JP5042127B2 - Authentication logging system, information processing apparatus, and logging method - Google Patents

Description

  The present invention relates to a network authentication system, and more particularly to an authentication logging system, an information processing apparatus, and a logging method for recording a user's behavior moving between switches.

  Various functions for strengthening security have been proposed along with the infrastructure of communication networks. Network authentication is one of them. The network authentication system includes a terminal device such as a PC, an authentication switch, and an authentication server. The basic operation of the authentication system is as follows.

  First, an authentication request packet is output from a terminal device such as a PC to the authentication switch. When receiving the authentication request packet, the authentication switch inquires of the authentication server whether the authentication information is registered based on the authentication information in the received packet. When notified from the authentication server that the authentication information is already registered, the authentication switch enables communication of the source MAC address of the authentication request packet. This is a login process in network authentication.

  In addition, the transition from a network communication enabled state to a disabled state by a terminal device such as a PC is called logout. The reasons for logout include the following. (1) When a terminal device such as a PC has been in a no-communication state for a long time, (2) When there is no response to a re-authentication request from the authentication switch, (3) A terminal device such as a PC When the authentication switch is notified to cancel the authentication.

  These are information such as the date and time when log-in and log-out processing are performed in network authentication, the IP address and MAC address information of the switch that performed authentication, and the result of authentication and the cause information recorded as the authentication log. Call. The authentication log is recorded and stored by the authentication switch and the authentication server.

  Patent Document 1 describes an authentication method of an authentication switch in network authentication. In Patent Document 1, it is determined whether or not to make an inquiry to an authentication server with reference to the MAC address of an unauthenticated terminal, and whether or not the corresponding MAC address can be communicated is determined according to the inquiry result from the authentication server. In the invention described in Patent Document 1, there is no description of means for detecting unauthorized access PCs and unauthorized access users from authentication log information.

JP 2003-46533 A

  Since the authentication log of Patent Document 1 was individually recorded and managed by the authentication switch and the authentication server, the behavior of the user moving between the switches was not understood. Further, it has not been possible to find an unauthorized user who logs in to the network by misrepresenting user IDs from a plurality of authentication switches.

  In order to solve the above-mentioned problem, the present invention obtains authentication log information from a plurality of authentication switches in an authentication server, and records the movement between the authentication switch of the authentication user and the means for merging with the authentication log of the authentication server. And means for displaying movement records in the authentication switch in time series and means for analyzing an unauthorized user who misrepresents a user ID from authentication log information.

  The above-described problem includes a plurality of authentication switches having a plurality of connection ports, a plurality of terminal devices connected to the authentication switch via the connection ports, and an authentication server connected to one of the connection ports. Authenticate with the authentication server via the first authentication switch using the user information of the user operating the first terminal device, record this authentication log with the first authentication switch and the authentication server, The authentication server creates a system authentication log by merging multiple switch authentication logs and server authentication logs with a collection processing unit that collects multiple switch authentication logs recorded by multiple authentication switches. This can be solved by an authentication logging system including a merge processing unit that performs an analysis processing unit that analyzes a system authentication log.

  In addition, it is connected to multiple authentication switches via the network interface, processes the authentication request of the terminal device from the authentication switch, records the result as a server authentication log, and collects the multiple switch authentication logs recorded by the authentication switch This can be solved by an information processing apparatus comprising: a collection processing unit that performs processing, a merge processing unit that generates a system authentication log by merging a plurality of switch authentication logs and a server authentication log, and an analysis processing unit that analyzes the system authentication log.

  Further, a step of collecting a plurality of switch authentication logs recorded by the authentication switch, a step of generating a system authentication log by merging the plurality of switch authentication logs and the server authentication log, and a step of analyzing the system authentication log This can be achieved by a logging method comprising:

  A record of movement between authentication switches of the authenticated user and a movement record within the authentication switch can be taken. Further, it is possible to find an unauthorized user who logs in to the network by misrepresenting a user ID from a plurality of authentication switches.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings using examples. The same reference numerals are assigned to substantially the same parts, and the description will not be repeated.

The configuration of the authentication logging system will be described with reference to FIG. Here, FIG. 1 is a hardware block diagram of the authentication logging system. In FIG. 1, an authentication logging system 500 includes an L3 switch 300, an authentication server 200 connected to the L3 switch 300, three authentication switches 100, a HUB 400 connected to the authentication switch 100, and a terminal connected to the HUB 400. 10.

  The L3 switch 300 is connected to the Internet via a broadband router (not shown). The authentication switch 100 holds a record of authentication with the authentication server 300 in the authentication log 110. The authentication server 200 holds a record of authentication with the authentication switch 100 in the authentication log 220. The authentication server 200 also collects authentication logs 110-1 to 110-3 of the authentication switches 100-1 to 100-3 and holds them in the authentication log 210. The authentication server 200 further holds an authentication result obtained by merging the authentication log 210 and the authentication log 220 in the authentication log 230. The authentication server 200 corresponds to MAC authentication, IEEE802.1x authentication, and Web authentication.

  HUB 400-1 and HUB 400-2 are connected to authentication switch 110-1. Similarly, HUB 400-3 and HUB 400-4 are connected to authentication switch 110-2. HUB 400-5 and HUB 400-6 are connected to authentication switch 110-3.

  A terminal 10-1 and a terminal 10-2 are connected to the HUB 400-1. Similarly, the terminal 10-3 and the terminal 10-4 are connected to the HUB 400-4. A terminal 10-5 is connected to the HUB 400-6.

The configuration of the authentication server will be described with reference to FIG. Here, FIG. 2 is a functional block diagram of the authentication server. In FIG. 2, the authentication server 200 includes a network interface 240, a user interface 280, a network authentication processing unit 250, an authentication log collection processing unit 290, an authentication log analysis processing unit 260, an authentication log display processing unit 270, and authentication logs 210 to 230. Composed.

The network authentication processing unit 250 processes an authentication request from the authentication switch 100 via the network interface 240 and returns an authentication result to the authentication switch 100. The network authentication processing unit 250 records the authentication result in the authentication log 220. The authentication log collection processing unit 290 accesses the authentication switch 100 via the network interface 240, collects the authentication log 110 of the authentication switch, and merges and records it in the authentication log 210. The authentication log collection processing unit 290 also merges the authentication log 220 and the authentication log 210 and records them in the authentication log 230. The authentication log analysis processing unit 260 analyzes the authentication log 230 and detects a spoofed terminal with a user ID. The authentication log analysis processing unit 260 includes an authentication log analysis table 261 for analyzing the authentication log 230. The authentication log display processing unit 270 displays the processing result of the authentication log analysis processing unit on a display device (not shown) connected to the user interface 280.
Note that the authentication log collection processing unit 290 may collect the authentication log 110 of the authentication switch 100 based on a report from the authentication switch 100.

  The configuration of the authentication log will be described with reference to FIGS. Here, FIG. 3 is a diagram illustrating the configuration of the authentication log of the authentication server. FIG. 4 is a diagram for explaining the configuration of the authentication log of the authentication switch. FIG. 5 is a diagram for explaining the configuration of the merged authentication log of the authentication server. 3 to 5 show only the title part, it is actually composed of a title part and a record.

  In FIG. 3, the authentication log 220 of the authentication server 200 includes a sequence number 221, a date / time 222, an event ID 223, authentication information 224, and authentication switch identification information 225. The event ID 223 is authentication OK or NG. The authentication information 224 includes a user ID and a password. The authentication switch identification information 225 is an IP address, a MAC address, or the like.

  In FIG. 4, the authentication log 110 of the authentication switch 100 includes a sequence No 111, a date / time 112, an event ID 113, authentication information 114, and terminal identification information 115. The event ID 113 is login or logout. The authentication information 114 includes a user ID and a password. The terminal identification information 225 is a MAC address, an IP address, a VLAN number, or the like.

  In FIG. 5, the authentication log 230 of the authentication server 200 includes sequence No 231, date / time 232, event ID (1) 233, event ID (2) 234, authentication information 235, authentication switch identification information 236, and terminal identification information 237. It is configured. Event ID (1) 233 is login or logout. The event ID (2) 234 is authentication OK or NG. The authentication information 235 includes a user ID and a password. The authentication switch identification information 236 is an IP address, a MAC address, or the like. The terminal identification information 237 is a MAC address, an IP address, a VLAN number, or the like.

  The authentication log 220 in FIG. 3 is also referred to as a server authentication log. The authentication log 110 of the authentication switch 100 in FIG. 4 is also called a switch authentication log. The authentication log 230 of the authentication server 200 in FIG. 5 is also called a system authentication log.

  Returning to FIG. 2, a method of detecting an unauthorized terminal that spoofs a MAC address and an unauthorized user that spoofs a user ID using the authentication log 230 in the authentication server 200 will be described. The authentication log analysis processing unit 260 reads authentication information registered in the authentication log 230 and performs an authentication information analysis process as described below.

  First, authentication event (login, logout) information is read in time series with the user ID and terminal information (MAC address) for network authentication. Next, pay attention when the logged-in user ID or terminal (MAC address) logs in for the second time without logging out. That is, when the user ID logged in the first time logs out after a predetermined time from the time when the user logged in the second time, it is determined that the terminal has moved normally. However, if the user ID or MAC address logged in the first time does not log out even after a predetermined time from the time when the user logged in the second time, the user ID or MAC address is detected as an unauthorized user ID or an unauthorized terminal. The authentication log analysis processing unit 260 controls the authentication log display processing unit 270 to notify the administrator of an alarm.

  With reference to FIG. 6, the sequence when the terminal 10 moves from the control area of the authentication switch 100-1 to the control area of the authentication switch 100-2 will be described. Here, FIG. 6 is a sequence diagram among the terminal, the two authentication switches, and the authentication server. In FIG. 6, the terminal 10 transmits an authentication request to the authentication switch 100-1 (S51). The authentication switch 100-1 transmits an authentication request packet to the authentication server 200 (S52). The authentication server 200 performs an authentication process on the authentication information in the authentication request packet, and returns an authentication result to the authentication switch 100-1 (S53). At this time, the authentication server 200 records the authentication result in the authentication log (S54).

  The authentication switch 100-1 returns an authentication result to the terminal (S56). When receiving the authentication result from the authentication server 200, the authentication switch 100-1 records the authentication result in the authentication log (S57). Since authentication is successful here, a login authentication log is recorded. The authentication switch 100-1 records the authentication result in its own authentication log 110-1, and transmits the log information to the authentication server 200 (S58). Here, normal communication between the terminal 10 and the authentication switch 100-1 is started. Thereafter, it is assumed that the terminal 10 has moved from the management of the authentication switch 100-1 to the management of the authentication switch 100-2.

  When the authentication switch 100-1 detects that there is no communication from the terminal 10, the authentication switch 100-1 cancels (logs out) the authentication of the terminal 10. After logout processing, a logout authentication log is recorded (S59), and the log is notified to the authentication server 200 (S61).

  The terminal 10 that has moved under the management of the authentication switch 100-2 transmits an authentication request to the authentication switch 100-2 (S62). Upon receiving the authentication request, the authentication switch 100-2 transmits an authentication request packet to the authentication server 200 (S63). The authentication server 200 performs an authentication process on the authentication information in the authentication request packet, and returns an authentication result to the authentication switch 100-2 (S64). At this time, the authentication server 200 records the authentication result in the authentication log (S65). Then, the authentication switch 100-2 returns an authentication result to the terminal (S66). When receiving the authentication result from the authentication server 200, the authentication switch 100-2 records the authentication result in the authentication log (S67). Since authentication is successful here, a login authentication log is recorded. The authentication switch 100-2 records the authentication result in its own authentication log 110-2 and transmits the log information to the authentication server 200 (S68).

  With reference to FIG. 7, the sequence when the terminal 10 moves from the control area of the authentication switch 100-1 to the control area of the authentication switch 100-2 will be described. However, since the terminal 10 moves quickly, the case where the login time to the authentication switch 100-2 becomes earlier than the logout time of the authentication switch 100-1. FIG. 7 is a sequence diagram between the terminal, the two authentication switches, and the authentication server. In FIG. 7, the description from step 71 to step 78 is the same as the step 51 to step 58 in FIG.

  Along with the movement, the terminal 10 transmits an authentication request to the authentication switch 100-2 (S79). Upon receiving the authentication request, the authentication switch 100-2 transmits an authentication request packet to the authentication server 200 (S81). The authentication server 200 performs an authentication process on the authentication information in the authentication request packet, and returns an authentication result to the authentication switch 100-2 (S82). At this time, the authentication server 200 records the authentication result in the authentication log (S83). Then, the authentication switch 100-2 returns an authentication result to the terminal (S84). When receiving the authentication result from the authentication server 200, the authentication switch 100-2 records the authentication result in the authentication log (S85). Since authentication is successful here, a login authentication log is recorded. The authentication switch 100-2 records the authentication result in its own authentication log 110-2 and transmits the log information to the authentication server 200 (S86).

  When the authentication switch 100-1 detects that there is no communication from the terminal 10, the authentication switch 100-1 cancels (logs out) the authentication of the terminal 10. After logout processing, a logout authentication log is recorded (S87), and the log is notified to the authentication server 200 (S88).

  With reference to FIG. 8, the detection of a user ID misrepresentation terminal is demonstrated. Here, FIG. 8 is a sequence diagram between two terminals, two authentication switches, and an authentication server. In FIG. 8, the description from step 91 to step 98 is the same as step 51 to step 58 in FIG.

  It is assumed that the spoofing terminal 20 that misrepresents the user ID of the terminal 10 in normal communication with the authentication switch 100-1 is connected to the authentication switch 100-2. The spoofing terminal 20 transmits an authentication request to the authentication switch 100-2 (S99). Upon receiving the authentication request, the authentication switch 100-2 transmits an authentication request packet to the authentication server 200 (S101). The authentication server 200 performs an authentication process on the authentication information in the authentication request packet, and returns an authentication result to the authentication switch 100-2 (S102). At this time, the authentication server 200 records the authentication result in the authentication log (S103). Then, the authentication switch 100-2 returns an authentication result to the terminal 20 (S104). When receiving the authentication result from the authentication server 200, the authentication switch 100-2 records the authentication result in the authentication log (S106). Here, since the authentication is successful as in the description of FIG. 7, a login authentication log is recorded. The authentication switch 100-2 records the authentication result in its own authentication log 110-2 and transmits the log information to the authentication server 200 (S107).

  At this time, it is assumed that the business is terminated at the terminal 10 in normal communication with the authentication switch 100-1 and the authorized user turns off the power of the terminal 10. When the authentication switch 100-1 detects that there is no communication from the terminal 10, the authentication switch 100-1 cancels (logs out) the authentication of the terminal 10. After logout processing, a logout authentication log is recorded (S108), and the log is notified to the authentication server 200 (S109). Here, in the authentication server 200, the terminal 10 or the terminal 20 is a user ID spoofed terminal based on the difference between the login time of the terminal 20 to the authentication switch 100-2 and the logout time of the terminal 10 from the authentication switch 100-1. Is detected (S111).

  With reference to FIG. 9, an authentication log analysis table focusing on the user ID “User-A” in the sequence of FIG. 8 will be described. Here, FIG. 9 is a diagram illustrating an authentication log analysis table of the authentication server.

  In FIG. 9, the authentication switch identification information 236 described in FIG. 5 is described as switch information instead of the authentication position information 236A for convenience of illustration. Sequence No. 1 is information recorded in the authentication log 220 in step 94 of FIG. Sequence No. 2 is information recorded in the authentication log 110-1 at Step 97 in FIG. 8 and transferred at Step 98. Sequence No. 3 is information recorded in the authentication log 220 in step 103 of FIG. Sequence No. 4 is information recorded in the authentication log 110-2 at Step 106 in FIG. 8 and transferred at Step 107. Sequence No. 5 is information recorded in the authentication log 110-1 at Step 108 in FIG. 8 and transferred at Step 109. In the authentication log analysis processing unit 260, the time difference between the sequence No. 4 and No. 5 in the authentication log analysis table 261 is as long as 29 minutes, and the terminal MAC address is different. Therefore, the terminal using User-A includes a user ID spoofing terminal. It is determined that

  The operation of the authentication log analysis processing unit of the authentication server will be described with reference to FIG. Here, FIG. 10 is an operation flowchart of the authentication log analysis processing unit. In FIG. 10, the authentication log analysis processing unit 260 acquires the latest authentication log information from the authentication log 230 (S201). The authentication log analysis processing unit 260 stores the authentication log information in the authentication log analysis table 261 created for each authentication information (S202). The authentication log analysis processing unit 260 determines whether the authentication log information is login information (S203). If YES, the authentication log analysis processing unit 260 determines whether there is the same user during the current login (S204). If YES, the authentication log analysis processing unit 260 determines whether the MAC addresses of the terminals are the same (S206). If Yes, the authentication log analysis processing unit 260 turns on the same multiple terminal login flag for the same user (S207), and returns to Step 201.

  If NO in step 206, the authentication log analysis processing unit 260 turns on the multiple terminal login flag for the same user (S208), and returns to step 201. If NO in step 204, the authentication log analysis processing unit 260 returns to step 201 as it is.

  If NO in step 203, it is determined whether the authentication log information is logout (S209). When NO, the step authentication log analysis processing unit 260 returns to step 201 as it is. If YES in step 209, it is determined whether the same multiple terminal login flag is ON for the same user (S211). When YES, the authentication log analysis processing unit 260 returns to step 201 as it is.

  When NO is determined in step 211, the authentication log analysis processing unit 260 determines whether the multiple terminal login flag is ON for the same user (S212). If NO, the authentication log analysis processing unit 260 returns to step 201 as it is. If YES in step 212, the authentication log analysis processing unit 260 determines whether or not the time difference between login and logout of a terminal with the same user and different MAC address is equal to or longer than a certain time (S213). If YES, the authentication log analysis processing unit 260 determines that the spoofed terminal is accessed, raises an alarm (S214), and returns to step 201. If NO in step 213, the authentication log analysis processing unit 260 returns to step 201 as it is.

According to the above-described embodiment, it is possible to take a movement record between user authentication switches and a movement record in the authentication switch. In addition, it is possible to find an unauthorized user who misrepresents a user ID in an authentication network including a plurality of authentication switches.
In the above-described embodiment, sorting is performed for each user ID, but if the sorting is performed for each MAC address, an unauthorized user who spoofs the MAC address can also be found.

It is a hardware block diagram of an authentication logging system. It is a functional block diagram of an authentication server. It is a figure explaining the structure of the authentication log of an authentication server. It is a figure explaining the structure of the authentication log of an authentication switch. It is a figure explaining the structure of the authentication log by which the authentication server was merged. It is a sequence diagram between a terminal, two authentication switches, and an authentication server. It is a sequence diagram between a terminal, two authentication switches, and an authentication server (the 2). It is a sequence diagram between two terminals, two authentication switches, and an authentication server. It is a figure explaining the authentication log analysis table of an authentication server. It is an operation | movement flowchart of an authentication log analysis process part.

Explanation of symbols

  DESCRIPTION OF SYMBOLS 10 ... Terminal, 20 ... Terminal, 100 ... Authentication switch, 110 ... Authentication switch authentication log, 200 ... Authentication server, 210 ... Authentication server authentication log, 220 ... Authentication log collected from authentication switch, 230 ... Merged authentication Log, 240 ... Network interface, 250 ... Network authentication processing unit, 260 ... Authentication log analysis processing unit, 261 ... Authentication log analysis table, 270 ... Authentication log display processing unit, 280 ... User interface, 290 ... Authentication log collection processing unit, 300 ... L3 switch, 400 ... HUB, 500 ... Authentication logging system.

Claims (3)

A plurality of authentication switches each having a plurality of connection ports, a plurality of terminal devices connected to the authentication switch via the connection ports, and an authentication server connected to one of the connection ports, Using the user information of the user who operates one terminal device to authenticate with the authentication server via the first authentication switch, record the authentication log with the first authentication switch and the authentication server, In the authentication logging system for connecting the first terminal device,
The authentication server includes a collection processing unit that collects a plurality of switch authentication logs recorded by the plurality of authentication switches, and a merge processing unit that generates a system authentication log by merging the plurality of switch authentication logs and server authentication logs. If, comprising an analysis processor for analyzing the system authentication log,
The analysis processing unit sorts the system authentication log in time series for each user ID, and for two terminal devices having authentication logging with the same user ID and different MAC addresses, at the logout timing of one terminal device. An authentication logging system characterized by determining the authenticity of the user ID . An information processing apparatus connected to a plurality of authentication switches via a network interface, processing an authentication request of a terminal device from the authentication switch, and recording the result as a server authentication log,
A collection processing unit for collecting a plurality of switch authentication logs recorded by the authentication switch, a merge processing unit for generating a system authentication log by merging the plurality of switch authentication logs and the server authentication log, and the system authentication log and a analysis processor for analyzing,
The analysis processing unit sorts the system authentication log in time series for each user ID, and for two terminal devices having authentication logging with the same user ID and different MAC addresses, at the logout timing of one terminal device. An information processing apparatus that determines the authenticity of the user ID . A step of collecting a plurality of switch authentication logs recorded by the authentication switch; a step of generating a system authentication log by merging the plurality of switch authentication logs and the server authentication log; and the system authentication log for each user ID A step of sorting in time series and a step of determining the authenticity of the user ID at the logout timing of one terminal device for two terminal devices having authentication logging with the same user ID and different MAC addresses Logging method.

Images