JP2000201143A - Terminal certification device - Google Patents

Abstract

PROBLEM TO BE SOLVED: To obtain a terminal certification device allowing only a server program to have a function for stopping an illegal access from a client terminal. SOLUTION: A server 2 is connected to plural client terminals 11 to 1n through Ethernet (registered trademark) 3. The server 2 is provided with a terminal data base 7 storing a record consisting of the terminal names, IP addresses and MAC addresses of the client terminals 11 to 1n. A terminal certification system 6 for extracting a MAC address from the data base 7 based on an IP address transferred from an access program as a parameter when the system is accessed from any one of the client terminals 11 to 1n and inspecting the presence of using right of the client terminal by deciding the combination of the IP address and the MAC address is correct or not is integrated in an interface program 5 built in the server 2.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

[0001] The present invention relates to a terminal authentication device,
In a system using the OCKET interface, the IP address and M of the connected client terminal
The present invention relates to a system for checking the legitimacy (whether or not there is a right to use) of a terminal by a combination of AC addresses.

[0002]

2. Description of the Related Art Japanese Patent Laid-Open Publication No.
"Local area network monitoring system" described in Japanese Patent No. 334671 can be mentioned. This technology uses collision-detected carrier multiple access (CSMA / CD).
Each of a plurality of terminals connected to a segment of a local area network such as Ethernet using Ethernet has, for example, an IP address and a MAC.
Identification information such as an address and a terminal name is assigned and stored, and the storage unit of the network monitoring device stores the identification information of each terminal. And
When the power of the terminal is turned on, a broadcast signal including the identification information on the terminal and indicating that the network environment has been started is issued to the segment. When the broadcast signal is received, the network monitoring device stores the broadcast signal in the storage device in the network monitoring device. Search for the identity of
Collate. At this time, if the received identification information of the terminal exists in the storage means, access to the segment of the terminal is tolerated, and nothing is performed. on the other hand,
If it is determined that the identification information does not exist in the storage means, the control logic automatically issues a collision signal to the terminal, prevents the terminal from using the LAN, and uses the LAN as necessary. The user performs an operation such as printing out identification information about the terminal that prevented the communication.

[0003]

However, according to the above-mentioned prior art, both the program on the network monitoring device (server) side and the program on the terminal (client) side use a terminal such as an IP address, a MAC address, and a terminal name. And an interface for transmitting and receiving the identification information. The present invention has been made in view of this point, and an object of the present invention is to provide a terminal authentication device in which only a server program needs to have a function of preventing unauthorized access from a client terminal.

[0004]

For this purpose, the terminal authentication apparatus according to the first aspect of the present invention is configured such that, when a call is made from a client terminal, the server executes the client authentication based on an IP address passed as a parameter from the calling program. The MAC address of the terminal is obtained, and it is determined whether or not the combination of the IP address and the MAC address is correct. A terminal authentication device according to a second aspect of the present invention is a terminal authentication device in a system in which a server and a plurality of client terminals are connected via Ethernet, wherein the server has a terminal name and an IP address of the client terminal. And a terminal database storing records consisting of a MAC address and a MAC address. When there is a call from the client terminal only in the server interface program, the terminal database is stored on the basis of the IP address passed as a parameter from the call program. A terminal authentication system for acquiring a MAC address, determining whether a combination of an IP address and a MAC address is correct, and checking whether or not the client terminal has a use right is incorporated. According to the present invention, by incorporating a terminal authentication system on the server side, a client terminal having no usage right in a system using the SOCKET interface can be used as an I / O terminal.
The P-address is illegally changed, and is shown to a terminal having the right to use, thereby preventing unauthorized access. This is usually performed using a unique user ID / password mechanism in the system, but conventionally, the client-side program and the server-side program had to be provided with the function. However, in the present invention, terminal authentication becomes possible by having a terminal authentication system only in the server program.

[0005]

Next, embodiments of the present invention will be described with reference to the drawings. Referring to FIG. 1, one embodiment of the present invention is shown and can be seen to be used in a client-server system configuration. That is, the n client terminals 11 to 1n and the server 2 are connected via the Ethernet 3. Each client terminal 1
On the 1st to 1n sides, the SOCKET interface program 4 is provided, while on the server side 2,
A SOCKET interface program 5 incorporating a terminal authentication system 6 is provided. Therefore, the terminal authentication system 6 exists only on the server 2,
SOCKET interface program 5 on server side
And operates as one function. Server 2
Is provided with a terminal database 7. Each record in the terminal database 7 of FIG.
It consists of items arranged in the order of address and MAC address, and each item is enclosed in parentheses ([]) to constitute one record. For example, if there is a terminal whose terminal name is TERM1, IP address is 111.22.11.222, and MAC address is 00: 00: 4C: FF: FF: FF, [TERM1] [111.22.11]
1.222] [00: 00: 4C: FF: FF: FF]
It becomes the definition. The file format is a text format sequential file in consideration of ease of maintenance and the processing speed of the file I / O. In operating the system, such data needs to be registered in the terminal database 7 in advance.

Next, the operation of this embodiment will be described with reference to FIG. FIG. 2 shows a flowchart of the terminal authentication system 6. First, in step A1, based on the IP address passed as a parameter from the calling program, the MA of the client terminal to be connected is determined.
Get the C address. At this time, ARP (Addre
ss Resolution Protocol). In step A2, the terminal database 7 is searched using the IP address as a keyword. It is determined whether or not the corresponding IP address exists in the terminal database 7 (step A3). If the IP address does not exist, NG is returned to the calling program and the program ends (A7). If the target IP address exists in step A3, it is determined whether the combination of the IP address and the MAC address is correct (step A3).
4) If the result of the determination is that the terminal is not a valid terminal, NG is returned to the calling program (A7), and the program is terminated. On the other hand, if the terminal is a valid terminal, OK is returned to the calling program (A6), and the program ends.

Next, another embodiment of the present invention will be described. Referring to FIG. 3, in this embodiment, the record in the terminal database 9 is such that a user ID and a password are combined.
Different from the record. As a result, terminal authentication and user authentication for the terminal can be performed, and unauthorized access with higher reliability can be prevented.

Next, the operation of this embodiment will be described with reference to FIG. FIG. 4 shows a flowchart of the terminal authentication system 8 in FIG. First, in step B1, the MAC address of the client terminal to be connected is obtained based on the IP address passed as a parameter from the calling program. At this time, ARP
(Address Resolution Protocol
ol). In step B2, the terminal database 9 is searched using the IP address as a keyword. It is determined whether or not the corresponding IP address exists in the terminal database 9 (step B3). If the IP address does not exist, NG is returned to the calling program and the program ends (B9). In step B3, if the target IP address is present, it is determined whether the combination of the IP address and the MAC address is correct (step B4). Return NG (B
9) End the program. The processing up to this point is shown in FIG.
Is the same as the processing in. 2 and FIG. 4, since the search of the terminal database 7 or 9, that is, the file I / O is performed only once, the client terminals 11 to 1n
Even if the user authentication function is added to, the processing speed is not significantly affected. Therefore, in this embodiment,
In steps B6 and B7 in FIG. 4, the user ID and password are checked, but this must be given as a parameter from the calling program, so that the client side SOCKET interface program 4 needs to be modified. Note that

[0009]

According to the present invention, the user ID /
If the system has a user authentication function using a password, it is possible to obtain an effect that more reliable prevention of unauthorized access can be realized. Also,
Even if the system uses the SOCKET interface that has already been put into operation and does not have such a function, the terminal usage right can be corrected only by modifying the server side program without modifying the client terminal side program. It is possible to introduce an inspection function.

[Brief description of the drawings]

FIG. 1 is a block diagram of one embodiment of the present invention.

FIG. 2 is a flowchart of the terminal authentication system in the embodiment shown in FIG. 1;

FIG. 3 is a block diagram of another embodiment of the present invention.

FIG. 4 is a flowchart of the terminal authentication system in the embodiment shown in FIG. 3;

[Explanation of symbols]

 11, 1n client terminal 2, 20 server 3 Ethernet 4, 5 SOCKET interface program 6, 8 terminal authentication system 7, 9 terminal database

──────────────────────────────────────────────────続 き Continued on the front page (51) Int.Cl. ⁷ Identification symbol FI theme coat ゛ (Reference) H04L 12/56 H04L 11/20 102Z F-term (Reference) 5B017 AA01 BA05 BB02 BB07 CA16 5B085 AE04 AE23 BG07 5J104 AA07 KA01 KA02 NA00 NA05 NA20 PA07 5K030 GA15 HC14 HD09 JT02 JT06 LB02 LC16 LD19 LD20 5K033 AA08 CA08 CB01 DA01 DB20 EC01 EC04

Claims (3)

[Claims] In a terminal authentication device in a system using a SOCKET interface, when a call is made from a client terminal, a server determines the M of the client terminal based on an IP address passed as a parameter from the calling program.
A terminal authentication device for acquiring an AC address and determining whether a combination of an IP address and a MAC address is correct, thereby checking whether or not the client terminal has a use right. 2. A terminal authentication device in a system in which a server and a plurality of client terminals are connected via Ethernet, wherein the server has a terminal name of the client terminal, an IP
A terminal database that stores a record consisting of an address and a MAC address. When there is a call from the client terminal only in the server interface program, the terminal database is stored on the basis of an IP address passed as a parameter from the call program. A terminal authentication system for acquiring a MAC address from a client terminal and determining whether a combination of an IP address and a MAC address is correct, thereby checking whether or not the client terminal has a right to use. 3. The terminal authentication system according to claim 2, wherein a user ID and a password are added to a record of said terminal database, and said terminal authentication system also performs user authentication.