KR20050029800A - Network connection control method - Google Patents

Abstract

A network connection control method is provided to operate an ARP(Address Resolution Protocol) table of a connection control target network terminal, and to continuously maintain a false ARP table, thereby continuously controlling a network connection of the connection control target network terminal. A system receives an ARP request message(S10). The system detects an IP address and an MAC address of a network terminal from the message, and stores association information between IP addresses and MAC addresses of all online network terminals(S20). The system verifies whether the network terminal is a connection target terminal(S30). If not, the system stores an IP address and an MAC address of the uncertified control target network terminal at a mapping table(S40), and transmits a false ARP response message(S50). The system checks states of online network terminals(S70). If the network terminals are in offline state(S80), the system removes IP address and MAC address information of the corresponding network terminals from the mapping table(S90).

Description

Network connection control method {NETWORK CONNECTION CONTROL METHOD}

The present invention relates to a network access control method, and more particularly, in a local area network environment, when a user wants to access a network through a network terminal, a network interface card mounted on the network terminal using ARP (Address Resolution Protocol) technology ( The present invention relates to a network access control method for continuously controlling network access by falsely manipulating the ARP table of an access control target network terminal after a process of determining access control by a MAC (Media Access Control) address of a network interface card.

ARP (Address Resolution Protocol) technology is a communication protocol for translating an IP address into a hardware address in MAC, which is a sublayer of the data link layer, for the TCP / IP protocol to communicate. In other words, in order to perform data communication using IP, it is necessary to find out the MAC (Media Access Control) address information of the network interface card where the IP address is set.

As a network terminal control technology using the ARP, there are techniques for blocking network access of unauthorized network terminals in a network access control system.

For these technologies, when an unauthorized network terminal sends an ARP request message to a specific system to access a network, the network access blocking system that receives it sends a false ARP response message to the destination system to the unauthorized network terminal. There is a method for transmitting an unauthenticated network terminal to have a false ARP table for a destination system.

Such false ARP response message transmission means that when the detected access control target network terminal wants to access the network, the MAC address of the destination system is set as the false MAC address for the ARP request message transmitted from the access control target network terminal to the specific system as a destination. The false ARP response message is changed to the access control target network terminal so that the access control target network terminal has a false ARP table for the destination system.

That is, it is a method of controlling a network connection by preventing a packet transmitted from a network terminal subject to access control to reach a destination system or to be delivered to another destination system.

Referring to the method of transmitting a false ARP response message implemented in the network terminal attack unit of the network access control system shown in FIG.

The network access control system is installed in a local area network in which network terminals that can be subject to network access control exist.

When the non-authenticated network terminal, which is the access control target network terminal 10, wants to access the network for communication with the external Internet, the access control target network terminal 10 uses the router 20 to obtain the MAC address of the router 20. The ARP request message is transmitted to the destination. The ARP request message is transmitted to the network access control system 30 because it is transmitted to all network terminals and network equipment existing in the same local area network.

The network access control system 30 having received the ARP request message transmits a false ARP response message in which the MAC address of the router 20 is changed to a false MAC address to the access control target network terminal 10 to access the network control target network terminal. Let 10 have a false ARP table for router 20.

Therefore, the packet transmitted from the access control target network terminal 10 receiving the false ARP response message cannot reach the router 20, thereby blocking the network connection of the access control target network terminal 10.

However, the network terminal transmits the ARP request message in its ARP table not only when it receives an ARP response message for the ARP request message sent by the network terminal but also when the destination receives an ARP request message other than itself. It will change the IP address information and MAC address information of the system.

2 illustrates a process of changing an ARP table of an access control target network terminal when the router transmits an ARP request message to a destination to communicate with the first network terminal.

That is, when the router 20 transmits the ARP request message to the destination of the first network terminal 40, the access control target network terminal 10 that receives the ARP request message may receive its own message even if the destination of the ARP request message is not itself. In the ARP table, the false MAC address information of the router is changed to the normal MAC address information.

Therefore, the non-authenticated network terminal, which is the access control target network terminal, is previously transmitted by the network access control system to block the network connection by any normal ARP request message sent by the source system to a destination other than itself. Since a false ARP table configured to receive a false ARP response message for the originating system is restored to a normal state, normal packet transmission is possible, and thus there is a problem in that the network connection of the unauthorized network terminal cannot be continuously blocked.

In addition, as a method for blocking network access of an unauthorized network terminal using ARP, when a specific system sends an ARP request message to a non-authenticated network terminal, the network access blocking system receiving the ARP request message transmits the ARP request message. There is a method of transmitting a false ARP response message for an unauthorized network terminal to a source system so that the source system has a false ARP table for the unauthorized network terminal.

This method prevents packets sent to a non-authenticated network terminal from reaching a non-authenticated network terminal.However, if an unauthorized user randomly assigns an IP, the network connection of the network terminal that is normally connected to the network may be blocked. There is a problem.

The present invention was made to solve the above problems, and an object of the present invention is to provide an ARP table of an access control target network terminal using ARP technology when a user wants to access a network through a network terminal in a local area network environment. The present invention provides a method for controlling network access of a network terminal to continuously control network access of a network terminal to be controlled for access by operating and maintaining a false ARP table continuously.

In addition, the present invention is to operate only the ARP table of the network terminal subject to the access control, so as not to affect the other network terminal is effective to control the specific network terminal and the network connection does not occur the ripple effect to other network terminal The present invention provides a control method.

According to the present invention for realizing the above object, when a network terminal transmits an ARP request message for obtaining a MAC address of a destination system to access a network, the destination system includes the MAC address of the destination system. A network access control method for transmitting an ARP response message, comprising: a first step of receiving the ARP request message and detecting a MAC address and an IP address of a network terminal from a source address; and detecting the network in the ARP table of the network terminal A second step of storing the IP address and the MAC address of the terminal in the IP-MAC address association information management table of the network access control system; and a third step of verifying whether the network terminal is a controlled network terminal using the MAC address of the network terminal; According to the verification result of the network terminal, In the case of the controlled network terminal, a fourth step of controlling a network connection by transmitting a false ARP response message and a false ARP request message to the network terminal, and controlling the connection of the controlled network terminal by the first to fourth steps. While the network terminal does not use the network, and further comprising the fifth step of removing the IP address and MAC address of the network terminal in the ARP table.

In the above step, the false ARP request message is transmitted immediately after receiving the ARP request message sent to the destination in the step of verifying whether the control target network terminal.

In this case, it is preferable to unicast the false ARP request message so that only the control target network terminal can control it.

The MAC address of the fake ARP response message and the fake ARP request message may be a randomly generated address or a MAC address of another specific network terminal.

According to the present invention made as described above, when the control target network terminal transmits an ARP request message to access the network, the network access control system determines whether the control target network terminal is used, and in the case of the control target network terminal, transmits a false ARP response message to control the target network terminal. Not only does it prevent the network terminal from accessing the network, but even when it receives an ARP request message destined for the controlled network terminal, it transmits a false ARP request message to the controlled network terminal and maintains the false ARP table continuously. The terminal is controlled to prevent access to the network.

Hereinafter, exemplary embodiments of the present invention will be described with reference to the accompanying drawings. In addition, this embodiment is not intended to limit the scope of the present invention, but is presented by way of example only.

4 is a flowchart sequentially illustrating a network access control method according to the present invention.

As shown here, first, an ARP request message transmitted to access a network is received from a network terminal connected to a local area network (S10).

Then, the IP address and MAC address of the network terminal are detected from the received ARP request message and stored in a table that manages the association information between the IP address and the MAC address of all online network terminals connected to the local area network (S20).

Thereafter, the network terminal verifies whether the network terminal is the access control target network terminal through the detected MAC address (S30).

Therefore, if the verified result is a non-authenticated access control target network terminal, the IP address and MAC address of the non-authenticated control target network terminal are stored in a mapping table (S40), and a false ARP response is obtained by changing the MAC address to a false target for the controlled network terminal. Send a message (S50).

In this case, the falsely changed MAC address may be arbitrarily produced or may be set to the MAC address of the network terminal of a specific system that is not required by the network terminal to be controlled.

When the control target network terminal is verified as described above, the false ARP table of the control target network terminal set to false by the false ARP response message is not changed for the ARP request message destined for the control target network terminal. The false ARP request message is transmitted to continue (S60).

This will be described with reference to the drawings for explaining a method of transmitting a false ARP request message in the network access control system according to the present invention shown in FIG.

A fake ARP request message in which the MAC address of the router 20 is changed to a false MAC address immediately after the network access control system 30 receives the ARP request message from the router 20 to the destination. (Unicasting) to the access control target network terminal 10 so that the access control target network terminal 10 receives a false ARP request message and then displays a normal MAC address for the router 20 in its ARP table. Since the packet transmitted from the access control target network terminal 10 to the router 20 does not reach the router 20, the network control of the access control target network terminal 10 is blocked.

In this case, since the general ARP request message is broadcasted to all network terminals existing in the same local area network, there is a problem that the connected network is blocked because it affects other network equipment or normal network terminals existing in the same local area network. The present invention is characterized in that by controlling unicasting (unicasting) of transmitting the false ARP request message in a 1: 1 manner, only a network connection target network terminal is controlled to block the ripple effect on other network terminals.

Then, the state of the online network terminals connected to the local area network is checked (S70).

Thus, when the network terminal is in an OFF-LINE state (S80), the IP address and MAC address of the online network terminal are removed from the ARP table and the mapping table (S90).

However, in the case of maintaining the ON-LINE state, the ARP request message is returned to the ARP request message reception state as described above, and the above process is repeated to control the network connection of the access control target network terminal (S80).

As described above, the present invention provides a MAC (Media Access Control) address of a network interface card mounted on a network terminal using ARP technology when attempting to access a network through a network terminal in a local area network (LAN) environment. After the verification process is performed, the ARP table of the access control target network terminal is operated to maintain a false ARP table, thereby blocking the packet communicating with the controlling network terminal or forcing a redirect to a specific system. The advantage is that you can control the connection continuously.

In addition, the present invention is to affect the network connection of the normal network terminal due to the network connection attempt of the access control target network terminal by controlling the network connection of the access control target network terminal while not affecting the network terminal that is normally connected to the network. There is an advantage that can block.

In addition, the present invention has an advantage that the security can be strengthened by controlling the network connection of the other network terminal except the network terminal is permitted to access in a wireless local area network environment particularly weak security.

1 is a diagram for describing a method of transmitting a false ARP response message generally implemented in a network access control system.

2 is a diagram for describing a process of changing an ARP table, which is generally managed by a terminal connected to a network.

3 is a flowchart sequentially illustrating a network access control method according to the present invention.

4 is a diagram illustrating a method of transmitting a false ARP request message in a network access control system according to the present invention.

   -Explanation of symbols for the main parts of the drawings-

10: network terminal subject to access control

20; router

30: network access control system

40: first network terminal

Claims (4)

When the network terminal transmits an ARP request message for obtaining the MAC address of the destination system to access the network, the destination system transmits an ARP response message including the MAC address of the destination system to the network terminal. In Receiving the ARP request message and detecting a MAC address and an IP address of a network terminal from a source address; A second step of storing the IP address and MAC address of the network terminal detected in the ARP table of the network terminal in an IP-MAC address association information management table of a network access control system; A third step of verifying whether the network terminal is a controlled target terminal using the MAC address of the network terminal; A fourth step of controlling a network connection by transmitting a false ARP response message and a false ARP request message to the network terminal according to the verification result of the network terminal; A fifth step of removing the IP address and the MAC address of the network terminal from the ARP table when the network terminal does not use the network while controlling the access of the controlled network terminal according to the first to fourth steps; Network access control method, characterized in that further comprises. The network access control as claimed in claim 1, wherein the false ARP request message is transmitted immediately after receiving the ARP request message sent to a destination in the step of verifying whether the false ARP request message is the controlled network terminal. Way. The method according to claim 1 or 2, wherein the false ARP request message is unicasted so that only a controlling network terminal can be controlled. The method of claim 1, wherein the MAC address of the fake ARP response message and the fake ARP request message is a randomly generated address or a MAC address of another specific network terminal.