KR100904215B1 - System and method for managing access to network based on user authentication - Google Patents

Abstract

A system and a method for managing an access to a network based on user authentication are provided to manage the access without an excessive cost by adding an enforcer with an authenticator to a network system using a LAN access device without the authenticator. A data filtering part(320) stores a MAC address table including the MAC address in which the user authentication succeeds. The data filter part determines whether the MAC address of the device to transmit the data is included in the MAC address table or the data is an EAP(Extensible Authentication Protocol) data or not. If the MAC address is included in the MAC address table, a data passing unit(350) transmits the data to a destination. An EAPOL(EAP Over LAN)/RADIUS(Remote Authentication Dial IN User Service) unit(330) converts the EAP data according to the RADIUS protocol and transmits the converted data to an authentication server if the data is the EAP data. An authentication management unit(370) adds the MAC address of a client requesting the user authentication to the MAC address table if the authentication is succeeded by the authentication server.

Description

Network access management system and method based on user authentication {SYSTEM AND METHOD FOR MANAGING ACCESS TO NETWORK BASED ON USER AUTHENTICATION}

The present invention relates to a system and method for managing and blocking access to a network based on user authentication, and more particularly, to managing and blocking access to a network at a layer 2 based on user authentication. System and method.

As the mobility of terminals using a network through a local area network (LAN) improves and a communication method for accessing a LAN network has been developed, security technologies for protecting a network have been developed.

In other words, as a terminal connecting to a LAN network acquires mobility in the form of a mobile terminal such as a laptop and the LAN connection method is developed into a wireless method, it is difficult to control and manage a client connecting to a LAN as the use of a wireless LAN increases. .

Therefore, the necessity of a method for selectively granting and managing network usage rights for a client connecting to a LAN has been raised. The representative technology is a port-based user authentication technology that conforms to the IEEE802.1X standard frame.

1 is a diagram illustrating a configuration of a local area network (LAN) system according to the prior art.

A local area network (LAN) system according to the prior art may use IEEE802.1X frames to control a user's access to the LAN.

LAN systems using the IEEE802.1X frame are only for authorized users who authenticate users when they make a physical connection to the LAN, for example, by connecting a LAN cable to a switch hub or when connecting to a wireless LAN. You can allow the connection.

The first user 10 and the second user 20 connect to a LAN network through a switch hub 11 and a wireless LAN access point (AP) 21.

The switch hub 11 or the wireless LAN AP 21 serves as an authenticator according to the IEEE802.1X standard in the process of connecting the first user 10 or the second user 20 to the LAN network, respectively. .

That is, when there is a request for connection to the LAN network from the first user 10 or the second user 20, the switch hub 11 or the wireless LAN AP 21 receives the first user 10 from the authentication server 30. Or confirms the authority of the second user 20, permits the authenticated user to connect to the LAN, and rejects the communication packet of the user who fails authentication to access the LAN.

The authenticated first user 10 or second user 20 can access a LAN network and can access the Internet through an internet router 40.

The IEEE802.1X technology for controlling a LAN connection according to the prior art provides a function for allowing a connection to a LAN network after authenticating a user correctly, but a network device, for example, a switch, used for a user's physical connection. The hub or wireless LAN AP must be equipped with the capabilities of the IEEE802.1X authenticator.

In this case, the process of applying IEEE802.1X is basically the same between the wired connection through the switch hub and the wireless connection through the wireless LAN AP.

In addition, IEEE802.1X cannot control additional access to a section on a particular LAN once the user has been authenticated and connected to the LAN network.

In addition, when a LAN connection device equipped with an IEEE802.1X authenticator and an unsupported device are mixed, it is not possible to perform connection management through user authentication as a whole. This is because IEEE802.1X is intended to protect the entire LAN by controlling access to the LAN at the second layer. Therefore, all LAN access devices must be replaced with LAN access devices supported by the IEEE 802.1X authenticator. In other words, when only some user clients are managed, not all user clients connected through the LAN connection device on the LAN network system, the entire LAN system is exposed to risk.

Therefore, the conventional LAN system must be constructed such that all LAN connection devices simultaneously support the IEEE802.1X authenticator function. And even if some LAN access devices do not support the IEEE802.1X authenticator function, such LAN access devices must be replaced with devices that support the IEEE802.1X authenticator function, thereby increasing the cost.

In addition, when the user authentication fails and cannot be connected to the network, the failed user cannot access the LAN network itself in any form, and thus cannot manage exception processing online via the network.

In addition, the user client supporting the existing IEEE802.1X frame operates only when the LAN access device supports the IEEE802.1X authenticator. Therefore, there is a need for an auxiliary function capable of authenticating a user even when the LAN access device does not perform the IEEE802.1X authenticator function.

In addition, when accessing a LAN network system through a LAN access device according to the related art, physical limitations may occur due to the number of physical ports, for example, a switch hub port, to connect to a LAN network system. The number of clients is limited.

2 is a diagram illustrating a protocol connection of a local area network (LAN) system according to the prior art.

The interval between the user client 12 and the LAN access device 13 corresponds to a layer 2 corresponding to the data link layer of the OSI model. The user client 12 and the LAN access device 13 correspond to an EAP ( Send and receive extensible authentication protocol (EAPOL) data from each other according to EAPOL (EAP over LAN) standard.

In addition, a section between the LAN access device 13 and the authentication server 30 corresponds to layer 3, and the LAN access device 13 and the authentication server 30 are based on TCP / IP RADIUS (remote). authentication dial in user service) Encapsulates EAP data in RADIUS packets according to protocol specifications and transmits and receives each other.

User client 12 may include a network terminal, such as a desktop, a notebook, or the like. The user client 12 may communicate with the LAN access device 13 mounted in the LAN access device 13 on the layer 2 using the authentication information provided from the user through the mounted authentication agent.

The LAN connection device 13 transmits and receives data of the EAP standard between the user client 12 and the authentication server 30. The authentication server 30 authenticates the user and transmits the result to the LAN connection device 13, and the LAN connection device 13 may permit or block the connection of the user agent 12.

In this case, the section between the user client 12 and the LAN connection device 13 operates in the second layer as described above and directly transmits EAP data according to the EAPOL (EAP Over LAN) standard.

In addition, the interval between the LAN access device 13 and the authentication server 30 conforms to the RADIUS protocol standard operating on the third layer (TCP / IP), and can transmit by encapsulating EAP data in the RADIUS packet.

An embodiment of the present invention is a connection management based on user authentication in a network system using a LAN access device without an authenticator function or using a LAN access device with an authenticator function and a LAN access device without an authenticator function. It is intended to provide a system and method that can provide functionality.

As a technical means for achieving the above-described technical problem, a first aspect of the present invention stores a MAC address table including a MAC address of the user authentication is successful, the MAC address of the device that transmitted the data is stored in the MAC address table A data filtering unit that determines at least one of whether the data is included and whether the data is extensible authentication protocol (EAP) data, and when the MAC address is included in the MAC address table, a destination of the data. EAPOL / RADIUS conversion unit and the authentication unit for transmitting the data passing through the transmission, if the data is EAP data for user authentication, converts the EAP data according to the RADIUS protocol (remote authentication dial in user service) If authentication is successful by the server, the MAC address of the client that requested the user authentication is changed. An authentication unit that added to the MAC address table, the EAP data may provide a Four Thirds (enforcer) to manage a network connection based on the user authentication is transmitted using a protocol of the second layer (layer 2).

In addition, the second aspect of the present invention is the step of receiving data from a user client, if the data is layer 2 EAP data, converting the data into data according to the remote authentication dial in user service (RADIUS) protocol, Transmitting the converted data to an authentication server for performing user authentication, if user authentication is successful using the authentication server, storing the MAC address of the user client in a MAC address table, and the data is stored in the MAC address table When received from the user client having a MAC address stored in the, it may provide a method for managing a network connection based on user authentication comprising passing the data.

In addition, a third aspect of the present invention is an InfoSAP that receives layer 2 EAP data from a user client and converts the received EAP data according to the RADIUS protocol. And an authentication server configured to receive data and authenticate the user client using the received EAP data, wherein the information agent manages a network connection by storing a MAC address of a client for which user authentication is successful. A network connection management system based on authentication can be provided.

According to the problem solving means of the present invention described above, by adding an information sheet providing the authenticator function to a network system using a LAN connection device without the authenticator function, user authentication using an existing network system without excessive additional costs It can provide access management based on.

DETAILED DESCRIPTION Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings so that those skilled in the art may easily implement the present invention. As those skilled in the art would realize, the described embodiments may be modified in various different ways, all without departing from the spirit or scope of the present invention. In the drawings, parts irrelevant to the description are omitted in order to clearly describe the present invention, and like reference numerals designate like parts throughout the specification.

Throughout the specification, when a part is "connected" to another part, this includes not only "directly connected" but also "electrically connected" with another element in between. . In addition, when a part is said to "include" a certain component, which means that it may further include other components, except to exclude other components unless otherwise stated.

In a network access management system based on user authentication according to an embodiment of the present invention described below, EAPOL (EAP over LAN) is used as a protocol of layer 2, and RADIUS (remote) as a protocol of layer 3 authentication dial in user service) protocol is used, but is not limited thereto, and another two-layer protocol and a three-layer protocol may be used.

3 is a diagram illustrating a configuration of a network access management system based on user authentication according to an embodiment of the present invention.

The first user client 100 connects to the LAN network through the first LAN access device 110. The first LAN connection device 110 provides the IEEE802.1X authenticator function. Accordingly, the first user client 100 may be authenticated by the authentication server 400 through the first LAN access device 110 and access the LAN network or the Internet.

The second user client 200 connects to the LAN network through the second LAN access device 110 and the infoser 300. The second LAN access point 210 does not provide the IEEE802.1X authenticator function. Accordingly, the second user client 200 may be authenticated by the authentication server 400 through the informationr 300 and connected to the LAN network or the Internet.

Here, the second user client 200 and the informationr 300 communicate with each other in the second layer (layer 2), and the EAP data uses the second layer protocol (protol) for the second LAN access point 210. It may be transmitted to the informationr 300 through, for example, may be transmitted to the informationr 300 through the second LAN connection device 210 in the form of EAPOL (EAP over LAN).

However, the second user client 200 and the second LAN access point 210 do not recognize the existence of the informationr 300, and the EAPOL data in the EAPOL form is transmitted by the second user client 200, and 2 is sent to the informationr 300 located between the user client 200 and the LAN network.

The informationr 300 substitutes for authentication of the second user client 200 connected through the second LAN access device 210. The informationr 300 receives the EAP data from the second LAN access point 210 using the EAPOL protocol, and uses the received EAP data as an authentication protocol using a layer 3 protocol, for example, a RADIUS protocol. To transmit to the authentication server (400). As such, the informationr 300 may receive the EAP data using the EAPOL and transmit the EAP data to the authentication server 400 using the RADIUS protocol.

In addition, the informationr 300 receives an authentication result for the second user client 200 from the authentication server 400 and, when authenticated as a suitable user, the MAC address (media access control address) of the second user client 200. Save).

The informationr 300 receives a LAN network connection request from the second user client 200, determines whether to authenticate the second user client 200, and authenticates the second user client 200 according to the result. 2 or allow or block the connection of the second user client 200, or connect the second user client 200 to the exception processing server 500.

The informationr 300 transmits and receives EAP data with the second user client 200 or the second LAN access point 210 according to the EAPOL, and transmits and receives the EAP data with the authentication server 400 according to the RADIUS protocol.

The authentication server 400 receives an authentication request for the second user client 200 from the informationr 300, performs authentication for the second user client 200 in response to the received authentication request, and authenticates the result. To transmit to the information book (300).

When the authentication is successful by the authentication server 400, the authentication result is transmitted to the infoser 300, and the MAC address of the user client which has been successfully authenticated may be stored in the MAC address table stored in the database of the infoser 300. .

The exception processing server 500 may provide an agent necessary for authentication to the second user client 200 and provide a guide for authentication. In addition, when an unauthorized user client attempts to connect, or when the user client attempts to access a web site that requires blocking, the informationr 300 forcibly reroutes the user client to the exception handling server 500. re-routing).

4 is a block diagram showing the configuration of an informationr according to an embodiment of the present invention.

The information sheet 300 according to an exemplary embodiment of the present invention includes a data receiver 310, a data filter 320, an EAPOL / RADIUS converter 330, a RADIUS / EAPOL converter 340, and a data passer 350. ), The rerouting unit 360 and the authentication management unit 370.

The data receiver 310 receives data from an external device, for example, a user client (not shown), a LAN connection device (not shown), or an authentication server (not shown), and sends the received data to the data filtering unit 320. send. The data receiver 310 may receive data of various protocols transmitted from a device connected to a network as well as an EAPOL or RADIUS protocol.

The data filtering unit 320 analyzes the data received from the data receiving unit 310 and converts the analyzed data into the EAPOL / RADIUS conversion unit 330, the RADIUS / EAPOL conversion unit 340, the data passing unit 350, or the like. Switch to the rerouting unit 360, or drop the data of the client that is not authenticated (drop).

The data filtering unit 320 includes a MAC address table including a MAC address of a client for which user authentication is successful, a specific port set to be transmitted to the exception processing server 500, for example, a logical port, a TCP / IP port, and the like. A management MAC address table including a port table and a MAC address configured to manage traffic may be stored.

When the received data is received from the user client on which the user authentication is performed, the data filtering unit 320 forwards the received data to the data passing unit 350.

For example, when the MAC address of the user client that transmits the data is included in the MAC address table, the received data may be bypassed to the data passing unit 350.

In addition, when the received data is received from a user client on which user authentication has not been performed, the data filtering unit 320 transmits the received data to the EAPOL / RADIUS converter 330, the RADIUS / EAPOL converter 340, or the receiver. Switching to one of the re-routing unit 360, or drop the corresponding data.

If data is received from a user client on which user authentication has not been performed, the data filtering unit 320 may determine whether the received data is EAP data.

If the received data is EAP data, the data filtering unit 320 transmits the received EAP data to the EAPOL / RADIUS converter 330 or the RADIUS / EAPOL converter 340.

As defined by the IEEE802.1X standard, when data is received via EAPOL (EAP over LAN), the identification of whether it is EAP data is a multicast or unicast data frame and Ethernet of the received data. This can be determined by analyzing the Ethernet Type.

For example, the destination address of the received data is 0x0180c2000003 or the address of the InfoSpherer 300, and the Ethernet type is 0x888e, ie EAPOL, or another value defined, for example 0x88c7, i.e. a dictionary. In case of authentication, the received EAP data is regarded as an EAPOL value, and the data filtering unit 320 transmits the received EAP data to the EAPOL / RADIUS converter 330.

In addition, when data is received through RADIUS, when the destination of the received data is the informationr 300 and the received data is received from the authentication server 400, the data filtering unit 320 EAP the received data. The data is determined to be transmitted, and the received data is transmitted to the RADIUS / EAPOL converter 340.

The data filtering unit 320 receives the data received from a user client that has not performed user authentication when the data is received from a port included in a port table or requests a specific service. May be transmitted to the rerouting unit 360. As mentioned above, the port table contains logical ports such as TCP / IP ports.

For example, when the received data is data for accessing an arbitrary web page, the data filtering unit 320 may transmit the received data to the rerouting unit 360. The detailed description of the rerouting unit 360 will be described later.

As such, the data filtering unit 320 bypasses, switches, or drops the received data using a MAC address table, a port table, and a management MAC address table, not a physical port. You can do the same thing with an unlimited number.

The EAPOL / RADIUS converter 330 receives the EAP data transmitted through the EAPOL of the layer 2, converts the received EAP data, and transmits the received EAP data to the authentication server 400. That is, the EAPOL / RADIUS conversion unit 330 converts the received EAP data according to the EAPOL to comply with the RADIUS protocol, and transmits the converted EAP data to the authentication server.

As such, the EAP data transmitted by the user client or the LAN access device is transmitted to the authentication server 400 by the EAPOL / RADIUS conversion unit 330, so that authentication of an unauthenticated user client or reauthentication of an authenticated user is performed. Can be performed.

The MAC address of the user client which has been authenticated by the authentication server 400 may be stored in the aforementioned MAC address table.

The RADIUS / EAPOL converter 340 receives the EAP data from the authentication server 400, converts the received EAP data, and transmits the received EAP data to a user client or a LAN access device. That is, the RADIUS / EAPOL conversion unit 340 converts the received EAP data according to the RADIUS protocol to conform to the EAPOL, and transmits the converted EAP data to the user client.

The data passing unit 350 passes the data determined to be received from the MAC address of the client authenticated by the data filtering unit 320 to be transmitted to the destination of the data.

The rerouting unit 360 transmits the network traffic of the user client 200 that has transmitted the data received from the data filtering unit 320 to the exception processing server 500. By the exception processing server 500, the user client 200 may install an agent for using EAPOL, and may receive other warnings or guide messages.

The authentication manager 370 adds the MAC address of the authenticated user client to the MAC address table stored in the data filtering unit 320 when the authentication server 400 successfully authenticates the user client.

As described above, since the authentication management unit 370 adds the successful MAC address to the MAC address table, the successful user authentication can access the network without a separate authentication procedure.

FIG. 5 is a flowchart illustrating a flow of EAP data processing in an informationr in a network access management method based on user authentication according to an embodiment of the present invention.

In step S105, the informer receives data from the user client. The InfoSphere can receive data from various protocols, including EAPOL.

In step S110, it is determined whether the data received in step S105 is a packet for requesting allocation of an IP address. The IP address of the user client may be a dynamic IP address that is dynamically changed. In this case, the user client transmits an IP address allocation request packet to a DHCP (dynamic host configuration protocol) server for IP address assignment. Therefore, it is determined whether the data received in step S105 is such an IP address assignment request packet.

In step S115, if it is determined in step S110 that the data received from the user client is an IP address assignment request packet, the received IP address assignment request packet is sent to a DHCP server or a preset DHCP server included in the information sheet. Or to the destination set in the IP address assignment request packet. For example, when the IP address allocation request packet is a BootP packet, the IP address allocation request packet may be transmitted to the destination of the BootP packet by passing the BootP packet.

In step S111, it is determined whether the data received from the user client in step S105 is a DNS request packet for obtaining an IP address of a domain name.

In step S116, if it is determined in step S111 that the data received from the user client is a DNS request packet for obtaining an IP address of the domain name, the received DNS request packet is passed through to the DNS server. send. This allows the user client to obtain the IP address of the DNS.

In step S120, it is determined whether the MAC address of the user client that has transmitted the data received in step S105 exists in the MAC address table stored in the informationr. The MAC address table includes MAC addresses of user clients that have successfully authenticated users. Accordingly, it is determined whether the MAC address of the user client that has transmitted the data received in step S105 is included in the MAC address table, and whether the data received in step S105 is transmitted from the user client having the user authenticated MAC address. It can be determined.

In step S125, if it is determined in step S110 that the data received from the user client is not an IP address allocation request packet, it is determined whether the received data is transmitted from the management MAC address.

The InfoSphere may include a management MAC address table configured to block traffic or reroute to an exception handling server or quarantine even if the user authentication is successful. Data received by comparing the management MAC address table with the MAC address that transmitted the data It can be determined whether or not to block.

In step S130, when it is determined in step S125 that data is not received from the MAC address included in the management MAC address table, the information sheet passes the data received in step S105, and the destination of the data ( destination).

As described above, since the MAC address included in the MAC address table is a MAC address for which user authentication is successful, the informationr transmits to the destination of the data without performing user authentication on the received data.

In step S135, when it is determined in step S120 that data is received from a MAC address not included in the MAC address table, it is determined whether the data received in step S105 is received through EAPOL.

EAP data for authentication of the user client is received from the user client through the EAPOL to the InfoSphere. Therefore, when the data received in step S105 is received through the EAPOL, it may be determined that the received data is EAP data for authentication of the user client.

In step S140, when it is determined in step S135 that data has been received through EAPOL, the information convertor converts the data so that the data received in step S105 can be transmitted to the authentication server according to the RADIUS protocol. Send the converted data to the authentication server.

The authentication server receives the EAPOL / RADIUS converted data from the informationr, performs authentication on the user client, and transmits the authentication result to the informationr. If the authentication of the user client by the authentication server is successful, the MAC address of the user client which has been successfully authenticated may be stored in the MAC address table.

In step S145, if it is determined in step S135 that the data is not received via EAPOL, the data received in step S105 is transmitted from a specific protocol or a specific port or a specific service, for example It is determined whether or not to include contents requesting access to a web page.

In step S150, when it is determined in step S125 that the data is transmitted from the management MAC address or when it is determined in step S145 that the data includes a content transmitted from a specific port or request a specific service or Re-routing the data received in step S105 to an exception processing server (not shown).

As described above, the rerouted exception handling server may install an agent necessary for authentication on a client which has not yet performed user authentication, and provide a guide for authentication.

In addition, even if the user is authenticated, a warning message or the like can be transmitted to the user client set to the blocking MAC address or rerouted to an exception processing server or quarantine due to a predetermined reason, for example, illegal program installation or virus retention. .

In step S155, when it is determined in step S145 that the data does not include a content transmitted from a specific protocol or a specific port or request a specific service, the data received in step S105 is dropped ( drop) to block.

As described above, the embodiment of the present invention may be applied not only to the case where the IP address of the user client is a fixed IP address but also to a floating IP address that is dynamically changed.

If the IP address of the user client is a dynamic IP address, the informationr may include a dynamic host configuration protocol (DHCP) server or may be preset to transmit the data to a specific DHCP server.

On the other hand, the network connection management system according to an embodiment of the present invention described above operates in the second layer, but does not directly interwork with a user client like a LAN interworking device, so that the network cable connected to the user client is determined to be attached or detached. Can not.

Accordingly, the network access management system according to an embodiment of the present invention performs reauthentication for a user client through a session timeout or idle timeout, and has no response to reauthentication. In this case, the MAC address of the user client can be deleted from the MAC address table stored in the informationr's database. In addition, the user client dropped by step S155 or the user client rerouted by step S150 may attempt to authenticate by requesting the infoser to the MAC address of the corresponding client.

In the above-described embodiment of the present invention, EAP data may use EAPOL (EAP over LAN), but another two-layer protocol may be used.

One embodiment of the present invention can also be implemented in the form of a recording medium containing instructions executable by a computer, such as a program module executed by the computer. Computer readable media can be any available media that can be accessed by a computer and includes both volatile and nonvolatile media, removable and non-removable media. In addition, computer readable media may include both computer storage media and communication media. Computer storage media includes both volatile and nonvolatile, removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data. Communication media typically includes computer readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave, or other transmission mechanism, and includes any information delivery media.

Although the methods and systems of the present invention have been described in connection with specific embodiments, some or all of their components or operations may be implemented using a computer system having a general purpose hardware architecture.

The foregoing description of the present invention is intended for illustration, and it will be understood by those skilled in the art that the present invention may be easily modified in other specific forms without changing the technical spirit or essential features of the present invention. will be. Therefore, it should be understood that the embodiments described above are exemplary in all respects and not restrictive. For example, each component described as a single type may be implemented in a distributed manner, and similarly, components described as distributed may be implemented in a combined form.

The scope of the present invention is shown by the following claims rather than the above description, and all changes or modifications derived from the meaning and scope of the claims and their equivalents should be construed as being included in the scope of the present invention. do.

1 is a view showing the configuration of a local area network (LAN) system according to the prior art,

2 illustrates a protocol connection of a local area network (LAN) system according to the prior art;

3 is a diagram illustrating a configuration of a network access management system based on user authentication according to an embodiment of the present invention;

4 is a block diagram showing the configuration of an informationr according to an embodiment of the present invention;

FIG. 5 is a flowchart illustrating a flow of EAP data processing in an informationr in a network access management method based on user authentication according to an embodiment of the present invention. FIG.

Claims (10)

In the Enforcer, which manages network access based on user authentication, A MAC address table including a MAC address for which user authentication is successful, and at least one of whether the MAC address of the device that transmits the data is included in the MAC address table and whether the data is extensible authentication protocol (EAP) data Data filtering unit for determining the, A data passing unit for transmitting the data to a destination of the data when the MAC address is included in the MAC address table; An EAPOL / RADIUS conversion unit for converting the EAP data according to a remote authentication dial in user service (RADIUS) protocol and transmitting the EAP data to an authentication server when the data is EAP data for user authentication; Authentication management unit for adding the MAC address of the client requesting the user authentication to the MAC address table when the authentication is successful by the authentication server Including, The EAP data is an information server for managing a network connection is transmitted using a layer 2 protocol. The method of claim 1, The data filtering unit stores a port table including a preset port, determines whether to receive the data from a port included in the port table, The information book, A rerouting unit for rerouting the client to an exception handling server when receiving the data from a port included in the port table. More, And the data manages a network connection that is received from a MAC address not stored in the MAC address table. The method of claim 1, The data filtering unit stores a management MAC address to be managed among user authenticated MAC addresses, and determines whether to receive the data from a MAC address included in the management MAC address table. The information book, A re-routing unit for rerouting the client to an exception handling server when the data is received from the management MAC address Infoser to manage the network connection further comprising. The method of claim 2 or 3, The exception processing server is an information server for managing a network connection to provide an installation of an agent (agent) for user authentication to the user client. In the method for managing a network connection based on user authentication using an information sheet disposed between the user client and the LAN connection device, Storing the MAC address table of the user client that has successfully authenticated the user in the information sheet; Receiving data from a user client, Converting the data into data according to a remote authentication dial in user service (RADIUS) protocol, and transmitting the converted data to an authentication server performing user authentication when the data is EAP data of two layers; Adding a MAC address of the user client to the MAC address table when user authentication is successful using the authentication server; and Passing the data to the LAN access device when the data is received from a user client having a MAC address stored in the MAC address table. Network connection management method comprising a. The method of claim 5, wherein Re-routing the user client to an exception handling server when the data is received from a preset port More, The exception processing server is a network connection management method for providing an installation of the agent (agent) for authentication to the user client. The method of claim 5, wherein Passing a packet associated with an IP address assignment from the user client; Network access management method further comprising. The method of claim 5, wherein When the packet is received from the user client requesting an IP address corresponding to a domain name, passing the packet. Network access management method further comprising. In the network access management system based on user authentication, An information sheet disposed between the user client and the LAN access device and receiving EAP data of a layer 2 of data received from the user client, and converting the received EAP data according to a RADIUS protocol; An authentication server that receives EAP data according to the RADIUS protocol from the informationr and authenticates the user client using the received EAP data. Including, And the information sheet stores a MAC address of a client that has successfully authenticated a user by the authentication server in a MAC address table, and determines whether to pass data to the LAN access device based on the MAC address table. The method of claim 9, An exception handling server that is routed by the infoser and provides an agent for user authentication installed in a user client. Network access management system further comprising.

Images