JP6535217B2 - Session management apparatus, session management method and program - Google Patents

Description

  The present invention relates to a session management device, a session management method, and a program.

  The Radius protocol is known as a protocol used in an authentication process to confirm whether a terminal accessing a predetermined service is a terminal of a legitimate user. In addition to the function of authenticating the user, the Radius protocol has a function of issuing an IP address to the terminal of the authenticated user, and a function of managing session information on a series of communications performed by the terminal of the authenticated user. (See, for example, Non-Patent Document 1 and Non-Patent Document 2).

ITEF RFC 2865 Remote Authentication Dial In User Service (RADIUS) IETF RFC 2866 RADIUS Accounting

  If the session information of the communication performed by the terminal is linked with the external device (distributed to the external device), the external device can use the session information as basic data when providing a new service and function. Conceivable.

  For example, it is considered that the band control function based on the contract of the user can be realized by linking the session information of the communication performed by the terminal with the band control device of the network. Further, for example, it is considered that the prepaid charging function can be provided to the user by linking the session information of the communication performed by the terminal with the prepaid charging apparatus. In addition, it may be possible to use it as charging for communication using VPN (Virtual Private Network) such as IPSec (Security Architecture for Internet Protocol), or as basic data when providing WiFi (registered trademark) service such as hotspot. .

  Here, as a method of collecting session information (user name, IP address of the terminal, etc.) of communication performed by the terminal, session information is output from these servers to the external system by customizing the Radius server or the Radius proxy server itself. Possible ways to make it possible. However, since the Radius server or the Radius proxy server plays an extremely important role of an authentication function, there is a problem that customizing the installed software itself has a high risk. Also, Radius server or Radius proxy server is often an appliance product that is difficult to customize in the first place.

  As another method, in order to collect session information of communication performed by the terminal, it is conceivable to set up a dedicated device for acquiring session information on the network path between the terminal and the Radius server. However, when a new device is introduced onto the network path, there is a problem that the network will be disconnected at the time of introduction and a problem that the number of failure points on the network path will increase. Also, if the Radius proxy server is installed on the network route, the user name included in the Radius packet may be changed in the Radius proxy server. Therefore, even if a new device is introduced on the network, there is a problem that the session information that can be collected is limited depending on the installation location of the new device.

  Yet another alternative is to collect session information from the Radius server or Radius proxy server logs. However, since it is difficult to collect session information in real time from a log, there is a problem that it is not suitable as basic data when providing services and functions with high real-time capability.

  The disclosed technology has been made in view of the above, and its object is to provide a technology capable of collecting session information of communication performed by a terminal from an authentication signal and rapidly providing it to an external device.

A session management apparatus according to the disclosed technology captures multiple types of authentication signals transmitted and received between an authentication server that performs terminal authentication and session management, and an access server connected between the terminal and the authentication server. A session management apparatus for managing a session of communication performed by the terminal, wherein the session is uniquely identified using capture means for capturing the plurality of types of authentication signals and the plurality of types of captured authentication signals. a session management means for acquiring and managing session information for identifying a transmission unit for transmitting the session information to a predetermined device, the possess in the capturing means, connected between the authentication server and the access server A predetermined authentication signal is captured among the plurality of types of authentication signals before and after the authentication proxy server And, wherein the session management means, the authentication and predetermined authentication signal captured before the proxy server, using a predetermined authentication signal captured after the authentication proxy server, acquiring the session information.

  According to the disclosed technology, there is provided a technology capable of collecting session information of communication performed by a terminal from an authentication signal and quickly providing it to an external device.

FIG. 1 is a diagram showing an example of the entire configuration of a communication network according to an embodiment. It is a figure for demonstrating the Radius packet which the session management apparatus which concerns on embodiment collects. It is a figure which shows an example of the hardware constitutions of the session management apparatus which concerns on embodiment. It is a figure which shows an example of the software configuration of the session management apparatus which concerns on embodiment. It is a figure which shows an example of a cache table. It is a figure for demonstrating the state transition of an access request cache table. It is a figure for demonstrating the state transition of an access signal cache table. It is a figure which shows an example of timeout setting information. It is a sequence diagram for demonstrating an example of the process sequence of the session management process which a session management apparatus performs. It is a flowchart which shows an example of cache table operation performed when an Access-Request packet is received in front of an authentication proxy server. It is a flowchart which shows an example of cache table operation performed when an Access-Request packet is received after an authentication proxy server. FIG. 17 is a flowchart showing an example of cache table operation performed when an Access-Accept packet or an Access-Reject packet is received. It is a flowchart which shows an example of cache table operation performed when an Accounting-Request packet is received.

  Hereinafter, embodiments will be described with reference to the drawings. In the drawings, the same components are denoted by the same reference numerals, and redundant description may be omitted. In the following description, the session management apparatus collects Radius packets transmitted / received between the terminal and the authentication server, and manages session information of communication performed by the terminal. The session management device in can also be applied to other authentication protocols.

<Overview>
(Network configuration)
FIG. 1 is a diagram showing an example of the entire configuration of a communication network according to the embodiment. The communication network according to the embodiment includes a terminal 1, an NAS (Network Access Server) 2, an authentication proxy server 3, an authentication server 4, an SW (Switch) 5a, an SW 5b, a session management device 10, and an external device. And an apparatus 11.

  The terminal 1 is a terminal used by a user to receive provision of a predetermined service. For example, a PC (Personal Computer), a portable terminal, a smartphone, a tablet, an image processing apparatus, a printer, a scanner, a projector, digital signage, or a game It is a device etc. The terminal 1 may be any device that performs communication. The predetermined service includes all services using communication, and is, for example, an Internet connection service using PPPoE (Point to Point Protocol over Ethernet (registered trademark)). The terminal 1 can receive provision of a predetermined service by accessing the NAS 2.

  The NAS 2 is a server installed at the entrance of a system that provides a predetermined service to the terminal 1. The NAS 2 is, for example, a server that receives a point-to-point protocol (PPP) connection from the terminal 1. When the NAS 2 receives an access from the terminal 1, the NAS 2 transmits a Radius packet to the authentication server 4 to start an authentication process. Also, when the NAS 2 receives from the authentication server 4 a Radius packet indicating that it has been correctly authenticated, it starts providing a predetermined service to the terminal 1, and that a communication session performed by the terminal 1 has been started. A Radius packet indicating that the session has ended is sent to the authentication server 4.

  The authentication proxy server 3 is, for example, a Radius Proxy server, and is a server that relays Radius packets transmitted from the NAS 2 to the authentication server 4. Further, the authentication proxy server 3 is connected to the plurality of authentication servers 4 and has a role of distributing the radius packet to the appropriate authentication server 4 based on the domain name which is a part of the user name included in the radius packet. When transmitting the Radius packet to the authentication server 4, the authentication proxy server 3 may delete the domain name that is a part of the user name and transmit it to the authentication server 4. In addition, when the Radius packet transmitted from the NAS 2 is an incorrect packet, the authentication proxy server 3 discards the Radius packet. The illegal packet is, for example, an attack packet or a Radius packet without an appropriate authentication server.

  The authentication server 4 is, for example, a Radius server, and has a function of performing authentication using Radius packets. The authentication server 4 also has a function of paying out an IP address used by the terminal 1, a function of managing session information of communication performed by the terminal, and the like.

  The SW 5 a is a switch installed on the network path between the NAS 2 and the authentication proxy server 3. The SW 5 a is, for example, a layer 2 switch, a layer 3 switch, a router, or a virtual switch. The SW 5 a has a mirror port, and has a function of outputting a packet flowing on the network path between the NAS 2 and the authentication proxy server 3 as it is from the mirror port.

  The SW 5 b is a switch installed on the network path between the authentication proxy server 3 and the authentication server 4. The SW 5 b is, for example, a layer 2 switch, a layer 3 switch, a router, or a virtual switch. The SW 5 b has a mirror port, and has a function of outputting a packet flowing on the network path between the authentication proxy server 3 and the authentication server 4 as it is from the mirror port.

  The session management device 10 is connected to the mirror ports of the SW 5 a and the SW 5 b, and flows in the network path between the NAS 2 and the authentication proxy server 3 in the radius packet, and between the authentication proxy server 3 and the authentication server 4. The Radius packet flowing on the network route is captured, and session information of communication performed by the terminal 1 is acquired and managed from the captured Radius packet. Also, the session management device 10 has a function of transmitting the acquired session information to the external device 11.

  Here, the session information managed by the session management apparatus 10 is information for uniquely identifying a session of communication performed by the terminal 1, and, for example, the user name of the terminal 1, the IP address of the terminal 1, and the IP of NAS2. It is an address etc.

  The external device 11 is connected to the session management device 10, and is a device that provides arbitrary services and functions using the session information notified from the session management device 10. In the present embodiment, optional services and functions provided by the external device 11 are not particularly limited, and examples thereof include a bandwidth control function and a prepaid charging function.

(Radius packet)
FIG. 2 is a diagram for explaining the Radius packet collected by the session management device according to the embodiment.

  The session management apparatus 10 includes an Access-Request packet transmitted from the NAS 2 to the authentication server 4, an Access-Accept packet and an Access-Reject packet transmitted from the authentication server 4 to the NAS 2, and an Accounting transmitted from the NAS 2 to the authentication server 4. -Collect Request packets.

  A classification code is assigned to these Radius packets. The type code is a code for uniquely identifying the type of Radius packet, and is a code defined by RFC (Request For Comments). The type codes of the Access-Request packet, Access-Accept packet, Access-Reject packet, and Accounting-Request packet are 1, 2, 3 and 4, respectively.

  The Radius packet includes a plurality of attributes as shown in FIG. The part to which "(circle)" is provided in FIG. 2 has shown the attribute contained (or possibility of being included) in various Radius packets.

  The user name of the terminal 1 is set in "User-Name". The user name of the terminal 1 includes, for example, a username portion (User1) and a domain name (@ example.com), such as “User1@example.com”. The IP address of NAS 2 is set in "NAS-IP-Address".

  In "Framed-IP-Address", an IP address to be paid out to the terminal 1 is set. Here, when a predetermined IP address (255.255.255.254) is set in “Framed-IP-Address”, the NAS 2 pays out the IP address to be paid out to the terminal 1 instead of the authentication server 4 It means that. In the following description, the fact that the NAS 2 delivers the IP address delivered to the terminal 1 instead of the authentication server 4 may be referred to as “dynamic IP address delivery” for convenience.

  In "Framed-IP-Netmask", the subnet mask of the IP address delivered to the terminal 1 is set. Here, when a subnet mask other than 255.255.255.255 (or / 32) is set in "Framed-IP-Netmask", a plurality of IP addresses are issued to terminal 1 (the use is Means allowed). For example, when "192.168.2.0" is set in "Framed-IP-Address" and 255.255.255.248 (or / 29) is set in "Framed-IP-Netmask", the terminal The IP address from 192.168.2.1 to 192.168.2.6 excluding 1 for the network address (192.168.2.0) and the broadcast address (192.168.2.7) Means to be paid out. In the following description, the fact that a plurality of IP addresses are delivered to the terminal 1 may be referred to as “multi-fixed IP address delivery” for convenience.

  If the "Framed-IP-Netmask" subnet mask is set to 255.255.255.255 (or / 32), the terminal 1 has one IP address set to "Framed-IP-Address" Means to be paid out. In the following description, the fact that one IP address is delivered to the terminal 1 may be referred to as “fixed IP address delivery” for convenience.

  “Proxy-State” is an attribute set in the Access-Request packet that has passed through the authentication proxy server 3 and an Access-Accept packet or Access-Reject packet that is the response, and is assigned by the authentication proxy server 3. The same value or character string is set in the Access-Request packet and the Access-Accept packet or Access-Reject packet that is the response thereof. Further, when transferring the Access-Accept packet or the Access-Reject packet to the NAS 2, the authentication proxy server 3 deletes the "Proxy-State" attribute set by itself.

  “Acct-Status-Type” is an attribute indicating whether the Accounting-Request packet means start of session (start of service) or end of session (end of service). If "Acct-Status-Type" is set to 1, then the Accounting-Request packet means start of session (start of service), and if "Acct-Status-Type" is set to 2, then Accounting -Request packet means end of session (end of service). In the following description, an Accounting-Request packet in which 1 is set in “Acct-Status-Type” is called “Accounting-Request (start) packet”, and 2 is set in “Acct-Status-Type”. The Accounting-Request packet being called may be called "Accounting-Request (stop) packet".

  “Acct-Session-Id” is an ID used to associate an Accounting-Request (start) packet with an Accounting-Request (stop) packet. Note that "Acct-Session-Id" can be included in the Access-Request packet.

  Each of the above attributes has an attribute number for uniquely identifying each attribute. Attribute numbers are defined by RFC. "User-Name", "NAS-IP-Address", "Framed-IP-Address", "Framed-IP-Netmask", "Proxy-State", "Acct-Status-Type", and "Acct-Session- The attribute numbers of “Id” are 1, 4, 8, 9, 33, 40 and 44, respectively.

(Operation summary)
The session management apparatus 10 includes an Access-Request packet transmitted from the NAS 2 to the authentication server 4, an Access-Accept packet and an Access-Reject packet transmitted from the authentication server 4 to the NAS 2, and an Accounting transmitted from the NAS 2 to the authentication server 4. -Capture the Request packet and store the setting value of each attribute included in the captured packet in the cache table sequentially.

  Subsequently, the session management device 10 grasps the transmission / reception state of the Radius packet between the terminal 1 and the authentication server 4 using the cache table. The session management device 10 transmits, to the external device 11, session information of communication performed by the terminal 1 when the transmission / reception state of the Radius packet and the setting value of the attribute satisfy predetermined conditions.

<Hardware configuration>
FIG. 3 is a diagram showing an example of the hardware configuration of the session management device according to the embodiment. The session management device 10 according to the embodiment includes a CPU 101, a ROM 102, a RAM 103, an HDD 104, an operation unit 105, a display unit 106, a drive device 107, and an NIC (Network Interface card) 108.

  The CPU 101 is a processor that performs overall control of the session management apparatus 10. The CPU 101 executes programs such as an operating system, an application, and various services stored in the HDD 104 or the like to realize various functions of the session management apparatus 10. The ROM 102 stores various programs, data used by the programs, and the like. The RAM 103 is used as a storage area for loading a program, a work area for the loaded program, and the like. In addition, the RAM 103 holds an in-memory database used when anonymizing processing is performed. The HDD 104 stores various information, programs, and the like.

  The operation unit 105 is hardware for receiving an input operation from a user, and is, for example, a keyboard or a mouse. The display unit 106 is hardware that performs display for the user.

  The drive device 107 reads the program from the storage medium 109 in which the program is recorded. The program read by the drive device 107 is installed in, for example, the HDD 104. The NIC 108 is a communication interface for connecting the session management device 10 to a network and transmitting and receiving data.

  The storage medium 109 refers to a non-transitory storage medium. Examples of the storage medium 109 include a magnetic storage medium, an optical disc, a magneto-optical storage medium, and a non-volatile memory.

<Software configuration>
FIG. 4 is a diagram showing an example of the software configuration of the session management device according to the embodiment. The session management device 10 includes a capture unit 201, a session management unit 202, a temporary storage unit 203, a storage unit 204, a session information notification unit 205, and a signal transmission unit 206. The session management unit 202 further includes an access request processing unit 211, an access signal processing unit 212, and an accounting signal processing unit 213.

  Each of these means may be realized by processing that one or more programs installed in the session management device 10 cause the CPU 101 to execute. Also, the session management device 10 uses the temporary storage unit 203. The temporary storage unit 203 is, for example, an in-memory database, and can be realized using the RAM 103. Also, the session management device 10 uses the storage unit 204. The storage unit 204 can be realized by using a storage device connected to the ROM 102, the RAM 103, the HDD 104, or the session management apparatus 10 via a network.

  Among the IP packets transmitted from the SW 5 a and the SW 5 b, the capture unit 201 is a UDP packet, a packet whose source address or destination address of the IP header is the IP address of the authentication proxy server, destination port number of the UDP header is 1645 or 1646. , 1812 and 1813, and packets having a Radius header type code of 1, 2, 3 or 4 are collected. Also, the capture unit 201 discards packets (such as TCP packets) that do not satisfy some of the conditions, without collecting them. The capture unit 201 also has a function of recognizing whether the captured IP packet is an IP packet transmitted from the SW 5 a or an IP packet transmitted from the SW 5 b.

  The session management unit 202 stores the setting value of the attribute included in the Radius packet collected by the capture unit in the cache table corresponding to each Radius packet, and, using the cache table, between the terminal 1 and the authentication server 4 Understand the sending and receiving status of Radius packet in. In addition, the session management unit 202 confirms the validity period of each record stored in the cache table based on the timeout setting information stored in the storage unit 204, and the validity period of each record is the timeout setting information. If the set effective period has been exceeded, the record is deleted from the cache table.

  The temporary storage unit 203 stores an access request cache table, an access signal cache table, and an accounting signal cache table. Here, specific examples of the access request cache table, the access signal cache table, and the accounting signal cache table will be described using FIGS. 5 to 7.

  FIG. 5 is a diagram showing an example of the cache table. First, a specific example of the access request cache table will be described. FIG. 5A shows an example of the access request cache table. As shown in FIG. 5A, the access request cache table includes the “management ID” column, the “state” column, the “user-name” column, the “NAS-IP-Address” column, and the “Proxy- It has a "State" column, an "Acct-Session-Id" column, and a "generation date" column.

  The “management ID” column stores an ID for uniquely identifying each record of the access request cache table. The “state” column stores information for managing the state transition of the captured Access-Request packet. In the "User-Name" column, "NAS-IP-Address" column, "Proxy-State" column, and "Acct-Session-Id" column, the setting value of each attribute included in the captured Access-Request packet Is stored. The "generation date" column stores the date when the record was created.

  The access request cache table is used to obtain the “User-Name” attribute included in the Access-Request packet before passing through the authentication proxy server 3 among the Access-Request packets that have passed through the authentication proxy server 3. The access request cache table is also used to prevent duplicate Access-Request packets from being processed when the Access-Request packet is retransmitted for some reason.

  As described above, the authentication proxy server 3 may delete the domain name part of the user name set in the “User-Name” attribute of the Access-Request packet. Specifically, for example, when the user name set in the "User-Name" attribute is "User1@example.com", the authentication proxy server 3 determines the user set in the "User-Name" attribute. The name may be rewritten as "User1". Therefore, the session management device 10 captures an Access-Request packet before and after the authentication proxy server 3 to confirm that the Access-Request packet has passed through the authentication proxy server 3, and before passing through the authentication proxy server 3. The user name including the domain name is acquired from the "User-Name" attribute included in the Access-Request packet of

  FIG. 6 is a diagram for explaining state transition of the access request cache table. Information for managing state transitions stored in the “state” column of the access request cache table will be specifically described with reference to FIG.

  “A-S0” indicates an initial state before receiving an Access-Request packet. Since "A-S0" is in the initial state, "A-S0" is never set in the "state" column of the access request cache table.

  Then, when the Access-Request packet transmitted from SW5a installed in front of the authentication proxy server 3 is captured, the state of "A-S0" changes to "A-S1". In this state, when the Access-Request packet passing through the authentication proxy server 3 is captured by the SW 5b installed after the authentication proxy server 3, the state of "A-S1" transitions to "A-S3" .

  On the other hand, if the reverse of the received packet occurs for some reason, and the Access-Request packet transmitted from the SW 5b installed after the authentication proxy server 3 is first captured, the state of “A-S0” is “A Transition to "-S2". In this state, when an Access-Request packet transmitted from the SW 5a installed in front of the authentication proxy server 3 is received, the state of "A-S2" transitions to "A-S3".

  Subsequently, when the states of "A-S1", "A-S2" and "A-S3" continue and the valid period has elapsed (when time-out occurs), these states return to "A-S0". When the state of "A-S1" continues and the valid period elapses, for example, the Access-Request packet is an invalid packet etc., and the Access-Request packet is discarded by the authentication proxy server 3, etc. The case is assumed. When the state of "A-S2" continues and the valid period elapses, for example, when the Access-Request packet mirrored by the SW 5a is missing and is not captured by the session management apparatus 10 for some reason Etc. are assumed.

  Next, a specific example of the access signal cache table will be described. FIG. 5B shows an example of the access signal cache table. As shown in FIG. 5 (b), the access signal cache table includes a "management ID" column, a "state" column, a "user-name" column, a "NAS-IP-Address" column, and a "framed-" column. It has an IP-Address "column, a" Framed-IP-Netmask "column, a" Proxy-State "column, an" Acct-Session-Id "column, and a" Generation Date "column.

  In the "management ID" column, an ID for uniquely identifying each record of the access signal cache table is stored. The “state” column stores information for managing the entire state transition of the captured Access-Request packet, Access-Accept packet, or Access-Reject packet. "User-Name" column, "NAS-IP-Address" column, "Framed-IP-Address" column, "Framed-IP-Netmask" column, "Proxy-State" column, and "Acct-Session-Id" column Stores a setting value of each attribute included in the Access-Request packet and the Access-Accept packet. The "generation date" column stores the date when the record was created.

  The access signal cache table is used to obtain the IP address of the terminal 1 paid out by the plurality of fixed IP address delivery. The access signal cache table is also used to prevent duplicate packets from being reprocessed when an Access-Request packet, an Access-Accept packet, or an Access-Reject packet is resent for some reason. Be

  The session management device 10 recognizes that the Access-Accept packet corresponding to the Access-Request packet has been transmitted from the authentication server 4 using the access signal cache table. In addition, when the “Framed-IP-Netmask” attribute is set to the “Framed-IP-Netmask” attribute other than 255.255.255.255 (or / 32), the session management device 10 issues a plurality of fixed IP addresses to the terminal 1. Recognize that

  FIG. 7 is a diagram for explaining the state transition of the access signal cache table. The information for managing state transitions stored in the “state” column of the access signal cache table will be specifically described using FIG.

  "B-S0" indicates the initial state of state transition of the access signal cache table. Since "B-S0" is in the initial state, "B-S0" is never set in the "state" column of the access signal cache table.

  Subsequently, when it is detected that the Access-Request packet has passed through the authentication proxy server 3, the state of "B-S0" transitions to "B-S1". In this state, when the Access-Accept packet corresponding to the Access-Request packet is captured, the state of "B-S1" transitions to "B-S3", and the Access-Reject corresponding to the Access-Accept packet When a packet is captured, the state of "B-S1" transitions to "B-S4".

  On the other hand, if an Access-Accept packet is captured before it is detected that the received packet is reversed for some reason and the Access-Request packet passes through the authentication proxy server 3, the state of "B-S0" Transitions to "B-S2". In this state, when it is detected that the Access-Request packet has passed through the authentication proxy server 3, the state of "B-S2" transitions to "B-S3". Also, if an Access-Reject packet is received before the Access-Request packet is detected to have passed through the authentication proxy server 3 due to a reversal of the received packet for some reason, the state of “B-S0” is It changes to "B-S4".

  Subsequently, when the states of "B-S1", "B-S2", "B-S3" and "B-S4" continue and the valid period has elapsed (when time-out occurs), these states are "B Return to "-S0". When the state of “B-S1” continues and the valid period elapses, it is assumed that, for example, an Access-Accept packet or an Access-Reject packet is not transmitted from the authentication server 4 due to any reason, etc. Ru. When the state of "A-S2" continues and the effective period elapses, it is assumed that the Access-Request packet has not been detected to have passed through the authentication proxy server 3 for some reason.

  Next, a specific example of the accounting signal cache table will be described. FIG. 5C shows an example of the accounting signal cache table. As shown in FIG. 5 (c), the accounting signal cache table includes a "management ID" column, a "User-Name" column, a "NAS-IP-Address" column, and a "Framed-IP-Address" column. , “Acct-Status-Type” column, “Acct-Session-Id” column, and “generation date and time” column.

  "User-Name" column, "NAS-IP-Address" column, "Framed-IP-Address" column, "Acct-Status-Type" column, and "Acct-Session-Id" column, Accounting-Request packet Stores the setting value of each attribute included in. The "generation date" column stores the date when the record was created.

  The accounting signal cache table is used to prevent repeated processing of retransmitted packets when Accounting-Request packets are retransmitted for some reason.

  Returning to FIG. 4, the explanation will be continued. The storage unit 204 stores timeout setting information. The timeout setting information is information for setting the effective period of each record stored in the access request cache table, the access signal cache table, and the accounting signal cache table.

  FIG. 8 is a diagram showing an example of timeout setting information. The timeout setting information has a “cache table name” column, a “state” column, and a “valid period” column. The "cache table name" column stores the name of the corresponding cache table. The “state” column stores each state in the access request cache table and the access signal cache table. The “valid period” column stores the valid period associated with each of the states and the valid period associated with the accounting signal cache table. For example, as shown in FIG. 8, “3 sec” is set in the valid period corresponding to the state “A-S1”. This indicates that among the records in the access request cache table, the valid period of the record for which “A-S1” is set in the “state” column is 3 seconds. That is, a record for which "A-S1" is set in the "state" column will be deleted after 3 seconds. In addition, the effective period shown in FIG. 8 is an example to the last, and another value may be set.

  The session information notification unit 205 notifies the external device 11 of the session information of the communication performed by the terminal 1 through the signal transmission unit 206 according to an instruction of the session management unit 202.

  The signal transmission unit 206 transmits various signals according to a protocol defined with the external device 11.

<Processing procedure>
FIG. 9 is a sequence diagram for explaining an example of a processing procedure of session management processing performed by the session management apparatus. While a specific example of the Radius packet flowing on the network will be described using FIG. 9, the session management device 10 captures the Radius packet transmitted and received on the network, and notifies the external device 11 of session information according to the captured Radius packet. A series of processing steps up to will be explained concretely.

  In step S301, the NAS 2 that has received the access from the terminal 1 transmits an Access-Request packet to the SW 5a.

  In step S302, an Access-Request packet is transmitted to the session management device 10 from the mirror port of the SW 5a.

  In step S303, the capture unit 201 of the session management device 10 notifies the session management unit 202 that the Access-Request packet has been captured before the authentication proxy server 3. Subsequently, the session management unit 202 stores the setting value of each attribute included in the captured Access-Request packet in the cache table. Here, details of the processing procedure performed by the session management unit 202 in step S303 will be described.

  FIG. 10 is a flowchart showing an example of cache table operation performed when an Access-Request packet is received in front of the authentication proxy server.

  In step S401, the session management unit 202 determines that the record having the same value as the setting value of "NAS-IP-Address" and "Acct-Session-Id" among the attributes included in the captured Access-Request packet. Is checked in the access request cache table. If no record having the same value is stored, the process proceeds to step S402. If a record having the same value is already stored, the process proceeds to step S403.

  Note that before performing the processing procedure of step S401, the session management unit 202 already stores a record having the same value as the setting value of all the attributes included in the captured Access-Request packet in the access request cache table. If a record having the same value as the setting value of all the attributes is stored, it may be determined that the Access-Request packet has been resent, and the process may be ended.

  In step S402, the session management unit 202 adds a new record to the access request cache table, and each attribute ("User-Name", "NAS-IP-Address", " Store the settings of Proxy-State and Acct-Session-Id in a new record. Further, the session management unit 202 sets the generation date and time in the “generation date and time” column of the new record, sets “A−S1” in the “state” column, and ends the processing.

  The processing procedure of step S403 is processing to be performed when, for some reason, a reverse of a received packet occurs and an Access-Request packet that has already passed through the SW 5b installed after the authentication proxy server 3 has been captured. It is a procedure. In step S403, the session management unit 202 captures the Access-Request in the “User-Name” column of the record having the same value as the setting values of “NAS-IP-Address” and “Acct-Session-Id”. Update to the setting value of "User-Name" attribute included in the packet. By this updating process, even if the domain name is deleted by the authentication proxy server 3, the user name set in the "User-Name" column of the record is updated to the user name including the domain name. be able to.

  The processing procedure of step S404 to step S407 is a processing procedure performed when an inversion of a received packet occurs for some reason and an Access-Accept packet has already been captured. The processing procedures of step S404 and step S405 are the same as the processing procedures of step S504 and step S505 of FIG. Further, the processing procedure of step S406 and step S407 is the same as the processing procedure of step S605 and step S606 in FIG. Returning to FIG. 9, the description will be continued.

  In step S304, the SW 5a transmits an Access-Request packet to the authentication proxy server 3.

  In step S305, the authentication proxy server 3 transmits an Access-Request packet to the SW 5b.

  In step S306, an Access-Request packet is transmitted to the session management device 10 from the mirror port of the SW 5b.

  In step S307, the capture unit 201 of the session management device 10 notifies the session management unit 202 that the Access-Request packet has been captured after the authentication proxy server 3. The session management unit 202 performs processing for updating the “state” column of the record stored in the access request cache table. Here, details of the processing procedure performed by the session management unit 202 in step S307 will be described.

  FIG. 11 is a flowchart showing an example of cache table operation performed when an Access-Request packet is received after the authentication proxy server.

  In step S501, the session management unit 202 records, among the attributes included in the captured Access-Request packet, a record having the same value as the setting value of “NAS-IP-Address” and “Acct-Session-Id”. Is checked in the access request cache table. If a record having the same value is already stored, the process proceeds to step S 503. If no record having the same value is stored, the process proceeds to step S 502.

  Note that, before performing the processing procedure of step S501, the session management unit 202 already stores in the access request cache table a record having the same value as the setting value of all the attributes included in the captured Access-Request packet. If a record having the same value as the setting value of all the attributes is stored, it may be determined that the Access-Request packet has been resent, and the process may be ended.

  The processing procedure of step S502 is performed when, for some reason, a reverse of a received packet occurs and an Access-Request packet that has passed through the SW 5a installed in front of the authentication proxy server 3 is not captured. In step S502, the session management unit 202 adds a new record to the access request cache table, and each attribute ("User-Name", "NAS-IP-Address", " Store the settings of Proxy-State and Acct-Session-Id in a new record. Also, the session management unit 202 sets the generation date and time in the “generation date and time” column of the new record, sets “A−S 2” in the “state” column, and ends the processing.

  In step S503, the session management unit 202 updates the “state” column of the record having the same value as the setting value of “NAS-IP-Address” and “Acct-Session-Id” to “A-S3”. Note that in the process procedure of step S503, as in the process procedure of step S403, the update process of the “User-Name” column of the record is not performed. This is to prevent the domain name from being updated to the deleted user name when the domain name is deleted by the authentication proxy server 3.

  In step S 504, the session management unit 202 stores in the access signal cache table a record having the same value as the setting value of “Proxy-State” included in the Access-Request packet captured after the authentication proxy server. Check if it is If a record having the same value is already stored, the process proceeds to step S506. If a record having the same value is not stored, the process proceeds to step S505.

  In step S505, the session management unit 202 adds a new record to the access signal cache table. Also, the session management unit 202 selects each column other than the “state” column among the columns of the records of the access request cache table in which the “state” column is updated to “A-S3” in the processing procedure of step S503 (ie, Copy the setting values of “User-Name”, “NAS-IP-Address”, “Proxy-State”, “Acct-Session-Id”, “Reception Date” to the new record. Further, the session management unit 202 sets the generation date and time in the “generation date and time” column of the new record, sets “B−S1” in the “state” column, and ends the processing.

  The processing procedure of steps S506 to S508 is a processing procedure performed when an inversion of a received packet occurs for some reason and an Access-Accept packet has already been captured. Since the processing procedure of step S506 to step S508 is the same as the processing procedure of step S604 to step S606 of FIG. 12 described later, the description will be omitted. Returning to FIG. 9, the description will be continued.

  In step S308, the SW 5b transmits an Access-Request packet to the authentication server 4.

  In step S309, the authentication server 4 authenticates the terminal 1. If the authentication is successful, the authentication server 4 sends an Access-Accept packet to the SW 5 b. If the authentication fails, the authentication server 4 sends an Access-Reject packet to the SW 5 b.

  In step S310, an Access-Accept packet or an Access-Reject packet is transmitted to the session management device 10 from the mirror port of the SW 5b.

  In step S311, the capture unit 201 of the session management device 10 notifies the session management unit 202 that the Access-Accept packet or the Access-Reject packet has been captured. The session management unit 202 performs a process of adding the setting value of each attribute included in the captured Access-Accept packet to the record stored in the access signal cache table. Here, details of the processing procedure performed by the session management unit 202 in step S311 will be described.

  FIG. 12 is a flowchart showing an example of cache table operation performed when an Access-Accept packet or an Access-Reject packet is received.

  In step S601, the session management unit 202 determines whether a record having the same value as the setting value of “Proxy-State” included in the captured Access-Accept packet or Access-Reject packet is stored in the access signal cache table. Check if it is not. If a record having the same value is already stored, the process proceeds to the process procedure of step S603, and if a record having the same value is not stored, the process proceeds to the process procedure of step S602. Note that the processing procedure of step S602 is a processing procedure performed when an inversion of a received packet occurs for some reason and an Access-Accept packet is captured before an Access-Request packet is captured.

  Note that, before performing the processing procedure of step S601, the session management unit 202 accesses the access signal cache in which a record having the same value as the setting value of all the attributes included in the captured Access-Accept packet or Access-Reject packet. It is checked whether it is already stored in the table, and if it is stored in a record that has the same value as the setting value of all the attributes, it is judged that the Access-Accept packet or Access-Reject packet has been resent, and processing is performed. It may be finished.

  In step S602, the session management unit 202 adds a new record to the access signal cache table, and sets the generation date and time in the "generation date and time" column. Also, if the captured packet is an Access-Accept packet, the session management unit 202 determines each attribute (“Framed-IP-Address”, “Framed-IP-Netmask”, “Proxy- While storing the setting value of “State” in the new record, the “state” column of the new record is set to “B-S2”, and the process is ended. When the captured packet is an Access-Reject packet, the session management unit 202 sets the “state” column of the new record to “B-S4”, and ends the processing.

  In step S603, the session management unit 202 determines whether the captured packet is an Access-Accept packet or an Access-Reject packet. If the packet is an Access-Accept packet, the process proceeds to step S604. If the packet is an Access-Reject packet, the process proceeds to step S607.

  In step S 604, the session management unit 202 transmits the captured Access-Accept packet to the record of the access signal cache table having the same value as the setting value of “Proxy-State” included in the captured Access-Accept packet. Add the setting value of each included attribute ("Framed-IP-Address", "Framed-IP-Netmask"). Also, the "state" column of the record is updated to "B-S3".

  In step S605, the session management unit 202 confirms whether 255.255.255.254 is set in "Framed-IP-Address" of the record in which the "state" column has been updated in the processing procedure of step S604. Do. If a value other than 255.255.255.254 is set, it is determined that multiple fixed IP address payouts or fixed IP address payouts have been performed, and the process proceeds to step S606, and 255.255.255 If .254 is set, it is determined that dynamic IP delivery is being performed, and the process ends.

  In step S606, the session information notification unit 205 transmits a session start notification including session information to the external device 11. More specifically, the session information notification unit 205 determines that the “state” column in the access signal cache table is “B-S3” and that “Framed-IP-Address” is other than 255.255.255.254 "User-Name" column, "NAS-IP-Address" column, "Framed-IP-Address" column, "Framed-IP-Netmask" column and "Acct-Session-Id" column of the record in which the value of is set Each setting value of the column is included in the session start notification and transmitted to the external device 11.

  In step S 607, the session management unit 202 executes the “state” column of the record of the access signal cache table having the same value as the setting value of “Proxy-State” included in the captured Access-Reject packet. Update to "S4" and end the process. Returning to FIG. 9, the description will be continued.

  The processing procedure of step S312 is the processing procedure performed in step S606 of FIG.

  In step S313, the SW 5b transmits the Access-Accept packet or the Access-Reject packet to the authentication proxy server 3. The Access-Accept packet or Access-Reject packet transmitted from the authentication proxy server 3 is transmitted to the NAS 2 via the SW 5a (S314, S315).

  In step S316, when the NAS 2 receives the Access-Accept packet, it determines that the authentication is successful, and in order to notify the authentication server 4 that the communication session performed by the terminal 1 is started, Accounting-Request start) Send a packet to SW 5a. Subsequently, the SW 5a transmits the packet to the authentication proxy server 3, and the authentication proxy server 3 transmits the packet to the SW 5b (S317, S318).

  In step S319, an Accounting-Request (start) packet is transmitted to the session management device 10 from the mirror port of the SW 5b.

  In step S320, the capture unit 201 of the session management device 10 notifies the session management unit 202 that the Accounting-Request (start) packet has been captured. The session management unit 202 stores the setting value of each attribute included in the captured Accounting-Request (start) packet in the accounting signal table. Here, details of the processing procedure performed by the session management unit 202 in step S320 will be described.

  FIG. 13A is a flowchart showing an example of cache table operation performed when an Accounting-Request (start) packet is received.

  In step S701, the session management unit 202 confirms whether a record having the same value as the setting value of each attribute included in the captured Accounting-Request (start) packet is stored in the accounting signal cache table. . If a record having the same value is already stored, it is determined that the Accounting-Request (start) packet has been resent, and the process ends. If no record having the same value is stored, the process proceeds to step S702.

  In step S702, the session management unit 202 adds a new record to the accounting signal cache table, and each attribute ("User-Name", "NAS-IP-Address") included in the captured Accounting-Request (start) packet. The setting values of “Framed-IP-Address”, “Acct-Status-Type”, and “Acct-Session-Id” are stored in the new record.

  In step S703, the session information notification unit 205 transmits a session start notification including session information to the external device 11. More specifically, the session information notification unit 205 adds the "User-Name" column, the "NAS-IP-Address" column, the "Framed-IP-Address" column, and the "Acct- column" of the new record added in step S702. Each setting value of the “Session-Id” column is included in the session start notification and transmitted to the external device 11. The session information notification unit 205 may further include the setting value of the “Acct-Status-Type” column in the session start notification and transmit the notification to the external device 11. Returning to FIG. 9, the description will be continued.

  The processing procedure of step S321 is the same as the processing procedure performed in step S703 of FIG.

  In step S322, the SW 5b transmits an Accounting-Request (start) packet to the authentication server 4.

  In step S323, when the NAS 2 detects that the communication session performed by the terminal 1 has ended, in order to notify the authentication server 4 that the communication session performed by the terminal 1 has ended, Accounting-Request (stop) Send the packet to SW 5a. Subsequently, the SW 5a transmits the packet to the authentication proxy server 3, and the authentication proxy server 3 transmits the packet to the SW 5b (S324, S325).

  In step S326, an Accounting-Request (stop) packet is transmitted to the session management device 10 from the mirror port of the SW 5b.

  In step S327, the capture unit 201 of the session management device 10 notifies the session management unit 202 that the Accounting-Request (stop) packet has been captured. The session management unit 202 stores the setting value of each attribute included in the captured Accounting-Request (stop) packet in the accounting signal table. Here, details of the processing procedure performed by the session management unit 202 in step S326 will be described.

  FIG. 13B is a flowchart showing an example of cache table operation performed when an Accounting-Request (stop) packet is received.

  In step S801, the session management unit 202 confirms whether a record having the same value as the setting value of each attribute included in the captured Accounting-Request (stop) packet is stored in the accounting signal cache table. . If a record having the same value is already stored, it is determined that the Accounting-Request (stop) packet has been resent, and the process ends. If no record having the same value is stored, the process proceeds to step S802.

  In step S802, the session management unit 202 adds a new record to the accounting signal cache table, and each attribute ("User-Name", "NAS-IP-Address") included in the captured Accounting-Request (stop) packet. The setting values of “Framed-IP-Address”, “Acct-Status-Type”, and “Acct-Session-Id” are stored in the new record.

  In step S 803, the session information notification unit 205 transmits a session end notification including session information to the external apparatus 11. More specifically, the session information notification unit 205 adds the "User-Name" column, the "NAS-IP-Address" column, the "Framed-IP-Address" column, the "Acct- column" of the new record added in step S702. Each setting value of the Status-Type "column and the" Acct-Session-Id "column is included in the session end notification and transmitted to the external device 11. Returning to FIG. 9, the description will be continued.

  The processing procedure of step S328 is the processing procedure performed in step S803 of FIG.

  In step S329, the SW 5b transmits an Accounting-Request (stop) packet to the authentication server 4.

  In the processing procedure of FIG. 9, the processing procedure of step S319 to step S321 may be performed between step S316 and step S317. That is, the processing procedure of steps S319 to S321 may be performed using an Accounting-Request (start) packet transmitted to the session management device 10 from the mirror port of the SW 5a. In addition, the capture unit 201 captures Accounting-Request (start) packets transmitted from both the mirror port of SW 5a and the mirror port of SW 5b, and the session management unit 202 compares both Accounting-Request (start) packets. By doing this, it may be confirmed that the Accounting-Request (start) packet has passed through the authentication proxy server 3.

  Further, the processing procedure of step S326 to step S328 may be performed between step S323 and step S324. That is, the processing procedure of step S326 to step S328 may be performed using an Accounting-Request (stop) packet transmitted to the session management apparatus 10 from the mirror port of the SW 5a. In addition, the capture unit 201 captures Accounting-Request (stop) packets transmitted from both the mirror port of SW 5 a and the mirror port of SW 5 b, and the session management unit 202 compares both Accounting-Request (stop) packets. By doing this, it may be confirmed that the Accounting-Request (stop) packet has passed through the authentication proxy server 3.

  Further, the signal formats of the session start notification and the session end notification transmitted in the processing procedure of step S312, step S321, and step S328 may be common. That is, the signal format of the session start notification and the session end notification includes "User-Name", "NAS-IP-Address", "Framed-IP-Address", "Framed-IP-Netmask", and "Acct-Status" in advance. An area capable of storing -Type "and" Acct-Session-Id "may be provided. The interface between the session management device 10 and the external device 11 can be simplified.

<Summary, effect>
The process procedure of the session management process performed by the session management apparatus 10 has been described above. When dynamic IP delivery is performed in the authentication processing performed between the NAS 2 and the authentication server 4, the session management apparatus 10 externally transmits the session start notification at the timing at which the Access-Accept packet was captured (step S310 in FIG. 9). A session start notification is sent to the external device 11 at the timing at which the Accounting-Request packet is captured (step S319 in FIG. 9) without sending it to the device 11.

  In addition, when multiple fixed IP payouts and fixed IP payouts are performed in the authentication process performed between the NAS 2 and the authentication server 4, the session management device 10 captures an Access-Accept packet at a timing (step S310 in FIG. 9). The session start notification is transmitted to the external device 11 at the timing at which the Accounting-Request packet is captured (step S319 in FIG. 9).

  When dynamic IP address delivery is performed, the "Framed-IP-Netmask" attribute included in the Access-Accept packet indicates that dynamic IP address delivery is performed instead of the IP address actually delivered to the terminal 1. A predetermined IP address (255.255.255.254) to be shown is stored. In other words, when the session start notification is sent to the external device 11 at the timing when the Access-Accept packet is captured, the external device 11 receives incomplete session information. Therefore, when dynamic IP address delivery is performed, the session management device 10 does not transmit a session start notification to the external device 11 when capturing the Access-Accept packet. As a result, the session management device 10 can prevent the external device 11 from being notified of incomplete session information.

  On the other hand, when multiple fixed IP address delivery is performed, the “Framed-IP-Netmask” attribute indicating multiple IP addresses to be delivered to the terminal 1 is included only in the Access-Accept packet, and included in the Accounting-Request packet. It is not done. In other words, when a session start notification is sent to the external device 11 only at the timing at which the Accounting-Request packet is captured, as in the case where dynamic IP address issuance is performed, the external device 11 sends It will not be possible to know all the IP addresses issued. Therefore, when multiple fixed IP address delivery is performed, the session management device 10 once transmits a session start notification to the external device 11 at the time of capturing the Access-Accept packet. Thus, the session management device 10 can notify the external device 11 of appropriate session information.

  Further, the session management device 10 captures an Access-Request packet before and after the authentication proxy server 3 to confirm that the Access-Request packet has passed through the authentication proxy server 3 and passes through the authentication proxy server 3. User name including domain name is acquired from "User-Name" attribute included in previous Access-Request packet. As a result, even if the authentication proxy server 3 deletes the domain name of the “User-Name” attribute included in the Access-Request packet, the session management device 10 sends the external device 11 the user name including the domain name. It can be notified.

  In addition, the session management device 10 temporarily stores various captured Radius packets in a cache, and after receiving all Radius packets necessary for processing, notifies the external device 11 of session information. Thereby, the session management device 10 notifies the external device 11 of more accurate session information without notifying the external device 11 of incomplete session information even if the capture order of the Radius packet is changed. can do.

  Also, the session management apparatus 10 temporarily stores various captured Radius packets in the cache, and deletes a record in the cache after a predetermined time has elapsed. This prevents unnecessary records from being accumulated in the cache and consuming the resources of the session management device 10 when a loss of a Radius packet occurs, or when an invalid Radius packet is captured, etc. Can. Also, as a result, when the Radius packet is retransmitted, the session management device 10 can prevent the external device 11 from being notified of the session information again before the elapse of a predetermined time.

<Supplement of embodiment>
The session management device 10 is also applicable to a network environment in which the NAS 2 does not exist. For example, the present invention can be applied to a network environment where the terminal 1 transmits / receives the Radius protocol to / from the authentication server 4.

  The session management apparatus 10 can also be applied to a network environment in which the authentication proxy server 3 does not exist and the Radius protocol is directly transmitted and received between the NAS 2 (or the terminal 1) and the authentication server 4. In this case, a series of processing procedures related to the access request cache table can be omitted.

  The configuration of the session management device 10 may be a configuration realized by executing a program by a CPU (processor) in the device including a CPU and a memory, or the logic of the processing described in the present embodiment. May be realized by hardware such as a hardware circuit or the like, and programs and hardware may be mixed.

  The session management device 10 may be implemented on a virtual OS. By being implemented in the virtual OS, scalability and availability can be ensured for the session management function. In addition, the authentication proxy server 3, the SW 5a, the SW 5b, and the session management device 10 may be collectively implemented in a virtual OS. Scalability and availability can be ensured for the entire capture and session management functions.

  Although the embodiments of the present invention have been described above, the disclosed invention is not limited to such embodiments, and those skilled in the art should understand various modifications, modifications, alternatives, replacements, and the like. I will. Although specific numerical examples are used to facilitate understanding of the invention, unless otherwise noted, those numerical values are merely examples and any appropriate values may be used. The division of items in the above description is not essential to the present invention, and the items described in two or more items may be used in combination as necessary, and the items described in one item may be used in another item. It may be applied to the matters described in (unless contradictory).

  The sequences and flowcharts described in the embodiments may be rearranged as long as there is no contradiction. Although the session management device 10 has been described using a software configuration diagram for the convenience of the processing description, such a device may be realized in hardware, software, or a combination thereof. The software operated by the processor of the session management device 10 according to the embodiment of the present invention is random access memory (RAM), flash memory, read only memory (ROM), EPROM, EEPROM, register, hard disk (HDD), removable disk , CD-ROM, database, server or any other suitable storage medium.

  The present invention is not limited to the embodiments described above, and various modifications, alterations, alternatives, and replacements are included in the present invention without departing from the spirit of the present invention.

In the above embodiment, the Radius packet is an example of an authentication signal. The capture unit 201 is an example of a capture unit. The session management unit 202 is an example of a session management unit. The session information notification unit 205 and the signal transmission unit 206 are an example of a transmission unit. The external device 11 is an example of a predetermined device. The Access-Request packet is an example of a predetermined authentication signal. The setting value of the attribute included in the Radius packet is an example of information included in a plurality of types of authentication signals. The temporary storage unit 203 is an example of a first storage unit. The storage unit 204 is an example of a second storage unit. The timeout setting information is an example of the setting information.
(Section 1)
Communication performed by the terminal by capturing a plurality of types of authentication signals transmitted and received between an authentication server that performs terminal authentication and session management, and an access server connected between the terminal and the authentication server A session management device that manages a session,
Capture means for capturing the plurality of types of authentication signals;
A session management unit that acquires and manages session information that uniquely identifies the session using the captured plurality of types of authentication signals;
Transmitting means for transmitting the session information to a predetermined device;
Session management apparatus having:
(Section 2)
The session management means detects that a session of communication performed by the terminal has been started or that a session of communication performed by the terminal has ended using the captured plurality of types of authentication signals.
The transmission means transmits a session start notification signal including the session information to a predetermined device when it is detected that the communication session performed by the terminal has been started, and the communication session performed by the terminal is ended. The session management device according to claim 1, which transmits a session end notification signal including the session information to the predetermined device when it is detected.
(Section 3)
The capture means captures a predetermined authentication signal among the plurality of types of authentication signals before and after an authentication proxy server connected between the access server and the authentication server.
The session management means acquires the session information using a predetermined authentication signal captured before the authentication proxy server and a predetermined authentication signal captured after the authentication proxy server. The session management device according to Item 2 or 3.
(Section 4)
First storage means for storing information contained in the plurality of types of authentication signals;
The session management means stores information contained in the captured plurality of types of authentication signals in the first storage means, and acquires the session information using the information stored in the first storage means. The session management device according to any one of the items 1 to 3.
(Section 5)
And second storage means for storing setting information indicating a valid period of the information stored in the first storage means,
5. The session management device according to claim 4, wherein the session management means deletes the information from the first storage means when the information stored in the first storage means has passed the effective period.
(Section 6)
When the transmission means receives an accounting request signal among the plurality of types of authentication signals, the transmission means acquires the session information from attribute information included in the accounting request signal, and acquires the acquired session information as the predetermined device. The session management device according to any one of claims 1 to 5, which transmits to the
(Section 7)
The transmission unit is configured to receive an access permission signal among the plurality of types of authentication signals, and a predetermined IP address set in advance is set in attribute information included in the access permission signal. If the session information is not acquired, the session information is acquired from the attribute information included in the access permission signal, and the acquired session information is transmitted to the predetermined device. The session management device as described.
(Section 8)
Communication performed by the terminal by capturing a plurality of types of authentication signals transmitted and received between an authentication server that performs terminal authentication and session management, and an access server connected between the terminal and the authentication server A session management method performed by a session management apparatus that manages a session, the method comprising:
A capture step of capturing the plurality of types of authentication signals;
A session management step of acquiring and managing session information for uniquely identifying the session using the plurality of types of authentication signals captured;
Transmitting the session information to a predetermined device;
A session management method having:
(Section 9)
Communication performed by the terminal by capturing a plurality of types of authentication signals transmitted and received between an authentication server that performs terminal authentication and session management, and an access server connected between the terminal and the authentication server A program in a session management device that manages a session,
In the session management device,
A capture step of capturing the plurality of types of authentication signals;
A session management step of acquiring and managing session information for uniquely identifying the session using the plurality of types of authentication signals captured;
Transmitting the session information to a predetermined device;
A program that runs

1 terminal 2 NAS
3 Authentication proxy server 4 Authentication server 5a SW
5b SW
10 session management apparatus 11 external apparatus 201 capture unit 202 session management unit 203 temporary storage unit 204 storage unit 205 session information notification unit 206 signal transmission unit

Claims (10)

Communication performed by the terminal by capturing a plurality of types of authentication signals transmitted and received between an authentication server that performs terminal authentication and session management, and an access server connected between the terminal and the authentication server A session management device that manages a session,
Capture means for capturing the plurality of types of authentication signals;
A session management unit that acquires and manages session information that uniquely identifies the session using the captured plurality of types of authentication signals;
It possesses a transmitting means for transmitting the session information to a predetermined device,
The capture means captures a predetermined authentication signal among the plurality of types of authentication signals before and after an authentication proxy server connected between the access server and the authentication server.
The session management means acquires the session information using a predetermined authentication signal captured before the authentication proxy server and a predetermined authentication signal captured after the authentication proxy server.
Session management device. Communication performed by the terminal by capturing a plurality of types of authentication signals transmitted and received between an authentication server that performs terminal authentication and session management, and an access server connected between the terminal and the authentication server A session management device that manages a session,
Capture means for capturing the plurality of types of authentication signals;
A session management unit that acquires and manages session information that uniquely identifies the session using the captured plurality of types of authentication signals;
Transmitting means for transmitting the session information to a predetermined device;
The transmission unit is configured to receive an access permission signal among the plurality of types of authentication signals, and a predetermined IP address set in advance is set in attribute information included in the access permission signal. If not, the session information is acquired from the attribute information included in the access permission signal, and the acquired session information is transmitted to the predetermined device.
Session management device. The session management means detects that a session of communication performed by the terminal has been started or that a session of communication performed by the terminal has ended using the captured plurality of types of authentication signals.
The transmission means transmits a session start notification signal including the session information to a predetermined device when it is detected that the communication session performed by the terminal has been started, and the communication session performed by the terminal is ended. The session management device according to claim 1 or 2 , wherein a session end notification signal including the session information is transmitted to the predetermined device when the above is detected. First storage means for storing information contained in the plurality of types of authentication signals;
The session management means stores information contained in the captured plurality of types of authentication signals in the first storage means, and acquires the session information using the information stored in the first storage means. The session management device according to any one of claims 1 to 3. And second storage means for storing setting information indicating a valid period of the information stored in the first storage means,
5. The session management device according to claim 4, wherein the session management means deletes the information from the first storage means when the information stored in the first storage means has passed the effective period.   When the transmission means receives an accounting request signal among the plurality of types of authentication signals, the transmission means acquires the session information from attribute information included in the accounting request signal, and acquires the acquired session information as the predetermined device. The session management device according to any one of claims 1 to 5, wherein the session management device transmits the session management information. Communication performed by the terminal by capturing a plurality of types of authentication signals transmitted and received between an authentication server that performs terminal authentication and session management, and an access server connected between the terminal and the authentication server A session management method performed by a session management apparatus that manages a session, the method comprising:
A capture step of capturing the plurality of types of authentication signals;
A session management step of acquiring and managing session information for uniquely identifying the session using the plurality of types of authentication signals captured;
Possess a transmitting step of transmitting the session information to a predetermined device,
In the capture step, the session management device captures a predetermined authentication signal among the plurality of types of authentication signals before and after an authentication proxy server connected between the access server and the authentication server.
In the session management step, the session management device uses the predetermined authentication signal captured in front of the authentication proxy server and the predetermined authentication signal captured after the authentication proxy server, and uses the session information. To get
Session management method. Communication performed by the terminal by capturing a plurality of types of authentication signals transmitted and received between an authentication server that performs terminal authentication and session management, and an access server connected between the terminal and the authentication server A session management method performed by a session management apparatus that manages a session, the method comprising:
A capture step of capturing the plurality of types of authentication signals;
A session management step of acquiring and managing session information for uniquely identifying the session using the plurality of types of authentication signals captured;
A transmitting step for transmitting the session information to a predetermined device, possess,
In the transmission step, the session management apparatus is a case where an access permission signal is received among the plurality of types of authentication signals, and a predetermined one of the attribute information included in the access permission signal is predetermined. When the IP address of is not set, the session information is acquired from the attribute information included in the access permission signal, and the acquired session information is transmitted to the predetermined device.
Session management method. Communication performed by the terminal by capturing a plurality of types of authentication signals transmitted and received between an authentication server that performs terminal authentication and session management, and an access server connected between the terminal and the authentication server A program in a session management device that manages a session,
In the session management device,
A capture step of capturing the plurality of types of authentication signals;
A session management step of acquiring and managing session information for uniquely identifying the session using the plurality of types of authentication signals captured;
A transmission step of transmitting the session information to a predetermined device ;
In the capture step, the session management apparatus is made to capture a predetermined authentication signal among the plurality of types of authentication signals before and after the authentication proxy server connected between the access server and the authentication server,
In the session management step, the session information using the predetermined authentication signal captured in front of the authentication proxy server and the predetermined authentication signal captured after the authentication proxy server in the session management device. To get
Program . Communication performed by the terminal by capturing a plurality of types of authentication signals transmitted and received between an authentication server that performs terminal authentication and session management, and an access server connected between the terminal and the authentication server A program in a session management device that manages a session,
In the session management device,
A capture step of capturing the plurality of types of authentication signals;
A session management step of acquiring and managing session information for uniquely identifying the session using the plurality of types of authentication signals captured;
A transmission step of transmitting the session information to a predetermined device ;
In the transmission step, the session management apparatus receives an access permission signal among the plurality of types of authentication signals, and is predetermined in attribute information included in the access permission signal. When the IP address of is not set, the session information is acquired from the attribute information included in the access permission signal, and the acquired session information is transmitted to the predetermined device.
Program .

Images