KR100513296B1 - Apparatus, system and method for controlling network access - Google Patents

Abstract

The present invention relates to a network management apparatus and a management system for network access control, and a network access control method using the same, wherein a probe message including network device information of the network apparatus is received from a wired or wireless network to which the network apparatus is connected. And a network interface module receiving a pseudo response message corresponding to the probe message and transmitting the same to the network, and receiving the probe message provided by the network interface module. A device information extraction module for extracting and providing the network device information included in the received probe message, the network device information provided by the device information extraction module, and searching for a storage unit in which network device information is registered; The received network Checks the presence of the device information, and if the received network device information does not exist in the storage unit, receives a search module for providing the received network device information, and the network device information provided by the search module. And an access control module for generating a pseudo response message corresponding to a probe message received from the network interface module using the received device information and providing the pseudo message to the network interface module. It features a network management device for.

Description

Network management device and management system for network access control and network access control method using same {APPARATUS, SYSTEM AND METHOD FOR CONTROLLING NETWORK ACCESS}

The present invention relates to authentication of a network device, and more particularly, to a network management apparatus and a management system for network access control and a network access control method using the same in performing authentication through a network address assignment process of a network device. will be.

In the related art, a router / switch 100 and a dynamic host configuration protocol (hereinafter, referred to as 'DHCP') server 120 as shown in FIG. 1 to control access of an IP-based network device. ), The authentication server 130, and the network device 110. The network device 110 incorporating the DHCP client broadcasts a DHCPDISCOVER message including its MAC address and host name to obtain an IP address from a DHCP server as a device to access a network. The router / switch 100 captures the DHCPDISCOVER message and transmits the DHCPDISCOVER message to the DHCP server 120. The DHCP server 120 receiving the DHCPDISCOVER message can provide the DHCPDISCOVER message within its IP pool range. Broadcast a DHCPOFFER message with an existing IP address. The network device 110 receiving the DHCPOFFER message through the router / switch 100 receives a DHCPREQUEST message including the IP address of the DHCP server 120 and the IP address of the network device 110. By broadcasting, the DHCP server 120 receives the DHCPREQUEST message via the router / switch 100 and extracts the MAC address of the network device 110 therefrom. The DHCP server 120 transmits the extracted MAC address to the authentication server 130, and the authentication server 130 checks whether the MAC address is already registered in the authentication server 130. If the MAC address is already registered, the DHCP server 120 broadcasts a DHCPACK message including an IP address and associated parameters assigned to the network device 110, and receives the DHCPACK message. ) Allows network access. If the MAC address is not registered in the DHCP server 120, the DHCP server 130 does not allow network access of the network device 110 by broadcasting a DHCPNACK message. The authentication server 130 has a data structure for managing the MAC address and IP address of the network device already registered, and receives the MAC address from the DHCP server 120 to investigate whether the MAC address is registered in the data structure It performs the function of delivering to the DHCP server (120).

FIG. 2 is a flowchart illustrating a method of authenticating a conventional network device using a DHCP server. When a network device is connected to a network, the network device requests an IP address by using a broadcast from a DHCP server in order to receive an IP address. S200). The router / switch forwards this packet to the DHCP server (S210). The DHCP server receives this message and extracts the MAC address of the network device requesting the network access included in the message (S220). The MAC address is transmitted to the authentication server to check whether the MAC address is registered (S230, S240). If the corresponding MAC address is registered in the authentication server, the DHCP server transmits the IP address and the associated c parameter to the network device requesting the IP address (S250). In addition, the assigned IP address and MAC address are transmitted to the authentication server to be registered in the data structure (S260). If the MAC address of the network device requesting the IP address is not registered in the authentication server, the IP address assignment is rejected (S70).

However, using the conventional method as shown in FIG. 1 or FIG. 2, the following problem occurs.

The prior art operates by comparing MAC addresses already registered in the authentication server to determine whether or not to assign an IP address to a network device requesting an IP address from a DHCP server. Therefore, in order to use a device whose MAC address is not registered, it is inconvenient to register the MAC address of the network device directly to the authentication server in advance. That is, if a user who is unfamiliar with computer use, such as a home network, needs to authenticate a network device that is not registered at a place away from a general housewife or authentication server, the network device cannot be easily accessed. . In addition, the existing method is applied only when a DHCP server exists in the network. When there is no DHCP server in the network, there is an AutoIP method for automatically generating an IP address in the case of IPv4, and an Autoconfiguration method for automatically generating an IP address in the case of IPv6. Can't stop

Due to these problems, the prior art requires another technical solution.

SUMMARY OF THE INVENTION The present invention has been made to solve the above problems. In the present invention, when an unauthorized network device is connected to an arbitrary network, a network administrator may allow connection of the network device using a probe message. By providing a method of determining whether or not to determine whether or not to effectively control the access of unauthorized network devices, and simplifying the process of registering network device information to authenticate the network device, we propose a method that can improve the convenience of network administrators will be.

In order to achieve the above object, a network management apparatus for network access control according to the present invention receives and provides a probe message including network device information of the network device from a wired or wireless network to which the network device is connected, and the probe Providing the network device information by using a network interface module receiving a pseudo response message corresponding to a probe message and transmitting it to the network, and the probe message provided by the network interface module. The device information extracting module, a storage unit storing network device information, and whether the network device information provided by the device information extracting module is registered in the storage unit and providing the received network device information if not registered. And the network Receives a command to register the value information to the storage unit to register the storage unit, and receives the network device information provided by the search module to the control terminal, and transmits to the control terminal, the network device from the control terminal Pseudo response message corresponding to a probe message received by the network interface module using the control terminal interface module for receiving and providing an access control command signal of the network and the network device information provided by the search module. It generates and provides to the network interface module, the access control module for receiving and providing an access control command signal from the control terminal interface module.

In addition, the network access control method according to the present invention comprises a first step of receiving and providing a probe (probe) message containing the network device information of the network device from a wired or wireless network to which the network device is connected, and provided in the first step Receiving a probe message, extracting and providing the network device information included in the received probe message; receiving the network device information provided by the second step, and receiving a network A third step of searching for a storage unit in which device information is registered, checking whether the received network device information exists, and providing the received network device information when the received network device information does not exist in the storage unit; Receiving and providing the device information provided in the third step; Receiving and muscle control command signal and a fourth step of controlling the pseudo (Pseudo) generation of a response message.

On the other hand, before the detailed description according to the present invention, look at the definition of each term provided by the present invention.

1. DHCP (Dynamic Host Configuration Protocol): A protocol that allows network administrators to centrally manage and assign IP addresses on networks within an organization.

2. Internet Protocol (IP): A protocol used to send data from one computer to another on the Internet. There are two versions of IP: version 4, IPv4 and version 6, IPv6.

3. AutoIP: Automatically assigns an IP address in IPv4. If the IP address generated by automatically generating an IP address within a given IP address range is unique in the network, the IP address is used. If the device uses the same address, it gives up using the newly created IP address and creates and uses another address.

4. Autoconfiguration: Automatically assigns IP addresses in IPv6.

5. probe message: A message sent by the broadcast method to check that the address is unique within the network before using the assigned network address.

6. ARP probe (Address Resolution Protocol probe): The process of checking whether an address is unique in the network before using it.

7. MAC Address: The address used by the MAC layer of the data link layer in a local area network, the 48-bit hardware address of the network card.

Hereinafter, a network management apparatus and a management system for a network access control and a network access control method using the same according to an embodiment of the present invention will be described with reference to the accompanying drawings.

For reference, a network address according to an embodiment of the present invention takes an IP address as an example, and a probe message will be described using an ARP probe as an example.

3 is an exemplary view showing the overall configuration according to the present invention, and is largely composed of a gateway 300, a network device 330 for requesting network access, a DHCP server 320, and a device access control management device 350. The gateway 300 transfers packets between the devices connected to the network and transfers the packets between the private network and the public network. The network device 330 requesting network access includes an AutoIP module (or Autoconfiguration) module for automatically generating an IP address when a DHCP client module is built in to obtain an IP address or a DHCP server is not available in the network. It is built in. The DHCP server 320 receives an IP address request message from the network device 330 and allocates and manages an IP address to the network device 330 when there is an assignable IP address. The device access control management device 350 detects the network device 330 newly connected to the network, checks whether the device is authorized to connect to the network, and authenticates the device if the device is not authenticated. It asks the network administrator (not shown) whether the device can obtain an IP address while the administrator makes a decision. When this device is determined to be connected to the network, it registers the MAC address of the device.

4A and 4B are exemplary diagrams showing the configuration of a module for IP address allocation in a network device according to the present invention. The network device 400 shown in FIG. 4A includes a DHCP client module 410 and an IPv4 implementation. It is composed of an AutoIP module 420, the network device 430 shown in Figure 4b is composed of a DHCP client module 440 and an Autoconfiguration module 450 implemented IPv6. As shown in FIGS. 4A and 4B, two network modules may be implemented at the same time, and only one module may be configured. 4C is an exemplary diagram illustrating an ARP packet configuration according to the present invention, in which a hardware type indicates a hardware type used in a network layer and is set to FF in the case of Ethernet. Sender HA is the hardware address of the network device requesting network access, and Sender IP is the Internet address of the network device requesting network access. Target HA is the hardware address of the destination when an ARP request occurs, and Target IP is the Internet address of the destination when an ARP request occurs.

5 is an exemplary view showing the configuration of a device access control management apparatus according to the present invention, the device access control management apparatus 350 is an ARP probe transmitted by the network device 330 to set the IP address when connecting to the network 570 Receive (probe) to extract the MAC address of this device and check whether this address is already authenticated. If the address is not authenticated, the network manager may determine whether the network device 330 is authenticated through the control terminal 560, and if the network manager 570 is determined to be connected to the network 570 by the manager at this time, the network management may be performed. The storage unit 550 of the device 350 registers the MAC address of the network device 330 and sets an IP address. However, if it is determined that the network device 330 cannot access the network 570, the access control module 530 does not allow the network device 330 to access the network 570.

The network interface module 500 serves to receive the ARP probe transmitted by the network device 330 and pseudo-seed for the ARP probe so that IP setting cannot be performed when the device is not authenticated. It sends a response message. The device information extraction module 510 extracts the MAC address of the device from the received ARP probe. The search module 520 receives the extracted MAC address and compares it with the list of MAC addresses registered in the storage unit 550 to determine whether or not the MAC address is authenticated, and if not, the access control module 530. By transmitting the MAC address to the access control module 530 generates a pseudo response message to be transmitted to the network 570 through the network interface module 500, and through the control terminal interface module 540 The authentication terminal transmits an authentication message to the control terminal 560. The control terminal interface module 540 transmits and receives an access control command signal with the control terminal 560 to determine whether to allow or deny the network connection of the network device 330 to the unauthorized device. . When the network device 330 is authorized to access the network 570, the access control module 530 causes the search module 520 to register the MAC address of the network device 330 in the storage unit 550, and the pseudo (Pseudo) Stops generating response messages. The storage unit 550 may exist inside the device access control management apparatus 350 as shown in FIG. 5, and as another embodiment, another storage unit may exist outside the device access control management apparatus 350. have. If the network device 330 is denied access to the network 570, the access control module 530 generates a pseudo response message corresponding to the probe message received by the network interface module 500. To be transmitted through the network interface module 500.

6 is an exemplary diagram illustrating an operation of performing an ARP probe according to the present invention, in which a network device 610 allocates an IP address from a DHCP server 650 by a DHCP client module 620 therein. If the DHCP server does not exist on the network, the IP address is automatically assigned by the AutoIP module or Autoconfiguration module. 6 illustrates the AutoIP module 630. The network device 610 performs an ARP (Address Resolution Protocol-RFC 826) probe procedure to check whether the address is unique in the network before using the IP address (625, 635). When the other network device sends a response indicating that the IP address is used, the network device 610 requests another IP address from the DHCP server 650 or is automatically assigned another IP address by the AutoIP module 630. If the network device 610 is authenticated, the network device 610 does not receive any response. The process of receiving an IP address from the DHCP server 650 and the process of ARP probe are repeated until a unique address is allocated in the network. You can specify the number of times to repeat this process. The AutoIP module 630 automatically generates an IP address within a range of available IP addresses when there is no DHCP server 650. The ARP probe checks whether the generated IP address is unique in the network and repeats this operation until a unique address is created. You can specify the number of times to repeat this process.

FIG. 7 is a diagram illustrating a MAC address registration checking and authentication process according to the present invention, wherein the device information extraction module 510 requests network access from an ARP probe message received from the network interface module 500. After extracting the MAC address (not shown) and transmitting the extracted MAC address to the search module 520, the search module 520 determines whether the transmitted MAC address is registered in the data structure in the storage unit 550. Check it. If it is not registered, the control terminal interface module 540 operates to allow the network administrator (not shown) to determine whether to register or not, and transmits and receives a message including an access control command to the control terminal 560. The access control command includes a command to register the MAC address or a pseudo response message to the storage unit 550. The control terminal 560 may include a wireless mobile terminal, a display device capable of operating a web application or a graphical user interface (GUI), a device visually or audibly indicating that a new device is connected to a network, and the like. The control terminal interface module 540 includes a wireless transmission / reception module for transmitting and receiving a message including an access control command with the control terminal 540, an application generation program module, and the like. The network device information provided to the network administrator in the control terminal 560 may be a MAC address, and may receive and provide the user information from a separate module for collecting user information of the network device requesting access to the network. In addition, a function for collecting user information may be added to the control terminal interface module 540. If your network administrator allows you to register, you can decide whether to register the device permanently, temporarily, or only during a specific period. This decision is registered in the storage unit 550 via the access control module 530 and the retrieval module 520, and when the network device attempts to access the same network later, access to the network is not performed without an additional authentication procedure. It becomes possible.

8A and 8B are diagrams illustrating a data structure of the MAC address storage unit according to the present invention. When the network device requesting access to the network is configured to allow access, the network administrator may authenticate the network device with an authentication form. Data structure to be able to specify. The data structures are largely member devices (800-devices authorized for permanent access), current guest devices (810-devices currently authorized to access temporarily), and peroidic guest devices (820-not currently accessible. Device is authenticated so that it can be accessed. Devices specified in the Current Guest Devices 810 are automatically deleted after a specified time for each device elapses.

9 is an exemplary view illustrating an operation process of a device access control management device for a network device that is not allowed to access the network according to the present invention. While the device is not registered, the device access is denied while waiting for authentication from the network administrator. If so, it indicates that the device sends a response to the ARP probe so that it cannot set an IP address. The access control module 530 generates a pseudo response message according to the ARP probe type received by the network interface module 500. The network interface module 500 transmits the generated pseudo response message to the network device that transmits the ARP probe. The network device receiving the pseudo response message gives up the assigned IP address, receives another IP address or generates another IP address, and then sends an ARP probe to it. This process may be repeated a predetermined number of times while authentication of the device is determined.

FIG. 10A is a flowchart illustrating a process of extracting a MAC address during operation of an ARP probe in a DHCP client-DHCP server system according to the present invention. When the DHCP client requests IP allocation from a DHCP server (S1000). The DHCP server transmits the IP address and related parameters to the DHCP client (S1010). The DHCP client performs an ARP probe process by broadcasting an ARP Request message to check whether the allocated IP is unique on the network (S1020). The network interface module of the device access control management device receives the ARP Request message (S1030), and extracts a MAC address from the received ARP Request message (S1040).

FIG. 10B is a flowchart illustrating a process of extracting a MAC address during operation of an ARP probe of IPv4 according to the present invention. When the AutoIP module automatically generates its own IP address (S1050), the AutoIP module generates ARP. The ARP probe process is performed by broadcasting a request message (S1060). The network interface module of the device access control management device receives the ARP Request message (S1070), and extracts the MAC address from the received ARP Request message (S1080).

11 is a flowchart illustrating an embodiment of a MAC address registration checking and authentication process according to the present invention. When the search module receives the MAC address extracted from the device information extraction module (S1100), the received MAC address is stored. It is checked whether or not registered in (S1110). If it is registered in the storage unit, it is terminated, but if it is not registered, the network manager executes the control terminal interface module to inform the network administrator whether to register the network device requesting network access (S1120), and the access control module is pseudo. A response message is generated (S1130). If the network administrator does not allow the access, the controller continuously generates a pseudo response message. If the network administrator permits the access, the access control module stops generating the pseudo response message (S1150) and sends the MAC address to the storage. Register (S1160).

The present invention described above is capable of various substitutions, modifications, and changes without departing from the spirit of the present invention for those skilled in the art to which the present invention pertains. It is not limited to drawing.

According to the present invention made as described above, if an unauthorized device attempts to connect to the network, it can detect and efficiently set the network administrator to allow or deny access to the device, and if the device is allowed to access Device information can be easily registered without any additional work. In particular, even if there is no DHCP server on the IP-based network as in the embodiment of the present invention, network access control is possible by IPv4 or IPv6.

1 is an exemplary view showing a configuration for a conventional network device authentication using a DHCP server

2 is a flowchart illustrating an exemplary method for authenticating a conventional network device using a DHCP server.

Figure 3 is an exemplary view showing the overall configuration according to the present invention

4A and 4B are exemplary views showing the configuration of a module for IP address allocation in a network device according to the present invention.

Figure 4c is an illustration showing an ARP probe packet configuration according to the present invention

5 is an exemplary view showing the configuration of a device access control management apparatus according to the present invention;

6 is an exemplary view showing an operation of performing an ARP probe according to the present invention.

7 is an exemplary diagram illustrating a MAC address registration checking and authentication process according to the present invention.

8A and 8B are exemplary views illustrating a data structure of a storage unit according to the present invention.

9 is an exemplary view showing an operation process of a device access control management device for a network device that is not allowed to access the network according to the present invention.

10A is a flowchart illustrating a process of extracting a MAC address during operation of an ARP probe in a DHCP client-DHCP server system according to the present invention.

10B is a flowchart illustrating an embodiment of MAC address extraction during operation of an ARP probe in IPv4 according to the present invention.

11 is a flowchart illustrating an embodiment of a MAC address registration checking and authentication process according to the present invention.

Explanation of symbols on main parts of drawing

330: network device

350: device access control management device

500: network interface module

510: device information extraction module

520: search module

530: access control module

540 control terminal interface module

550: storage unit

560: control terminal

Claims (19)

Detects a newly connected network device from a wired / wireless network to check whether the detected network device is authenticated to connect to the wired or wireless network, and if the device is not authenticated, transmits an authentication message of the network device and transmits the message. And transmitting a pseudo response message to the network device such that the network device cannot access the network while receiving a signal corresponding to the message. The method of claim 1, A network interface module for receiving and providing a probe message including network device information of the network device from a wired / wireless network to which a network device is connected, and receiving and sending a pseudo response message corresponding to the probe message to the network; A device information extraction module for extracting and providing the network device information by using the probe message provided by the network interface module; A storage unit for storing network device information; Investigate whether the network device information provided by the device information extraction module is registered in the storage unit, and if not registered, provide the received network device information and receive a command to register the network device information in the storage unit. A search module to register with the storage unit; A control terminal interface module for receiving and transmitting the network device information provided by the search module to a control terminal and receiving and providing an access control command signal of the network device from the control terminal; Using the network device information provided by the search module, a pseudo response message corresponding to a probe message received by the network interface module is generated and provided to the network interface module, and an access control command signal is received from the control terminal interface module. An access control module for receiving and providing; Network management device for network access control comprising a. The method of claim 2, The network device information is a network management device for network access control including a MAC address. The method of claim 2, The control terminal interface module is a network management device for a network access control including a wireless transmission and reception interface module capable of wireless transmission and reception with a wireless device. The method of claim 2, The control terminal interface module includes a module for generating a web application network management apparatus for network access control. The network device transmits a probe message including its network device information, and the network management device having the network device information receives the message to check whether the network device information included in the message is registered and not registered. Network access control for transmitting the authentication response message of the network device and transmitting a pseudo response message to the network device so that the network device cannot access the network while receiving a signal corresponding to the transmitted message. Network management system. The method of claim 6, A network device which transmits a probe message including network device information of its own, and receives a response message corresponding to the transmitted probe message; A network interface module for receiving and providing a probe message including the network device information of the network device from a wired / wireless network to which the network device is connected, and receiving and sending a pseudo response message corresponding to the probe message to the network; A device information extraction module for extracting and providing the network device information by using the probe message provided by the network interface module; A storage unit for storing network device information; Investigate whether the network device information provided by the device information extraction module is registered in the storage unit, and if not registered, provide the received network device information and receive a command to register the network device information in the storage unit. A search module to register with the storage unit; A control terminal interface module for receiving and transmitting the network device information provided by the search module to a control terminal and receiving and providing an access control command signal of the network device from the control terminal; Using the network device information provided by the search module, a pseudo response message corresponding to a probe message received by the network interface module is generated and provided to the network interface module, and an access control command signal is received from the control terminal interface module. Network management system for a network access control comprising a network management device including an access control module for receiving and providing. The method of claim 7, wherein And a control terminal for receiving and providing network device information transmitted from the control terminal interface module of the network management device, receiving an access control command of the network device corresponding to the provided information, and transmitting the received access control command to the control terminal interface module. Network management system for network access control. The method according to claim 7 or 8, And said network device information comprises a MAC address. The method according to claim 7 or 8, The control terminal interface module includes a wireless transmission and reception interface module capable of wireless transmission and reception with a wireless device. The method according to claim 7 or 8, The control terminal interface module includes a module for generating a web application network management system for network access control. The method of claim 8, The control terminal is a network management system for a network access control including a wireless mobile terminal. The method of claim 8, The control terminal is a network management system for network access control comprising a device for providing network device information in the form of a web page. The method of claim 8, The control terminal is a network management system for network access control comprising a device for providing network device information in the form of a graphical user interface (GUI). A first step of receiving and providing a probe message including network device information of the network device from a wired or wireless network to which a network device is connected; A second step of extracting and providing the network device information using the probe message provided in the first step; After receiving the network device information provided in the second step, checking the storage unit in which the network device information is registered, checking whether the received network device information exists, and if the received network device information does not exist, A third step of providing the received network device information; A fourth step of generating and providing a pseudo response message corresponding to the probe message received in the first step by using the network device information provided in the third step; And And a fifth step of receiving the pseudo response message provided in the fourth step and transmitting the pseudo response message to the wired / wireless network in the first step. A first step of receiving and providing a probe message including network device information of the network device from a wired or wireless network to which a network device is connected; A second step of receiving a probe message provided in the first step and extracting and providing the network device information included in the received probe message; Receiving the network device information provided in the second step, to search for a storage unit registered with the network device information to confirm the existence of the received network device information, the network device information received in the storage unit If not, a third step of providing the received network device information; and And a fourth step of receiving and providing the device information provided in the third step, and controlling generation of a pseudo response message by receiving an access control command signal of the network device. The method of claim 16, In the fourth step, the device information provided in the third step is received and provided through a wireless transmission / reception module capable of transmitting and receiving with a wireless device, and the access control command signal of the network device is received to control generation of a pseudo response message. Network access control method comprising the step of. The method of claim 16, The fourth step includes receiving the device information provided in the third step and providing the same through a web application, and receiving an access control command signal of the network device to control generation of a pseudo response message. Control method. The method according to any one of claims 15 to 18, The network device information includes a MAC address.