TWI396144B - System and method for controlling network usage rights in attendance state - Google Patents

Description

System and method for controlling network usage rights by attendance status

The system and method for controlling the use rights of the network in the attendance state are the system and method for controlling the use rights of the network, in particular, the method for opening the use permission of the Internet by using the record of employee attendance, and utilizing the network authority The controller sends an Address Resolution Protocol (ARP) packet that blocks the computer connection, so that the computer cannot connect to the Internet to ensure the security rights of the Internet.

The familiar Internet access control is mostly used to set up a proxy server (porxy server) inside the company. The employee needs to connect to the Internet through the proxy server. The proxy server will ask the employee's account password for authentication. Authentication will not be able to connect to the Internet, but this method has its shortcomings. First, the personal account password is easily stolen or cracked. Second, the proxy server only controls the specific network connection (such as port 80). That is, only the packets using the HyperText Transfer Protocol (HTTP) are controlled, and the control of other network ports depends on the firewall.

It can be seen that there are still many shortcomings in the above-mentioned methods of use, which is not a good design, but needs to be improved.

In view of the shortcomings derived from the above-mentioned conventional methods, the inventor of the present invention has improved and innovated, and after years of painstaking research, he finally succeeded in researching and developing the device and method for controlling the use of the network in the attendance state.

The object of the present invention is to provide a system and method for controlling network usage rights in an attendance state, which is to improve the current method of using a proxy to control a user's connection to the Internet, and the account password is easily stolen.

Another object of the present invention is to improve the shortcomings of the prior art that only the specific network connection is controlled, and can effectively block the network of the computer device that does not have the right to use the Internet without adding a new network switching device. The right to use the road, the unlicensed computer can not connect to the Internet through any connection.

The system and method for achieving the use rights of the attendance state control network for achieving the above object is to use the record of the employee's attendance as the basis for opening or not the network device authority of the computer device to which it belongs, and the network authority control server timing execution bit. ARP request to obtain a list of IP and MAC addresses of all computers currently booted in the local area network; if it is found to be a computer device that does not have access to the Internet, the network rights control server will continue Sending an address resolution agreement (ARP reply), the physical address of the gateway in the target computer address interpretation agreement table (ARP table) is changed, causing the target computer to be unable to access the Internet; On the other hand, if the computer is a legitimate Internet-accessible computer, the network authority control server will send an ARP reply to change the physical address of the gateway in the target computer ARP table back to the correct value to open its connection to the Internet. .

Please refer to FIG. 1 , which is a system architecture diagram of a system and method for controlling network usage rights in an attendance state according to the present invention. The present invention uses an attendance card reader 1 to read a user's IC card and obtain an employee identification number. The employee's commute time is recorded through the attendance data server 2, and the network control server 3 will determine whether to provide the employee's computer access to the internet for the attendance data. permission. The network authority control server 3 includes the IP and MAC corresponding data registered by the employee, and combined with the log-on time recorded by the attendance data server 2, a user attendance database can be generated. The network access control server 3 will periodically send an ARP request to find out all the computers that are currently powered on under the company's network segment, and compare them with the IP and MAC of the user attendance database. If the IP or MAC of the employee is not found, Appears in the ARP scan list, the network access control server 3 will send the ARP packet, change the physical address of the ARP gateway of the target computer, so that the computer can not find the correct Gateway MAC and can not access the Internet. To achieve the purpose of blocking the computer.

FIG. 2 is a flow chart of the device and method for controlling the use of the network by the attendance state, and step 101 is for the employee to perform the check-in and check-out with the IC card; then, step 102, the attendance data server actively collects the employee's commute time record. Step 103: The network authority control server periodically executes the ARP request, and obtains the IP and MAC list of all the computers currently booted in the local area network; then, step 104, the network authority control server targets the user attendance database and At present, all the computers that are turned on are compared. If it is found that the computer of the non-attendor is turned on, the process proceeds to step 105, and the network authority control server will continuously send the ARP reply to change the physical address of the gateway in the target computer ARP table. The target computer cannot access the Internet. Otherwise, proceed to step 106 to change the physical address of the gateway in the target computer ARP table back to the correct value to make it available for Internet access.

The system and method for controlling the use of the network by the attendance state control system provided by the present invention have the following advantages when compared with other conventional technologies:

1. The present invention can combine the attendance record as a medium for allowing the employee's computer to connect to the Internet, and avoid the problems of password theft and borrowing caused by the password control of the account in the past.

2. The present invention changes the gateway entity address of an unauthorized computer through the update of the ARP table. Users can be completely banned from connecting to the Internet through any port.

2. The present invention can be applied to a regional network in an enterprise or company environment. The ARP function is a basic function of the Internet Protocol specification, so there is no replacement of the network switching device 4 architecture in the company, and only a control server needs to be installed. It is easy to achieve the effect of controlling the control of Internet access, and its economic benefits are very obvious.

The detailed description of the present invention is intended to be illustrative of a preferred embodiment of the invention, and is not intended to limit the scope of the invention. The patent scope of this case.

To sum up, this case is not only innovative in terms of technical thinking, but also has many of the above-mentioned functions that are not in the traditional methods of the past. It has fully complied with the statutory invention patent requirements of novelty and progressiveness, and applied for it according to law. Approved this invention patent application, in order to invent invention, to the sense of virtue.

1‧‧‧Attendance card reader

2‧‧‧Attendance data server

3‧‧‧Network Authority Control Server

4‧‧‧Network switching equipment (switch)

5‧‧‧PC

6‧‧‧Internet

The detailed description of the present invention and the accompanying drawings will be further understood, and the technical contents of the present invention and the functions thereof can be further understood. FIG. 1 is a system and method for controlling the use rights of the network in the attendance state according to the present invention. System architecture diagram; and Figure 2 is a flow chart of the system and method for controlling network usage rights by attendance status;

1‧‧‧Attendance card reader

2‧‧‧Attendance data server

3‧‧‧Network Authority Control Server

4‧‧‧Network switching equipment (switch)

5‧‧‧PC

6‧‧‧Internet

Claims (9)

A system for controlling the use of a network by attendance status, comprising: a. an attendance card reader, a tool for an employee to sign in and get off work; b. an attendance data server, an attendance card reader, and an employee The commute time; c. The network authority control server records the basic data of the employee and the IP and MAC of the computer to which it belongs, and has the scanning area network computer and the address resolution interpretation response (ARP reply) blocking target. The function of connecting the computer to the Internet; and d. The network switching device (Switch) is a networked device that generally conforms to the TCP/IP specification. The system for controlling the use of the network by the attendance status, as described in claim 1, wherein the attendance card reader is a device that can read employee card data and record the commute time. The system for controlling the use of the network by the attendance status, as described in claim 1, wherein the network authority control server can combine the employee's commute time recorded by the attendance data server with the employee basic data to generate A user attendance database. For example, in the system of claim 1, the system for controlling the use of the network by the attendance state, wherein the network access control server is capable of executing an ARP request, and obtaining a list of all computers currently booted in the local area network. The system for controlling the use of the network by the attendance status, as described in claim 1, wherein the network authority control server can compare the user attendance database with a list of all the computers in the local area network and can send Continuous ARP reply, blocking the ability of computers that do not have access to the Internet to connect to the Internet. For example, the system for controlling the use of the network by the attendance state as described in the first item of the patent scope, wherein the switch is a switching device that can connect to the local area network computer. A method for controlling the use of the network by the attendance state, the steps of which include: a. the employee performs the check-in and check-out with the IC card on the attendance card reader; b. the attendance data server collects and records the employee's check-in time; c The network authority control server combines the employee's commute time and employee basic data recorded by the attendance data server to generate a user attendance database, and periodically executes the ARP request to obtain all the current startups in the local area network. The IP and MAC list of the computer; d. The network authority control server compares the IP and MAC list of the user attendance database with all currently powered on computers, and if the computer of the non-attendance is found to be powered on, the network authority controls The server will continuously send the ARP reply, and the physical address of the gateway in the target computer ARP table will be changed, so that the target computer cannot access the Internet; e. If the computer belongs to a legitimate Internet-accessible computer, the network authority control servo The device will send an ARP reply to change the physical address of the gateway in the target computer ARP table back to the correct value. For example, in the method of claim 7, the method for controlling the use of the network by the attendance status, wherein the content of the user attendance database includes the basic information of the employee, the computer IP and MAC corresponding information registered by the employee, and the employee attending the work registration. Time and so on. For example, in the method of claim 7, the method for controlling the use of the network by the attendance state, wherein it is found that the computer of the non-attendance is turned on, and the network authority control server compares the IP of the computer registered by the unworked employee and The MAC corresponds to the IP and MAC list of all currently powered computers.