JP4282806B2 - Network system and information recording medium - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to a network environment in which addresses are dynamically allocated in response to access requests from user terminals connected to a network.
[0002]
[Prior art]
Since an unspecified number of computers are connected to the Internet, a method of dynamically allocating an IP (Internet Protocol) address, which is address information for identifying each computer connected to the Internet, has become common.
[0003]
In addition, when performing data communication between internal networks, the number of computers connected to the internal network has increased, and a dynamic host configuration protocol (DHCP) server dynamically assigns IP addresses to each computer. Examples have increased.
[0004]
In an environment in which an IP address is dynamically allocated, the IP address changes each time the computer is connected to the network. Therefore, information for identifying each computer (for example, a user ID and password) and a dynamically allocated IP address It was difficult to keep the correspondence of
[0005]
For example, when dial-up access to an internal network from an external network such as the Internet, conventionally, a network device (for example, an access server such as a router) that a user terminal first accesses and a server connected to the network device After performing the authentication procedure, an IP address was assigned to the user terminal.
[0006]
[Problems to be solved by the invention]
However, in the conventional network system, which user terminal owns each IP address is not managed on the server side, and a correspondence relationship between IP address information and user information such as a user ID is acquired. It was necessary to obtain the information from the terminal of each user terminal. However, in a large-scale network, individual computers are often installed at locations apart from each other, and the above information cannot be easily obtained.
[0007]
Further, when data communication is performed between a plurality of networks, since the IP address dynamically changes for each network, it is difficult to update the IP address information and the user information in a timely manner.
[0008]
Further, even in an internal network having a DHCP server function, there has been no system that centrally manages user terminals by updating IP address information and user information in a timely manner.
[0009]
Further, conventionally, there has not been a network system that improves the convenience on the user side, such as providing information suitable for the user terminal using the correspondence between the IP address information and the user information.
[0010]
The present invention has been made in view of the above points, and an object thereof is to centrally manage a plurality of user terminals connected to a network and to improve security during data communication. To provide a network system.
[0011]
[Means for Solving the Problems]
In one aspect of the present invention, in a network system that performs data communication within a first network or with a second network outside the first network,
A network relay unit connected between the first and second networks;
A plurality of units connected to the first network via the network relay unit and connected to the second network and performing data communication with a server connected to the first network An access server,
The network relay unit is
An address correspondence information storage unit for storing a correspondence relationship between information identifying each user terminal connected to the second network and addresses dynamically allocated to the user terminals on the first network;
A user-specific information storage unit that stores user-specific information regarding the connection form to the first network for each user terminal;
A server selection unit that selects a server connected to the first network that provides information according to the types of the plurality of access servers;
Routing setting for setting a connection route according to each information stored in the address correspondence information storage unit and the user information specific information storage unit so that the server selected by the server selection unit and the user terminal can perform data communication. A network system characterized by comprising:
[0012]
According to one aspect of the present invention, the correspondence between the information for identifying the user terminal and the address dynamically allocated on the first network is stored, and the user-specific information regarding the connection form to the first network Therefore, each user terminal connected to the second network can be centrally managed.
[0013]
According to one aspect of the present invention, since a server suitable for a user terminal is automatically selected, security is improved.
[0014]
According to one aspect of the present invention, since a server corresponding to an installation location of an access server that is first accessed by a user terminal is automatically selected, area-limited information can be provided to the user.
[0015]
According to one aspect of the present invention, when a line is disconnected during download and then the line is reconnected, the download can be continued from the state immediately before the line is disconnected, so the data downloaded to the middle is not wasted. The communication cost can be reduced and the download time can be shortened.
[0018]
In one aspect of the present invention, in a computer-readable information recording medium recording a program for performing data communication within a first network or with a second network outside the first network,
A network relay step of relaying data transmitted and received between the first and second networks;
A plurality of access servers connected to the first network through the network relay step and connected to the second network perform data communication with a server connected to the first network. A step of performing control,
The network relay step includes
An address correspondence information storing step for storing a correspondence relationship between types of user terminals connected to the second network and addresses dynamically allocated to the user terminals on the first network;
A user-specific information storing step for storing user-specific information regarding the connection form to the first network for each user terminal;
A server selection step of selecting a server connected to the first network that provides information according to the types of the plurality of access servers;
Routing setting for setting a connection route according to each information stored in the address correspondence information storage step and the user information unique information storage step so that the server selected in the server selection step and the user terminal can perform data communication. And an information recording medium recording a program for executing the steps.
[0019]
DETAILED DESCRIPTION OF THE INVENTION
Hereinafter, a network system according to the present invention will be specifically described with reference to the drawings.
[0020]
(First embodiment)
FIG. 1 is a block diagram of a first embodiment of a network system according to the present invention. The network system of FIG. 1 includes an access server 2 connected to an external network 1 and a network relay mechanism 4 connected between the external network 1 and the internal network 3.
[0021]
The external network 1 is formed by connecting a plurality of user terminals in the form of the Internet, a LAN (Local Area Network), a WAN (Wide Area Network), or the like. A plurality of computers 6 are connected to the internal network 3 in addition to an authentication server 5 that authenticates each user terminal.
[0022]
The network relay mechanism 4 is located between the external network 1 and the internal network 3 and performs a gateway function for relaying packets. As shown in FIG. 2, the network relay mechanism 4 includes a packet analysis unit 11, an information association unit 12, an information holding unit 13, and an information distribution unit 14.
[0023]
The packet analysis unit 11 selects a packet for performing user authentication from the packets transmitted from the user terminal, analyzes the inside of the selected packet, and extracts user information and corresponding IP address information.
[0024]
The information associating unit 12 includes user information such as a user ID and a password, IP address information corresponding to the user information, the type of the access server 2 accessed by the user terminal, and information indicating the connection form of each user terminal to the network (hereinafter referred to as “user information”). , User specific data information), and control to store the correspondence in the information holding unit 13 is performed. In addition, when information stored in the information holding unit 13 becomes out of date, control for updating the information is also performed.
[0025]
The information holding unit 13 includes an address correspondence information unit 13A that stores user information such as a user ID and IP address information in association with each other, and a user specific data information unit 13B that stores user specific information related to a connection form to the network. Have
[0026]
The information distribution unit 14 performs a process of distributing services provided to the user terminals based on the information stored in the information storage unit 13. Specifically, user-specific data information is read from the information holding unit 13 using user information as a key, and based on the information, a server is selected, the type of information provided to the user terminal is limited, Select the connection type.
[0027]
FIG. 3 is a flowchart showing a processing flow of the network relay mechanism 4. First, it is determined whether the packet transmitted from the user terminal is an authentication packet (step S1). If it is not an authentication packet, the packet is transmitted according to a normal network process (step S2). On the other hand, if it is an authentication packet, the inside of the packet is analyzed, and user information such as a user ID and IP address information are extracted (step S3).
[0028]
Next, it is determined whether or not the IP address information corresponding to the extracted user information is stored in the information holding unit 13 (step S4). If stored, the stored user information and IP address information are compared with the old and new user information and IP address information extracted in step S2 (step S5), and the stored information is older. If so, the user information is associated with the IP address information based on the information extracted in step S2 (step S6). On the other hand, if the stored information is newer, the process ends without changing the association between the user information and the IP address information.
[0029]
If user information or the like is not stored in the information holding unit 13 at the time when the process of step S4 is performed, the extracted user information is associated with the IP address information (step S6).
[0030]
When the process of step S6 is completed, the associated user information and IP address information are stored in the address correspondence information unit 13A in the information holding unit 13, and network connection information unique to each user terminal is stored. It memorize | stores in the user specific data information part 13B (step S7).
[0031]
FIG. 4 is a diagram showing a specific example of the network relay mechanism 4 of FIG. 2, and shows an example in which a user A who owns a mobile terminal accesses the server 6 of the internal network 3 from the external network 1 via the access server 2. ing. Hereinafter, an example in which the user acquires timetable data from the server 6a or 6b will be described.
[0032]
The network relay mechanism 4 extracts the telephone number information transmitted by the user A and the type of the access server 2 corresponding to the telephone number, and provides the timetable data of the area where the access server 2 is installed. Alternatively, the user A is connected to 6b.
[0033]
FIG. 5 is a diagram illustrating the operation of the network relay mechanism 4 when the user A acquires timetable data from the server 6a or 6b.
[0034]
For example, when the user A accesses the access server 2 in Tokyo, the access information is stored in the information holding unit 13 in the network relay mechanism 4. Specifically, as shown in FIG. 5, the user information of each user A and the corresponding IP address information are stored in the address correspondence information holding unit 13 </ b> A in the information holding unit 13. In addition, the user-specific data information unit 13B stores network connection information of each user terminal, for example, information indicating to which server each user terminal is connected.
[0035]
The information distribution unit 14 sets a connection path between each user terminal and the server 6 in accordance with each information stored in the information holding unit 13. For example, when the user A accesses the access server 2 in Tokyo, the mobile terminal of the user A is routed to the server 6a that provides timetable data for Tokyo.
[0036]
Thereafter, when the user A accesses the access server 2 in Osaka, the information association unit 12 in the network relay mechanism 4 unit recognizes that the access server 2 has changed, and the information held in the information holding unit 13 Update. Specifically, the IP header is rewritten. In addition, the information distribution unit 14 routes the user A to the server 6b that provides timetable data for the Osaka area according to the contents held by the information holding unit 13.
[0037]
As described above, in the first embodiment, the network relay mechanism 4 is provided between the external network 1 and the internal network 3, and the correspondence relationship between the user information and the IP address information, the network connection form information of each user terminal, and the like. The information distribution unit 14 selects a server that stores and updates the information holding unit 13 in the network relay mechanism 4 in a timely manner and provides information according to the type of the access server 2 accessed by the user terminal. Therefore, the network connection path of each user terminal can be regulated and monitored, and the security of the network can be improved. In addition, it is possible to always grasp which IP address is assigned to each user terminal, and to centrally manage each user terminal.
[0038]
(Second Embodiment)
In the second embodiment, when the line is disconnected while the user terminal is downloading data from the server, and then the line is reconnected, the download is continued from the state immediately before the line is disconnected. The feature is that it can be done.
[0039]
FIG. 6 is a block diagram illustrating a schematic configuration of a network system according to the second embodiment. The network system in FIG. 6 includes a network relay mechanism 4 connected between the external network 1 and the internal network 3 as in the first embodiment. A user A having a mobile terminal is connected to the external network 1.
[0040]
All packets sent from the external network 1 to the access server 2 are sent to the internal network 3 via the network relay mechanism 4. The network relay mechanism 4 is configured similarly to FIG.
[0041]
Hereinafter, an example in which the user A downloads data from the server 6 connected to the internal network 3 will be described.
[0042]
FIG. 7 is a diagram for explaining the operation of the network relay mechanism 4 when downloading data. FIG. 8 is a flowchart showing the operation of the network relay mechanism 4. Hereinafter, the operation of the second embodiment will be described with reference to these drawings. Will be explained.
[0043]
First, when the user A accesses the access server 2 via the external network 1, the correspondence relationship between the user information and the dynamically allocated IP address information is stored in the address correspondence information holding unit 13A in the information holding unit 13, Download information indicating the type of data to be downloaded, download progress, etc. is stored in the user-specific data information section 13B (step S21).
[0044]
Next, the information distribution unit 14 routes the server 6 that provides the download data and the user A based on the information stored in the information holding unit 13 (step S22). Thereafter, the download is started (step S23). During the download, the download data is sent to the user A and is also stored in the user specific data information section 13B in the information holding section 13 (step S24).
[0045]
Next, after the line is disconnected during the download, it is determined whether or not the line is reconnected and the user A is instructed to continue the download (step S25). The unit 12 stores the correspondence between the user information and the IP address information newly assigned to the user A in the address correspondence information holding unit 13 in the information holding unit 13 (step S26).
[0046]
Further, the information association unit 12 reads the download information held in the information holding unit 13, detects how far the download has been performed, and instructs the server to continue the download from the point at which the download is interrupted ( Step S27). Thereby, the user terminal can continue to download from the state immediately before the line is disconnected.
[0047]
As described above, in the second embodiment, when the user terminal downloads data from the server via the network, not only the data being downloaded is transmitted to the user terminal but also the data is stored in the network relay mechanism 4. Since the data is stored sequentially, when the line is disconnected during the download and then reconnected and the download is resumed, the download does not have to be repeated from the beginning, the download time can be shortened, and the communication cost can be reduced.
[0048]
In the second embodiment described above, instead of storing the download data in the network relay mechanism 4, only information indicating how far the data has been downloaded is stored in the information storage unit 13, even if the line is disconnected halfway. The download may be continued from the middle.
[0049]
(Third embodiment)
The third embodiment is characterized in that, in a DHCP server environment in which an IP address is dynamically allocated within the internal network 3, the correspondence relationship between each user information and the dynamically allocated IP address information is always maintained. And
[0050]
FIG. 9 is a block diagram of a third embodiment of the network system. The network system in FIG. 9 includes a server 8 and user terminals 10 connected to an internal network, a DHCP server 9 that dynamically assigns IP addresses to the user terminals 10, and user information and IP addresses of the user terminals 10. And a network information collecting mechanism 7 for storing information and the like in association with each other.
[0051]
As shown in FIG. 10, the network information collection mechanism 7 in FIG. 9 is associated with a packet analysis unit 11 that analyzes packets transmitted through the internal network 3, and information correspondence that associates user information, IP address information, and the like And the information control unit 15 for providing security functions such as services in the network and access control of the server 8.
[0052]
In the network system of FIG. 9, the user terminal 10 sends a request packet to the DHCP server 9. The DHCP server 9 returns a response packet to the received request packet to the user terminal 10. This response packet includes IP address information allocated to the user terminal 10, lease time information indicating the validity period of the IP address, and the like.
[0053]
The network information collection mechanism 7 in FIG. 9 analyzes the response packet sent from the DHCP server 9 and acquires the above-described IP address information, lease time information, and the like in a timely manner. Specifically, the user information (for example, the MAC address, user ID, and password unique to the user terminal) and the corresponding IP address information are associated with the information holding unit 13 in the network information collecting mechanism 7. Remember.
[0054]
As described above, in the third embodiment, the network information collection mechanism 7 centrally manages which IP address is assigned to which user terminal 10, so that the network connection status of each user terminal 10 is comprehensively managed. This makes it easy to identify the location where the failure occurred.
[0055]
(Fourth embodiment)
The fourth embodiment is characterized in that the server defense (security) is improved in a DHCP server environment.
[0056]
FIG. 11 is a block diagram of the fourth embodiment of the network system. The network system of FIG. 11 includes a network information collecting mechanism 7 inside the DHCP server 9, unlike FIG. 9.
[0057]
As in FIG. 10, the network information collection mechanism 7 includes a packet analysis unit 11, an information association unit 12, an information holding unit 13, and an information control processing unit 15.
[0058]
As in FIG. 2, the information holding unit 13 stores an address correspondence information holding unit 13A that stores user information such as a user ID and corresponding IP address information in association with each other, and user specific data that stores user specific data information. And an information holding unit 13B. The user specific data information is information indicating, for example, what protocol each user terminal is connected to the network.
[0059]
When the user terminal 10 connected to the internal network 3 accesses the server, the information association unit 12 in the network information collection mechanism 7 reads information on the user terminal 10 from the information holding unit 13. When it is determined that the access is from an unauthorized user terminal 10, a TCP FIN packet is sent back to the user terminal 10 to forcibly cut off the connection between the user terminal 10 and the server 9. The determination as to whether or not the user terminal 10 is an unauthorized user terminal may be performed by, for example, determining whether or not the access is within the lease time, which is a valid period after the IP address is allocated to the user terminal 10, It depends on whether you own it or not.
[0060]
As described above, in the fourth embodiment, since various kinds of information unique to each user terminal 10 are stored in the server 9 in the DHCP server environment, even if the user terminal 10 tries to access the server illegally, the access is made. Can be reliably prevented and security can be improved.
[0061]
11, the example in which the network information collecting mechanism 7 is provided in the server 9 has been described. However, similarly to FIG. 9, the network information collecting mechanism 7 is provided separately from the server 9 to prevent unauthorized access to the server 9. It may be prevented.
[0062]
Part or all of the network relay mechanism and network information collection mechanism described in each of the above-described embodiments may be configured by software or hardware. When configured by software, the software may be stored in a recording medium such as a CD-ROM or floppy disk, and the recorded contents of the recording medium may be read into a computer and executed.
[0063]
【The invention's effect】
As described above in detail, according to the present invention, the correspondence between the information for identifying the user terminal and the address dynamically allocated to each user terminal is stored, and the user-specific network connection for each user terminal is stored. Therefore, each user terminal connected to the network can be centrally managed. In particular, according to the present invention, since data communication of each user terminal can be regulated and monitored, security is improved.
[0064]
Similarly, in a DHCP server environment in which addresses are dynamically allocated to a plurality of user terminals connected to the internal network, centralized management of each user terminal and regulation and monitoring during data communication are possible.
[Brief description of the drawings]
FIG. 1 is a block diagram of a first embodiment of a network system according to the present invention.
FIG. 2 is a block diagram showing a detailed configuration of the network relay mechanism shown in FIG.
FIG. 3 is a flowchart showing a processing flow of a network relay mechanism.
FIG. 4 is a diagram showing a specific example of a network relay mechanism.
FIG. 5 is a diagram illustrating an operation of a network relay mechanism when a user acquires timetable data from a server.
FIG. 6 is a block diagram of a second embodiment of a network system.
FIG. 7 is a diagram for explaining the operation of the network relay mechanism when downloading data;
FIG. 8 is a flowchart showing the operation of the network relay mechanism.
FIG. 9 is a block diagram of a third embodiment of a network system.
10 is a block diagram showing a detailed configuration of the network relay mechanism shown in FIG. 9;
FIG. 11 is a block diagram of a fourth embodiment of a network system.
[Explanation of symbols]
DESCRIPTION OF SYMBOLS 1 External network 2 Access server 3 Internal network 4 Network relay mechanism 5 Authentication server 6 Server 11 Packet analysis part 12 Information matching part 13 Information holding part 13A Address correspondence information part 13B User specific data information part 14 Information distribution part 15 Information control processing Part

Claims (5)

In a network system that performs data communication within a first network or with a second network outside the first network,
A network relay unit connected between the first and second networks;
A plurality of units connected to the first network via the network relay unit and connected to the second network and performing data communication with a server connected to the first network An access server,
The network relay unit is
An address correspondence information storage unit for storing a correspondence relationship between information identifying each user terminal connected to the second network and addresses dynamically allocated to the user terminals on the first network;
A user-specific information storage unit that stores user-specific information regarding the connection form to the first network for each user terminal;
A server selection unit that selects a server connected to the first network that provides information according to the types of the plurality of access servers;
Routing setting for setting a connection route according to each information stored in the address correspondence information storage unit and the user information specific information storage unit so that the server selected by the server selection unit and the user terminal can perform data communication. And a network system.   The user-specific information storage unit can continue downloading even if the line is disconnected while a user terminal connected to the second network is downloading data from a server connected to the first network. 2. The network system according to claim 1, wherein download information immediately before the line is disconnected is stored.   The user-specific information storage unit sequentially stores data when a user terminal connected to the second network downloads data from a server connected to the first network. Item 3. The network system according to Item 2. In a computer-readable information recording medium recording a program for performing data communication within a first network or with a second network outside the first network,
A network relay step of relaying data transmitted and received between the first and second networks;
A plurality of access servers connected to the first network through the network relay step and connected to the second network perform data communication with a server connected to the first network. A step of performing control,
The network relay step includes
An address correspondence information storing step for storing a correspondence relationship between types of user terminals connected to the second network and addresses dynamically allocated to the user terminals on the first network;
A user-specific information storing step for storing user-specific information regarding the connection form to the first network for each user terminal;
A server selection step of selecting a server connected to the first network that provides information according to the types of the plurality of access servers;
Routing setting for setting a connection route according to each information stored in the address correspondence information storage step and the user information unique information storage step so that the server selected in the server selection step and the user terminal can perform data communication. And an information recording medium recording a program for executing the steps.   The user-specific information storing step can continue downloading even if the line is disconnected while a user terminal connected to the second network is downloading data from a server connected to the first network. 7. The information recording medium according to claim 6, wherein download information immediately before the line is disconnected is stored.

Images