JP2001326696A - Method for controlling access - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an access control method to a server in the unit of users by utilizing a DHCP in a network consisting of terminals connected to a sub net and application servers connected to the server via routers. SOLUTION: When a terminal is connected to a network, the terminal broadcasts connection request information, the server broadcasts a proposal of assigned setting information, the terminal receiving the proposal of the assigned setting information broadcasts request information including information required for authentication, the server receives information required for the authentication are references a database connected to the server to authenticate the terminal. If the authentication is successful, the server requests access control, corresponding to the terminal to the route. The router, receiving the request, executes filtering of a transmission reception packet on the basis of various sets of information included in the request. The router transmits result information to the terminal and to the server, on the basis of the result of filtering of the transmission reception packet, to complete the connection between the terminal and the server.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an access control method for connecting a terminal to a network, and more particularly to a dynamic host setting protocol (Dynamic Host Conto).
figuration Protocol, DHC
P) is controlled on a user-by-user basis using server.

[0002]

2. Description of the Related Art When a terminal is connected to a network, D
HCP is a very useful protocol. However, DH
Even if the CP is used, there is a problem in security in operation.

[0003]

A first problem is that if there is a connection request, an Internet Protocol (hereinafter referred to as IP) address is assigned to any terminal and connection to a network is permitted. That is. The reason is that there is no concept of authentication in DHCP.

A second problem is that it is not possible to deny access to a specific server to a certain terminal or user in operation.

[0005] A terminal to which an IP address has been assigned by DHCP can transmit WWW, mail,
It is possible to access an application server that provides services such as News, printers, and files. If it is desired to refuse access to a specific application server, it is necessary to refuse the connection to the network itself, which significantly impairs user convenience.

A third problem is that it is not possible to prevent the IP address of the network from being illegally acquired by some method and performing manual setting to connect to the network.

SUMMARY OF THE INVENTION An object of the present invention is to solve the above-mentioned problems by using DHCP on a network composed of a DHCP client terminal connected to a subnet, a DHCP server and an application server connected via a router. An object of the present invention is to provide a method of controlling access to an application server on a user-by-user basis.

[0008]

An access control method according to the present invention comprises: a DHCP client terminal connected to a first subnet; a DHCP server having a database;
In an access control method in a network including a first subnet and a second subnet connected via a router, and an application server connected to the second subnet, DHCP is used, and an authentication information database is used for each user based on an authentication information database. It is characterized in that a client terminal is authenticated, and packets transmitted and received by the client terminal are filtered by cooperation between a server and a router.

Further, the access control method of the present invention comprises the following steps:
In a network composed of a DHCP client terminal connected to a subnet, a DHCP server having a database, a second subnet connected via a first subnet and a router, and an application server connected to the second subnet An access control method, comprising the steps of: when a client terminal connects to a network, obtaining terminal authentication and user authentication from a DHCP server;
The method includes a step in which the P server and the router cooperate to perform access control for each user, and a step in which connection of the accessed client terminal to the network is completed.

Further, the access control method of the present invention provides a DHCP client terminal connected to a first subnet, a DHCP server having a database, a second subnet connected to the first subnet via a router,
An access control method in a network including an application server connected to a second subnet, wherein when the DHCP client terminal connects to the network, the DHCP client terminal broadcasts connection request information, and the DHCP server assigns the setting. Broadcasting the information proposal, the DHCP client terminal receiving the allocation setting information proposal broadcasts DHCP request information including information required for authentication, and the DHCP server receives information required for authentication of the DHCP client terminal, Authenticating by referring to a database connected to the router, and if the authentication is successful, the DHCP server requests the router for access control corresponding to the DHCP client terminal,
If the authentication fails, a step of reporting the failure to the DHCP client terminal, a step in which the requested router sets filtering of transmitted / received packets based on various information included in the request, and a step in which the router sets the filtering of transmitted / received packets. Transmitting the result information to the DHCP server based on the result, further returning the result information to the DHCP client terminal, and finally completing the network connection of the DHCP client terminal.

[0011] Further, the step of filtering the transmitted and received packets includes the step of the router receiving all the packets transmitted from the DHCP client terminal, and the step of the router determining the packet based on the access list set in the DHCP server. If the packet is permitted, the packet is transferred to the application server, and if the packet is not permitted, the packet is discarded without being transferred to the application server, and the log information is left as a history.

[0012] In addition, the D connected to the first subnet
The HCP client terminal sets a special subnet mask to form a third subnet of only the router and the DHCP client terminal, and transmits / receives a packet to / from the application server connected to the first subnet via the router. With steps.

[0013] Further, an agent terminal is further connected to the first subnet, and the agent terminal collects IP and medium access control (hereinafter referred to as MAC) address information flowing through the network in a database of the agent terminal, and a DHCP server. DH possessed
And comparing and verifying the cache data of the CP client terminal with the database of the agent terminal.

Further, the access control method of the present invention provides a DHCP client terminal connected to a first subnet, a DHCP server having a database, a second subnet connected to the first subnet via a router,
A method of controlling access to an application server for each DHCP client terminal in an access control method in a network including application servers connected to a second subnet;
In addition to the user authentication by the CP server, a step of performing access control in cooperation of the DHCP server and the router, a step of constructing a subnet of only the DHCP client terminal and the router, and an unauthorized connection by an agent terminal connected to the first subnet And detecting the terminal.

[0015]

Embodiments of the present invention will now be described in detail with reference to the drawings.

Referring to FIG. 1, an embodiment of the present invention provides a D
HCP server 1, database 2, and terminal 3 (DHC
P client), a router 4, and a terminal a3 and a server a5 existing on another subnet 7.

The DHCP server 1 has a database 2 containing data for user authentication and data for user access control, in addition to a normal DHCP server. The DHCP server 1 authenticates the request from the terminal 3 and requests the router 4 for access control corresponding to the user.

The database 2 includes authentication data and cache data. The authentication data includes a user ID and password required for authentication, and an access list for performing access control corresponding to the user. The access list includes a source IP address (scheduled address to be allocated), a destination IP
A packet transfer permission / non-permission is described by combining parameters such as an address (IP address of various servers and a network address), a source port number (arbitrary), and a destination port number (port numbers of various servers). .

The cache data is data that dynamically changes during operation, and includes a user ID, an IP address assigned to the user, and a MAC address of a terminal used by the user.
Address (Ethernet (registered trademark) address),
It includes the time at which the IP address was assigned, the lease time, and the like.

The terminal 3 sends an IP address to the DHCP server 1.
Requests assignment of setting information such as addresses, and provides authentication information for authentication. Router 4
Performs access control in response to a request from the DHCP server 1. Packets destined for the terminal 3 always pass through the router 4. The server a5 has WWW, mail,
A terminal that provides various services such as News, file, printer, and the like is present on a different subnet 7 from the terminal 3.

Next, the operation of this embodiment will be described in detail with reference to FIG. 1, FIG. 2 and FIG.

First, an IP address assignment procedure including an authentication procedure when the terminal 3 connects to the network will be described with reference to FIG.

The terminal 3 broadcasts DHCPDISCOVER (step 20). DHCPDIS
The DHCP server 1 that has received the COVER broadcasts a DHCPOFFER to propose setting information to be assigned (step 21). Up to this point, the flow is the same as the normal DHCP flow. The terminal 3 having received the proposal of the setting information broadcasts the DHCP REQUEST to the DHCP server 1 (Step 22). This message includes a user ID and a password option (hash and invisible).

The DHCP server 1 which has received the DHCPREQUEST including the user ID and the password from the terminal 3
Performs terminal authentication and user authentication (step 2
3). The terminal authentication is performed by referring to the database 2 using the MAC address transmitted from the terminal 3 as a search key. Next, user authentication is performed by referring to the database 2 from the user ID and password transmitted from the terminal 3. If the authentication is successful, the DHCP server 1 sends a Configure-Request to request the router 4 for access control corresponding to the user (step 24). If the authentication fails, the client sends DHCPNAK to the client.

Conf sent from the DHCP server 1
The information request includes information such as an access list, a MAC address of the terminal 3, and an IP address to be allocated.

The router 4 sets an appropriate packet filter based on the access list requested by the DHCP server 1 (step 25). When the setting is completed, the router 4 sends a Configure-Ack to the DHCP server 1 (Step 26). Upon receiving the Config-Ack indicating the completion of the access control setting from the router 4, the DHCP server 1 sends a DHCPA
CK is transmitted (step 27). As described above, after the user authentication, the minimum necessary setting for connection to the network, that is, the initialization is completed (step 28).

At this point, the terminal 3 performs, after user authentication, at least IP address, subnet mask, routing information (default route), I
The lease time of the P address has already been set, and the access list has been set in the router.

Next, how the access control is realized while following the flow of data communication between the terminal 3 (DHCP client) and the server a5 existing on the different subnet 7 will be described.

The terminal 3 transmits a packet addressed to the server a5 to the router based on the routing table. The router 4 receiving the packet forwards the packet to the server a5 based on the routing table. Thus, the server a5 can receive the packet transmitted from the terminal 3. Conversely, a packet addressed to the terminal 3 from the server a5 is sent to the router 4 based on the routing table. The router 4 receiving the packet forwards the packet to the terminal 3 based on the routing table. Thus, the terminal 3 can receive the packet transmitted from the server a5.

As described above, all packets transmitted from the terminal 3 always pass through the router 4. That is, the router 4 forwards the transmitted packet if the packet is permitted, and discards the packet without forwarding if the packet is not permitted.
Leave the log information to that effect. Therefore, the router 4 can perform access control based on the access list set in step 25.

Finally, a procedure for releasing the IP address when the terminal 3 completes all the processes and disconnects from the network will be described with reference to FIG.

The terminal 3 sends a DHCP message to the DHCP server 1.
A CPRLEASE is transmitted (step 31). This message includes a user ID and a password option. DHCP that received DHCPRELEASE
The server 1 performs authentication based on the database 2 from the user ID and password included in the message (step 32). If the authentication is successful, a request is made to the router 4 to release the access control corresponding to the user. For that purpose, the DHCP server 1 transmits the Terminate-Requ
est is transmitted to the router 4 (step 33). Ter
The router 4 receiving the minate-Request,
The setting is released based on the access list requested from the DHCP server 1, and the Terminate-Ack is transmitted to the DHCP server.
The data is transmitted to the P server (step 34).

Next, a second embodiment of the present invention will be described in detail with reference to the drawings. According to FIG.
Server b on the same subnet 6 physically as terminal 3
8 is different from that of the previous embodiment in that access control is performed.

The terminal 3 obtains the IP address and the subnet mask (255.25) as the minimum setting information assigned by the DHCP server 1 after the user authentication in the procedure of FIG.
5.255.251), routing information (default route), and the lease time of the IP address. Furthermore, the terminal 3 that was not implemented in the first embodiment
A stop of its own ARP Reply is additionally executed.

The router 4 has an access list setting, a Proxy ARP setting for the terminal 3, and an MA of the terminal 3.
The registration of the C address in the ARP table is performed at the time of step 25 in FIG. The Proxy ARP is such that the router 4 responds to the ARP Request of the IP address of the terminal 3 with an ARP Reply instead.

The characteristic feature is that a 255.255.255.251, 30-bit mask is used as a subnet mask. With this setting, as shown in FIG. 4, the router 4 and the terminal 3 form the subnet 9 to which only the terminal belongs. Therefore, even if the server b8 is physically present on the same subnet, it is logically present on another subnet, and a packet addressed to the server b8 is transmitted via the router 4.

Next, the communication procedure between the server b8 and the terminal 3 will be described in detail with reference to FIGS.

According to FIG. 5, first, the terminal 3 sets the ARP R
broadcast of the request and the MA of the router 4
Inquire about the C address (step 40). ARP
The router 4 receiving the Request sends the ARP Rep
Responds with ly (step 41). The terminal 3 that has resolved the MAC address of the router 4 transmits a packet addressed to the server b8 to the router 4 (Step 42). The router 4 receiving the packet performs routing and tries to transfer the packet to the server b8. (Step 43). Therefore,
The router 4 broadcasts an ARP Request and attempts to resolve the MAC address of the server b8 (step 44). On the other hand, server b8 is ARP
Respond with Reply (step 45). The router 4 having received the packet forwards the packet addressed to the server b8 to the server b8 (step 46). At this time, the packet addressed to the server b6 has passed through the router 4.

Conversely, a procedure for transmitting a packet from the server b8 to the terminal 3 will be described. According to FIG. 6, the server b8
Broadcasts an ARP Request,
Attempt to resolve the MAC address of terminal 3 (step 50). On the other hand, the router 4 in which the Proxy ARP has been set (step 51) sets the ARP Rep
A response is made by putting its own MAC address in ly (step 52). On the other hand, the terminal 3 stops the ARP Reply 5
3 cannot be responded to this ARP Request. Server b that resolved the address
8 transmits a packet addressed to the terminal 3 to the router 4 (step 54). The router 4 receiving the packet performs routing (step 55), and transfers a packet addressed to the terminal 3 to the terminal 3 (step 56). At this time, since the set of the IP address and the MAC address of the terminal 3 is registered in the ARP table, the packet can be transferred by unicast without using ARP.

In any case, since all packets transmitted from the terminal 3 always pass through the router 4, access control can be performed by the access list of the router 4.

As described above, the server is in the same subnet 6 as the terminal 3
The access control method in the case where the terminal 3 exists is described. However, even when the server exists in the same subnet 6 as the terminal 3 and in another subnet 7 at the same time, the access control can be performed in the same manner as in the present embodiment.

Next, a third embodiment of the present invention will be described in detail with reference to the drawings. According to FIG.
An agent 7 having a function of capturing an ARP Reply packet flowing on the Ethernet and storing a set of an IP address and a MAC address in a database.
The difference is that 0 exists.

In the present embodiment, a countermeasure method will be described in a case where an IP address is illegally obtained by some method during operation of the above-described embodiment and a terminal is connected to a network by performing manual setting.

Referring to FIG. 8, the agent 70 is called Et.
An ARP Reply packet flowing on the hernet is captured, a set of an IP address and a MAC address is collected, and this is stored in the database 80.

On the other hand, in the database 2 of the DHCP server 1, the user I to whom the address is currently assigned is stored.
D, the IP address assigned to the user, the MAC address of the terminal used by the user, the time at which the IP address was assigned, the lease time, and the like.

The cache data 2 to which the information of the terminal to which the IP address is properly assigned by the procedure other than the DHCP is added and the database 80 of the agent are periodically compared and verified. If there is a terminal that uses the illegally obtained IP address, there is no information of the terminal in the cache data, so that an illegal connection can be detected by the above-described comparison verification.

In this embodiment, the introduction of the agent has a new effect that a connection due to illegal acquisition of an IP address can be detected.

[0048]

The first effect is that network connection availability can be controlled for each user and terminal.

The reason is that user authentication is introduced into DHCP.

The second effect is that access control to the application server can be controlled for each user and each terminal.

The reason is that the DHCP server and the router cooperate to set a packet filter, and all packets transmitted from the terminal pass through the router.

The third effect is that a terminal connected to the network can be detected by illegally obtaining the IP address of the network and performing manual setting.

The reason is that an agent having a function of collecting a set of an IP address and a MAC address is introduced.

A fourth effect is that access control for each server can be eliminated.

The reason is that access control is performed at the terminal connection stage, and no packet addressed to the server arrives from the terminal.

[Brief description of the drawings]

FIG. 1 is a network diagram showing a configuration of a first embodiment.

FIG. 2 is a sequence diagram showing an operation of the first embodiment.

FIG. 3 is a sequence diagram showing an operation of the first embodiment.

FIG. 4 is a network diagram showing a configuration of a second embodiment.

FIG. 5 is a sequence diagram showing an operation of the second embodiment.

FIG. 6 is a sequence diagram showing an operation of the second embodiment.

FIG. 7 is a network diagram showing a configuration of a third embodiment.

FIG. 8 is a diagram illustrating the operation of the third embodiment.

[Explanation of symbols]

 1 DHCP server 2 Database 3 Terminal (DHCP client) 4 Router 5 Server a 6, 7, 9 Subnet 8 Server b 70 Agent

 ──────────────────────────────────────────────────続 き Continued on the front page F term (reference) 5B089 GA11 GA21 GA31 HA01 HA06 HA10 HB18 JB00 KB06 KB13 KC58 MB01 5K030 GA15 HA08 HC14 HD03 HD07 HD09 JT03 JT06 KA05 LB02 LC13 LD19 LD20 MD09 5K033 AA08 CB01 CB08 EC03

Claims (7)

[Claims] 1. A DHC connected to a first subnet
An access control method in a network including a P client terminal, a DHCP server having a database, a second subnet connected via a first subnet and a router, and an application server connected to the second subnet, comprising: Using the authentication information database to authenticate the client terminal for each user, and filtering a transmission / reception packet of the client terminal in cooperation with a server and a router. 2. A DHC connected to a first subnet
An access control method in a network including a P client terminal, a DHCP server having a database, a second subnet connected via a first subnet and a router, and an application server connected to the second subnet. A step in which the client terminal obtains terminal authentication and user authentication from a DHCP server when connecting to a network; and a DHCP server and a router cooperate with each other to perform access control on a user basis based on information obtained by the authentication. And an access control method comprising: completing the network connection of the DHCP client terminal that has obtained the authentication. 3. A DHC connected to a first subnet
An access control method in a network including a P client terminal, a DHCP server having a database, a second subnet connected via a first subnet and a router, and an application server connected to the second subnet. When the DHCP client terminal connects to the network, the DHCP client terminal broadcasts connection request information, and the DHCP server broadcasts a proposal for allocation setting information; and A DHCP client terminal broadcasts DHCP request information including information required for authentication, and a DHCP server receives information required for authentication of the DHCP client terminal, and stores a database connected to the DHCP server. And authenticating by irradiation, it requests the access control router A successful authentication DHCP server corresponding to the DHCP client terminal,
A step of reporting the failure to the DHCP client terminal if the authentication fails; a step of setting the filtering of the transmitted / received packet based on various information included in the request by the router that has received the request; An access control method comprising transmitting result information to the DHCP server based on a setting result, further returning the result information to the DHCP client terminal, and finally completing the network connection of the DHCP client terminal. 4. The step of filtering the transmitted and received packets, wherein the router receives all the packets transmitted from the DHCP client terminal; and the router has an access list set in the DHCP server. A filtering step of forwarding the packet to an application server if the packet is permitted, discarding the packet without forwarding the packet to the application server if the packet is not permitted, and leaving log information as a history based on the packet. 3. The access control method according to any one of 3. 5. D connected to the first subnet
An HCP client terminal setting a special subnet mask to form a third subnet of only the router and the DHCP client terminal; and a packet to an application server connected to the first subnet via the router. The access control method according to any one of claims 1 to 4, further comprising a step of performing transmission and reception. 6. A step of further connecting an agent terminal to the first subnet, wherein the agent terminal collects IP and MAC address information flowing through a network in a database of the agent terminal, wherein the DHCP of the DHCP server The access control method according to claim 1, further comprising a step of comparing and verifying cache data relating to a client terminal with a database of the agent terminal. 7. DHC connected to a first subnet
An access control method in a network including a P client terminal, a DHCP server having a database, a second subnet connected via a first subnet and a router, and an application server connected to the second subnet. Performing access control to the application server for each DHCP client terminal;
A step of performing access control in cooperation with an HCP server and a router, a step of constructing a subnet of only the DHCP client terminal and the router, and a step of detecting an illegally connected terminal by an agent terminal connected to the first subnet. An access control method, characterized in that: