of the data frame, and selects the output port to forward the data frame.
Further, when the communication terminal is disconnected, the wireless access point or the edge switch deletes the setting of the VID and the service class identifier, and the VID and the service class with respect to the in-network information management device An identifier release notification is performed, and the in-network information management device sets the VID and the service class identifier registered in the in-network identifier management database to a free state.
According to the present invention, since the broadcast domain is not shared among a plurality of communication terminals, the communication terminal can arbitrarily transmit a data frame without deteriorating the security level such as that it is impossible to attack other communication terminals and IP address impersonation. It is possible to select a priority for.
[0009]
The present invention also provides a communication terminal, a wireless access point connected to the communication terminal wirelessly, a router connected to an IP service network, and a relay Layer 2 switch for connecting the wireless access point and the router An access authentication information management database that manages user authentication information for each user ID that can uniquely identify the communication terminal in the network, and an in-network identifier management database that manages a VID that distinguishes data frames for each communication terminal A network system in which a VLAN is set for each VID used in the network system in the wireless access point, the router, and the relay Layer 2 switch, The network information management device makes the communication terminal the first wireless access point. When the communication terminal is confirmed to be a legitimate user after moving to another second wireless access point in a connected state, if the user ID is a lifetime user ID, the communication The same VID as the VID used before the terminal moves to the second access point is set as an in-network identifier, and the wireless access point adds the VID to the data frame from the communication terminal having the user ID. It is characterized by registering.
[0010]
The wireless access point deletes the VID setting when the communication terminal is disconnected, and notifies the in-network information management device of the release of the VID. The association between the VID and the user ID held in the in-network identifier management database is held during the lifetime, and when the lifetime is exceeded, the VID is set to a free state.
According to the present invention, the second wireless access from the first wireless access point is managed by managing the association between the VID and user ID given in cooperation with the access authentication when the communication terminal is connected and the connection state of the communication terminal. Since VID can be ensured at the time of handover to a point, connectivity during movement can be ensured.
In addition, since the VID does not change at the time of movement, the service can be continued when connected to the service network associated with the VID, so that it is possible to improve user convenience.
[0011]
The present invention is also a method for setting an in-network identifier in the network system described above.
The present invention also relates to an in-network information management apparatus applied to the above-described network system and an in-network identifier setting method in the in-network information management apparatus.
The present invention is also a wireless access point or edge switch applied to the network system described above, and a method for setting an in-network identifier in the wireless access point or edge switch.
Further, the present invention, when a computer is used as an in-network information management apparatus, a wireless access point, or an edge switch applied to the above-described network system, causes the computer to execute the above-described in-network identifier setting method. And a recording medium on which the program is recorded.
[0012]
DETAILED DESCRIPTION OF THE INVENTION
Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.
Note that components having the same function are denoted by the same reference symbols throughout the drawings for describing the embodiment, and the repetitive description thereof will be omitted.
[Embodiment 1]
FIG. 1 is a block diagram showing a schematic configuration of a public network system based on Ethernet technology according to Embodiment 1 of the present invention.
The public network system (hereinafter referred to as public NW system) of the present embodiment includes a communication terminal 5, an AP 20 or a wired edge SW 21, a router 3 connected to the IP service network 9, an AP 20, or a wired edge SW 21. The relay layer 2 switch 4 connecting the router 3 and the in-network information management device 1 are configured.
The AP 20 directly accommodates the communication terminal 5 by radio, that is, the AP 20 and the communication terminal 5 are connected by radio. The wired edge SW21 directly accommodates the communication terminal 5 by wire, and the wired edge SW21 and the communication terminal are connected by wire. Here, the in-network information management device 1 includes an access authentication information management database 6 that manages user authentication information for each user ID (identifier) that can uniquely identify the communication terminal 5 in the network, and a data frame for each communication terminal. And an in-network identifier management database 7 for managing VIDs for distinguishing between them.
The AP 20 or the wired edge SW 21 inserts an in-network identifier (VID) into a data frame (user data frame) from a communication terminal based on an in-network identifier registration request from the in-network information management device 1.
Further, a VLAN is set for each user between the AP 20 or the wired edge SW 21, the relay Layer 2 switch 4, and the router 3.
[0013]
FIG. 2 is a diagram showing a connection procedure of the public NW system according to the present embodiment.
In FIG. 2, the authentication protocol used at the time of access authentication is an access authentication protocol on Ethernet such as IEEE 802.1x. In this example, description will be made using IEEE 802.1x, but the same applies to other access authentication protocols on Ethernet.
When the communication terminal 5 is connected to the public NW system (L1 in FIG. 2), first, the user manages the user ID and authentication information (password) for access authentication in the network information based on the IEEE 802.1x authentication procedure. The device 1 is notified (L2 in FIG. 2).
The network information management apparatus 1 performs access authentication by comparing the user ID / authentication information managed in the access authentication information management database 6 with the user ID / authentication information input by the user (FIG. 2). L3).
By the access authentication, the authentication information notified from the communication terminal 5 and the authentication information for the user ID notified from the communication terminal 5 stored in the access authentication information management database 6 match, and the user is in the present network (hereinafter referred to as “the network ID”). Only when it is recognized that the user is an authorized user of the information communication network), the in-network information management device 1 sets the broadcast domain for each user in Ethernet based on the in-network identifier management database 7. A free VID (in-network identifier) is selected, and the free VID and user ID are associated with each other and registered in the in-network identifier management database 7.
[0014]
Then, the selected network identifier (VID) is notified to the AP 20 or the wired edge SW 21 and a registration request to the user data frame is made (L4 in FIG. 2).
The AP 20 or the wired edge SW 21 that has received the notification from the in-network information management device 1 opens the network port for the communication terminal and the network port for the relay Layer 2 switch 4 (or information communication network), and the communication terminal The VID is inserted into the data frame from 5 and the two network ports are connected (L5 and L6 in FIG. 2).
When the communication terminal 5 releases the connection to the information communication network (L7 in FIG. 2), the AP 20 or the wired edge SW 21 deletes the VID set for the communication terminal 5 (FIG. 2). L8), the in-network information management device 1 is notified that it has been deleted (L9 in FIG. 2).
The in-network information management device 1 receives the notification of deletion of the in-network identifier from the AP 20 or the wired edge SW 21 and cancels the one-to-one correspondence between the corresponding VID and the user ID in the in-network identifier management database ( L10 in FIG.
As a result, the VID becomes empty and can be used for the next connected user.
As described above, according to the present embodiment, it is possible to implement VID assignment in cooperation with user authentication.
[0015]
FIG. 3 is a functional block diagram showing the internal configuration of the in-network information management device 1.
The in-network information management apparatus 1 includes an access authentication information management database 6, an in-network identifier management database 7, an in-network identifier registration request / deletion request execution unit 12, and a transmission / reception unit 11.
The in-network identifier registration request / deletion request execution unit 12 executes access authentication, and when the access authentication confirms that the user is a regular user of the information communication network, the in-network identifier (VID) is set to AP20, Alternatively, it notifies the wired edge SW21.
Further, when the connection of the communication terminal 5 is released, the one-to-one correspondence between the corresponding VID and the user ID in the in-network identifier management database is released.
The transmission / reception unit 11 transmits / receives control information to / from the AP 20 or the wired edge SW 21 via the information communication network. Here, the control information means information related to access authentication and an in-network identifier (VID).
FIG. 4 is a diagram showing the contents of the access authentication information management database 6 and the in-network identifier management database 7 of the present embodiment.
As shown in FIG. 4A, the access authentication information management database 6 manages user information (authentication information such as a user ID and password) that can uniquely identify the communication terminal 5 in the information communication network. As shown in FIG. 4B, the in-network identifier management database 7 manages user IDs and VIDs assigned to the respective user IDs.
[0016]
FIG. 5 is a functional block diagram relating to the network identifier registration function of the AP 20 or the wired edge SW 21 according to the present embodiment.
The AP 20 or the wired edge SW 21 includes a data frame transmission / reception unit 30, an Ethernet access authentication client function unit 32, an in-network identifier registration / deletion execution unit 31, and a transmission / reception unit 33.
The data frame transmitting / receiving unit 30 receives a data frame from the communication terminal 5 or issues a data frame from the information communication network to the communication terminal 5.
The network identifier registration / deletion execution unit 31 receives the network identifier (VID) notification from the network information management device 1, inserts the network identifier into the user data frame, and cancels the connection of the communication terminal 5. If it is, a connection release notification is sent to the in-network information management device 1.
The access authentication client function unit 32 transmits the user ID and authentication information input from the communication terminal 5 to the in-network information management device 1.
The transmission / reception unit 33 transmits / receives control information to / from the network information management apparatus 1 via the router 3 (that is, the information communication network). Here, the control information means information related to access authentication and an in-network identifier.
[0017]
[Embodiment 2]
Since the public NW system based on the Ethernet technology according to the second embodiment of the present invention is the same as that shown in FIG. 1, the system configuration is not shown.
FIG. 6 is a diagram showing a connection procedure of the public NW system according to the present embodiment.
In FIG. 6, the authentication protocol used at the time of access authentication is an access authentication protocol on Ethernet such as IEEE 802.1x. In this example, description will be made using IEEE 802.1x, but the same applies to other access authentication protocols on Ethernet.
When the communication terminal 5 is connected to the information communication network (M1 in FIG. 6), first, the user sends the user ID / authentication information for access authentication to the in-network information management apparatus 1 based on the IEEE 802.1x authentication procedure. Notification is made (M2 in FIG. 6).
The in-network information management device 1 compares the user ID / authentication information managed in the access authentication information management database 6 with the user ID / authentication information input by the user, and performs access authentication (M3 in FIG. 6). ).
Only when the user is recognized as an authorized user of this information communication network by the access authentication, the in-network information management device 1 sets a broadcast domain for each user in Ethernet based on the in-network identifier management database 7. A vacant VID for setting is selected, and the vacant VID and user ID are associated with each other and registered in the in-network identifier management database 7.
[0018]
Furthermore, based on the in-network identifier management database 7, a service identifier corresponding to the IP service ID representing the IP service network name that the communication terminal 5 desires to connect to is selected, and the service identifier and the IP service ID are associated with each other. And registered in the network identifier management database 7.
The IP service ID representing the IP service network name is notified to the in-network information management apparatus 1 by the user via the communication terminal 5. Also, IEEE 802.1Q VID is used for this service identifier.
Then, the selected network identifier (VID, service identifier) is notified to the AP 20 or the wired edge SW 21 and a registration request to the user data frame is made (M4 in FIG. 6).
In the AP 20 or the wired edge SW 21 that has received the notification from the in-network information management device 1, the network port for the communication terminal and the network port for the information communication network are opened, and the data frame from the communication terminal 5 After inserting an identifier (VID, service identifier) (both are IEEE802.1Q VIDs), two network ports are connected (M5 and M6 in FIG. 6).
On the other hand, the VID is fixedly set in the relay Layer 2 SW 4, and a dynamic network path is configured in the information communication network when the in-network identifier is inserted in the AP 20 or the wired edge SW 21. It becomes.
[0019]
In the router 3, a router interface for each IP service network is prepared, a mapping table of service identifiers and router interfaces for each IP service network is held, and a service identifier in a network path indicating a connection destination IP service network is set. Based on this, the user data frame is transferred to the IP service network requested at the time of the connection request.
When the communication terminal 5 releases the connection to the information communication network (M7 in FIG. 6), the AP 20 or the wired edge SW 21 sets the network identifier (VID, (Service identifier) is deleted (M8 in FIG. 6), and the network information management apparatus 1 is notified of the deletion (M9 in FIG. 6).
The in-network information management device 1 receives the notification of deletion of the in-network identifier from the AP 20 or the wired edge SW 21, receives a one-to-one correspondence between the corresponding VID and user ID in the in-network identifier management database, and the IP service. The one-to-one correspondence between the ID and the service identifier is canceled (M10 in FIG. 6).
As a result, the network identifier (VID, service identifier) becomes empty and can be used for the next connected user.
As described above, according to the present embodiment, it is possible to improve the convenience of the communication terminal 5 by simultaneously assuring service selectivity and ensuring security in the information communication network using Ethernet.
[0020]
The internal configuration of the in-network information management device 1 according to the present embodiment is the same as that shown in FIG.
However, in this embodiment, the in-network identifier registration request / deletion request execution unit 12 of the in-network information management device 1 confirms that the user is a regular user of the information communication network by access authentication. As the internal identifier, the aforementioned VID and service identifier are notified to the AP 20 or the wired edge SW 21, and when the communication terminal 5 is disconnected, the corresponding in-network identifier in the in-network identifier management database 7 is made free. Set.
Although the illustration of the contents of the access authentication information management database 6 of this embodiment is omitted, the access authentication information management database 6 of this embodiment is similar to FIG. User information (authentication information such as user ID and password) that can be uniquely identified is managed.
FIG. 7 is a diagram showing the contents of the in-network identifier management database 7 of the present embodiment.
As shown in FIG. 7, the in-network identifier management database 7 manages user IDs, IP service IDs, VIDs, and service identifiers.
Further, the configuration related to the network identifier registration function of the AP 20 or the wired edge SW 21 according to the present embodiment is the same as that shown in FIG.
[0021]
[Embodiment 3]
Since the public NW system based on the Ethernet technology according to the third embodiment of the present invention is the same as that shown in FIG. 1, the system configuration is not shown.
FIG. 8 is a diagram showing a connection procedure of the public NW system according to the present embodiment.
In FIG. 8, the authentication protocol used at the time of access authentication is an access authentication protocol on Ethernet such as IEEE 802.1x. In this example, description will be made using IEEE 802.1x, but the same applies to other access authentication protocols on Ethernet.
When the communication terminal 5 is connected to the information communication network (N1 in FIG. 8), first, based on the IEEE 802.1x authentication procedure, the user sends the user ID / authentication information for access authentication to the in-network information management device 1. Notification is made (N2 in FIG. 8).
The in-network information management apparatus 1 compares the user ID / authentication information managed in the access authentication information management database 6 with the user ID / authentication information input by the user, and performs access authentication (N3 in FIG. 8). ).
Only when the user is recognized as an authorized user of this information communication network by the access authentication, the in-network information management device 1 sets a broadcast domain for each user in Ethernet based on the in-network identifier management database 7. A vacant VID for setting is selected, and the vacant VID and user ID are associated with each other and registered in the in-network identifier management database 7.
[0022]
Further, based on the in-network identifier management database 7, a service class identifier that uses a priority tag of IEEE 802.1Q and is associated with a service class ID that designates a service class desired by the user is selected, and the service class identifier and The service class ID is associated with and registered in the in-network identifier management database 7.
The service class ID for designating the service class desired by the user is notified to the in-network information management device 1 via the communication terminal 5 by the user.
Then, the network identifier (VID, service class identifier) is notified to the AP 20 or the wired edge SW 21 and a registration request to the user data frame is made.
The AP 20 or the wired edge SW 21 that has received the notification from the in-network information management device 1 opens the network port for the communication terminal and the network port for the information communication network, and the data frame from the communication terminal 5 After inserting the identifier (VID, service class identifier), the two network ports are connected (N5 and N6 in FIG. 8).
Here, the VID is an IEEE 802.1Q VID, and the service class identifier is an IEEE 802.1Q priority tag.
[0023]
On the other hand, when receiving the user data frame, the router 3 and the relay Layer 2 SW 4 and the AP 20 or the wired edge SW 21 determine the priority of the data frame based on the service class identifier, and output port to which the data frame is transferred A service class is provided for each communication terminal by mapping to one of CoS (Class of Service) that can be used.
When the communication terminal 5 releases the connection to the information communication network (N7 in FIG. 8), the AP 20 or the wired edge SW 21 sets the in-network identifier (VID, (Service class identifier) is deleted (N8 in FIG. 8), and the network information management apparatus 1 is notified of the deletion (N9 in FIG. 8).
The in-network information management device 1 receives the notification of deletion of the in-network identifier from the AP 20 or the wired edge SW 21, and has a one-to-one correspondence between the corresponding VID and user ID in the in-network identifier management database, and the service class The one-to-one correspondence between the ID and the service class identifier is canceled (N10 in FIG. 6).
As a result, the in-network identifier (VID, service class identifier) becomes empty and can be used for the next connected user.
As described above, according to the present embodiment, it is possible to improve the convenience of the communication terminal 5 by assuring service class selectivity and ensuring security simultaneously in the information communication network using Ethernet.
[0024]
FIG. 9 is a diagram illustrating an example of assignment of a service class identifier according to the present embodiment.
As shown in FIG. 9, the service class identifier (priority TAG) can be assigned in 0 to 8 stages. Here, priority means that the user data frame can be transmitted before other data frames.
For example, as shown in FIG. 9, when the priority TAG is set in two stages, when the priority TAG is 0 (priority TAG = 0), the priority TAG is transmitted and the priority TAG is 1 ( When priority TAG = 1), transmission is performed with best effort.
The internal configuration of the in-network information management device 1 according to the present embodiment is the same as that shown in FIG.
However, in this embodiment, the in-network identifier registration request / deletion request execution unit 12 of the in-network information management device 1 confirms that the user is a regular user of the information communication network by access authentication. As the internal identifier, the above-mentioned VID and service class identifier are notified to the AP 20 or the wired edge SW 21, and when the communication terminal 5 is disconnected, the corresponding internal network identifier in the internal network identifier management database 7 is set to an empty state. Set to.
Although the illustration of the contents of the access authentication information management database 6 of this embodiment is omitted, the access authentication information management database 6 of this embodiment is similar to FIG. User information (authentication information such as user ID and password) that can be uniquely identified is managed.
FIG. 10 is a diagram showing the contents of the in-network identifier management database 7 of the present embodiment.
As shown in FIG. 10, the access authentication information management database 6 manages user IDs, service class IDs, VIDs, and service class identifiers.
Further, the configuration related to the network identifier registration function of the AP 20 or the wired edge SW 21 according to the present embodiment is the same as that shown in FIG.
[0025]
[Embodiment 4]
FIG. 11 is a block diagram showing a schematic configuration of a public NW system based on Ethernet technology according to the fourth embodiment of the present invention.
The public NW system according to the present embodiment includes a communication terminal 5, an AP 20, a router 3, a relay Layer 2 switch 4 that connects between the AP 20 and the router 3, and an in-network information management device 1.
The AP 20 directly accommodates the communication terminal 5 by radio, that is, the AP 20 and the communication terminal 5 are connected by radio.
Here, the in-network information management device 1 includes an access authentication information management database 6 that manages user authentication information for each user ID (identifier) that can uniquely identify the communication terminal 5 in the network, and a data frame for each communication terminal. And an in-network identifier management database 7 for managing VIDs for distinguishing between them.
Further, the AP 20 inserts an in-network identifier (VID) into a data frame (user data frame) from the communication terminal based on the in-network identifier registration request from the in-network information management device 1.
In the present embodiment, a fixed VLAN is set for each VID used in the public NW system using the Ethernet technology in the router 3, the relay Layer 2 switch 4, and the AP 20. For example, when VID of 0 to 1000 is used, 1000 TAG is set.
[0026]
A case will be described where the mobile terminal moves to another AP 20 (hereinafter referred to as a second AP) while connected to the AP 20 (hereinafter referred to as a first AP).
FIG. 12 is a diagram illustrating a connection procedure of the public NW system according to the fourth embodiment of the present invention, and is a diagram illustrating a connection procedure when the communication terminal 5 moves.
In FIG. 12, the authentication protocol used at the time of access authentication is an access authentication protocol on Ethernet such as IEEE 802.1x. In this example, description will be made using IEEE 802.1x, but the same applies to other access authentication protocols on Ethernet.
Note that the procedure for connecting the communication terminal 5 to the information communication network is the same as that in the first embodiment, and therefore, this procedure is hereinafter referred to as the procedure in the first embodiment.
When the communication terminal 5 moves from the first AP 20 to the second AP 20, disconnection occurs in the physical layer of radio access (O1 in FIG. 12).
Therefore, the procedure of the first embodiment is started again under the second AP 20 (O2 in FIG. 12).
At that time, the in-network information management device 1 holds a period during which the same VID can be reused after the communication terminal 5 is disconnected (hereinafter referred to as the lifetime), and disconnects the communication terminal 5 remaining in the in-network identifier management database 7. When the difference between the time and the current time is within the lifetime, the one-to-one correspondence between the user ID and the VID is held (O3 in FIG. 12).
[0027]
When the communication terminal 5 is recognized as a legitimate user by the access authentication at the second AP 20 after moving, and the user ID is in the lifetime, the in-network information management is performed. The device 1 requests the second AP 20 to register the same VID as the VID using the IEEE 802.1Q VID used last time based on the in-network identifier management database 7 (O4 in FIG. 12).
The second AP 20 that has received the notification from the in-network information management device 1 opens the network port for the communication terminal and the network port for the information communication network, and adds an in-network identifier (IEEE 802.1) to the data frame from the communication terminal 5. After inserting the VID of Q, the two network ports are connected (O5 and O6 in FIG. 12).
When the connection of the communication terminal 5 is released (O7 in FIG. 12), the second AP 20 deletes the VID setting (O8 in FIG. 12) and sends a VID release notification to the in-network information management device 1. This is performed (O9 in FIG. 12).
The network information management device 1 starts a timer based on the release notification, and maintains the correspondence between the VID and the user ID in the network identifier management database 7 within the lifetime, and the lifetime is exceeded. Cancels the association between the corresponding VID in the in-network identifier management database and the user ID (O10 in FIG. 12).
In the present embodiment, the connection procedure when newly connecting to the information communication network from the communication terminal 5 is the same as in the first embodiment.
[0028]
The internal configuration of the in-network information management device 1 according to the present embodiment is the same as that shown in FIG.
Although the illustration of the contents of the access authentication information management database 6 of this embodiment is omitted, the access authentication information management database 6 of this embodiment is similar to FIG. User information (authentication information such as user ID and password) that can be uniquely identified is managed.
FIG. 13 is a diagram showing the contents of the in-network identifier management database 7 of the present embodiment.
As shown in FIG. 13, the in-network identifier management database 7 manages user IDs, VIDs, and connection status record flags.
The connection status record flag shown in FIG. 13 is turned on when the communication terminal 5 is connected to the information communication network, and is turned off within the above-described lifetime.
Further, the configuration related to the in-network identifier registration function of the AP 20 according to the present embodiment is the same as that shown in FIG.
In the above description, the in-network information management apparatus 1 or AP 20 or the wired edge SW 21 can be executed by a computer. In this case, the in-network information management apparatus 1 or AP 20 or The method of setting the in-network identifier of the wired edge SW 21 is performed by the computer executing a program stored in a hard disk or the like in the computer. This program is supplied by downloading via a CD-ROM or a network.
Although the invention made by the present inventor has been specifically described based on the above-described embodiment, the present invention is not limited to the above-described embodiment, and various modifications can be made without departing from the scope of the invention. Of course.
[0029]
【The invention's effect】
The effects obtained by the representative ones of the inventions disclosed in the present application will be briefly described as follows.
(1) According to the present invention, it is possible to effectively use VIDs that are numerically limited, improve user convenience, and reduce network management operations.
(2) According to the present invention, it is possible to realize service selectivity and service class selectivity at a CoS level without deteriorating the security level and without wasting traffic resources in the network.
(3) According to the present invention, it is possible to realize service sustainability when the communication terminal moves.
[Brief description of the drawings]
FIG. 1 is a block diagram showing a schematic configuration of a public network system using Ethernet technology according to a first embodiment of the present invention.
FIG. 2 is a diagram showing a connection procedure of the public network system according to the first embodiment of the present invention.
3 is a functional block diagram showing a schematic configuration of an in-network information management device 1 shown in FIG.
FIG. 4 is a diagram showing contents of an access authentication information management database and an in-network information identifier management database according to the first embodiment of the present invention.
FIG. 5 is a functional block diagram showing an in-network identifier registration function of the AP or wired edge SW shown in FIG. 1;
FIG. 6 is a diagram showing a connection procedure of the public network system according to the second embodiment of the present invention.
FIG. 7 is a diagram showing the contents of an in-network identifier management database according to the second embodiment of the present invention.
FIG. 8 is a diagram showing a connection procedure of the public network system according to the third embodiment of the present invention.
FIG. 9 is a diagram illustrating a service class implementation example in Embodiment 3 of the present invention;
FIG. 10 is a diagram showing the contents of an in-network identifier management database according to the third embodiment of the present invention.
FIG. 11 is a block diagram showing a schematic configuration of a public network system based on Ethernet technology according to a fourth embodiment of the present invention.
FIG. 12 is a diagram showing a connection procedure of the public network system according to the fourth embodiment of the present invention.
FIG. 13 is a diagram showing the contents of an in-network identifier management database according to the fourth embodiment of the present invention.
[Explanation of symbols]
DESCRIPTION OF SYMBOLS 1 ... Network information management apparatus, 3 ... Router, 4 ... Relay Layer2 switch, 5 ... Communication terminal, 6 ... Access authentication information management database, 7 ... Network identifier management database, 9 ... IP service network, 11, 33 ... Transmission / reception , 12 ... In-network identifier registration request / deletion request execution unit, 20 ... Wireless access point, 21 ... Wired edge switch, 30 ... Data frame transmission / reception unit, 31 ... In-network identifier registration / deletion execution unit, 32 ... Access authentication client Functional part.

Claims (24)

A communication terminal;
A wireless access point wirelessly connected to the communication terminal, or an edge switch connected to the communication terminal by wire;
A router connected to the IP service network;
The wireless access point, or the relay layer 2 switch connecting the edge switch and the router,
An access authentication information management database that manages user authentication information for each user ID that can uniquely identify the communication terminal in the network, and an in-network identifier management database that manages a VID that distinguishes data frames for each communication terminal A network information management device having
A network system in which a VLAN is set for each user between the wireless access point or the edge switch, the relay Layer 2 switch, and the router,
The in-network information management device includes authentication information notified from the communication terminal at the time of a connection request for the communication terminal, and authentication information for the user ID notified from the communication terminal stored in the access authentication information management database. And a first means for confirming that the communication terminal is an authorized user,
When it is confirmed by the first means that the communication terminal is an authorized user, an empty VID is selected based on the in-network identifier management database, and the empty VID and the user ID are selected. In association with each other and registering it in the in-network identifier management database;
Issuing a registration request for causing the wireless access point or the edge switch to register the VID selected by the second means to the wireless access point or the edge switch; Means,
A fourth means for releasing the association between the VID and the user ID registered in the in-network identifier management database based on a release notification from the wireless access point or the edge switch;
The wireless access point or edge switch has a first means for registering the VID in a data frame from the communication terminal in response to a registration request from the in-network information management device;
A network system comprising: a second unit that deletes the VID setting and releases the VID release notification to the in-network information management device when the communication terminal is disconnected. A communication terminal;
A wireless access point wirelessly connected to the communication terminal, or an edge switch connected to the communication terminal by wire;
A router connected to the IP service network;
The wireless access point, or a relay Layer 2 switch that connects between the edge switch and the router,
An access authentication information management database that manages user authentication information for each user ID that can uniquely identify the communication terminal in the network, and a service that recognizes a VID and a connection destination IP service network for distinguishing data frames for each communication terminal An in-network information management device having an in-network identifier management database for managing identifiers,
A network system in which a VLAN is set for each user between the wireless access point or edge switch, the relay Layer 2 switch, and the router,
The in-network information management device includes authentication information notified from the communication terminal at the time of a connection request for the communication terminal, and authentication information for the user ID notified from the communication terminal stored in the access authentication information management database. And a first means for confirming that the communication terminal is an authorized user,
When it is confirmed by the first means that the communication terminal is an authorized user, an empty VID is selected based on the in-network identifier management database, and the empty VID and the user ID are selected. In association with each other and registering it in the in-network identifier management database;
In response to the notification of the IP service ID representing the name of the IP service network desired to be connected from the communication terminal, the vacant service identifier and the IP are selected based on the in-network identifier management database. A third means for associating the service ID with each other and registering the service ID in the in-network identifier management database;
A registration request for causing the wireless access point or the edge switch to register the VID and the service identifier selected by the second and third means is sent to the wireless access point or the edge switch. A fourth means for issuing;
Based on the release notification from the wireless access point or the edge switch, the association between the VID and the user ID and the service identifier and the IP service ID registered in the in-network identifier management database is released. And a fifth means to
The wireless access point or edge switch, based on a registration request from the in-network information management device, first means for registering the VID and the service identifier in a data frame from the communication terminal,
A second means for deleting the setting of the VID and the service identifier at the time of disconnection of the communication terminal and notifying the in-network information management device of the release of the VID and the service identifier;
The network system, wherein the router has means for transferring a data frame from the communication terminal to a router interface of an IP service network associated with the service identifier. A communication terminal;
A wireless access point wirelessly connected to the communication terminal, or an edge switch connected to the communication terminal by wire;
A router connected to the IP service network;
The wireless access point, or a relay Layer 2 switch that connects between the edge switch and the router,
An access authentication information management database for managing user authentication information for each user ID that can uniquely identify the communication terminal in the network, and an in-network identifier for managing a VID and a service class identifier for distinguishing data frames for each communication terminal A network information management device having a management database;
A network system in which a VLAN is set for each user between the wireless access point or edge switch, the relay Layer 2 switch, and the router,
The in-network information management device includes authentication information notified from the communication terminal at the time of a connection request for the communication terminal, and authentication information for the user ID notified from the communication terminal stored in the access authentication information management database. And a first means for confirming that the communication terminal is an authorized user,
When it is confirmed by the first means that the communication terminal is an authorized user, an empty VID is selected based on the in-network identifier management database, and the empty VID and the user ID are selected. In association with each other and registering it in the in-network identifier management database;
Upon receiving a notification of a service class ID representing a service class name desired to be connected from the communication terminal, based on the in-network identifier management database, a free service class identifier is selected, and the free service class identifier and the A third means for associating the service class ID with each other and registering it in the in-network identifier management database;
A registration request for causing the wireless access point or the edge switch to register the VID and the service class identifier selected by the second and third means is sent to the wireless access point or the edge switch. And a fourth means for issuing
Based on the release notification from the wireless access point or edge switch, the VID registered in the in-network identifier management database and the user ID, and the service class identifier and the service class ID are associated with each other. And a fifth means for releasing,
The wireless access point or the edge switch, based on a registration request from the in-network information management device, first means for registering the VID and the service class identifier in a data frame from the communication terminal;
And a second means for deleting the setting of the VID and the service class identifier and releasing the VID and the service class identifier to the in-network information management device when the communication terminal is disconnected. And
The wireless access point or edge switch, and the relay layer 2 switch and router determine the priority of the data frame from the communication terminal based on the service class identifier, and select an output port to which the data frame is to be transferred And a network system. A communication terminal;
A wireless access point wirelessly connected to the communication terminal;
A router connected to the IP service network;
A relay Layer2 switch connecting the wireless access point and the router;
An access authentication information management database that manages user authentication information for each user ID that can uniquely identify the communication terminal in the network, and an in-network identifier management database that manages a VID that distinguishes data frames for each communication terminal A network information management device having
A network system in which a VLAN is set for each VID used in the network system in the wireless access point, the router, and the relay Layer 2 switch,
The in-network information management device includes authentication information notified from the communication terminal at the time of a connection request for the communication terminal, and authentication information for the user ID notified from the communication terminal stored in the access authentication information management database. And a first means for confirming that the communication terminal is an authorized user,
When it is confirmed by the first means that the communication terminal is an authorized user, an empty VID is selected based on the in-network identifier management database, and the empty VID and the user ID are selected. In association with each other and registering it in the in-network identifier management database;
Third means for issuing a registration request for causing the wireless access point to register the VID selected by the second means;
After the communication terminal is connected to the first wireless access point and moved to another second wireless access point, the first means confirms that the communication terminal is an authorized user. In this case, when the user ID notified from the communication terminal is a lifetime user ID, the communication terminal is used before moving to the second access point based on the in-network identifier management database. A fourth means for issuing a registration request for registering the same VID to the second wireless access point to the second wireless access point; and releasing the VID from the wireless access point. Based on the notification, the association between the VID and the user ID held in the in-network identifier management database is performed within the lifetime. Lifting and, if it exceeds the survival time, and a fifth means for releasing the association between the user ID and the VID,
The wireless access point has a first means for registering the VID in a data frame from the communication terminal in response to a registration request from the in-network information management device;
A network system comprising: a second unit that deletes the VID setting and releases the VID release notification to the in-network information management device when the communication terminal is disconnected. A communication terminal;
A wireless access point wirelessly connected to the communication terminal, or an edge switch connected to the communication terminal by wire;
A router connected to the IP service network;
The wireless access point, or a relay Layer2 switch that connects between the edge switch and the router,
An access authentication information management database that manages user authentication information for each user ID that can uniquely identify the communication terminal in the network, and an in-network identifier management database that manages a VID that distinguishes data frames for each communication terminal A network information management device having
A method for setting an in-network identifier in a network system in which a VLAN is set for each user between the wireless access point or the edge switch, the relay Layer 2 switch, and the router,
The in-network information management device corresponds to the authentication information notified from the communication terminal and the user ID notified from the communication terminal stored in the access authentication information management database at the time of connection request of the communication terminal. A first step of comparing the authentication information and confirming that the communication terminal is an authorized user;
When the in-network information management device determines that the communication terminal is an authorized user in the first step, the in-network information management device selects a free VID based on the in-network identifier management database, and A second step of associating the registered VID with the user ID and registering it in the network identifier management database;
In the second step, the in-network information management device sends a registration request for causing the wireless access point or the edge switch to register the VID associated with the user ID in the wireless access point. Or a third step of issuing to the edge switch;
The wireless access point or the edge switch has a fourth step of registering the VID as an in-network identifier in a data frame from the communication terminal in response to a registration request from the in-network information management device. The setting method of the network identifier. A fifth step in which the wireless access point or the edge switch deletes the VID setting and releases the VID release notification to the in-network information management device when the communication terminal is disconnected; ,
The in-network information management device releases the association between the VID registered in the in-network identifier management database and the user ID based on a release notification from the wireless access point or the edge switch. 6. The network identifier setting method according to claim 5, further comprising: 6 steps. A communication terminal;
A wireless access point wirelessly connected to the communication terminal, or an edge switch connected to the communication terminal by wire;
A router connected to the IP service network;
The wireless access point, or a relay Layer 2 switch that connects between the edge switch and the router,
An access authentication information management database that manages user authentication information for each user ID that can uniquely identify the communication terminal in the network, and a service that recognizes a VID and a connection destination IP service network for distinguishing data frames for each communication terminal An in-network information management device having an in-network identifier management database for managing identifiers,
A network identifier setting method in a network system in which a VLAN is set for each user between the wireless access point or edge switch, the relay Layer 2 switch, and the router,
When the in-network information management device requests connection of the communication terminal, the authentication information notified from the communication terminal and the authentication information for the user ID notified from the communication terminal stored in the access authentication information management database And confirming that the communication terminal is an authorized user,
When it is confirmed that the communication terminal is an authorized user in the first step, the in-network information management device selects a free VID based on the in-network identifier management database, and A second step of associating the registered VID with the user ID and registering it in the in-network identifier management database;
The in-network information management device receives a notification of an IP service ID representing an IP service network name to be connected from the communication terminal, selects a free service identifier based on the in-network identifier management database, and A third step of associating a vacant service identifier with the IP service ID and registering them in the in-network identifier management database;
The in-network information management device sends a registration request for registering the VID and the service identifier selected in the second and third steps to a wireless access point or an edge switch, the wireless access point, Or a fourth step of issuing to the edge switch;
A fifth step in which the wireless access point or edge switch registers the VID and the service identifier as an in-network identifier in a data frame from the communication terminal based on a registration request from the in-network information management device. A method for setting an in-network identifier, comprising: The wireless access point or the edge switch deletes the setting of the VID and the service identifier when the communication terminal is disconnected, and releases the VID and the service identifier to the in-network information management device. A sixth step of providing notification;
The in-network information management device, based on a release notification from the wireless access point or the edge switch, the VID and the user ID registered in the in-network identifier management database, the service identifier, and the IP The network identifier setting method according to claim 7, further comprising a seventh step of releasing the association with the service ID. A communication terminal;
A wireless access point wirelessly connected to the communication terminal, or an edge switch connected to the communication terminal by wire;
A router connected to the IP service network;
The wireless access point, or a relay Layer 2 switch that connects between the edge switch and the router,
An access authentication information management database for managing user authentication information for each user ID that can uniquely identify the communication terminal in the network, and an in-network identifier for managing a VID and a service class identifier for distinguishing data frames for each communication terminal A network information management device having a management database;
A network identifier setting method in a network system in which a VLAN is set for each user between the wireless access point or edge switch, the relay Layer 2 switch, and the router,
When the in-network information management device requests connection of the communication terminal, the authentication information notified from the communication terminal and the authentication information for the user ID notified from the communication terminal stored in the access authentication information management database And confirming that the communication terminal is an authorized user,
When it is confirmed that the communication terminal is an authorized user in the first step, the in-network information management device selects a free VID based on the in-network identifier management database, and A second step of associating the registered VID with the user ID and registering it in the in-network identifier management database;
The in-network information management device receives a notification of a service class ID indicating a service class name desired to be connected from the communication terminal, selects a free service class identifier based on the in-network identifier management database, and A third step of associating a vacant service class identifier with the service class ID and registering them in the in-network identifier management database;
The in-network information management device sends a registration request for registering the VID and the service class identifier selected in the second and third steps to a wireless access point or an edge switch. Or a fourth step to issue to the edge switch;
The wireless access point or edge switch has a fifth step of registering the VID and the service class identifier as an in-network identifier in a user data frame based on a registration request from the in-network information management device. A method for setting a characteristic in-network identifier. The wireless access point or edge switch deletes the setting of the VID and the service class identifier when the communication terminal is disconnected, and the VID and the service class identifier of the in-network information management device are deleted. A sixth step of performing a release notification;
The in-network information management device is configured so that the VID and the user ID registered in the in-network identifier management database, the service class identifier, and the The network identifier setting method according to claim 9, further comprising: a seventh step of canceling the association with the service class ID. A communication terminal;
A wireless access point wirelessly connected to the communication terminal;
A router connected to the IP service network;
A relay Layer2 switch connecting the wireless access point and the router;
An access authentication information management database that manages user authentication information for each user ID that can uniquely identify the communication terminal in the network, and an in-network identifier management database that manages a VID that distinguishes data frames for each communication terminal A network information management device having
A network identifier setting method in a network system in which VLANs are set for all VIDs used in a network system in the wireless access point, the router, and the relay Layer 2 switch,
When the in-network information management device requests connection of the communication terminal, the authentication information notified from the communication terminal and the authentication information for the user ID notified from the communication terminal stored in the access authentication information management database And confirming that the communication terminal is an authorized user,
When it is confirmed that the communication terminal is an authorized user in the first step, the in-network information management device selects a free VID based on the in-network identifier management database, and A second step of associating the registered VID with the user ID and registering it in the in-network identifier management database;
The network information management device issues a registration request for causing the first wireless access point to register the VID selected in the second step to the first wireless access point. Steps,
When the first wireless access point moves from the state where the communication terminal is connected to the first wireless access point to another second wireless access point, the VID setting is deleted and the in-network information A fourth step of notifying the management device of the release of the VID;
Based on the VID release notification from the first wireless access point, the in-network information management device corresponds to the correspondence between the VID held in the in-network identifier management database and the user ID within the lifetime. A fifth step of releasing the association between the VID and the user ID when the lifetime is exceeded and the lifetime is exceeded;
After the in-network information management device moves from the state in which the communication terminal is connected to the first wireless access point to another second wireless access point, the communication terminal is an authorized user by the first step. When it is confirmed that the user ID is the user ID during the lifetime, it is used before the communication terminal moves to the second access point based on the in-network identifier management database. A sixth step of issuing, to the second wireless access point, a registration request for causing the second wireless access point to register the same VID as the previous VID;
The second wireless access point has a seventh step of registering the VID as an in-network identifier in a data frame from a communication terminal having the user ID in response to a registration request from the in-network information management device. A method for setting an in-network identifier characterized by A communication terminal;
A wireless access point wirelessly connected to the communication terminal, or an edge switch connected to the communication terminal by wire;
A router connected to the IP service network;
The wireless access point, or a relay Layer2 switch that connects between the edge switch and the router,
An in-network information management apparatus in a network system in which a VLAN is set for each user between the wireless access point or the edge switch, the relay Layer 2 switch, and the router,
An access authentication information management database for managing user authentication information for each user ID capable of uniquely identifying the communication terminal in the network;
An in-network identifier management database for managing in-network identifiers for distinguishing data frames for each communication terminal ;
The authentication information notified from the communication terminal at the time of connection request of the communication terminal is compared with the authentication information for the user ID notified from the communication terminal stored in the access authentication information management database. A first means for confirming that the user is an authorized user;
When it is confirmed by the first means that the communication terminal is an authorized user, based on the in-network identifier management database, an unoccupied in-network identifier is selected, and the unoccupied in-network identifier and A second means for associating with the user ID and registering the user ID in the in-network identifier management database;
A registration request for causing the wireless access point or the edge switch to register the in-network identifier selected by the second means to the wireless access point or the edge switch; 3. An in-network information management device comprising: 3 means. A communication terminal;
A wireless access point wirelessly connected to the communication terminal;
A router connected to the IP service network;
A relay Layer2 switch connecting the wireless access point and the router;
A network information management device in a network system in which VLANs are set for all VIDs used in a network system in the wireless access point, the router, and the relay Layer 2 switch,
An access authentication information management database for managing user authentication information for each user ID capable of uniquely identifying the communication terminal in the network;
An in-network identifier management database that manages a VID that distinguishes a data frame for each communication terminal ;
The authentication information notified from the communication terminal at the time of connection request of the communication terminal is compared with the authentication information for the user ID notified from the communication terminal stored in the access authentication information management database. A first means for confirming that the user is an authorized user;
When it is confirmed by the first means that the communication terminal is an authorized user, an empty VID is selected based on the in-network identifier management database, and the empty VID and the user ID are selected. In association with each other and registering it in the in-network identifier management database;
Third means for issuing a registration request for causing the wireless access point to register the VID selected by the second means;
When it is confirmed by the first means that the communication terminal is an authorized user after the communication terminal has moved from the state connected to the first wireless access point to another second wireless access point. When the user ID is a lifetime user ID, based on the in-network identifier management database, the same VID as the VID used before the communication terminal moved to the second access point is A fourth means for issuing a registration request for registration to the second wireless access point to the second wireless access point;
Based on the release notification of the VID from the wireless access point, the association between the VID and the user ID held in the in-network identifier management database is held within the lifetime, and the lifetime has been exceeded. A network information management apparatus comprising: a fifth means for canceling the association between the VID and the user ID. A communication terminal;
A wireless access point wirelessly connected to the communication terminal, or an edge switch connected to the communication terminal by wire;
A router connected to the IP service network;
The wireless access point, or a relay Layer2 switch that connects between the edge switch and the router,
An access authentication information management database that manages user authentication information for each user ID that can uniquely identify the communication terminal in the network, and an in-network identifier management database that manages an in-network identifier that distinguishes a data frame for each communication terminal And an in-network information management device having
In the network identifier setting method of the network information management apparatus in the network system in which a VLAN is set for each user between the wireless access point or the edge switch, the relay Layer 2 switch, and the router. And comparing the authentication information notified from the communication terminal with the authentication information corresponding to the user ID notified from the communication terminal stored in the access authentication information management database at the time of connection request of the communication terminal. And a first step of confirming that the communication terminal is an authorized user;
In the first step, when it is recognized that the communication terminal is a legitimate user, based on the network identifier management database, a free network identifier is selected, and the free network identifier A second step of associating with the user ID and registering it in the in-network identifier management database;
In the second step, a registration request for causing the wireless access point or the edge switch to register the in-network identifier associated with the user ID is sent to the wireless access point or the edge switch. And a third step of issuing to the network information management apparatus. A communication terminal;
A wireless access point wirelessly connected to the communication terminal;
A router connected to the IP service network;
A relay Layer2 switch connecting the wireless access point and the router;
An access authentication information management database that manages user authentication information for each user ID that can uniquely identify the communication terminal in the network, and an in-network identifier management database that manages a VID that distinguishes data frames for each communication terminal A network information management device having
A method for setting an in-network identifier of an in-network information management device in a network system in which a VLAN is set for each VID used in a network system in the wireless access point, the router, and the relay Layer 2 switch,
The authentication information notified from the communication terminal at the time of connection request of the communication terminal is compared with the authentication information for the user ID notified from the communication terminal stored in the access authentication information management database. A first step of confirming that is a legitimate user;
When it is confirmed by the first step that the communication terminal is an authorized user, an empty VID is selected based on the in-network identifier management database, and the empty VID and the user ID are selected. A second step of associating and registering in the in-network identifier management database;
A third step of issuing a registration request for causing the first wireless access point to register the VID selected in the second step with the first wireless access point;
Based on the release notification of the VID from the first wireless access point, the association between the VID and the user ID held in the in-network identifier management database is held within the lifetime, and the lifetime A fourth step of canceling the association between the VID and the user ID when exceeding
When the communication terminal is confirmed to be an authorized user by the first step after the communication terminal has moved from the state connected to the first wireless access point to another second wireless access point. In addition, when the user ID is the user ID during the lifetime, based on the in-network identifier management database, the same VID as the VID used before the communication terminal moves to the second access point is selected. And a fifth step of issuing a registration request for registration to the second wireless access point to the second wireless access point. Method. A communication terminal;
A wireless access point wirelessly connected to the communication terminal, or an edge switch connected to the communication terminal by wire;
A router connected to the IP service network;
The wireless access point, or a relay Layer2 switch that connects between the edge switch and the router,
An access authentication information management database that manages user authentication information for each user ID that can uniquely identify the communication terminal in the network, and an in-network identifier management database that manages an in-network identifier that distinguishes a data frame for each communication terminal A network information management computer having
A network information management computer in a network system in which a VLAN is set for each user between the wireless access point or the edge switch, the relay layer 2 switch, and the router is configured to set an in-network identifier. A program for
The program includes authentication information notified from the communication terminal at the time of a connection request for the communication terminal, and authentication information corresponding to the user ID notified from the communication terminal stored in the access authentication information management database. In comparison, a first procedure for confirming that the communication terminal is an authorized user;
In the first procedure, when it is recognized that the communication terminal is a legitimate user, a free network identifier is selected based on the network identifier management database, and the free network identifier and A second procedure for associating the user ID with the in-network identifier management database,
A registration request for causing the wireless access point or the edge switch to register the in-network identifier selected in the second procedure is issued to the wireless access point or the edge switch; 3. A program for causing the network information management computer to execute the procedure of No. 3. A communication terminal;
A wireless access point wirelessly connected to the communication terminal;
A router connected to the IP service network;
A relay Layer2 switch connecting the wireless access point and the router;
An access authentication information management database that manages user authentication information for each user ID that can uniquely identify the communication terminal in the network, and an in-network identifier management database that manages a VID that distinguishes data frames for each communication terminal A network information management device having
A program for setting an in-network identifier in an in-network information management computer in a network system in which a VLAN is set for each VID used in the network system in the wireless access point, the router, and the relay Layer 2 switch. hand,
The program compares the authentication information notified from the communication terminal at the time of the connection request of the communication terminal with the authentication information for the user ID notified from the communication terminal stored in the access authentication information management database. A first procedure for confirming that the communication terminal is an authorized user;
In the first procedure, when it is confirmed that the communication terminal is a legitimate user, a free VID is selected based on the in-network identifier management database, and the free VID and the user ID are selected. In association with each other and registering it in the in-network identifier management database;
A third procedure for issuing a registration request for causing the first wireless access point to register the VID selected in the second procedure with the first wireless access point;
Based on the release notification of the VID from the first wireless access point, the association between the VID and the user ID held in the in-network identifier management database is held within the lifetime, and the lifetime A fourth procedure for releasing the association between the VID and the user ID when exceeding
When the communication terminal is confirmed to be an authorized user by the first step after the communication terminal has moved from the state connected to the first wireless access point to another second wireless access point. In addition, when the user ID is the user ID during the lifetime, based on the in-network identifier management database, the same VID as the VID used before the communication terminal moves to the second access point is selected. A program for causing the in-network information management computer to execute a fifth procedure for causing the second wireless access point to issue a registration request for causing the second wireless access point to register. A communication terminal;
An edge switch connected to the communication terminal by wire;
A router connected to the IP service network;
A relay Layer2 switch connecting the edge switch and the router;
Network information management device,
An edge switch in a network system in which a VLAN is set for each user between the edge switch, the relay Layer 2 switch, and the router,
And a means for registering the in-network identifier in a data frame from a communication terminal having the user ID in response to a registration request for the in-network identifier associated with the user ID from the in-network information management apparatus. Edge switch to do. A communication terminal;
An edge switch connected to the communication terminal by wire;
A router connected to the IP service network;
A relay Layer2 switch connecting the edge switch and the router;
Network information management device,
A network identifier setting method for an edge switch in a network system in which a VLAN is set for each user between the edge switch, the relay Layer 2 switch, and the router,
An edge switch for registering the in-network identifier in a data frame from a communication terminal having the user ID in response to a registration request for the in-network identifier associated with the user ID from the in-network information management device How to set network identifiers A communication terminal;
A computer connected to the communication terminal by wire and functioning as an edge switch;
A router connected to the IP service network;
A relay Layer2 switch that connects the computer and the router;
Network information management device,
A program for setting a network identifier in a computer in a network system in which a VLAN is set for each user between the computer, the relay Layer2 switch, and the router,
The program is configured to register the in-network identifier in a data frame from a communication terminal having the user ID in response to a registration request for the in-network identifier associated with the user ID from the in-network information management device. A program executed by the computer. A communication terminal;
A wireless access point wirelessly connected to the communication terminal;
A router connected to the IP service network;
A relay Layer2 switch connecting the wireless access point and the router;
Network information management device,
A wireless access point in a network system in which a VLAN is set for each VID used for each VID used in the network system between the wireless access point, the relay Layer 2 switch, and the router,
And a means for registering the in-network identifier in a data frame from a communication terminal having the user ID in response to a registration request for the in-network identifier associated with the user ID from the in-network information management apparatus. Wireless access point. A communication terminal;
A wireless access point wirelessly connected to the communication terminal;
A router connected to the IP service network;
A relay Layer2 switch connecting the wireless access point and the router;
Network information management device,
The network identifier of the wireless access point in the network system in which a VLAN is set for each VID used for each VID used in the network system between the wireless access point, the relay Layer 2 switch, and the router. A setting method,
Radio access characterized by registering the in-network identifier in a data frame from a communication terminal having the user ID in response to a registration request for the in-network identifier associated with the user ID from the in-network information management device How to set the point network identifier. A communication terminal;
A computer that is wirelessly connected to the communication terminal and functions as a wireless access point;
A router connected to the IP service network;
A relay Layer2 switch that connects the computer and the router;
Network information management device,
A program for setting an in-network identifier on a computer in a network system in which a VLAN is set for each VID used in the network system between the computer, the relay layer 2 switch, and the router. Because
The program is configured to register the in-network identifier in a data frame from a communication terminal having the user ID in response to a registration request for the in-network identifier associated with the user ID from the in-network information management device. A program that is executed by a computer. A recording medium on which the program according to claim 16, claim 17, claim 20, or claim 23 is recorded.

Images