JP2006025065A - Network, network equipment, local authenticating method used therefor, and program thereof - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a network whose security can be increased by physically limiting a connectable range of a connected supplicant. <P>SOLUTION: A supplicant 3-1 sends an authentication request to network equipment 2-1 by a local authenticating function 32-1 by using a local authentication key and when a local authenticating function 21-1 of the network equipment 2-1 detects the local authentication key being coincident, the local authentication with the network equipment 2-1 is successful. Once the local authentication is successful, the supplicant 3-1 sends an authentication request to an authenticating server 1 by an individual authenticating function 31-1 by using an individual authentication key and when the individual authenticating function 11 of the authenticating server 1 detects the individual authentication key being coincident, all the authentications are successful, so a connection with a backbone network 100 can be made. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention relates to a network, a network device, a local authentication method used therefor, and a program therefor, and more particularly, to an authentication method using IEEE (Institute of Electrical and Electronic Engineers) 802.1X of a supplicant configuring a network.

  IEEE 802.1X is a standard specification that defines a procedure for authenticating a user's access right for each port of a LAN device such as a LAN (Local Area Network) switch or a bridge (for example, see Non-Patent Document 1).

  The main application of IEEE802.1X is authentication when connecting from a wireless LAN to a wired LAN. In other words, in IEEE 802.1X, a user is authenticated using a RADIUS (Remote Authentication Dial-In User Service) server, an encryption key is generated for each user, and the key is updated each time a connection is made. It is specified that EAP (Extensible Authentication Protocol) is used for cooperation.

  In the above IEEE802.1X, a supplicant (Supplicant) indicating a component to be authenticated, an authenticator (Authenticator) indicating a component that controls access to the supplicant (a component that opens and closes a port), and authentication of the supplicant Three structural units (components) are defined with an authentication server that indicates a component that performs the operation.

  On the other hand, as an authentication method according to IEEE 802.11, there is a method in which a wireless client authenticates with an access point and then sends a user name and a password to the authentication server via the access point (for example, Patent Documents 1 and 2). reference).

JP 2004-015725 A JP 2004-023736 A “Port-Based Network Access Control” (IEEE 802.1X, pages 5 to 48, June 14, 2001)

  In the above-described conventional IEEE802.1X authentication method, only individual authentication by the supplicant and the authentication server is performed by IEEE802.1X. However, in the individual authentication, once the key for individual authentication is stolen, There is a risk of unauthorized connection from anywhere in the network.

  That is, in the individual authentication by the authentication server, as long as there is a key for individual authentication, the connection position of the network is not limited, and connection is possible from anywhere, and there is a risk of unauthorized access. The same applies to the techniques of the above-mentioned Patent Documents 1 and 2, and since the authentication between the wireless client and the access point is not an authentication as to whether or not the individual authentication procedure should be permitted, the wireless client only has to have a key for individual authentication. May gain unauthorized access to the network by connecting to the access point. In addition, the wireless access point authentication method is a method for encrypting the data frame itself, and is not suitable for a network that requires high-speed transfer.

  On the other hand, when individual authentication based on a MAC (Media Access Control) address is added, security is improved, but it takes time to change the MAC address by examining the MAC address or changing the terminal.

  Therefore, an object of the present invention is to solve the above-described problems, physically limit the connectable range of connected supplicants, and improve security. Network, network device, and local authentication method used therefor And providing the program.

The network according to the present invention is a network comprising a supplicant that is individually authenticated in accordance with IEEE 802.1X specifications, an authentication server that performs individual authentication of the supplicant, and a network device that connects the supplicant to the network. ,
Means for performing local authentication for determining whether or not to permit individual authentication of a supplicant connected to the network device is provided in the network device.

A network device according to the present invention is a network device for connecting a supplicant that is individually authenticated by an authentication server in accordance with the IEEE 802.1X specification to a network.
There is provided means for performing local authentication for determining whether or not individual authentication of a supplicant connected to the own device is permitted.

  The local authentication method according to the present invention is a network that includes a supplicant that is individually authenticated in accordance with IEEE 802.1X specifications, an authentication server that performs individual authentication of the supplicant, and a network device that connects the supplicant to the network. In the local authentication method to be used, the network device includes a step of performing local authentication to determine whether individual authentication of a supplicant connected to the network device is permitted.

  A program for a local authentication method according to the present invention includes a supplicant that is individually authenticated in accordance with IEEE 802.1X specifications, an authentication server that performs individual authentication of the supplicant, and a network device that connects the supplicant to a network. A program for a local authentication method used for a network, which causes a computer of the network device to execute a process of performing local authentication to determine whether individual authentication of a supplicant connected to the network device is permitted ing.

  That is, the network of the present invention is composed of a network device having a built-in IEEE (Institute of Electrical and Electronic Engineers) 802.1X function and a supplicant, and the IEEE 802.1X function possessed by these network devices and the supplicant, The network has been expanded to limit the network devices that can be connected to the supplicant.

  In the network of the present invention, the above-described functions limit the network devices that can be connected to the supplicant to network devices that directly accommodate the supplicant. In this case, the authenticated supplicant may be connected to any of the physical ports of the network device.

  As described above, in the network of the present invention, the connectable range of the connected supplicant can be physically limited, and security can be increased.

  In the individual authentication by the authentication server, as long as there is a key for individual authentication, the connection position of the network is not limited, and connection is possible from anywhere, so there is a risk that the network is illegally accessed.

  On the other hand, when individual authentication based on a MAC (Media Access Control) address is added, security is improved, but it takes time to change the MAC address by examining the MAC address or changing the terminal.

  On the other hand, in the network of the present invention, it is possible to increase the security of the network and to save the labor required for individual authentication by the MAC address. Further, in the network of the present invention, the supplicant to be authenticated can be connected to any physical port of the network device, so that the operability is high.

  Therefore, in the network of the present invention, by limiting the network devices to which the supplicant can be connected using the local authentication function, the range that can be connected is physically limited even if the key for individual authentication is stolen. It is possible to reduce the risk of unauthorized connection without deteriorating operability.

  By adopting the configuration and operation as described below, the present invention can physically limit the connectable range of the connected supplicant, and the effect that security can be improved is obtained.

  Next, embodiments of the present invention will be described with reference to the drawings. FIG. 1 is a block diagram showing a network configuration according to an embodiment of the present invention. 1, the network according to one embodiment of the present invention includes an authentication server 1, a backbone network 100, network devices (switches) 2-1, 2-2,..., And supplicants 3-1 to 3-3. , 4-1 and 4-2. In the following description, the network devices 2-1 and 2-2 will be described.

  An authentication server 1 and network devices 2-1 and 2-2 are connected to the backbone network 100, and the network devices 2-1 and 2-2 are supplicants 3-1 to 3-3, 4-1, and 4, respectively. -2 is accommodated. The authentication server 1 individually authenticates the supplicants 3-1 to 3-3, 4-1, and 4-2.

  The supplicants 3-1 to 3-3 have a common key for connecting to the network device 2-1, and when these are connected to the network device 2-1, local authentication is performed using the key of the network device 2-1. Is done. Similarly, the supplicants 4-1 and 4-2 have a common key for connecting to the network device 2-2, and when these are connected to the network device 2-2, the key held by the network device 2-2. Authenticated locally.

  The supplicants 3-1 to 3-3, 4-1 and 4-2 connected to the network devices 2-1 and 2-2 are authenticated by the local authentication function of the network devices 2-1 and 2-2. Individual authentication by the authentication server 1 enables connection to the backbone network 100.

  The supplicant 3-3 has a key for connecting to the network device 2-1, but does not have a key for connecting to the network device 2-2. If the supplicant 3-3 is to be connected to the network device 2-2, the key is different, so local authentication is not performed and the connection to the network device 2-2 is not possible.

  The individual authentication of the supplicants 3-1 to 3-3, 4-1, and 4-2 by the authentication server 1 is performed according to the IEEE 802.1X standard specification (see Non-Patent Document 1 above). In this embodiment, it is possible to improve security by using both the local authentication and the individual authentication described above.

  FIG. 2 is a diagram showing a relationship of local authentication and individual authentication among the authentication server 1, the network device 2-1, and the supplicant 3-1. In FIG. 2, an authentication server 1 has an individual authentication function 11 for holding an individual authentication key and authenticating the supplicant 3-1 using the individual authentication key, and the network device 2-1 has a local authentication key. And a local authentication function 21-1 for authenticating the supplicant 3-1 using the local authentication key.

  The supplicant 3-1 holds an individual authentication key and a local authentication key, and makes an authentication request to the authentication server 1 with the individual authentication key, and a network with the local authentication key. A local authentication function 32-1 for making an authentication request to the device 2-1. Although not shown, the network device 2-2 and the supplicants 3-2, 3-3, 4-1, 4-2 have the same functions as the network device 2-1 and the supplicant 3-1. It has.

  The supplicant 3-1 makes an authentication request to the network device 2-1 using the local authentication key in the local authentication function 32-1, and the local authentication key in the local authentication function 21-1 of the network device 2-1. Is detected, the local authentication with the network device 2-1 succeeds.

  When local authentication is successful, the supplicant 3-1 makes an authentication request to the authentication server 1 using the individual authentication key in the individual authentication function 31-1, and the individual authentication key in the individual authentication function 11 of the authentication server 1. When a match is detected, all the authentications are successful, and connection to the backbone network 100 becomes possible.

  FIG. 3 is a diagram showing a packet format of local authentication key notification according to an embodiment of the present invention. In FIG. 3, the base of this packet format is IEEE802.1X, but a key for local authentication is accommodated in this, and the network devices 2-1 and 2-2 perform local authentication with the key. To do.

  That is, the above packet formats are Code = 1 (1 byte) [EAP (Extensible Authentication Protocol) -Response], Identifier (1 byte), Length (2 bytes), Type = 2 (1 byte), type, and type. (Local authentication key).

  The local authentication key may be an authentication method key such as MD5 (Message Digest algorithm 5) or SHA-1 (Secure Hash Algorithm-1).

  FIG. 4 is a sequence chart showing an authentication operation in a network according to an embodiment of the present invention. The authentication operation in the network according to the embodiment of the present invention, that is, the local authentication operation and the individual authentication operation will be described with reference to FIGS. In the following description, local authentication and individual authentication among the authentication server 1, the network device 2-1, and the supplicant 3-1 shown in FIG. 2 will be described.

  When the “802.1X start request” for starting IEEE 802.1X is output from the supplicant 3-1 (a 1 in FIG. 4), the network device 2-1 configured to perform local authentication receives this. Then, a “local authentication start request” for starting local authentication is output to the supplicant 3-1 (a 2 in FIG. 4).

  The supplicant 3-1 that has received the notification notifies the network device 2-1 of “local authentication key notification” (see FIG. 3) (a3 in FIG. 4), and the network device 2-1 performs local authentication and authentication. Then, “local authentication OK” is output (a4 in FIG. 4).

  The supplicant 3-1 that has received this starts the IEEE802.1X individual authentication and is authenticated by the authentication server 1, and can be connected to the backbone network 100 (a5 to a9 in FIG. 4).

  On the other hand, if the network device 2-1 that has received the “local authentication key notification” fails to perform local authentication because the local authentication key is different, the IEEE802.1X authentication from the supplicant 3-1 is performed. The processing sequence is not advanced any further, and the individual authentication by the authentication server 1 is not advanced.

  FIG. 5 is a flowchart showing local authentication processing by the network device 2-1 in FIG. The local authentication process by the network device 2-1 will be described with reference to FIG. 1, FIG. 2, and FIG.

  5 is performed when the network device 2-1 includes a computer (not shown) including a CPU (Central Processing Unit), a RAM (Read Only Memory), and a recording medium. It is realized by moving to and executing. Further, in the following description, the operation of the network device 2-1 when performing local authentication and individual authentication among the authentication server 1, the network device 2-1, and the supplicant 3-1 shown in FIG.

  When the network device 2-1 receives the 802.1X start request from the supplicant 3-1 (step S 1 in FIG. 5), it authenticates the local authentication key from the supplicant 3-1 (step S 2 in FIG. 5).

  If the authentication result of the local authentication key is OK (step S3 in FIG. 5), the network device 2-1 transfers the individual authentication key from the supplicant 3-1 to the authentication server 1 and confirms the authentication result. (FIG. 5, step S4).

  If the authentication result from the authentication server 1 is OK (step S5 in FIG. 5), the network device 2-1 connects the supplicant 3-1 to the backbone network 100 (step S6 in FIG. 5).

  On the other hand, when the authentication result of the local authentication key is NG (step S3 in FIG. 5) or the authentication result from the authentication server 1 is NG (step S5 in FIG. 5), the network device 2-1 has a supplicant 3 -1 authentication processing sequence is stopped (step S7 in FIG. 5).

  As described above, in this embodiment, the connectable range of the connected supplicants 3-1 to 3-3, 4-1, and 4-2 is physically limited (the network device 2-1 corresponding to the connectable range). , 2-2), and security can be enhanced.

  In the individual authentication by the authentication server 1, as long as there is a key for individual authentication, the connection position of the network is not limited and connection can be made from anywhere, but there is a risk of unauthorized access. In addition, when individual authentication based on a MAC address is added, the security can be enhanced, but it takes time to change the MAC address by examining the MAC address or changing the terminal.

  In the present embodiment, as described above, by limiting the connectable range of the supplicants 3-1 to 3-3, 4-1, and 4-2 to the corresponding network devices 2-1 and 2-2, security can be achieved. The effort required for the individual authentication by the MAC address can be saved.

  In this embodiment, the supplicants 3-1 to 3-3, 4-1, and 4-2 to be authenticated may be connected to any physical port of the connected network devices 2-1 and 2-2. Since there is no, the operability can be improved.

It is a block diagram which shows the structure of the network by one Example of this invention. It is a figure which shows the relationship of the local authentication and individual authentication between the authentication server of FIG. 1, a network apparatus, and a supplicant. It is a figure which shows the packet format of the key notification for local authentication by one Example of this invention. It is a sequence chart which shows the authentication operation | movement in the network by one Example of this invention. It is a flowchart which shows the local authentication process by the network device of FIG.

Explanation of symbols

1 Authentication server
2-1, 2-2 Network equipment 3-1-3-3, 4-1, 4-2 Supplicant
11, 31-1 Individual authentication function
21-1, 32-1 Local authentication function
100 backbone network

Claims (16)

A network composed of a supplicant that is individually authenticated in accordance with IEEE 802.1X specifications, an authentication server that performs individual authentication of the supplicant, and a network device that connects the supplicant to a network;
A network characterized in that the network device has means for performing local authentication for determining whether or not to permit individual authentication of a supplicant connected to the network device when performing individual authentication of the supplicant. .   2. The network according to claim 1, wherein the supplicant can be freely connected to any physical port of the network device.   3. The network according to claim 1, wherein the supplicant holds the individual authentication key and the local authentication key.   4. The method according to claim 1, wherein the local authentication key is at least one of MD5 (Message Digest algorithm 5) and SHA-1 (Secure Hash Algorithm-1) authentication methods. The described network.   5. The network according to claim 1, wherein the network device suppresses transfer of the individual authentication request from the supplicant that has not been able to perform local authentication to the authentication server. 6. A network device that connects a supplicant that is individually authenticated by an authentication server in accordance with the IEEE 802.1X specification to a network,
A network device comprising means for performing local authentication for determining whether or not to permit individual authentication of a supplicant connected to the own device when performing individual authentication of the supplicant.   7. The network device according to claim 6, wherein the supplicant can be freely connected to any physical port of the device itself.   The network device according to claim 6 or 7, wherein the local authentication is performed using the local authentication key held by the supplicant.   9. The method according to claim 6, wherein the local authentication key is at least one of MD5 (Message Digest algorithm 5) and SHA-1 (Secure Hash Algorithm-1) authentication methods. The described network equipment.   10. The network device according to claim 6, wherein a transfer of the individual authentication request from the supplicant that cannot be locally authenticated to the authentication server is suppressed. 11.   A local authentication method used for a network including a supplicant that is individually authenticated according to IEEE 802.1X specifications, an authentication server that performs individual authentication of the supplicant, and a network device that connects the supplicant to a network, The network device has a step of performing local authentication for determining whether or not to permit individual authentication of a supplicant connected to the network device when performing individual authentication of the supplicant. Local authentication method to use.   12. The local authentication method according to claim 11, wherein the supplicant can be freely connected to any physical port of the network device.   13. The local authentication method according to claim 11, wherein the supplicant holds the individual authentication key and the local authentication key.   The local authentication key is at least one of MD5 (Message Digest algorithm 5) and SHA-1 (Secure Hash Algorithm-1) authentication methods. The local authentication method described.   The local authentication method according to claim 11, wherein the network device suppresses transfer of the individual authentication request from the supplicant that has not been able to perform the local authentication to the authentication server. A program for a local authentication method used in a network including a supplicant that is individually authenticated in accordance with IEEE 802.1X specifications, an authentication server that performs individual authentication of the supplicant, and a network device that connects the supplicant to the network. A program for causing a computer of the network device to execute a process of performing local authentication for determining whether or not to permit individual authentication of a supplicant connected to the network device.

Images