JP6511001B2 - Network communication confirmation system and network communication confirmation method - Google Patents

Description

  The present invention relates to a network communication confirmation system and a network communication confirmation method.

  Silent failures (also called silent failures) that can not be detected by an autonomous diagnostic function prepared in advance on a computer system may occur. The silent failure causes symptoms such as performance degradation without displaying an error message on the management tool. If left as it is, it will eventually be unable to connect to the network (hereinafter referred to as NW as appropriate) or the entire system will be adversely affected, leading to a large scale failure. A silent failure is not only hard to notice the occurrence, but also takes time and time to identify the cause.

  There is a "ping command" as a troubleshooting tool for identifying a suspected failure point. This ping command transmits the Internet Control Message Protocol (ICMP) protocol (basic control protocol in the TCP / IP protocol) to the designated destination host and displays the response status. As a command used for the same purpose as this ping, there is a traceroute (in Windows (registered trademark) tracert) command. The traceroute command investigates the reachability to a specified destination by sending an Echo request of the ICMP protocol as well as a ping command. The traceroute command displays one by one the hosts (routers) passed through during routing.

  Non-Patent Document 1 describes a distribution control technique of DPI (Deep Packet Inspection) that executes transmission control (filter or the like) of packets in accordance with a predetermined policy. The policy in DPI is that 5-tuple (source / destination IP address, source / destination port, protocol number) is an identification key. 5-tuple can be spoofed if the sender is a malicious user.

  In Non-Patent Document 2, the client adds an account and a password to the request signal, and when the information matches the information set in advance in the server, HTTP (Hypertext Transfer Protocol) which gives permission for the request (returns the response signal) Basic authentication technology is described.

  In Non-Patent Document 3, the ping source recognizes the installation location of the FW (firewall: firewall) on the NW and (1) opens the FW setting of the HGW (home gateway), (2) ping transmission, (3) HNG ping technology of NGN (Next Generation Network) TEMS (Telecom Equipment Manufacturers) / NTEMS to execute, to close the HGW FW settings is described.

Distribution control of DPI, issued by Net One Systems, [online], [search on March 22, 2016], Internet <URL: http://www.bcm.co.jp/itxp/2011/07/cat04/25000000 .php〉 NGN TEMS / NTEMS HGWping, [online], [search on March 22, 2016], Internet <URL: http://www.netone.co.jp/report/column/20150805a.html> Basic authentication in HTTP, [online], [Search on March 22, 2016], Internet <URL: https://en.wikipedia.org/wiki/Basic%E8%AA%8D%E8%A8%BC>

  However, there is a problem that it takes a long time to identify the suspected point when transmitting the connectivity confirmation packet (ping or traceroute) for the purpose of identifying the suspected point, if there is an FW in the route. The problem will be described below with reference to FIG.

FIG. 10 is a diagram for explaining the problem of the existing technology. The solid arrows in FIG. 10 indicate the flow in the route of the connectivity confirmation packet. The x marks in FIG. 10 indicate that the continuity check packet can not exceed the FW 15, and the dashed arrows in FIG. 10 virtually indicate the flow of the continuity check packet that can not exceed the FW 15.
As shown in FIG. 10, the IP network 10 has a plurality of routers 11, 12, 13, 14 in a route connecting between end to end (route), and between the router 12 and the router 13. And relays IP packets between end-to-end. The FW 15 opens and closes the firewall (pass / pass packets) according to the configuration (access list) of the FW. Also, the network manager 16 transmits a connectivity confirmation packet. The network administrator 16 knows the address (presence location) of the FW 15 in the route.

When a silent failure occurs, the communication confirmation packet transmitter (not shown) (which may be the network administrator 16) transmits a communication confirmation packet (ping or traceroute) to identify a suspected place. In the example of FIG. 10, since the FW 15 exists in the route of the NW 10, operations (A), (B), and (C) are required for the packet for checking the continuity to exceed the FW 15.
If there is FW15 in the route, (A) specify the location of FW15, (B) divide the section to perform packet transmission, (C) after setting the access list to packet passing, There is a method of transmitting a packet for communication confirmation, and operating the setting so as not to pass the access list after the end. Even if any of the above methods is adopted, there is a problem that it takes time to identify the suspected place when the FW 15 exists in the route.

  The present invention has been made in view of such backgrounds, and an object of the present invention is to provide a network continuity check system and a network continuity check method capable of shortening the time required to identify a fault suspected part. .

  In order to solve the above-mentioned problems, the invention according to claim 1 is a packet for communication confirmation packet transmission unit for transmitting on a network a predetermined communication confirmation packet to which a password is assigned, and the transmission confirmation message transmission unit installed on the network (Firewall) operating according to an access list for setting the passing of packets not to pass or not passing, an agent for continuity check included in the FW and executing continuity check control of the FW, and the packet for continuity check A transmission unit and an authentication server for authenticating the validity of the communication confirmation packet transmission unit between the communication confirmation agent, and the communication confirmation packet transmission unit transmits the communication confirmation agent to the communication confirmation agent via the authentication server When the password is set in advance and the suspected failure point is identified, the communication confirmation packet transmission unit The communication confirmation packet is transmitted on the network, and the communication confirmation agent collates the password assigned to the received communication confirmation packet with the password set in advance, and when the passwords coincide with each other. The access list is set to pass packets, the communication confirmation packet is transferred to the communication confirmation packet transmission destination, and after the response of the communication confirmation packet is received from the communication confirmation packet transmission destination, the access list is transmitted through the packet. The network connectivity confirmation system is characterized in that it performs an operation to make it not set.

  Also, in the invention according to claim 3, a packet for communication confirmation packet transmitting unit for transmitting a predetermined packet for communication confirmation to which a password is given on the network, and a packet installed on the network and passing the transmitted packet Alternatively, an FW (firewall) operating according to an access list for setting not to pass, an agent for communication confirmation provided in the FW to execute communication confirmation control of the FW, the packet transmission unit for communication confirmation, and the communication confirmation An authentication server for authenticating the legitimacy of the packet transmission unit for communication confirmation among agents for the network communication confirmation system of the network communication confirmation system, wherein the packet transmission unit for communication confirmation uses the authentication server via the authentication server Setting a password in advance to the communication confirmation agent; When identifying the suspected place, the communication confirmation packet transmission unit transmits the communication confirmation packet on the network; and the communication confirmation agent assigns the communication confirmation packet to the received packet. The password and the password set in advance are collated, and if they match, the access list is set to pass packets, the communication confirmation packet is transferred to the communication confirmation packet transmission destination, and the communication confirmation packet transmission The network connectivity confirmation method is characterized by performing the operation of setting the access list not to pass the packet after the response of the connectivity confirmation packet is received from the beginning.

In this way, when identifying a suspected failure point, it is possible to dynamically change the setting (access list) of the FW on demand simply by transmitting a predetermined connectivity confirmation packet to which a password is assigned. it can. As a result, even if there is an FW in the route, there is no need for the network administrator or the like to specify the location of the FW, and the network administrator or the like changes the setting (access list) of the FW. Since it is not necessary, it is possible to reduce the time taken to identify a suspected failure point.
In addition, since authentication is performed using the password assigned to the communication confirmation packet, it is possible to provide resistance against packet misrepresentation.

  The communication confirmation packet is a packet for executing a ping or traceroute command, and the password assigned to the communication confirmation packet is set in an IP datagram datagram. Network connectivity confirmation system.

  By doing this, it is possible to assign a password to a connectivity confirmation packet that executes a ping or traceroute command, which is a basic control protocol in the TCP / IP protocol, and is applied to an IP network generally. Can.

  According to the present invention, it is possible to provide a network connectivity confirmation system, a network connectivity confirmation method, and a program capable of shortening the time required to identify a failure suspected part.

FIG. 1 is a block diagram showing a network connectivity confirmation system according to an embodiment of the present invention. It is a figure which shows the structure of the packet for communication confirmation of the network communication confirmation system which concerns on embodiment of this invention. It is a control sequence diagram explaining pre-processing (FW address list registration) of the network communication check system concerning an embodiment of the present invention. It is a figure which shows the FW address list which the authentication server of the network communication confirmation system which concerns on embodiment of this invention manages. It is a control sequence diagram explaining pre-processing (pre-preparation and password setting) of the network communication check system concerning an embodiment of the present invention. It is a figure which shows the account list | wrist which registers the account and user password of the network continuity check system which concerns on embodiment of this invention. It is a figure which shows the PING password list | wrist of the network communication confirmation system based on embodiment of this invention. It is a control sequence diagram in the case of specifying a failure suspected part of the network communication confirmation system according to the embodiment of the present invention. It is a figure which shows the transmission destination address list which manages the packet transmission destination of the network connectivity check system which concerns on embodiment of this invention. It is a figure explaining the subject of existing technology.

Hereinafter, a network connectivity confirmation system and the like in a mode for carrying out the present invention (hereinafter, referred to as “this embodiment”) will be described with reference to the drawings.
FIG. 1 is a block diagram showing a network connectivity confirmation system according to an embodiment of the present invention.
As shown in FIG. 1, the network communication confirmation system 100 includes a communication confirmation packet transmitter 110, a communication confirmation agent 130 provided in the FW 120, and an authentication server 140. The network communication confirmation system 100 is used for the IP network 10. The IP network 10 includes, for example, a plurality of routers 11, 12, 13, and 14 in a route (route) connecting end-to-end, and an FW 120 installed between the router 12 and the router 13; Relay IP packets between the ends.

<Packet Transmission Confirmation Packet>
The communication confirmation packet transmission unit 110 may be a device that transmits a packet on the IP network 10, may be a single device, or may be disposed in various devices. Also, any arrangement device may be used. The communication confirmation packet transmitter 110 is disposed, for example, in a network management device (network manager 16).
The communication confirmation packet transmitting unit 110 transmits the communication confirmation packet 200 (see FIG. 2) to which the password 230 (see FIG. 2) is added to the IP network 10.
The communication confirmation packet transmitter 110 sets a password in advance in the communication confirmation agent 130 via the authentication server 140 (see FIG. 5).
The communication confirmation packet transmitting unit 110 transmits the communication confirmation packet 200 onto the IP network 10 (see FIG. 8) when identifying the suspected failure point.

<FW>
The FW 120 includes a routing unit 121 (see FIG. 8) that performs routing (path control). Further, the routing unit 121 executes the communication check function of the communication check agent 130 by routing according to the instruction of the communication check agent 130. The FW 120 is installed on the IP network 10 and operates in accordance with an access list that sets transmitted packets to pass or not to pass. Further, a communication confirmation agent 130 is installed in the FW 120.

<Agent for checking connectivity>
The connectivity confirmation agent 130 is software that executes the connectivity confirmation control of the FW 120 and is installed in the FW 120.
The communication confirmation agent 130 registers its own address in the address of the authentication server 140 set in advance. The connectivity confirmation agent 130 has a PING password list 270 (see FIG. 7) for registering the notified PING password (described later).
When identifying the suspected failure point, the communication confirmation agent 130 collates the password 230 (see FIG. 2) assigned to the received communication confirmation packet 200 (see FIG. 2) with the password set in advance and matches them. In this case, the access list is set to packet passing, and the communication confirmation packet 200 is transferred to the communication confirmation packet transmission destination 150 (see FIG. 8), and the communication confirmation packet transmission destination 150 to the communication confirmation packet 200 After the response is received, the access list is set not to pass the packet.

<Authentication server>
The authentication server 140 is installed between the communication check packet transmitter 110 and the communication check agent 130. The authentication server 140 manages the address of the FW 120 based on the address registration accepted from the FW 120. The authentication server 140 comprises an account list 260 (see FIG. 6) for registering account / user passwords (described later).
The authentication server 140 is a general authentication server for identity verification such as a public key method. The authentication server 140 authenticates the validity check of the communication check packet transmitter 110.

<Packaging check packet 200>
FIG. 2 is a view showing the configuration of the communication confirmation packet 200. As shown in FIG.
As shown in FIG. 2A, the communication confirmation packet 200 uses a packet (IP datagram) 210 sent from an IP (Internet Protocol) layer. The IP datagram 210 includes an IP header 211 and an IP payload 212 which is data.
As shown in FIG. 2B, the IP payload 212 is composed of an ICMP header 221 and an ICMP message 222. ICMP is a protocol corresponding to a network layer that notifies when a failure occurs, and is executed by a ping command or a traceroute (tracert) command. The connectivity confirmation packet 200 sets the password 230 (fixed length) in the ICMP message 222, with the left side justified. For convenience of explanation, it is assumed that "Innocent World" is set as the password 230.
The communication confirmation packet 200 has a configuration in which the password 230 is set in the ICMP message 222 of the IP datagram 210. Since the connectivity confirmation packet 200 sets the password 230 in the ICMP message 222 of the IP datagram 210, routing control (routing) is performed as described later with the routers 11, 12, 13 and 14 of the IP network 10 shown in FIG. It becomes possible.

Hereinafter, the operation of the network connectivity confirmation system 100 configured as described above will be described.
[Preprocessing]
First, preprocessing will be described.
<FW address list registration>
FIG. 3 is a control sequence diagram for explaining pre-processing (FW address list registration).
In the FW 120, an agent 130 for communication confirmation is installed. The connectivity confirmation agent 130 registers its own address (for example, “152.33.6.3”) in the IP address of the authentication server 140 set in advance (step S1).

The authentication server 140 manages the address of the FW 120 by the address registration accepted from the FW 120 (step S2).
FIG. 4 is a diagram showing the FW address list 250 managed by the authentication server 140. As shown in FIG. As shown in FIG. 4, the FW address list 250 stores the IP address (for example, “10.1.1.15” “192.168.29.55” “152.33.6.3”) of the FW 120 managed by the authentication server 140.
The authentication server 140 receives the notification of registration of the FW 120 address from the communication confirming agent 130, and adds the address (“152.36.6.3”) notified by the FW address registration to the FW address list 250 (see FIG. 4). The address (“152.33.6.3”) (see bold letters in FIG. 4) is the address added to the FW address list 250 this time.
After adding the notified address to the FW address list 250, the authentication server 140 returns registration completion OK to the communication confirmation agent 130 (step S3).

<Authentication server: Preparation in advance>
FIG. 5 is a control sequence diagram for explaining pre-processing (pre-preparation and password setting).
As shown in FIGS. 1 and 5, an authentication server 140 is installed between the communication check packet transmitter 110 and the communication check agent 130 to confirm the legitimacy of the communication check packet transmitter 110. The control sequence for confirming the legitimacy will be described below.

The authentication server 140 and the communication confirmation packet transmitter 110 prepare in advance.
First, the authentication server 140 performs the following preparation (step S11). The authentication server 140 is a general authentication server for identity verification such as a public key system, generates a public key and a secret key, and makes the public key public. Then, the authentication server 140 registers the account / user password used by the communication check packet transmitter 110 in the account list 260 (see FIG. 6) that the authentication server 140 has.
FIG. 6 is a diagram showing an account list 260 for registering account / user passwords. As shown in FIG. 6, the account list 260 stores accounts and user passwords. In the example of FIG. 6, the account ("Hogehoge") and its user password ("XXXXXXX"), the account ("Children") and its user password ("Namonakiuta") are stored. The account (“Children”) and the user password (“Namonakiuta”) (see bold letters in FIG. 6) are the account / user password additionally registered in the account list 260 this time.

  In addition, the communication check packet transmission unit 110 performs the following preparation (step S12). That is, the communication confirmation packet transmitter 110 acquires the public key from the authentication server 140 in advance. Then, the communication confirmation packet transmitter 110 encrypts the account and the user password with the public key acquired from the authentication server 140. Furthermore, the communication confirmation packet transmitter 110 encrypts the PING password with the public key acquired from the authentication server 140.

<Packet for confirming communication: Preparation in advance>
The communication confirmation packet transmitter 110 sets a password in the communication confirmation agent 130 via the authentication server 140.
Specifically, as shown in FIG. 5, the communication confirmation packet transmitter 110 requests the authentication server 140 to perform authentication, and registers the PING password in the authentication server 140. In this case, the communication check packet transmission unit 110 makes an authentication request with the public key encrypted (Account: Children, user password: Namonakiuta) and the authentication server 140 with the public key encrypted (PING password: Innocent World) is registered (step S13).

<Authentication server: Authentication>
The authentication server 140 confirms the legitimacy of the communication check packet transmitter 110 according to the following. That is, the authentication server 140 decrypts the encrypted account / user password with the secret key upon authentication request, and performs authentication to be collated with the account list 260 (see FIG. 6) (step S14).
If the verification matches, the authentication server 140 sends (PING password: Innocent World) to the connectivity confirmation agent 130 (step S15).
The communication confirmation agent 130 registers (PING password: Innocent World) transmitted from the authentication server 140 for PING password registration (step S16).
As described above, the communication confirmation packet transmitter 110 sets the password in the communication confirmation agent 130 via the authentication server 140.

<Communication confirmation agent: Password registration>
The communication confirmation agent 130 registers the notified PING password in the PING password list 270 provided for itself.
FIG. 7 is a diagram showing the PING password list 270. As shown in FIG. As shown in FIG. 6, the PING password list 270 stores the notified PING password ("Innocent World").
After registering the notified PING password in the PING password list 270, the communication confirmation agent 130 returns registration completion OK to the communication confirmation packet transmitter 110 (step S17).

[Identify a suspected failure point]
Next, identification of a fault suspected place will be described.
<Overview>
As shown in FIG. 1, when a silent failure occurs or the like, the network administrator 16 (network management apparatus) transmits a connectivity confirmation packet 200 (see FIG. 2) to identify a suspected place. A password 230 is set in the ICMP message 222 of the communication confirmation packet 200. The communication confirmation packet transmitter 110 of the network communication confirmation system 100 transmits the communication confirmation packet 200 to the IP network 10.
As shown in (1) of FIG. 1, the communication confirmation packet transmitting unit 110 transmits the communication confirmation packet 200 to the IP network 10.
As shown in (2) of FIG. 1, the communication confirmation agent 130 collates the received communication confirmation packet 200 with the password stored in advance in the PING password list 270 (see FIG. 7).
As shown in (3) of FIG. 1, the agent 130 for checking connectivity opens the access list (sets the access list to packet passing), as shown in (4) of FIG. Then, the communication confirmation packet 200 is transferred.
As shown in (5) of FIG. 1, the communication confirmation agent 130 closes the access list after receiving the response of the communication confirmation packet 200 from the communication confirmation packet transmission destination (not shown) (does not pass the access list) Setting) Perform operation.

<Detailed description>
FIG. 8 is a control sequence diagram in the case of identifying a failure suspected place.
The communication confirmation packet transmission unit 110 transmits the communication confirmation packet 200 (see FIG. 2) to the IP network 10 (see FIG. 1) when identifying the suspected failure point. The communication confirmation packet 200 is relayed by the routers 11 and 12 (see FIG. 1) and transmitted to the FW 120 (step S21).
The FW 120 includes a routing (path control) unit 121 and performs routing (path control). The routing unit 121 of the FW 120 issues a PING password authentication request (here, PING password: Innocent World) to the connectivity confirmation agent 130 (step S22).

The communication confirmation agent 130 performs password authentication (step S23). Specifically, the communication confirming agent 130 collates the password 230 extracted from the ICMP message 222 (see FIG. 2B) of the communication confirming packet 200 with the PING password list 270 (see FIG. 7) to obtain a password. Perform authentication. In the example of FIG. 8, since the password 230 “Innocent World” extracted from the ICMP message 222 is registered in the PING password list 270, the passwords match.
The communication confirmation agent 130 returns an authentication OK to the routing unit 121 of the FW 120 (step S24).

The routing unit 121 of the FW 120 changes the access list according to the collation of the connectivity confirmation agent 130 (step S25). In this case, since the collation matches, the access list is set to pass packets. By changing the access list, bidirectional communication (ICMP) between the transmission source address and the transmission destination address of the communication confirmation packet 200 is enabled.
The routing unit 121 of the FW 120 manages the transmission destination address (step S26). Specifically, the routing unit 121 of the FW 120 acquires the transmission destination address of the communication confirmation packet 200 from the transmission destination address list 280 (see FIG. 9) and manages it.
FIG. 9 is a diagram showing a transmission destination address list 280 which manages packet transmission destinations. As shown in FIG. 9, the transmission destination address list 280 registers the IP address (for example, “10.1.1.1”) of the transmission confirmation packet transmission destination.

As shown in FIG. 8, the routing unit 121 of the FW 120 transmits a connectivity confirmation packet 200 (see FIG. 2) to the connectivity confirmation packet destination (here, “10.1.1.1”) 150 registered in the destination address list 280. Are transferred (step S27). The communication confirmation packet 200 is transmitted to the communication confirmation packet transmission destination 150 (step S28).
The communication check packet transmission destination 150 returns a response to the communication check packet 200 to the routing unit 121 of the FW 120 (step S29).

The routing unit 121 of the FW 120 confirms and deletes the transmission destination address (step S30). Specifically, the routing unit 121 collates the transmission source address and the transmission destination address list when receiving the response of the connectivity confirmation packet 200, and if they match, returns the access list to the original after packet transmission, and transmits the transmission destination address. Remove an address from the list.
The routing unit 121 of the FW 120 returns a response to the communication confirmation packet 200 to the communication confirmation packet transmitting unit 110 (step S31).
The routing unit 121 of the FW 120 changes the access list to a setting for not passing the packet (step S32).

As described above, the network continuity check system 100 (see FIG. 1) according to the present embodiment transmits the continuity check packet 200 to which the password 230 (see FIG. 2) is added onto the IP network 10. A packet transmission unit 110, an FW 120 installed on the IP network 10 and operating according to an access list for setting transmission of packets to pass or not to pass, communication provided in the FW 120 to execute continuity check control of the FW 120 The confirmation agent 130 and the authentication server 140 for authenticating the legitimacy of the communication confirmation packet transmitter 110 between the communication confirmation packet transmitter 110 and the communication confirmation agent 130 are provided. The communication confirmation packet transmitting unit 110 sets a password in advance in the communication confirmation agent 130 via the authentication server 140.
When identifying the suspected failure point, the communication confirmation packet transmission unit 110 transmits the communication confirmation packet 200 onto the IP network 10. The communication confirmation agent 130 collates the password assigned to the received communication confirmation packet 200 with the password set in advance, and if it matches, sets the access list to packet passing, and the communication confirmation packet 200. Are transferred to the destination packet 150 for communication confirmation. Then, after receiving the response of the connectivity confirmation packet 200 from the connectivity confirmation packet transmission destination 150, the connectivity confirmation agent 130 performs an operation of setting the access list not to pass the packet.

In this way, when a suspected failure point is identified when a silent failure occurs or the like, the setting of the FW 120 is dynamically made on demand only by transmitting the connectivity confirmation packet 200 to which the password 230 is assigned. You can change the list). As a result, even when the FW 120 exists in the route, the network administrator 16 or the like does not have to specify the location of the FW 120, and the network administrator 16 or the like changes the setting (access list) of the FW. It is possible to reduce the time taken to identify the suspected part of the failure.
Also, since authentication is performed using the password 230 assigned to the communication confirmation packet 200, there is resistance against packet spoofing.

  Further, in the present embodiment, the communication confirmation packet 200 is a packet for executing a ping or traceroute command, and the password 230 attached to the communication confirmation packet 200 is set in the ICMP message 222 of the IP datagram 210. .

  In this way, a password can be assigned to the connectivity confirmation packet for executing the ping or traceroute command, which is a basic control protocol in the TCP / IP protocol, and is applied to the IP network 10 generically. be able to.

Of the processes described in the above embodiment, all or part of the process described as being automatically performed may be manually performed, or the process described as being performed manually. All or part of them can be automatically performed by a known method. In addition to the above, the processing procedures, control procedures, specific names, and information including various data and parameters shown in the above documents and drawings can be arbitrarily changed unless otherwise specified.
Further, each component of each device illustrated is functionally conceptual, and does not necessarily have to be physically configured as illustrated. That is, the specific form of the dispersion and integration of each device is not limited to that shown in the drawings, and all or a part thereof is functionally or physically dispersed in any unit depending on various loads, usage conditions, etc. It can be integrated and configured.

  Further, each of the configurations, functions, processing units, processing means, etc. described above may be realized by hardware, for example, by designing part or all of them with an integrated circuit. Further, each configuration, function, etc. described above may be realized by software for a processor to interpret and execute a program that realizes each function. Information such as programs, tables, and files for realizing each function is a memory, a hard disk, a recording device such as an SSD (Solid State Drive), or an IC (Integrated Circuit) card, an SD (Secure Digital) card, an optical disk, etc. It can be held on a recording medium.

DESCRIPTION OF SYMBOLS 10 IP network 11, 12, 13, 14 Router 100 Network continuity check system 110 Packet transmission part for continuity check 120 FW
121 Routing Unit 130 Communication Check Agent 140 Authentication Server 200 Packet for Communication Check 210 IP Datagram 212 IP Payload 221 ICMP Header 222 ICMP Message 230 Password 250 FW Address List 260 Account List 270 PING Password List 280 Destination Address List

Claims (3)

A communication confirmation packet transmission unit for transmitting a predetermined communication confirmation packet to which a password is assigned on the network;
FW (firewall) installed on the network and operating according to an access list that sets transmitted packets not to pass or to pass through;
A communication confirmation agent that is provided to the FW and executes communication confirmation control of the FW;
The communication confirmation packet transmission unit and an authentication server for authenticating the validity of the communication confirmation packet transmission unit between the communication confirmation agent;
The communication confirmation packet transmission unit
Set a password in advance to the connectivity check agent via the authentication server,
When identifying a suspected fault,
The communication confirmation packet transmission unit
Sending the connectivity confirmation packet onto the network;
The communication confirmation agent is
The password attached to the received communication confirmation packet is collated with the previously set password, and if they match, the access list is set to packet passing, and the communication confirmation packet is the communication confirmation packet Forward to destination,
A network communication confirmation system, which performs an operation of setting the access list not to pass the packet after receiving a response of the communication confirmation packet from the communication confirmation packet transmission destination. The connectivity confirmation packet is a packet for executing a ping or traceroute command,
The network communication confirmation system according to claim 1, wherein the password assigned to the communication confirmation packet is set in an IP datagram ICMP message. A communication confirmation packet transmission unit for transmitting a predetermined communication confirmation packet to which a password is assigned on the network;
FW (firewall) installed on the network and operating according to an access list that sets transmitted packets not to pass or to pass through;
A communication confirmation agent that is provided to the FW and executes communication confirmation control of the FW;
A network connectivity confirmation method for a network connectivity confirmation system, comprising: an authentication server that authenticates the legitimacy of the communication confirmation packet transmitter between the communication confirmation packet transmitter and the communication confirmation agent; In the packet transmitter,
Setting a password in advance to the communication confirmation agent via the authentication server;
When identifying a suspected fault,
In the communication confirmation packet transmission unit,
Sending the connectivity confirmation packet onto the network;
In the communication confirmation agent,
The password attached to the received communication confirmation packet is collated with the previously set password, and if they match, the access list is set to packet passing, and the communication confirmation packet is the communication confirmation packet Forward to destination,
A method according to any one of the preceding claims, further comprising the step of setting the access list not to pass through the access list after receiving a response to the connection confirmation packet from the communication confirmation packet destination.

Images