JP2023009950A - Router device, filter registration program, and filter registration method - Google Patents

Abstract

To solve the problem of a conventional router in which setting processing for a MAC address filter is complicated.SOLUTION: A router device includes: an authorized MAC address database 22 which holds authorized MAC address; a filter processing unit 21 which restricts communication between an unregistered terminal, which is not authorized in a normal operation mode, and an external region on the basis of the authorized MAC address, and allows a specific packet issued from the unregistered terminal to pass in a filter registration mode; a MAC address acquisition unit 23 which acquires a MAC address of the unregistered terminal from the specific packet; a button switch 28 to be depressed by a user; and a filter registration processing unit 26 which, in response to detecting depression of the button switch 28, switches the filter processing unit 21 to the filter registration mode and records the MAC address received from the MAC address acquisition unit 23, as an authorized MAC address, on the authorized MAC address database 22.SELECTED DRAWING: Figure 2

Description

The present invention relates to a router device, a filter registration program, and a filter registration method, and more particularly to a router device, a filter registration program, and a filter registration method having a function of performing communication control based on MAC addresses.

For example, there is a router device as a device that mediates communication between terminals in different network management areas such as on-premises and off-premises. A MAC address that uniquely defines each device is assigned to each device that performs communication. A router device has a MAC address filtering function for controlling whether to permit or block communication via the terminal based on the MAC address of the terminal in the network management area managed by the router. In order to perform MAC address filtering, it is necessary to check the MAC address of the terminal and input the MAC address that permits communication to the router device each time a device is added. However, there is a problem that the input of this MAC address to the router device is a heavy burden for the administrator, and it is very difficult for the user who has no knowledge of the network. Therefore, Japanese Patent Laid-Open No. 2002-200003 discloses a technique for easily setting MAC address filtering.

In the communication system disclosed in Patent Document 1, when a probe request is received before a predetermined time elapses, a MAC address extraction unit extracts from a device connected to a wireless LAN segment using an access point as a relay station The MAC address of the device is extracted from the transmitted probe request, the MAC address storage control unit stores and registers the extracted MAC address in the MAC address table stored in the setting information storage unit, and the filtering processing unit , perform MAC address filtering according to the MAC addresses stored in the MAC address table.

JP 2006-261939 A

However, the setting method for MAC address filtering described in Patent Document 1 stores device information in a storage unit based on a communication protocol specific to wireless communication, so there is a problem that devices connected by wired communication cannot be dealt with.

One aspect of the router device according to the present invention is a LAN connection unit serving as a connection port for a terminal that communicates with an external area via the own device, and a permission router that is a MAC address of a permitted terminal that permits communication with the external area. Based on the permitted MAC address database holding MAC addresses and the permitted MAC address, in the normal operation mode, communication between the unregistered terminal that is not the permitted terminal and the external area is restricted, and in the filter registration mode, the unregistered terminal is restricted. a filter processing unit for passing a specific packet sent from a registered terminal; a router processing unit for transmitting/receiving a communication packet between the permitted terminal permitted to communicate by the filter processing unit and the external area; a MAC address acquisition unit that acquires the MAC address of an unregistered terminal; a button switch that can be pressed by a user; a filter registration processing unit that switches to a registration mode and records the MAC address received from the MAC address acquisition unit as the permitted MAC address in the permitted MAC address database.

One aspect of the filter registration program according to the present invention is a LAN connection unit that serves as a connection port for a terminal that communicates with an external area via its own device, and a MAC address of a permitted terminal that permits communication with the external area. Restrict communication between an unregistered terminal that is not the permitted terminal and the external area based on a permitted MAC address database that holds permitted MAC addresses, a button switch that can be pressed by the user of the device, and the permitted MAC address. A filter registration program executed by a processor incorporated in a router device having a filter processing unit, the normal operation of blocking a communication request from the unregistered terminal in response to detection of depression of the button switch. Mode switching processing for shifting the operation of the filter processing unit from a mode to a filter registration mode that permits communication of a specific packet transmitted from the unregistered terminal; and transmission from the unregistered terminal in the filter registration mode. a permitted MAC address adding process of acquiring the MAC address from the received specific packet and recording the acquired MAC address as the permitted MAC address in the permitted MAC address database.

One aspect of the filter registration method according to the present invention is a LAN connection unit that serves as a connection port for a terminal that communicates with an external area via its own device, and a MAC address of a permitted terminal that permits communication with the external area. Restrict communication between an unregistered terminal that is not the permitted terminal and the external area based on a permitted MAC address database that holds permitted MAC addresses, a button switch that can be pressed by the user of the device, and the permitted MAC address. A filter registration method using a processor built in a router device having a filter processing unit, the normal operation of blocking a communication request from the unregistered terminal in response to detection of pressing of the button switch. Mode switching processing for shifting the operation of the filter processing unit from a mode to a filter registration mode that permits communication of a specific packet transmitted from the unregistered terminal; and transmission from the unregistered terminal in the filter registration mode. a permitted MAC address adding process of acquiring the MAC address from the received specific packet and recording the acquired MAC address as the permitted MAC address in the permitted MAC address database.

According to the router device, the filter registration program, and the filter registration method according to the present invention, MAC address filtering can be registered by automatic processing regardless of the terminal connection configuration.

1 is a schematic diagram of a communication system according to a first embodiment; FIG. 1 is a block diagram of a router device 10 according to a first exemplary embodiment; FIG. 4 is a flowchart for explaining the operation of the router device 10 according to the first exemplary embodiment; 2 is a block diagram of a router device 10a according to a second embodiment; FIG. 9 is a flowchart for explaining the operation of the router device 10a according to the second embodiment;

For clarity of explanation, the following descriptions and drawings are omitted and simplified as appropriate. In addition, each element described in the drawings as a functional block that performs various processes can be configured with a CPU (Central Processing Unit), memory, and other circuits in terms of hardware, and memory implemented by a program loaded in the Therefore, those skilled in the art will understand that these functional blocks can be realized in various forms by hardware only, software only, or a combination thereof, and are not limited to either one. In each drawing, the same elements are denoted by the same reference numerals, and redundant description is omitted as necessary.

The programs described above also include instructions (or software code) that, when read into a computer, cause the computer to perform one or more of the functions described in the embodiments. The program may be stored in a non-transitory computer-readable medium or tangible storage medium. By way of example, and not limitation, computer readable media or tangible storage media may include random-access memory (RAM), read-only memory (ROM), flash memory, solid-state drives (SSD) or other memory technology, CDs -ROM, digital versatile disc (DVD), Blu-ray disc or other optical disc storage, magnetic cassette, magnetic tape, magnetic disc storage or other magnetic storage device. The program may be transmitted on a transitory computer-readable medium or communication medium. By way of example, and not limitation, transitory computer readable media or communication media include electrical, optical, acoustic, or other forms of propagated signals.

Embodiment 1
BEST MODE FOR CARRYING OUT THE INVENTION Hereinafter, embodiments of the present invention will be described with reference to the drawings. First, a communication system 1 using the router device 10 according to the first embodiment will be described. FIG. 1 shows a schematic diagram of a communication system 1 according to the first embodiment.

As shown in FIG. 1, in a communication system 1 according to the first embodiment, a terminal under the control (local area) of a router device 10 is on a public network (eg, global area) via the router device 10. Access the terminal or server. In other words, the router device 10 relays communication between devices in the local area and devices in the global area.

1 shows an example in which a personal computer 12 and a printer 13 are connected to the router device 10 via the hub 11 in the local area. The personal computer 12 and the printer 13 are communicably connected to each other by the routing function of the hub 11 . Also, the personal computer 12 and the printer 13 are connected to the router device 10 via the hub 11 . In addition, the router device 10 has a MAC address filtering function that restricts devices in the local area that can communicate with the public network based on MAC (Media Access Control) addresses of the devices. Further, in the communication system 1 according to the first embodiment, when adding the additional terminal 14 to the local area, the MAC of the additional terminal 14 is set so that the additional terminal 14 can communicate with the public network via the router device 10. It has the function of registering an address as an authorized MAC address to be authorized.

Therefore, the router device 10 will be described in more detail. FIG. 2 shows a block diagram of the router device 10 according to the first embodiment. As shown in FIG. 2, the router device 10 includes a LAN (Local Area Network) connection unit 20, a filter processing unit 21, a permitted MAC address database 22, a MAC address acquisition unit (for example, a DHCP server 23), a router processing unit 24, It has a WAN (Wide Area Network) connection section 25 , a filter registration processing section 26 , a timer management section 27 , a button switch 28 and a display section 29 .

The LAN connection unit 20 is a connection port that serves as a connection port for a terminal that communicates with an external area (for example, global area) via its own device. The filter processing unit 21 switches the operation mode between the normal operation mode and the filter registration mode based on the instruction from the filter registration processing unit 26 . Based on the permitted MAC address, the filter processing unit 21 restricts communication between unregistered terminals that are not permitted terminals and the global area in the normal operation mode, and allows specific packets from unregistered terminals to pass through in the filter registration mode. . When blocking communication, the filtering unit 21 discards a communication request sent from an unregistered terminal.

Further, in the filter registration mode, the filter processing unit 21 transmits a specific packet transmitted from an unregistered terminal to a DHCP (Dynamic Host Configuration Protocol) server 23, and receives from the DHCP server 23 in response to the transmitted DHCP packet. A DHCP response is sent to the unregistered terminal that is the source of the specific packet. Here, in Embodiment 1, since the DHCP server 23 is used as the MAC address acquisition unit, the filter processing unit 21 allows the specific packet conforming to DHCP to pass through. In the filter registration mode, the filter processing unit 21 refers to the permitted MAC address database 22 to distinguish between permitted terminals and unregistered terminals. The specific packet sent from the terminal is sent to the DHCP server 23, and communication requests including the specific packet sent from other unregistered terminals are discarded.

The permitted MAC address database 22 is, for example, a storage device such as a non-volatile memory. The permitted MAC address database 22 holds permitted MAC addresses, which are the MAC addresses of permitted terminals permitted to communicate with the global area. In the example shown in FIG. 1, the MAC address of personal computer 12 is stored in allowed MAC address database 22 .

The DHCP server 23 delivers network connection information necessary for communication in the unregistered terminal to the permitted terminal according to the received DHCP packet. This network connection information includes, for example, information such as a gateway address to be queried when an authorized terminal accesses the global area. The DHCP server 23 also obtains from the specific packet the MAC address of the unregistered terminal that has transmitted the specific packet, and transmits the obtained MAC address to the filter registration processing unit 26 .

The router processing unit 24 transmits and receives communication packets between the permitted terminal permitted to communicate by the filter processing unit 21 and the global area. The WAN connection unit 25 is a connection port to which a device such as a modem that relays communication with a public network is connected.

The filter registration processing unit 26 switches the filter processing unit 21 from the normal operation mode to the filter registration mode in response to detecting the depression of the button switch 28 . The filter registration processing unit 26 also records the MAC address received from the DHCP server 23 as a permitted MAC address in the permitted MAC address database. Further, the filter registration processing unit 26 displays on the display unit that a new permitted MAC address has been added to the permitted MAC address database 22, and then displays the permitted MAC address added to the permitted MAC address database 22 according to the number of times the button switch 28 is pressed. Either cancel or keep the MAC address.

The timer management unit 27 counts a predetermined processing time limit. More specifically, the timer management unit 27 starts measuring the processing time limit in response to an instruction output by the filter registration processing unit 26 in response to detection of the depression of the button switch 28 by the filter registration processing unit 26, When the processing time limit has passed, the filter registration processing unit 26 is notified that the processing time limit has passed. The filter registration processing unit 26 instructs the filter processing unit 21 to switch the operation mode from the filter registration mode to the normal operation mode in response to receiving the notification that the processing time limit has passed. The button switch 28 is a physical button that the user of the router device 10 pushes down, for example, when granting communication permission to the additional terminal 14 . The display unit 29 displays the status of the device during the filter registration process and the result of the filter registration process.

Among the processing blocks described above, the filter processing unit 21, the DHCP server 23, the router processing unit 24, the filter registration processing unit 26, and the timer management unit 27 are realized by a filter registration program executed by the calculation unit. be able to. Also, the permitted MAC address database 22 can be realized by a non-volatile memory or the like that can be accessed by the operation unit. The LAN connection unit 20, WAN connection unit 25, button switch 28, and display unit 29 are implemented as individual hardware connected to the calculation unit. In other words, the router device 10 can be implemented by a computer that executes a filter registration program in the computing section.

Next, filter registration processing in the router device 10 according to the first embodiment will be explained. Therefore, FIG. 3 shows a flowchart for explaining the operation of the router device 10 according to the first embodiment. In the router device 10, a filter registration processing program is executed at the same time when it is activated. Then, as shown in FIG. 3, in the router device 10, when the button switch 28 is pushed down, specific processing of filter registration processing is started (step S1). Note that the router device 10 preferably starts the filter registration process in response to the button switch 28 being pushed down for a certain period of time. In this manner, by starting the specific processing of the filter registration processing in response to the depression of the button switch 28 for a certain period of time or more, it is possible to prevent the filter registration processing from being started erroneously.

When the filter registration process is started, first, the filter registration processing unit 26 switches the operation mode of the router device 10 from the normal operation mode to the filter registration mode (step S2). In addition, the filter registration processing unit 26 sets the timer time to the timer management unit 27 in accordance with the start of the filter registration processing (step S3). Specifically, in step S3, the filter registration processing unit 26 instructs the timer management unit 27 to start timing, and tells the timer management unit 27 to set the time from the start of timing until the preset processing limit time elapses. let me measure.

Thereafter, the filter registration processing unit 26 notifies the filter processing unit 21 that the operation mode of the router device 10 has been switched to the filter registration mode, and the filter processing unit 21 performs mode switching processing for switching from the normal operation mode to the filter registration mode. (step S4). As a result, the filtering unit 21 notifies the DHCP server 23 of a specific packet (for example, a DHCP packet) from an unregistered terminal whose MAC address is not registered in the permitted MAC address database 22 among the accessing terminals. Upon receiving the DHCP packet, the DHCP server 23 extracts the MAC address of the terminal that transmitted the DHCP packet from the received specific packet, and notifies the filter registration processing unit 26 of the extracted MAC address. (Step S5). Note that if the MAC address is not notified from the DHCP server 23 to the filter registration processing unit 26 within the processing limit time clocked by the timer management unit 27 (NO branch in step S5), the router device 10 registers the permitted MAC address database 22. The processing ends without registering a new permitted MAC address. On the other hand, when the filter registration processing unit 26 receives the MAC address from the DHCP server 23 in step S5, the filter registration processing unit 26 adds a permitted MAC address to register the received MAC address in the permitted MAC address database 22 as a permitted MAC address. Processing is performed (step S6).

Subsequently, when the addition of the MAC address to the permitted MAC address database 22 is completed, the filter registration processing unit 26 instructs the filter processing unit 21 to cancel the filter registration mode (step S7). As a result, the operation mode of the filter processing unit 21 becomes the normal operation mode in which MAC address filtering is performed. Further, the filter registration processing unit 26 cancels the timer time for stopping the clocking of the timer management unit 27 in response to switching the operation mode of the filter processing unit 21 to the normal operation mode (step S8).

After that, the filter registration processing unit 26 displays the result of the filter registration processing on the display unit 29 (step S9). Here, the filter registration processing unit 26 displays the registered MAC address and whether or not the registration processing was successful on the display unit 29 (step S9). Then, the filter registration processing unit 26 switches whether to maintain the registered MAC address according to the number of times the user presses down the display unit 29 (step S10). In the example shown in FIG. 3, the filter registration processing unit 26 maintains the registered permitted MAC address if the number of pushes of the button switch 28 is one, and the number of pushes of the button switch 28 within a predetermined time is two. If so, the permitted MAC address registered in step S6 is canceled (step S11). After that, when it is determined whether to maintain or cancel the registered permitted MAC address, the filter registration processing unit 26 returns the display of the display unit to the initial display, and waits for processing until the button switch 28 is pressed next time. state (step S12).

As described above, the router device 10 according to the first embodiment acquires the MAC address of a terminal newly attached to the network by using a specific packet (for example, DHCP packet) transmitted by the terminal after belonging to the local area network. Then, the obtained MAC address is used as the permitted MAC address. As a result, in the router device 10, whether the additional terminal 14 is connected to the network by wire or belongs to the network wirelessly, it is possible to easily register the permitted MAC address for both connection modes. can be realized.

In addition, in the router device 10, it is possible to display the permitted MAC address registered by the filter registration on the display unit 29 after registration, and to judge the quality of the registered MAC address. If the registered permitted MAC address is invalid, it can be canceled by simply pressing the button switch 28 twice, thereby enhancing network security.

In addition, in the router device 10, only the terminal that issues the first DHCP packet in the filter registration mode is subject to registration of the permitted MAC address. As a result, in the router device 10, a plurality of terminals are not permitted to be used at once, thereby avoiding user confusion and further enhancing network security.

Further, in the router device 10, the timer management unit 27 is provided, and if no DHCP packet is received from the additional terminal 14 within the processing time limit, the filter registration processing is terminated without adding the permitted MAC address, thereby preventing unauthorized registration. can reduce the risk of

Embodiment 2
Embodiment 2 describes another example of the MAC address acquisition unit. FIG. 4 shows a block diagram of the router device 10a according to the second embodiment. As shown in FIG. 2, the router device 10a according to the second embodiment uses an ARP processing unit 33 as a MAC address acquisition unit.

The ARP processing unit 33 performs processing based on ARP (Address Resolution Protocol) commands. The ARP command is a protocol for obtaining MAC address information from an IP address. In order to communicate between devices connected to a LAN, MAC address information is required because IP packets are transmitted after being added with an L2 header in the lower layer. However, since these IP addresses and MAC addresses are not automatically associated, the MAC address of the terminal is obtained by the ARP command. The ARP processing unit 33 returns a response to the ARP command issued by the additional terminal 14, and obtains the MAC address of the additional terminal 14 at the time of this response. That is, when the ARP processing unit 33 is used as the MAC address acquisition unit, the specific packet is replaced with this ARP packet. As described above, the specific packet from which the MAC address of the additional terminal 14 can be acquired is not limited to the DHCP packet, but the packet to be passed when the filter processing unit 21 is in the filter registration mode is limited to a predetermined specific packet. By doing so, it is possible to further prevent an unauthorized terminal from entering a terminal registered as a permitted MAC address.

Here, the operation of the router device 10a according to the second embodiment will be explained. FIG. 5 shows a flowchart for explaining the operation of the router device 10 according to the second embodiment. As shown in FIG. 5, the operation of the router device 10a is obtained by changing the DHCP processing in step S5 of FIG. 3 to MAC address acquisition processing (step S25) by the ARP processing unit 33. FIG. Also in the router device 10, if the filter processing unit 21 is not set to the filter registration mode, communication between the additional terminal 14 to be added and the ARP processing unit 33 cannot be performed, so switching of the operation mode of the filter processing unit 21 in step S4 is required. is necessary.

In other words, if the MAC address acquisition unit acquires the MAC address of the additional terminal 14 from packets and information transmitted and received between the additional terminal 14 and the router device after the additional terminal 14 belongs to the local area network, Components other than those described in the embodiments can also be used.

It should be noted that the present invention is not limited to the above embodiments, and can be modified as appropriate without departing from the scope of the invention.

1 communication system 10 router device 11 hub 12 personal computer 13 printer 14 additional terminal 20 LAN connection unit 21 filter processing unit 22 permitted MAC address database 23 DHCP server 24 router processing unit 25 WAN connection unit 26 filter registration processing unit 27 timer management unit 28 button switch 29 display unit 33 ARP processing unit

Claims (7)

A LAN connection unit that serves as a connection port for a terminal that communicates with an external area via its own device;
a permitted MAC address database that holds permitted MAC addresses, which are the MAC addresses of permitted terminals that are permitted to communicate with the external area;
Based on the permitted MAC address, a filtering process for restricting communication between an unregistered terminal that is not the permitted terminal and the external area in a normal operation mode, and passing a specific packet issued from the unregistered terminal in a filter registration mode. Department and
a router processing unit that transmits and receives communication packets between the permitted terminal permitted to communicate by the filter processing unit and the external area;
a MAC address acquisition unit that acquires the MAC address of the unregistered terminal from the specific packet;
a user depressible button switch;
switching the filter processing unit from the normal operation mode to the filter registration mode in response to detecting the pressing of the button switch, and using the MAC address received from the MAC address acquisition unit as the permitted MAC address; a filter registration processing unit that records in an address database;
router device. After displaying on the display unit that the permitted MAC address has been newly added to the permitted MAC address database, the filter registration processing unit displays the permitted MAC address added to the permitted MAC address database according to the number of times the button switch is pressed. 2. The router device according to claim 1, wherein either processing of canceling or maintaining a MAC address is performed. The filter processing unit refers to the permitted MAC address database in the filter registration mode to distinguish between the permitted terminal and the unregistered terminal, and determines which of the unregistered terminals first accesses in the filter registration mode. 3. The apparatus according to claim 1, wherein the specific packet transmitted from the unregistered terminal that has been received is transmitted to the MAC address acquisition unit, and communication requests including the specific packet transmitted from other unregistered terminals are discarded. router device. Having a timer management unit that measures a predetermined processing time limit,
The timer management unit starts measuring the processing time limit in response to an instruction output by the filter registration processing unit in response to the detection of the depression of the button switch by the filter registration processing unit,
notifying the filter registration processing unit that the processing time limit has passed in response to the processing time limit passing;
wherein the filter registration processing unit instructs the filter processing unit to switch the operation mode from the filter registration mode to the normal operation mode in response to receiving the notification that the processing time limit has passed. 4. The router device according to any one of items 1 to 3. 5. The MAC address acquisition unit is a DHCP server that performs processing based on DHCP (Dynamic Host Configuration Protocol) or an ARP processing unit that performs processing based on ARP (Address Resolution Protocol). The router device described in . A LAN connection unit that serves as a connection port for a terminal that communicates with an external area via its own device, and a permitted MAC address database that holds permitted MAC addresses that are the MAC addresses of permitted terminals that are permitted to communicate with the external area. , a button switch that can be pressed by the user of the router device, and a filter processing unit that restricts communication between an unregistered terminal that is not the permitted terminal and the external area based on the permitted MAC address. A filter registration program running on a processor that
In response to detection of depression of the button switch, the filter is switched from a normal operation mode for blocking communication requests from the unregistered terminal to a filter registration mode for permitting communication of a specific packet transmitted from the unregistered terminal. mode switching processing for shifting the operation of the processing unit;
In the filter registration mode, the MAC address is obtained from the specific packet transmitted from the unregistered terminal, and the obtained MAC address is recorded as the permitted MAC address in the permitted MAC address database. processing;
A filter registration program that does A LAN connection unit that serves as a connection port for a terminal that communicates with an external area via its own device, and a permitted MAC address database that holds permitted MAC addresses that are the MAC addresses of permitted terminals that are permitted to communicate with the external area. , a button switch that can be pressed by the user of the router device, and a filter processing unit that restricts communication between an unregistered terminal that is not the permitted terminal and the external area based on the permitted MAC address. A filter registration method using a processor that
In response to detection of depression of the button switch, the filter is switched from a normal operation mode for blocking communication requests from the unregistered terminal to a filter registration mode for permitting communication of a specific packet transmitted from the unregistered terminal. mode switching processing for shifting the operation of the processing unit;
In the filter registration mode, the MAC address is obtained from the specific packet transmitted from the unregistered terminal, and the obtained MAC address is recorded as the permitted MAC address in the permitted MAC address database. processing;
How to register the filter.

Images