JP2001211180A - Dhcp server with client authenticating function and authenticating method thereof - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide high security by equipping a DCHP server with a function of authenticating an IP-address assigned client and releasing an IP address when an unallowed client is found and a function of reporting communication rejection. SOLUTION: The DHCP server 10 when receiving requests to assign IP addresses from clients 40 and 60 checks whether or not their MAC addresses are registered in an allowed client MAC address DB 20, and allocates and records the IP addresses in an allocated-address DB while making them correspond to the MAC addresses when they are registered. Then an ARP packet is sent periodically to the IP addresses and it is checked whether or not a combination of the transmission source MAC address and the transmission source IP address in its response packet is recorded in the allocated address database, when it is recorded, a regular client is decided and when not, an irregular client is decided.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a DHCP server with a client authentication function and an authentication method therefor, and more particularly to a DHCP server which receives a request from a client connected to a network and dynamically allocates an IP address, and under the control of the DHCP server. The present invention relates to a switching hub device that controls whether communication with other network components of a client is possible, and a client authentication method thereof.

[0002]

2. Description of the Related Art DHCP (Dynamic Host)
Configuration Protocol) is a UDP protocol that can centrally manage IP addresses of systems in a network.
The server method is adopted. Normally, a DHCP server is installed for each subnet, and dynamically allocates an IP address according to a client request. As a result, the client can perform TCP / IP communication without individually setting an IP address.

[0003]

However, the above-mentioned conventional DHCP server has the advantage of dynamic allocation,
No authentication is performed for the client when assigning the P address. Therefore, once connected to the network, any client can obtain an IP address and perform communication. This is a serious security problem. In addition to obtaining a new IP address, the IP address of another legitimate client may be stolen. Even in this case, the legitimacy of the client cannot be confirmed.

[0004] In order to solve these problems, the present invention provides a DHCP server with an IP address assignment client authentication function, an IP address release notification function when an unacceptable client is found, and a communication rejection notification function to provide high security. provide.

[0005]

SUMMARY OF THE INVENTION A DHCP server with a client authentication function according to the present invention is a DHCP server for dynamically assigning an IP address in response to a request from a client connected to a network. Has an allowed client MAC address database in which the MAC address of the client is registered in advance, and an assigned address database for recording the IP address and the MAC address in association with each other, and receives a message requesting the assignment of the IP address from the client. And the source M in the message
Check whether the AC address is registered in the allowable client MAC address database, assign an available IP address only when registered, notify the client, and associate the assigned address with the MAC address. Recorded in
After the assignment of the IP address, a message requesting a reply of a response message including the MAC address of the client is periodically transmitted to the client of the IP address, and the source MAC address and the source IP in the response message are transmitted. It is configured to collate whether the combination of addresses is recorded in the allocated address database and determine whether or not the client is a client to which the IP address is properly assigned based on the collation result.

In the above configuration, if the combination of the source MAC address and the source IP address in the response message from the client is checked by the assigned address database as a result of the collation, the combination is not recorded. It is determined that the client is not a client to which the IP address is properly assigned, and the I
A configuration may be adopted in which the assignment of the P address is canceled and a forced IP address release notification message is transmitted to the client.

[0007] Alternatively, the client to which the client has been properly assigned an IP address based on the result of collation of the combination of the source MAC address and the source IP address in the response message from the client by the assigned address database. If it is determined that the MAC address is not determined, the switching hub device for connecting the client to the network may be set to not perform communication with the MAC address.

[0008] A switching hub device of the present invention accommodates a DHCP server with a client authentication function having the above configuration and a client, and the DHCP server with a client authentication function.
It has means for registering control information from the CP server, and switch means for controlling whether or not communication with other network components of the client is possible in accordance with the registered control information.

According to a client authentication method of the present invention, in a client authentication method of a DHCP server which receives a request from a client connected to a network and dynamically allocates an IP address, the client receives a message requesting the allocation of an IP address from the client. And whether the source MAC address in the message is registered in the allowable client MAC address database in which the MAC address of the client whose IP address is permitted to be assigned is registered in advance, and the IP address that can be used only when it is registered And notifies the corresponding client of the IP address, records it in the allocated address database in association with the MAC address, and periodically allocates the client to the client of the IP address after the allocation of the IP address. Sending a message requesting the return of a response message including the client's MAC address, and checking whether a combination of the source MAC address and the source IP address in the response message is recorded in the assigned address database, A step of determining whether the client is a client to which a proper IP address is assigned based on the result.

In the above step, if the combination of the source MAC address and the source IP address in the response message from the client is checked by the assigned address database as a result of the comparison, if the combination is not recorded, It is determined that the client is not a client to which the IP address is properly assigned, and the I
The method may include canceling the assignment of the P address and transmitting a forced IP address release notification message to the client.

Alternatively, the client to which the client has been properly assigned an IP address based on the result of collation of the combination of the source MAC address and the source IP address in the response message from the client by the assigned address database. If it is determined that the MAC address is not set, the switching hub device for connecting the client to the network may be set to not perform communication with the MAC address.

[0012]

DESCRIPTION OF THE PREFERRED EMBODIMENTS First, an outline of the present invention will be described.
DHCP (Dyna) with Client Authentication Function of the Present Invention
mic Host Configuration Pr
The autocol) server has a client authentication function for preventing spoofing that can occur when dynamically allocating an IP address, and is characterized by improving security. “Spoofing” means that an unauthorized client acquires an IP address as if it were a legitimate client in a network.

Next, embodiments of the present invention will be described in detail with reference to the drawings.

FIG. 1 shows a DHC according to an embodiment of the present invention.
FIG. 2 is a configuration diagram of a network using a P server. Referring to FIG. 1, a DHCP server 10 is set in a subnet, and a plurality of clients (40 and 6) connected via a transmission path including a switching HUB (hub device) 30.
(Only 0 is shown) in this network.

The permitted client M of the DHCP server 10
The AC address DB (database) 20 contains the MAC address of the client that permits IP address assignment.
In the address pool DB (database) 18, assignable IP addresses (XX.XX.XX.02) are recorded.

At present, the client 40 is a permitted client, and its MAC address is recorded in the permitted client MAC address DB 20 of the DHCP server 10,
It is assumed that an address (XX.XX.XX.01) is assigned. The client 60 is a non-permitted client, and the MAC address is not recorded in the permitted client MAC address DB 20 of the DHCP server 10.

In this state, when the DHCP server 10 receives a server search request from the client 60, the DHCP server 10
Is compared with the MAC address. If they do not match, the DHCP server 10 transmits NG information indicating that the IP address cannot be assigned to the client 60, and does not assign the IP address. However, this does not completely prevent spoofing.

Here, the procedure for obtaining an IP address will be described by taking as an example the case of the permitted client 40 that has obtained a regular IP address. After the authentication of the permitted client, the DHCP server 10 sets the ICMP (Internet Control).
ol Message Protocol)
IP selected message from address pool DB18
It is sent to the address (XX.XX.XX.01 (still unused at this time)). After confirming that the address is unused, the address is presented to the client 40, and the client 40 requests the address. Thereafter, the DHCP server 10 formally assigns an IP address.

It is true that the client 40 is an acceptable client, and the IP address is normally assigned. However, a problem arises here. Allowed client 40 is IP
This means that after obtaining the address, the address may be stolen by other clients.

As a method of avoiding this, ARP (Address) is periodically applied to all the addresses that have been assigned.
Resolution Protocol) packet. MAC (Med) obtained by the response
ia Access Control) address, the spoofing client can be found.

Then, when an actual spoofing client is found, the DHCP server 10 checks the client (for example, the client 60) that does not recognize the assignment.
To the IP address release notification.

However, this forced IP address release notification is only a notification, and the release of the IP address depends on the client side. Therefore, it is better to think that it is unlikely that it will actually be released.

Therefore, by providing the following function to the switching HUB 30 having switching means (not shown) for switching the packet data between the input and output ports by the MAC address, the IP communication of the spoofing client is stopped.

When an unacceptable MAC address exists in the ARP response, the DHCP server 10 notifies the switching HUB 30 that the impersonation client 60 has rejected the communication. The switching HUB 30 is controlled by a built-in control information reception / registration unit (not shown) to control
The notification information from 0 is extracted and the MAC address communication availability state (flag) of the client 60 in the built-in MAC address / port number correspondence table (not shown) is NG.
(No communication). Thereby, the switching HUB3
A value of 0 stops the switching operation by the switching means for the client 60 whose communication availability state is NG and stops the communication.

Next, the detailed configuration of the DHCP server 10 is shown in FIG.

In FIG. 2, the DHCP server 10 of the present embodiment
Is the MA of the client that allows IP address assignment
Permitted client MAC address DB (database) 20 for recording C address (plurality), and DHCP server processing unit 1 for normal dynamic IP address assignment
6 and an assigned address DB for recording the assignment status (combination of IP address and MAC address)
(Database) 17, an assigned address confirmation unit 12 for confirming the status of the IP address currently used, a use address DB (database) 19 for recording the use status, An address release notifying unit 13 for urging the client to release the address when detected, a communication rejecting notifying unit 14 for stopping communication of the unacceptable client, and a general process for transmitting and receiving the respective data. It is composed of a communication processing unit 15 to be performed and an address pool DB (database) 18 that records addresses that have not been assigned yet.

Allowable client MAC address DB 20
Is set in advance with the MAC address of a client that permits IP address assignment. Thus, when a server search request is received from a client, the MAC address is compared with the MAC address set in the DB, and authentication is performed. Note that the MAC address registration contents (MAC address) of the allowable client MAC address DB 20 are appropriately rewritten according to the operation state (by an administrator or the like). That is, MAC address information that always allows the latest IP address assignment is obtained.

The IP address assigned by the DHCP server processor 16 is recorded in the assigned address DB 17 together with the corresponding MAC address. When the assigned address confirmation unit 12 receives the IP address assignment request,
In order to confirm the usage status of the scheduled IP address selected from the address pool DB 18, ICMP_
An Echo message (see FIG. 3) is sent. This use status is recorded in the use address DB 19.

In order to prevent an IP address assigned to a permitted client from being used by a non-permitted client, a response is periodically made by an ARP packet request / response message (see FIG. 4) after the IP address is assigned. Detected by MAC address. The data (combination of the IP address and the MAC address) obtained thereby is registered as an ARP table in the temporary memory of the assigned address confirmation unit 12 (see FIG. 5). This ARP table is compared with the assigned address DB 17 and the allowable client MAC address DB 20 to determine them. The allowed client MAC address DB 20 determines whether the MAC address is currently allowed, and the assigned address DB 17 determines whether the combination of the MAC address and the IP address is correct.

When an unacceptable client actually uses the IP address, the address release notifying unit 13 and the communication processing unit 15 send a compulsory IP address release notification to the client, and the unacceptable client is notified of the unacceptable client. The information is recorded in the unacceptable client information portion of the use address DB 19, and thereafter, no assignment is performed.

When an unacceptable client is detected, the communication rejection notifying unit 14 switches the switching hub 30 in the network.
Sends a communication refusal notice. Upon receiving the communication rejection notification, the switching HUB 30 sets the communication availability state (flag) in the built-in MAC address / port number correspondence table to N.
G (communication not) is set (see FIG. 6).

Next, the operation of this embodiment will be described in more detail with reference to FIG. 7 showing an operation sequence together with FIG. 1 to FIG.

As a prerequisite, a DHCP
The server 10 is installed and the allowed client M registered
The AC address is "AA AA AA AA AA A
A ". Then, the permitted client is set to the client 40 (MAC address: AAAAA AAA AAA AAA
AA), the unacceptable client is changed to client 60 (MA
C address: BB BB BB BB BB BB) and no IP address is set (state 4
01, state 601). In addition, switching HUB
A DHCP server 10 is connected to port 1, a client 60 is connected to port 2, and a client 40 is connected to port 3 via appropriate network paths.

Client 4 that is a valid client
0 is the DHC to build the network address
A DHCP_DISCOVER message is broadcast to the P server 10.

The DHCP server 10 has a client 40
Source MAC address (AA A
A AA AA AA AA) holds the allowed client MAC address (s) that it holds (in this case, AA
AA AA AA AA AA).
As a result of the comparison, if the client is an acceptable client, the DHCP server 10 sends an ICMP
The use status of the IP address is confirmed by the _Echo message, and if not used, the configuration information in which the IP address is set is notified to the client 40 by the DHCP_OFFER message.

The client 40 that has received the notification sets a server ID and the like and broadcasts a DHCP_REQUEST message. The DHCP server 10 selected by the client 40 transmits a DHCP_ACK (OK) message to the client 40 by specifying an IP address (for example, “10.1.32.1”).

However, if assignment is impossible due to reasons such as no IP address to be assigned, DHCP_NAK (N
G) The message is sent and no assignment is made. At this point, the power of the client 40 is still ON, and the client 40 can transmit and receive messages to and from the DHCP server 10. This is referred to as a state 402.

On the other hand, the client 60 (MAC address: BBBB BB BB B
B BB) makes an IP address assignment request with a DHCP_DISCOVER message, the DHCP server 10
An allowable client is determined based on the MAC address. However, since the client 60 is an unacceptable client, the DHCP server 10 transmits an unacceptable client notification and does not perform IP address assignment. This is called state 60
Let it be 2.

The unacceptable client 60 (the user) who has failed to obtain the IP address impersonates the client 40 to which a valid IP address has been assigned.
03) and the client 4 as its own IP address
0 IP address (“10.1.32.1”) is set. This is referred to as state 603.

After a lapse of a predetermined time, the DHCP server 10 broadcasts an ARP request message on the network at intervals of a time set by the server administrator.

Since the power of the client 40 is turned off, the ARP response message is returned only from the client 60.

The IP included in the ARP response message
Combination of address and MAC address (ARP table)
Against the data held in the assigned address DB 17 and the allowed client MAC address DB 20, respectively. As a result of the comparison, a different MAC address (in this case, “BB BB BB BB BB”) for the corresponding IP address (in this case, “10.1.32.1”)
BB "), the client (client 60) that has returned the ARP response message is determined to be an unacceptable client and its MAC address (" BB ").
BB BBBB BB BB "), the address release notification unit 13 transmits a forced IP address release notification message.

After transmitting the release notification message, the DHCP server 10 sends the switching HUB
30. The communication rejection notification message is transmitted to the MAC address / port number correspondence table in the switching HUB 30 (“BB BB
BB BB BB BB)) is set to NG and the communication is not performed so that the communication is not performed (refer to FIG. 6).
The IP communication of the impersonating client 60) can be stopped. This state is referred to as a state 604.

[0044]

According to the present invention, in a network in which an IP address is dynamically assigned by a DHCP server, an allowable client authentication function and a periodic ARP
By sending a packet, the MAC address status corresponding to the IP address assigned to the client is confirmed, and an IP address release notification function, a communication rejection notification function, and a communication rejection unit are provided as a function to cope with a case where an unacceptable client is found. In addition, impersonation of an unacceptable client can be prevented.

[Brief description of the drawings]

FIG. 1 is a network configuration diagram showing an embodiment of the present invention.

FIG. 2 is a block diagram showing a detailed configuration of a DHCP server.

FIG. 3 is a diagram illustrating a configuration example of an ICMP_Echo message.

FIG. 4 is a diagram illustrating a configuration example of an ARP packet request / response message.

FIG. 5 is a diagram illustrating a configuration example of an ARP table.

FIG. 6 is a diagram illustrating a configuration example of a MAC address / port number correspondence table.

FIG. 7 is a diagram showing an operation sequence according to the embodiment of the present invention.

[Explanation of symbols]

 Reference Signs List 10 DHCP server 17 Assigned address DB 18 Address pool DB 20 Permitted client MAC address DB 30 Switching HUB 40, 60 Client

Claims (7)

[Claims] 1. A DHC which receives a request from a client connected to a network and dynamically allocates an IP address.
In the P server, the MAC of the client whose IP address is allowed to be assigned
Allowed client MAC with pre-registered address
It has an address database and an assigned address database for recording assigned IP addresses and MAC addresses in association with each other. When a message requesting assignment of an IP address is received from a client, transmission of the message is performed. Former MAC
Check whether the address is registered in the allowable client MAC address database, assign an available IP address only when registered, notify the client, and associate the IP address with the MAC address in the assigned address database. Recording, after the assignment of the IP address, periodically transmits a message requesting a reply of a response message including the MAC address of the client to the client of the IP address, and the source MAC address and Collating a combination of transmission source IP addresses in the allocated address database, and determining whether the client is a client to which a proper IP address has been allocated based on the collation result. Crying DHCP server with cement authentication function. 2. If the combination of the source MAC address and the source IP address in the response message from the client is checked by the assigned address database and the combination is not recorded, the client is authenticated. 2. The DHCP with a client authentication function according to claim 1, wherein it is determined that the client is not the client to which the IP address is assigned, and the assignment of the IP address is canceled, and a forced IP address release notification message is transmitted to the client. server. 3. A client to which a client has been properly assigned an IP address based on a result of checking a combination of a source MAC address and a source IP address in a response message from the client by the assigned address database. 2. A DHCP server with a client authentication function according to claim 1, wherein when it is determined that the client is not connected, the switching hub device for connecting the client to the network is set not to perform communication with the MAC address. . 4. A means for accommodating a DHCP server with a client authentication function according to claim 3 and a client, and for registering control information from the DHCP server with a client authentication function, and the client according to the registered control information. Switching means for controlling whether communication with other network components is possible or not. 5. A DHC which receives a request from a client connected to a network and dynamically allocates an IP address.
In the client authentication method of the P server, when receiving a message requesting assignment of an IP address from a client, the source MAC in the message is received.
Check whether the MAC address of the client whose IP address is permitted to be assigned is registered in a pre-registered allowable client MAC address database, assign an IP address that can be used only when it is registered, and notify the client. A message that requests the client of the IP address to periodically return a response message including the MAC address of the client after the assignment of the IP address. The client checks whether the combination of the source MAC address and the source IP address in the response message is recorded in the assigned address database, and based on the result of the comparison, the client properly determines the IP address. Client authentication method characterized by determining whether a Kurainto assigned to. 6. If the combination of the source MAC address and the source IP address in the response message from the client is checked by the assigned address database as a result of checking the combination, the client is authenticated. 6. The client authentication method according to claim 5, wherein it is determined that the client is not the client to which the IP address has been assigned, the assignment of the IP address is canceled, and a forced IP address release notification message is transmitted to the client. 7. A client to which a client has been properly assigned an IP address based on a result of checking a combination of a source MAC address and a source IP address in a response message from the client by the assigned address database. 6. The client authentication method according to claim 5, wherein when it is determined that the client is not connected, the switching hub device for connecting the client to the network is set not to perform communication with the MAC address.