JP4909392B2 - IP address issue system, IP address issue device, IP address issue method, and IP address issue program - Google Patents

Description

  The present invention relates to an IP address issue system, an IP address issue device, an IP address issue method, and an IP address issue program.

As a method for managing information for connecting a client terminal used by a user to a network, a method of automatically managing by DHCP (Dynamic Host Configuration Protocol) is widely used (for example, see Non-Patent Document 1).
In DHCP, for example, a DHCP server prepares a plurality of IP addresses that can be paid out to a client terminal (address pool), and when a request is made from a client terminal, one IP address is selected from these IP addresses and a predetermined number is selected. You can pay out only for hours. Thus, it is possible to connect to the network by the function of the DHCP server without any special setting on the client terminal, which is very convenient for the network administrator.

  However, since the user cannot be authenticated by DHCP, there is a possibility that a malicious user impersonates another person and performs an illegal act. In order to suppress the act of impersonating another person, the user is authenticated using RADIUS or the like, and after confirming that the user is authorized to access the network, the IP address is paid. It is desirable to be able to output (see, for example, Patent Document 1).

Here, a conventional IP address delivery method using RADIUS will be described.
As shown in FIG. 14, the IP address payout system using RADIUS includes an access point (AP) 320 such as a wireless LAN connected to the terminal 310 and L2, an authentication server 330, and a connection management device 340.
When connecting to the target network, the terminal 310 first transmits a user ID and password to the authentication server 330 via the access point 320 to request authentication. Then, the authentication server 330 performs authentication by collating the transmitted user ID and password pair with data stored in the connection management device 340. When the authentication is successful, the connection management device 340 is further inquired of the IP address that can be issued to the terminal 310, and the access point 320 is notified of one IP address selected from the IP address. Assign to. As a result of assigning the IP address to the terminal 310 in this way, the terminal 310 can connect to the target network via the access point 320.

  By the way, in actual operation, it is desirable to provide a plurality of pairs of authentication servers and connection management devices. In particular, it is desirable to install each pair in a remote location and operate them simultaneously. This is because it is possible to distribute the load from the client and to reduce damage in the event of a disaster.

  However, when the authentication server and the connection management device pair are distributed and installed in separate locations, the data held by each connection management device will be illegal, and the IP address will be issued in duplicate. There is a risk of inconvenience. A method of synchronizing the data of all the servers every time data is updated can be considered, but if each server is far away, a time lag occurs before the synchronization.

  In order to eliminate such inconvenience, for example, it is conceivable to perform synchronization processing by two-phase commitment control (see, for example, Non-Patent Document 2). In two-phase commitment control, all servers communicate with each other when updating data, and after confirming that all servers can update data, all servers update data at once. If the update fails, all servers perform rollback processing at the same time. For this reason, it is possible to prevent data inconsistency between the servers.

JP 2009-100309 A

Dynamic Host Configuration Protocol, RFC 2131, Internet <http://www.ietf.org/rfc/rfc2131.txt>. Nishikawa Yoichi Hidekazu System Co., Ltd. “Illustrations / Standards Latest Database Technology Mastering Handbook” on pages 391-399.

  However, in the two-phase commitment control, it is necessary to communicate with all the servers when updating the data. Therefore, particularly when each server is installed relatively far away, the processing speed decreases due to communication delay. And there is a risk of incurring problems such as communication line congestion.

  The present invention has been made in order to solve the above-described problems, and it is possible to pay out an IP address more appropriately and to suppress a decrease in processing speed due to a communication delay and congestion of a communication line between servers. It is an object of the present invention to provide an IP address issuing system, an IP address issuing device, an IP address issuing method, and an IP address issuing program.

  An IP address issuing system according to the present invention is an IP address issuing system in which a plurality of servers that can issue IP addresses in response to requests from users synchronously issue IP addresses to users. Each of the first state represents that data of a plurality of IP addresses has not been paid out to the user, the second state represents that the data has not been paid out to the user, and the first state to the first state. When the IP address management means for managing and distinguishing from the third state indicating that the update is in progress, and when the IP address is requested by the user, the state of the managed data is the first state. A single IP address is selected and paid out to the user, and the managed data is stored in all of the plurality of servers. IP address issue control means for controlling all of the plurality of servers to update the data state corresponding to the IP address to the second state, and reaps the IP address from the user who issued the IP address. In some cases, the state of the data corresponding to the IP address assigned to the user among the managed data is once updated to the third state, and then the process of updating the state of the data to the first state is performed. Address trimming control means.

  In such an IP address issuing system according to the present invention, each of the plurality of servers is configured such that the state of the data from another server is the data state of the IP address whose managed data state is the third state. When the synchronization is requested to update the data to the second state, a synchronization control means for updating the data state to the second state according to the request may be further provided.

  Also, in such an IP address issuing system according to the present invention, the IP address issuing means is means for selecting one IP address with a predetermined priority order that is different for each server and issuing it to the user. It is good.

  An IP address issuing device according to the present invention is an IP address issuing device that issues an IP address in response to a request from a user in synchronization with another IP address issuing device, and still stores data of a plurality of IP addresses. A first state indicating that the user has not been paid out, a second state indicating that the user has already been paid out, and a third state indicating that the user is in the process of updating from the second state to the first state, When the IP address management means for managing the IP address and the user is requested to issue an IP address, the IP address management means selects the one IP address whose managed data is in the first state and pays out to the user In addition, in all of the IP address issuing devices, the data corresponding to this IP address among the managed data IP address issuing control means for controlling all of the IP address issuing device to update the state to the second state, and when reclaiming the IP address from the user who issued the IP address, IP address pruning control means for performing processing for updating the data state to the first state after the data state corresponding to the IP address assigned to the user is once updated to the third state. Features.

  The first IP address issue method according to the present invention includes a first state indicating that data of a plurality of IP addresses has not been assigned to the user, and a second state indicating that the data has already been assigned to the user. A plurality of servers which are managed separately from the third state indicating that the second state is being updated to the first state, and which can issue the plurality of IP addresses in response to a request from a user In each of the plurality of servers, each of the plurality of servers receives one IP address whose managed data is in the first state when the user requests the IP address to be issued. Select and pay out to the user, and in all of the plurality of servers, the data corresponding to this IP address among the managed data When all of the plurality of servers are controlled to update the state to the second state and the IP address is reclaimed from the user who has issued the IP address, the IP address assigned to the user among the managed data After the data state corresponding to is updated once to the third state, the data state is updated to the first state.

  In the first IP address issuing method according to the present invention as described above, each of the plurality of servers receives the IP address data whose managed data state is the third state from other servers. When synchronization is requested to update the data state to the second state, the data state may be updated to the second state in accordance with this request.

  Further, in the first IP address issuing method according to the present invention, each of the plurality of servers may select one IP address with a predetermined priority order that is different for each server and issue the same to the user. Good.

  The second IP address issuing method according to the present invention includes a first state indicating that data of a plurality of IP addresses has not been issued to the user, and a second state indicating that the data has already been issued to the user. The plurality of IP addresses are managed separately from the third state indicating that the second state is being updated to the first state, and in response to a request from the user in synchronization with another server. IP address delivery method using a server capable of delivering IP address, and when the user requests IP address delivery, select one IP address whose managed data is in the first state. In addition to paying out to the user, the status of data corresponding to the IP address among the managed data is set in the second server in all of the plurality of servers. When all of the plurality of servers are controlled so as to be updated, and the IP address is reclaimed from the user who has issued the IP address, the data corresponding to the IP address assigned to the user is out of the managed data. After the state is updated to the third state, a process for updating the state of the data to the first state is performed.

  An IP address issuing program according to the present invention is an IP address issuing program incorporated in each of a plurality of servers capable of issuing an IP address in response to a request from a user, and data of the plurality of IP addresses is still transmitted to the user. A first state indicating that the payout has not been made, a second state indicating that the payout has been made to the user, and a third state indicating that the second state is being updated to the first state. When the IP address is requested to be issued by a user, the IP address of the managed data is selected and paid out to the user, and the plurality of servers are selected. In all of the managed data, the state of the data corresponding to this IP address is updated to the second state. When all of the plurality of servers are controlled and the IP address is reclaimed from the user who has issued the IP address, the state of data corresponding to the IP address assigned to the user among the managed data is temporarily set. After the update to the third state, the data state is updated to the first state.

  According to the IP address issue system, IP address issue device, first IP address issue method, second IP address issue method, and IP address issue program according to the present invention, each server issues the IP address. When the IP address is reclaimed from the user, the data state corresponding to the IP address assigned to the user among the managed data is once updated to the third state, and then the state of the data is changed to the first state. Processing to update to the state is performed. As a result, the IP address can be returned again, and the exhaustion of the IP address can be suppressed. Further, since it is not necessary to synchronize with other servers when the IP address is trimmed, it is possible to suppress a decrease in processing speed due to communication delays and congestion of communication lines between servers. Furthermore, when updating the state of the data corresponding to the IP address paid out to the user to the first state among the managed data, the state is made unable to be paid out for a while by updating to the third state once. Therefore, it is possible to prevent the same IP address from being repeatedly issued to different users even when the IP address that has been paid out is not re-synchronized with other servers.

It is a block diagram which shows the structure of the IP address delivery system concerning Embodiment 1 of this invention. It is a figure which shows the user information management table used for the IP address delivery system concerning Embodiment 1 of this invention. It is a figure which shows the IP address management table used for the IP address delivery system concerning Embodiment 1 of this invention. It is a figure which shows the session management table used for the IP address delivery system concerning Embodiment 1 of this invention. It is a sequence diagram which shows the operation | movement at the time of paying out an IP address by the IP address paying-out system concerning Embodiment 1 of this invention. It is a sequence diagram which shows the operation | movement at the time of collect | recovering IP addresses by the IP address delivery system concerning Embodiment 1 of this invention. It is a sequence diagram which shows the operation | movement at the time of harvesting an IP address by the IP address delivery system concerning Embodiment 1 of this invention. It is a flowchart which shows the mowing process performed by the IP address delivery system concerning Embodiment 1 of this invention. It is a transition diagram which shows a mode that the state of an IP address changes, when IP address discharge | payout, collection | recovery, and mowing are performed by the IP address discharge | release system concerning Embodiment 1 of this invention. It is a transition diagram which shows a mode that the state of an IP address changes, when IP address discharge | payout, collection | recovery, and mowing are performed by the IP address discharge | release system concerning Embodiment 1 of this invention. It is a figure which shows the IP address priority table used for the IP address delivery system concerning Embodiment 2 of this invention. It is a figure which shows the IP address management table used for the IP address delivery system concerning Embodiment 2 of this invention. It is a figure which shows the modification of the session management table used for the IP address delivery system concerning Embodiment 1 of this invention. It is a figure which shows the structure of the conventional IP address issuing system.

[Embodiment 1]
Hereinafter, Embodiment 1 of the present invention will be described in detail with reference to the drawings.
The IP address issue system according to the first embodiment of the present invention includes a plurality of servers that can issue IP addresses in response to requests from users.

First, the configuration of the IP address issuing system according to the first embodiment of the present invention will be described.
As shown in FIG. 1, the IP address payout system according to the first embodiment of the present invention is provided at the site # 2 and the authentication server 130 provided at the site # 1, the connection management device 140 that manages the IP address, and the like. And a connection management device 240 that manages the authentication server 230 and the IP address, an access point (AP) 120 that can be connected to the authentication server 130, and an access point (AP) 220 that can be connected to the authentication server 230. The Here, the pair of the base # 1 and the base # 2 is assumed to be relatively far away, for example, a pair of Tokyo and Osaka. The access point 120 is L2 connected to the terminal 110, and the access point 220 is L2 connected to the terminal 210.
For convenience of explanation, the first embodiment will be described using only two bases, base # 1 and base # 2, but the number of bases is not limited to two. There may be three or four.

The authentication server 130 provided at the site # 1 is a server that can perform authentication by, for example, RADIUS, and the expiration date is expired in conjunction with the connection control unit 131 that controls the overall control and the connection management device 140. A cutting request unit 132 that performs control for requesting the cutting of the IP address that is being connected, an IP address dispensing request unit 133 that performs control for dispensing to the user in conjunction with the connection management device 140, and a dispensing by connecting to the connection management device 140 A session registration request unit 134 that performs control when an IP address is used, a synchronization request unit 135 that requests the connection management device 240 to synchronize, a user ID, a password, and the like that are stored in the connection management device 140 And an authentication processing unit 136 that performs authentication by extracting the information.
Since the authentication server 230 provided at the site # 2 has the same configuration as the authentication server 130, detailed description thereof is omitted.

Next, the connection management device 140 and the connection management device 240 will be described.
Each of the connection management device 140 and the connection management device 240 is a device that functions as a database, and possesses and manages at least three tables: a user information management table, an IP address management table, and a session management table.
As shown in FIG. 2, the user information management table includes two columns of “user ID” and “password”. When a pair of user ID and password is transmitted from the terminal 110, authentication can be performed by checking whether or not this information is consistent with the combination entered in the user information management table.
As shown in FIG. 3, the IP address management table includes two columns of “IP address” indicating the IP address managed by the connection management device 140 and “usage state” indicating the use state of this IP address. include. Here, the IP address usage state is referred to as an unused state, a used state, and a state in the middle of updating from a used state to an unused state (hereinafter referred to as a “reaping state”). There are three states. In the present embodiment, by inputting the values “0”, “1”, and “2” in the “usage state” of the IP address management table, respectively, the corresponding IP address is changed. , Respectively indicate an unused state, a used state, and a state of cutting. When paying out an IP address to the terminal 110 by a process described later, one of the IP addresses managed with this IP address management table having a usage value of “0” is selected and paid out. Will be put out.
As shown in FIG. 4, the session management table includes columns such as “session ID”, “user ID”, “IP address”, “connection state”, and “expiration date”. Here, “session ID” is a variable that uniquely indicates a record created in the session management table. “User ID” indicates the user ID of the user who requested the connection. “IP address” indicates the IP address assigned to the user. The connection state of the session is the state where the IP address has been issued but the connection has not yet been confirmed (hereinafter referred to as “temporary connection state”), the state where the IP address has been issued and the connection has been confirmed (hereinafter referred to as “connection”) There are two states, referred to as “main connection state”. In the present embodiment, by inputting the value “0” and the value “1” in the “connection state” of the session management table, it is indicated that the corresponding sessions are the temporary connection state and the main connection state, respectively. ing. The “expiration date” literally indicates the expiration date, and when the expiration date is exceeded, a repatriation process can be performed again by performing a mowing process described later.
The data input to the IP address management table and the session management table can refer to the record of the other table based on the record of one table, using the “IP address” column as a common key. Is possible.

Next, the operation of the IP address payout system according to the first embodiment of the present invention, particularly the operation when paying out an IP address will be mainly described with reference to FIG.
As shown in FIG. 5, when the terminal 110 requests connection to the network, the terminal 110 transmits information such as a user ID and a password to the access point 120, and the access point 120 receives the user ID and password received from the terminal 110. Such information (Access-Request packet) is transmitted to the authentication server 130 (step S110). Then, the authentication server 130 performs communication processing with the connection management device 140, and converts the user ID and password pair received from the terminal 110 via the access point 120 into the user ID and password pair stored in the user information management table. Is verified (step S120). When the authentication fails, the subsequent processing is not performed. When the authentication is successful, the authentication server 130 communicates with the connection management device 140 and the connection management device 240 to perform temporary connection processing (step S130). .
Note that the authentication processing in step S120 is not limited to authentication performed using a user ID or password, and authentication performed using an electronic certificate or a common key is also conceivable.

Next, the temporary connection process in step S130 of FIG. 5 will be described in detail.
First, an IP address to be paid out to the terminal 110 is selected. More specifically, if one IP address having a value of “0” in the “usage state” column is extracted from the IP address management table owned and managed by the connection management device 140 and selected in the order of ascending order, for example. Good.
When the IP address to be paid out is determined in this way, among the records in the IP address management table, the “usage state” of the record corresponding to this IP address is updated to the value “1”, and at the same time a new record is added to the session management table. Create As the contents of the newly created record, the session ID included in the Access-Request packet received from the access point 120 is input to “Session ID”, and the user received from the terminal 110 is input to “User ID”. Enter the ID, enter the IP address selected earlier in “IP Address”, enter the value “0” indicating that the connection has not been confirmed yet in “Connection Status”, and enter the “Expiration Date” A time after a first predetermined time (for example, a relatively short time such as every several tens of seconds or every several minutes) after the current time is input. Here, as the first predetermined time, when it is not confirmed that the terminal 110 is connected to the network using this IP address within this time, it can be determined that the IP address is unlikely to be used for a while. What is necessary is just to set to length.
Thereafter, a synchronization request is also made to the connection management device 240 so that the data in the IP address management table and the session management table are similarly updated.
The connection management device 240 requested to synchronize indicates that the “use state” of the corresponding record on the IP address management table is a value “0” indicating that it is not in use or that it is being pruned. When the value is “2”, the synchronization process is performed according to this request. On the other hand, when the value “1” indicating that the “usage state” of the corresponding record on the IP address management table is the in-use state, the same IP address is paid out separately and repeatedly. Therefore, this synchronization request is not accepted. In this case, it is necessary to perform control such as rollback. However, since control for this problem departs from the core of the present invention, detailed description is omitted.

  Next, the authentication server 130 notifies the IP address to be paid out to the terminal 110 via the access point 120 (step S140). In this way, the terminal 110 notified of the IP address can be connected to the network via the access point 120.

When the terminal 110 to which the IP address has been issued actually connects to the network via the access point 120 and the access point 120 confirms, the access point 120 confirms that the terminal 110 has started connection (Accounting-Request [Start] Packet) is transmitted to the authentication server 130 (step S150). Then, the authentication server 130 performs the main connection process based on the Accounting-Request [Start] packet received from the access point 120 (step S160). Specifically, in the corresponding record in the session management table of the connection management device 140, the “connection state” is updated to the value “1”, and the “expiration date” column is set to a second predetermined value from the current time, for example. Update processing is performed after time (for example, at least a first predetermined time or more, such as 24 hours, 48 hours, or indefinite period). Also, a synchronization request is made to the connection management device 240 so that the corresponding record in the session management table is updated in the same manner. Here, as the second predetermined time, even if the user once connects to the network and tries to connect to the network again after the second predetermined time has elapsed, the user is stressed again. The length should not be felt. In addition, every time it is confirmed that the terminal 110 is connected to the network using the IP address issued, it may be updated after a second predetermined time from the current time. If it is not confirmed, the length may be set to such a degree that it can be determined that it is unlikely to be used for a while.
In this way, if the main connection process is performed, the access point 120 is notified that the main connection process has ended (Accounting-Response [Start] packet) (step S170), and this sequence ends.
The connection management device 240 requested to synchronize the records of the session management table from the authentication server 130 receives the “session ID” and “session ID” included in the Accounting-Request [Start] packet received by the authentication server 130 from the access point 120. The contents of “User ID” are compared with the contents of “Session ID” and “User ID” included in the corresponding record of the session management table owned and managed at the local site. It is determined that the request is a synchronous request, and synchronization processing is performed. On the other hand, when the two do not match, there is a possibility that an abnormality such as redundant payment of the same IP address to different users may occur, so it is necessary to perform control such as rollback. However, the control for this problem departs from the core of the present invention, so a detailed explanation is omitted.

Next, the operation when collecting the issued IP address will be described.
After the connection process is performed for the IP address, when a disconnection request is made from the terminal 110, when the terminal 110 is turned off, or when the connection cable is disconnected, as shown in FIG. The fact that there is a disconnection request (Accounting-Request [Stop] packet) is transmitted to authentication server 130 (step S210).
Next, the authentication server 130 performs an IP address collection process based on the Accounting-Request [Stop] packet received from the access point 120 (step S220). That is, the corresponding record in the session management table is deleted, and the “usage state” of the corresponding record in the IP address management table is updated to the value “2” indicating that the state is being pruned. Subsequently, a synchronization request is also made to the connection management device 240 so that the data in the IP address management table and the data in the session management table are similarly updated.
Thereafter, the fact that the IP address has been collected (Accounting-Response [Stop] packet) is notified to the access point 120, and when the L2 connection between the access point 120 and the terminal 110 is maintained, the access point 120 The terminal 110 is notified that the IP address has been collected, and the sequence for collecting the IP address is terminated (step S230).
Note that the IP address recovered by this IP address recovery process has been updated to a value “0” indicating that the “usage state” of the corresponding record in the IP address management table is unused by the mowing process described later. It becomes possible to pay out again later. The reason why the “usage state” of the corresponding record in the IP address management table is not immediately updated to the value “0” by the collection process will be described later for convenience of explanation.

On the other hand, there is a case where it is not confirmed that the terminal 110 is connected to the network using this IP address even though the temporary connection process is performed in step S130 of FIG. Here, as a case where the connection of the terminal 110 to the network is not confirmed in the temporary connection state, for example, the operation may be simply stopped, and communication between the access point 120 and the authentication server 130 may be considered. 5 uses a low-reliability UDP, so that when the communication between the access point 120 and the authentication server 130 is congested, the IP address is notified to the terminal 110 via the access point 120, that is, FIG. There may be a case where an abnormality such as a packet loss or a packet arrival delay occurs in the process of step S140.
Further, even if the IP address for which the connection from the terminal 110 is once confirmed and the connection process of step S160 in FIG. 5 is performed, it has not been used for a long period of time, for example, 24 hours or 48 hours. In some cases, it is unlikely to be used for a while.
In such a case, since the “usage state” of the record of the corresponding IP address on the IP address management table is “1” indicating that it is in use, the IP address is again processed in the process of step S130 in FIG. I cannot give out my address. When the number of IP addresses increases, the IP address may eventually be depleted, that is, all prepared IP addresses may be in use, and a situation may occur in which the IP address cannot be paid out to the user. In order to deal with such a problem, in the present embodiment, processing for making an IP address that is less likely to be used for network connection into a state where it can be repaid, that is, “use of corresponding record in the IP address management table” A process of updating the “state” to the value “0” (hereinafter referred to as “reaping process”) is performed.

As shown in FIG. 7, the mowing process is performed every period T (a period of at least the first predetermined time, for example, a relatively short time such as 5 minutes or 10 minutes. The period T is the first predetermined time. The authentication server 130 and the connection management device 140 at the site # 1 and the authentication server 230 and the connection management device 240 at the site # 2 are independently performed. Here, although the period T can be set and changed as appropriate, it is necessary to match the base # 1 and the base # 2 for the reason described later. Further, it is necessary to match the first predetermined time and the second predetermined time at the base # 1 and the base # 2 so that the same IP address is not repeatedly issued to different users.
The mowing process shown in step S310, step S320, etc. in FIG. 7 includes an IP address that has expired after the process of making the IP address being trimmed unused (steps S311 and S321), as shown in FIG. Is carried out (steps S312 and S322).
In addition, the mowing process is performed independently for each base. When the mowing process is performed at one of the bases, if the other base is also requested to perform the synchronization process, the mowing process is performed between the base # 1 and the base # 2. It is necessary to wait for the communication to be completed in the process, and the processing time as a whole of the mowing process may become longer, or congestion may occur in the communication line connecting the base # 1 and the base # 2. Based on.

A state in which the state transitions by the mowing process focusing on one IP address will be described with reference to FIG. Note that FIG. 9 shows not only the state of transition when the IP address is reclaimed, but also the state of transition when the IP address is issued for reference, the state of transition according to the synchronization request from the authentication server at another base, etc. Is also shown.
First, as shown in FIG. 9, a process (step S <b> 312 in FIG. 8) is performed by changing the state of the IP address whose validity period has expired to the state that is in the process of cutting by the cutting process of the first round.
Specifically, the authentication server 130 extracts and deletes a record whose “expiration date” has already passed from the session management table held and managed by the connection management device 140, and the same “IP” as this record. A record having an “address” is extracted from the IP address management table and is updated to a value “2” indicating that the “use state” is in a state of cutting. Here, as described above, the IP address for which the “expiration date” has expired on the session management table has been issued to the user but the first predetermined time has passed without confirmation of the connection, For example, the second predetermined time has elapsed after the payout and the connection is confirmed.
Note that the “usage state” of the corresponding record in the IP address management table is not immediately updated to the value “0” indicating that it is not used, but is set to the value “2” indicating that it is in the state of cutting once. The reason for this will be described later for convenience of explanation.

Next, as shown in FIG. 9, a process of making it unused (step S321 in FIG. 8) is performed by the cutting process of the second round, and it becomes possible to pay out again.
Specifically, the authentication server 130 indicates that the “use state” is in the state of being reaped on the IP address management table owned and managed by the connection management device 140 by the process of step S312 of FIG. 8 described above. Records updated to the value “2” are extracted and updated to a value “0” indicating that the “use state” of these records is an unused state. Thus, since the “use state” on the IP address management table is updated to the value “0”, it can be paid out again in the temporary connection processing in step S140 of FIG.

  As described above, when the value “1” indicating that the “used state” in the IP address management table is being used is updated to the value “0” indicating that it is not being used, The value is updated to “2” indicating the state, and the payout for a period corresponding to the cycle T is stopped until at least the second trimming process is performed. As described above, since the cycle for executing the mowing process at the site # 2 is the cycle T as in the site # 1, the period during which the payout is stopped at the site # 1 (the period corresponding to the cycle T) is The mowing process is executed at least once at the site # 2. For this reason, for example, in the connection management device 240, the connection management device 140 has already performed the trimming process even though it recognizes that the pruning processing has not yet been performed and has been paid to the previous user. Is newly issued in response to a request from the user, and as a result, the same IP address in the data held by the connection management device 140 and the connection management device 240 is repeatedly issued to different users. Can do.

Now, referring to the transition diagram of FIG. 10, in the IP address management table possessed and managed by the connection management device 140, the IP address having the value “2” indicating that the “use state” is the state of cutting. On the other hand, a process when a synchronization request is issued from the authentication server 230 to update to a temporary connection state will be described. Here, in FIG. 10, arrows (1), (2), and (3) indicated by solid lines indicate a state of transition in synchronization between the own base and other bases, and an arrow (1 ′) indicated by an alternate long and short dash line is It shows how the transition is made in synchronism with the temporary connection process indicated by the arrow (1) at the other site, and the arrows (4), (5), and (6) indicated by the broken lines are synchronized with the other site. It shows a state of transitioning independently without taking.
In FIG. 10, as indicated by solid arrows in (1), (2), and (3), the IP addresses before and after the transition that are grasped by the connection management device 240 of the base # 2 that is the synchronization request source In general, the state of the IP address before and after the transition that the connection management device 140 of the site # 1 that is the synchronization request destination knows are consistent with each other. This is because if the two do not match, the same IP address will be repeatedly issued to different users. As such a situation, for example, when the same IP is issued to different users at the base # 1 and the base # 2 at the same timing, that is, the IP address is given to the user at one base and the other It is conceivable that the same IP address is paid out to another user at the other site during the communication requesting the synchronization to the site. In this case, it is necessary to perform control such as rollback at one site, select a new IP address, and pay out again. In addition, there may be a case where data inconsistency occurs due to a system failure such as a hardware failure at one site. In this case, it is necessary to take measures such as synchronizing the data held by the base where the system failure has occurred and returning it to operation.

However, in FIG. 10, as indicated by the dashed line arrow (1 ′), the state transitions from the cutting state to the in-use state and the temporary connection state in accordance with the synchronization request for the temporary connection process performed at the other site. In this case, the state before transition managed by the synchronization request source does not match the state before transition managed by the synchronization request destination. For this reason, there seems to be a situation in which the same IP address is repeatedly paid out to different users.
However, in this case, the value “1” indicating that the data is updated according to the synchronization request from the authentication server 230 of the site # 2, that is, the “use state” in the IP address management table is in use. In addition, a process for creating a record having a value “0” indicating that the “connection state” is the temporary connection state may be performed in the session management table.
This is because the connection management device 140 and the connection management device 240 have different harvesting timings, so that the “used state” in the IP address management table possessed by the connection management device 140 represents that it is being trimmed. Even if the value is “2”, the connection management device 240 has already completed the trimming process and once the “use state” is updated to the value “0”, then pays out again to the new user and performs the temporary connection process. This is because there are cases where it is performed. Further, in the connection management device 140, the IP address in which the “use state” of the IP address management table is the value “2” indicating that the state is being pruned and the record of the session management table has been deleted is From the perspective of the connection management device 140, although IP addressing is prohibited for a while, the IP address has already been cut. For this reason, even if the connection management device 240 at the base # 2 issues this IP address to a new user, the same IP address is not redundantly assigned to different users.

  As described above, according to the IP address issuing system according to the first exemplary embodiment of the present invention, the IP address issuance process is performed on an IP address that has already expired among IP addresses that are held and managed by the connection management device 140. In this case, the IP address can be discharged again, so that IP address exhaustion can be suppressed. Further, when performing such a mowing process, synchronization with the connection management apparatus 240 at another base is not performed, so that it is possible to suppress a decrease in processing speed and communication line congestion due to communication delay. Furthermore, since the “usage state” in the IP address management table of the IP address that has already expired is updated to a value “2” indicating that it is being trimmed, it becomes a state in which it cannot be paid out for a while. Even when the process of synchronizing data is not performed between the connection management device 140 and the connection management device 240 during the cutting process, it is possible to suppress the same IP address from being repeatedly issued to different users.

[Embodiment 2]
Next, the second embodiment of the present invention will be described in detail.
The IP address issue system according to the second embodiment of the present invention also includes a plurality of servers that can issue IP addresses in response to requests from users, as in the first embodiment. The configuration of the IP address issuing system according to the second embodiment is the same as the configuration of the IP address issuing system according to the first embodiment, and thus detailed description thereof is omitted.

In the first embodiment, in the temporary connection process shown in step S130 of FIG. 5, first, an IP address to be paid out to the terminal 110 is selected. At this time, one IP address whose value of “0” is extracted from the IP address management table is selected, and the priority when selecting one IP address is the base # 1. There is no particular difference between the authentication server 130 at the site and the authentication server 230 at the site # 2.
In contrast, in the second embodiment, for example, the authentication server 130 at the site # 1 selects one IP address in ascending order, whereas the authentication server 230 at the site # 2 selects one IP address in descending order. It is different from the first embodiment in that IP addresses to be paid out with different priorities, such as selection, are selected.

Considering that the base # 1 and the base # 2 are relatively far apart, for example, the IP address management table and the session by the temporary connection process for the IP address that is the authentication server 130 and the connection management device 140 at the base # 1. After updating the data in the management table, the data held by the connection management device 140 and the connection management device 240 is not valid until communication with the connection management device 240 at the site # 2 is performed and a similar update is requested. There is consistency. At this time, the authentication server 230 and the connection management device 240 at the site # 2 may repeatedly issue the same IP address to different users.
However, in the second embodiment, the priority order for selecting an IP address to be paid out is different for each site, so that IP addresses are issued from a plurality of users to site # 1 and site # 2 within a relatively short time. Even when requested, it is possible to prevent the same IP address from being repeatedly issued to different users.

Further, when selecting an IP address to be paid out, not only the priority order is determined in ascending or descending order of the IP address, but for example, the priority order of the payout set for each IP address may be considered. .
For example, in the IP address priority order table shown in FIG. 11, a column “priority order” is provided to indicate the priority order for each corresponding IP address. For example, a number such as 0 to 10 is input to “priority order”, and a value “0” indicates that no payout is performed because it is used as a static IP address. A smaller value indicates a higher priority. The base # 1 and the base # 2 set different “priorities” for one IP address. When any of the bases selects “priority” that is not “0” and has a small “priority” value, and the selected IP address can be paid out, that is, the IP address It is assumed that when the “usage state” of the corresponding record in the management table is the value “0”, it is paid out to the user. By doing so, it is possible to prevent the same IP address from being repeatedly issued to different users. In addition, there is also an advantage that, when it is desired to change the priority when paying out an IP address, it can be dealt with by changing the setting of “priority” in the IP address priority table.

Further, when selecting an IP address to be paid out, for example, the IP address may be selected in consideration of an elapsed time after the IP address becomes ready to be paid out.
For example, in the modified example of the IP address management table shown in FIG. 12, a column of “update date / time” indicating the date and time when the value of “use state” of the record is updated is provided. It is also possible to preferentially select 0 that has an old value of “update date / time”. Thereby, the network trouble which arises by paying out the same IP address to a different user in a short period can be reduced.

[Modification]
In the above-described embodiment, the pair of authentication server 130 and connection management device 140 provided at site # 1 and the pair of authentication server 230 and connection management device 240 provided at site # 1 are independent of each other. Although described as being an apparatus, the connection management apparatus 140 may be incorporated in the authentication server 130, and the connection management apparatus 240 may be incorporated in the authentication server 230.

  In the above-described embodiment, the user authentication is performed when the IP address is paid out. However, the user authentication may not be performed. For example, the present invention can be applied to an IP address issuing system using a plurality of DHCP servers.

  Furthermore, in the above-described embodiment, in the temporary connection process shown in step S130 of FIG. 5, the main connection process shown in step S160 of FIG. 5, and the recovery process shown in step S220 of FIG. In the above description, it has been described that the process of updating the data held and managed by the connection management device 140 is performed, and then the synchronization request is made to update the data held and managed by the connection management device 240. The connection management device 240 may be requested to update data simultaneously. At this time, waiting for a predetermined time such as 2 minutes or 3 minutes, waiting for a synchronization request for an IP address to reach a certain number of cases such as three or four, or the capacity of the packet reaches a predetermined capacity After waiting for this, it is also possible to make a synchronization request collectively. In this way, by performing a plurality of synchronization processes together, it is possible to suppress the occurrence of congestion on the communication line between the bases.

  In the above embodiment, the session management table has been described as having five columns of “session ID”, “user ID”, “IP address”, “connection state”, and “expiration date”. As shown in FIG. 13, a column for storing information such as “domain name”, “access point IP address”, “terminal netmask”, and “User-Name” may be provided. In this way, for example, in the main connection process of step S160, when connection requests (Accounting-Request [Start] packets) are notified from a plurality of access points to one authentication server to the authentication server 130, Accounting is performed. -The session ID included in the Request [Start] packet may be duplicated, but the data can be verified accurately by verifying other information such as the domain name.

  Further, in the above-described embodiment, the IP address issuing system including a plurality of servers has been described. However, an IP address issuing apparatus, an IP address issuing method using a plurality of servers, and a plurality of servers are incorporated. It may be an IP address issuing program.

  The present invention can be used in the communication equipment manufacturing industry.

  DESCRIPTION OF SYMBOLS 110 ... Terminal, 120 ... Access point, 130 ... Authentication server, 131 ... Connection control part, 132 ... Reaping request part, 133 ... IP address rental request part, 134 ... Session registration request part, 135 ... Synchronization request part, 136 ... Authentication Processing unit 140 ... connection management device 210 ... terminal 220 ... access point 230 ... authentication server 231 ... connection control unit 232 ... reaping request unit 233 ... IP address lending request unit 234 ... session registration request unit, 235 ... Synchronization request section, 236 ... Authentication processing section, 240 ... Connection management apparatus, 310 ... Terminal, 320 ... Access point, 330 ... Authentication server, 340 ... Connection management apparatus.

Claims (5)

A plurality of servers that can issue IP addresses in response to requests from users are IP address issuing systems that issue IP addresses to users synchronously;
Each of the plurality of servers is
The data of a plurality of IP addresses is updated from the first state indicating that the data has not been paid out to the user yet, the second state indicating that the data has already been paid out to the user, and the second state to the first state. An IP address managing means for managing the IP address separately from the third state representing the middle;
When the IP address is requested from the user, the managed data is selected in the first state and the IP address is selected and paid out to the user. IP address issue control means for controlling all of the plurality of servers so as to update the state of data corresponding to the IP address of the managed data to the second state;
When the IP address is reclaimed from the user who has issued the IP address, the state of data corresponding to the IP address assigned to the user among the managed data is once updated to the third state, and then the data IP address pruning control means for performing processing for updating the state to the first state ;
When synchronization is requested from another server to update the data state to the second state with respect to the data of the IP address whose managed data state is the third state, this data according to this request. And a synchronization control means for updating the state to the second state ,
The IP address allocation control means, IP address, payout system that selects one IP address at different predetermined priority for each of the server and wherein the means der Rukoto for paying out to the user. An IP address issuing device that issues an IP address in response to a request from a user in synchronization with another IP address issuing device,
The data of a plurality of IP addresses is updated from the first state indicating that the data has not been paid out to the user yet, the second state indicating that the data has already been paid out to the user, and the second state to the first state. An IP address managing means for managing the IP address separately from the third state representing the middle;
When an IP address is requested to be issued by a user, the IP address is assigned to the user by selecting one IP address whose managed data is in the first state, and in all of the IP address issuing devices, IP address issuing control means for controlling all of the IP address issuing devices so as to update the state of data corresponding to the IP address of the managed data to the second state;
When the IP address is reclaimed from the user who has issued the IP address, the state of data corresponding to the IP address assigned to the user among the managed data is once updated to the third state, and then the data IP address pruning control means for performing processing for updating the state to the first state ;
When synchronization is requested from the other IP address issuing device to update the data state to the second state with respect to the data of the IP address whose managed data state is the third state, Synchronization control means for updating the state of this data to the second state according to a request ;
The IP address allocation control means, IP address, dispenser, wherein means der Rukoto paid out to the user selects one of the IP address at different predetermined priority for each of the IP dispenser. The data of a plurality of IP addresses is updated from the first state indicating that the data has not been paid out to the user yet, the second state indicating that the data has already been paid out to the user, and the second state to the first state. An IP address issuing method using a plurality of servers that are managed separately from the third state representing the middle, and that can issue the plurality of IP addresses in response to a request from a user,
Each of the plurality of servers is
When the IP address is requested from the user, the managed data is selected in the first state and the IP address is selected and paid out to the user. Controlling all of the plurality of servers to update the state of data corresponding to the IP address of the managed data to the second state;
When the IP address is reclaimed from the user who has issued the IP address, the state of data corresponding to the IP address assigned to the user among the managed data is once updated to the third state, and then the data Processing to update the state to the first state;
When synchronization is requested from another server to update the data state to the second state with respect to the data of the IP address whose managed data state is the third state, this data according to this request. update the state to the second state,
Each of the plurality of servers selects one IP address with a predetermined priority order that is different for each server, and issues the IP address to the user . The data of a plurality of IP addresses is updated from the first state indicating that the data has not been paid out to the user yet, the second state indicating that the data has already been paid out to the user, and the second state to the first state. In an IP address issuing method using a server that is managed separately from the third state indicating that it is in the middle and that can issue the plurality of IP addresses in response to a request from a user in synchronization with another server There,
When the IP address is requested from the user, the managed data is selected in the first state and the IP address is selected and paid out to the user. Controlling all of the plurality of servers to update the state of data corresponding to the IP address of the managed data to the second state;
When the IP address is reclaimed from the user who has issued the IP address, the state of data corresponding to the IP address assigned to the user among the managed data is once updated to the third state, and then the data Processing to update the state to the first state;
When synchronization is requested from another server to update the data state to the second state with respect to the data of the IP address whose managed data state is the third state, this data according to this request. update the state to the second state,
Each of the plurality of servers selects one IP address with a predetermined priority order that is different for each server, and issues the IP address to the user . An IP address issuing program incorporated in each of a plurality of servers capable of issuing an IP address in response to a request from a user,
The data of a plurality of IP addresses is updated from the first state indicating that the data has not been paid out to the user yet, the second state indicating that the data has already been paid out to the user, and the second state to the first state. It is managed separately from the third state indicating that it is in the middle,
When the IP address is requested from the user, the managed data is selected in the first state and the IP address is selected and paid out to the user. Controlling all of the plurality of servers to update the state of data corresponding to the IP address of the managed data to the second state;
When the IP address is reclaimed from the user who has issued the IP address, the state of data corresponding to the IP address assigned to the user among the managed data is once updated to the third state, and then the data Processing to update the state to the first state;
When synchronization is requested from another server to update the data state to the second state with respect to the data of the IP address whose managed data state is the third state, this data according to this request. update the state to the second state,
Each of the plurality of servers selects an IP address with a predetermined priority order that is different for each of the servers, and issues the IP address to the user .

Images