JP2012070225A - Network relay device and transfer control system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To apply various policies to an individual terminal device or an individual user who uses the terminal device without being limited to a VLAN.SOLUTION: An authentication server 20 executes authentication of respective terminal devices 10, 12, 14, 16 and authentication of a user who uses those terminal devices, using a prescribed network authentication method. Network relay devices 1, 2 perform filtering with respect to a user frame based on a policy corresponding to a class ID allocated to an individual terminal device or a user in the process of relaying the user frame received from authenticated respective terminal devices 10, 12, 14, 16.

Description

  The present invention relates to a network relay device and a transfer control system.

  Conventionally, before a terminal device performs communication to a network or a predetermined server connected via a switching hub, an authentication server connected via the switching hub uses a predetermined network authentication method to Prior art for authenticating an individual is known (for example, see Patent Document 1). In this prior art, a terminal device, a router, and the like are connected to a switching hub, and a RADIUS (Remote Authentication Dial In User Service) server and the like are further connected to the switching hub.

  The RADIUS server used in the prior art includes a user ID and a password for individually identifying a user who uses the terminal device by a worker who manages the server in advance, and a VLAN (Virtual Local Area Network) ID assigned to the user. Can be registered. The RADIUS server authenticates the user who uses the terminal device connected to the switching hub. When the authentication is successful, the RADIUS server notifies the switching hub of a response packet indicating the VLAN ID together with the authentication result. Based on the received response packet, the switching hub sets the VLAN to the port to which the terminal device that has been successfully authenticated is connected.

  For this reason, according to the above prior art, an operator who manages a RADIUS server or a terminal device transmits source information such as a MAC (Media Access Control) address or an IP (Internet Protocol) address assigned to the RADIUS server. Even if the user ID and password for identifying each user and the VLAN ID corresponding to the user are registered in advance, the VLAN is automatically set to the port of the switching hub together with the user authentication. can do.

JP 2005-286558 A

  By the way, when a frame transmitted from a generally authenticated terminal device is received by the switching hub, the received frame is filtered by the switching hub based on policies (filtering conditions) such as an access list, routing, and priority control. By doing so, it is considered that the communication security can be further improved.

  However, when a VLAN ID is set for a port to which a terminal device is connected in a switching hub, even though a common policy can be applied in units of VLAN IDs, each individual belonging to the same VLAN ID at present Various policies cannot be freely set for the user.

  Therefore, the present invention is not limited to a VLAN, and an object of the present invention is to provide a technology that can apply various policies to individual terminal devices or individual users who use the terminal devices.

  In order to achieve the above object, a network relay device of the present invention is a network relay device that relays a user frame transmitted from a terminal device, and includes terminal device identification information for identifying the terminal device and filtering identification information. Filtering corresponding to the terminal device identification information by referring to the filtering identification information storage unit stored in association with the filtering identification information storage unit by the terminal device identification information of the terminal device that transmitted the user frame stored in the user frame A transfer processing unit that identifies the identification information for filtering, and a filtering identification information and a policy for filtering are stored in association with each other, based on the policy corresponding to the filtering identification information identified in the transfer processing unit, Filtering that performs filtering on user frames And a grayed part.

  In order to achieve the above object, the transfer control system of the present invention includes a terminal device and a network relay device that relays a user frame transmitted from the terminal device. When the network relay device relays a user frame, The network relay apparatus includes a filtering identification information storage unit that stores therein terminal device identification information for identifying terminal devices and filtering identification information in association with each other, and a user frame. A transfer processing means for identifying the filtering identification information corresponding to the terminal device identification information by referring to the filtering identification information storage unit by the terminal device identification information of the terminal device that has transmitted the stored user frame; and the filtering identification information; Map to policy for filtering Stored and, based on the policy corresponding to the filtering identification information specified by the transferring unit, and a filtering means for performing filtering to the user frame.

  According to the network relay device and transfer control system of the present invention, various policies can be applied to individual terminal devices or individual users using the terminal devices, without being limited to VLANs.

It is a figure which shows roughly the structural example of the transfer control system of 1st Embodiment. It is a block diagram which shows roughly the functional structure of a network relay apparatus and an authentication server. It is a table | surface which shows the class ID table of a network relay apparatus. It is a table | surface which shows the filtering table which a filtering part has. It is a table | surface which shows the authentication information and class ID registered into authentication DB. It is a sequence diagram which shows the flow of the transfer process of a user frame. It is a figure which shows roughly the structural example of the transfer processing system of 2nd Embodiment. It is a block diagram which shows roughly the functional structure of the network relay apparatus of 2nd Embodiment. It is a sequence diagram which shows the flow of the transfer process of the user frame in 2nd Embodiment.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings. In the following, an embodiment executed by the network relay device will be mainly described, but a combination of the network relay device and the terminal device is an embodiment as a “transfer control system”.

[First Embodiment]
FIG. 1 is a diagram schematically illustrating a configuration example of a transfer control system according to the first embodiment. The network relay apparatuses 1 and 2 are provided with a plurality of ports 4, and an access point 6 and a HUB 8 for wireless communication are connected to any one of the ports 4. In addition, terminal devices 10 and 12 and terminal devices 14 and 16 are connected to the access point 6 and the HUB 8, respectively. In addition, an authentication server 20 and a business server 22 are connected to the network relay devices 1 and 2 via the corporate network 18. Further, a public network 26 is connected to the network relay devices 1 and 2 via the corporate network 18 and the router 24. The network relay devices 1 and 2 may be connected to a plurality of terminal devices, department servers, department networks, and the like (not shown).

[Overview of transfer control system]
The network relay apparatuses 1 and 2 are switching hubs having data transfer functions such as layer 2 and layer 3 of an OSI (Open Systems Interconnection) reference model, for example. The network relay devices 1 and 2 transfer user frames transmitted from the terminal devices 10, 12, 14, and 16 to the destination terminal devices 10, 12, 14, and 16, and a plurality of terminal devices and business servers (not shown) 22 or the public network 26 or the like. In the present specification, the “user frame” is used to include a layer 2 frame and a layer 3 packet transmitted from the terminal devices 10, 12, 14, and 16.

  Further, the network relay devices 1 and 2 have an authentication function, and data from a terminal device that has not been successfully authenticated is blocked from relaying, and data from a terminal device that has been successfully authenticated is relayed. The network relay devices 1 and 2 perform relay for communication for performing authentication between the terminal devices 10, 12, 14, 16 and the authentication server 20 that have not been successfully authenticated.

  The terminal devices 10, 12, 14, and 16 are devices such as a PC (Personal Computer) and a workstation that are operated by a predetermined user and transmit / receive data as a user frame.

  The authentication server 20 is a server for authenticating each terminal device 10, 12, 14, 16 and a user who uses these using a predetermined network authentication method. As the network authentication method, for example, the authentication server 20 displays a WEB page for inputting a user ID and a password on the terminal device, and authenticates the user based on the input user ID and password (WEB). Authentication), an authentication method (MAC authentication) for authenticating a terminal device based on a MAC (Media Access Control) address, an authentication method based on the IEEE (Institut of Electrical and Electronic Engineers) 802.1x standard, an authentication method based on the RADIUS protocol, etc. Is used to authenticate the terminal devices 10, 12, 14, 16 and users who use them.

  Further, in order to authenticate the terminal devices 10, 12, 14, 16 and users who use these in advance, the authentication server 20 authenticates MAC addresses, authentication information such as user IDs and passwords, VLAN IDs, and filtering described later. The class ID as the business identification information is registered in association with each other. The authentication server 20 performs authentication with each terminal device 10, 12, 14, 16 based on the above network authentication method. For example, the authentication information transmitted from each terminal device 10, 12, 14, 16 is transferred to the authentication server 20 via the network relay devices 1, 2. Specifically, the authentication server 20 determines that the authentication is successful when the received authentication information is registered, and determines that the authentication is unsuccessful when the received authentication information is not registered. When the authentication by the authentication server 20 is successful, the terminal devices 10, 12, 14, 16 are permitted to relay communication in the network relay devices 1, 2, and the corporate network 18, The business server 22, the public network 26, etc. can be accessed.

  In addition, the network relay devices 1 and 2 perform, for example, an access list in the process of relaying user frames received from the terminal devices 10, 12, 14, and 16 authenticated by the authentication server 20 using a predetermined network authentication method. In addition, user frames can be filtered based on policies (filtering conditions) such as routing and priority control. Note that a technique for filtering user frames in the process of transferring user frames in the network relay apparatuses 1 and 2 will be described in more detail later with reference to FIGS.

  FIG. 2 is a block diagram schematically showing functional configurations of the network relay devices 1 and 2 and the authentication server 20. In addition, the arrow shown with a dotted line in FIG. 2 represents the direction in which a user frame or authentication information is transferred.

  The network relay devices 1 and 2 mainly include a CPU (Central Processing Unit) 28, a transmission / reception unit 30, and a control unit 32.

The CPU 28 controls operations executed by the transmission / reception unit 30 and the control unit 32.
The transmission / reception unit 30 includes a plurality of ports 4, and the plurality of ports 4 include the access point 6 shown in FIG. 1, the HUB 8, the authentication server 20, the corporate network 18, other terminal devices (not shown), and the like. It is connected.

  The transmission / reception unit 30 transfers the user frame received at the port 4 to the control unit 32. Specifically, the transmission / reception unit 30 adds an in-device tag to the user frame, stores the port number of the received port in a predetermined area of the in-device tag, and transfers the user frame to the control unit 32.

  Further, the transmission / reception unit 30 transmits the user frame transferred from the control unit 32 from a predetermined port 4. Specifically, the transmission / reception unit 30 refers to the transfer destination port number stored in the in-device tag of the user frame, and transmits the user frame from the port 4 corresponding to the transfer destination port number. The transmission / reception unit 30 removes the in-device tag attached to the user frame when transmitting the user frame from the port 4.

  The control unit 32 includes a transfer processing unit 34, a class ID table 36 as a filtering identification information storage unit, an FDB (Forwarding Data Base) 38, and a filtering unit 40 as a filtering unit. Perform the transfer process. In the present embodiment, the control unit 32 uses the transfer processing unit 34, the class ID table 36, the FDB 38, and the filtering unit 40 to process user frames transmitted from the individual terminal devices 10, 12, 14, and 16. And filtering based on a predetermined policy.

[Identification information storage unit for filtering]
The class ID table 36 serving as a filtering identification information storage unit includes a MAC address or IP address as terminal device identification information for identifying the terminal device 10, 12, 14, 16 that is the transmission source of the user frame, and a filtering identification. A class ID as information is associated and registered. The class ID table 36 will be described later in detail with reference to FIG.

  In the FDB 38, the MAC address and the port number are registered in association with each other in the same manner as the FDB provided in a known switching hub.

[Transfer processing unit (transfer processing means)]
The transfer processing unit 34 receives the user frame transferred from the transmission / reception unit 30.
The transfer processing unit 34 discards the user frame transmitted from the terminal device that has not been successfully authenticated, and performs transfer processing on the user frame transmitted from the terminal device that has been successfully authenticated. Note that the transfer processing unit 26 performs transfer processing for user frames transmitted from terminal devices that have not been successfully authenticated and for communication with the authentication server 20 for authentication. Further, for example, the control unit 32 includes an authentication table (not shown) in which authentication success or failure information and a port number or terminal device identification information are stored in association with each other, and the transfer processing unit 34 includes an authentication table. The user frame may be determined to be transferred or discarded.

  In the case of a user frame transmitted from a terminal device that has been successfully authenticated, the transfer processing unit 34 refers to the class ID table 36 and associates it with the transmission source MAC address by using the transmission source MAC address that is the transmission source information of the user frame. The registered class ID is specified. The transfer processing unit 34 adds the identified class ID to the user frame. Specifically, the class ID is stored in a predetermined area of the in-device tag attached to the user frame.

  Next, the transfer processing unit 34 refers to the FDB 38 based on the destination MAC address of the user frame, and identifies the port number registered in association with the destination MAC address. The transfer processing unit 34 adds the specified port number to the user frame. Specifically, the port number is stored in a predetermined area of the in-device tag added to the user frame. In addition, the transfer processing unit 34 associates the transmission source MAC address of the user frame with the port number of the received port stored in the in-device tag attached to the user frame, and registers it in the FDB 38.

  Next, the transfer processing unit 34 transfers the user frame to the transmission / reception unit 30 via the filtering unit 40.

[Filtering section (filtering means)]
The filtering unit 40 refers to the class ID added to the user frame while the transfer processing unit 34 transfers the user frame to the transmission / reception unit 30, and filters the user frame based on the policy corresponding to the class ID. Specifically, the filtering unit 40 includes a filtering table 42 as a filtering information storage unit that stores a class ID and a policy in association with each other. The filtering unit 40 performs filtering such as an access list, routing, and priority control based on a policy stored in the filtering table 42 in association with the class ID added to the user frame.

  The authentication server 20 includes a CPU 44 as an authentication unit (authentication unit) and an authentication DB 46 as an authentication management unit (authentication management unit). For example, the CPU 44 uses the WEB authentication, the MAC authentication, the authentication method based on the IEEE802.1x standard, the authentication method based on the RADIUS protocol, or the like to authenticate the terminal devices 10, 12, 14, and 16 and uses them. Authenticate the user. In the authentication DB 46, for example, authentication information such as a MAC address, a user ID, and a password, a VLAN ID assigned to each user, and a class ID assigned to each user are registered in association with each other.

  For example, when the CPU 44 receives the authentication information transmitted from the terminal device 10 illustrated in FIG. 1 via the network relay device 1, the CPU 44 collates the authentication DB 46 with the received authentication information. When the received authentication information is registered in the authentication DB 46, the CPU 44 determines that the authentication is successful and transmits response data indicating that the authentication is successful to the terminal device 10. At this time, the response data stores the VLAN ID and class ID stored in the authentication DB 46 in association with the received authentication information. On the other hand, if the received authentication information is not registered in the authentication DB 46, the CPU 44 determines that the authentication is unsuccessful, and transmits response data indicating that the authentication is unsuccessful to the terminal device 10. The table indicating the authentication information and class ID registered in the authentication DB 46 will be described later in detail with reference to FIG.

  FIG. 3 is a table showing the class ID table 36 of the network relay devices 1 and 2.

  In FIG. 3, the “source address” column arranged in the left column indicates MAC addresses, IP addresses, and the like assigned to the terminal devices 10, 12, 14, and 16 that transmit user frames. . In the “class ID” column arranged in the right column, class IDs are indicated by numbers.

  The class IDs indicated by the numbers correspond to the MAC addresses and IP addresses shown in the left column. For example, “20” shown in the class ID column corresponds to the MAC address or IP address of the terminal device 10 shown in the source address column, and “30” shown in the class ID column. "Corresponds to the MAC address or IP address of the terminal device 12.

  For example, when the transfer processing unit 34 receives a user frame transmitted from the terminal device 10, the transfer processing unit 34 refers to the class ID table 36 based on the transmission source MAC address or transmission source IP address of the user frame, and determines the MAC of the terminal device 10. The class ID “20” registered in association with the address or IP address is specified. Then, the identified class ID “20” is added to the user frame.

  The network relay devices 1 and 2 are stored in the response data when the transfer processing unit 34 relays the response data transmitted from the authentication server 20 to the terminal devices 10, 12, 14, and 16 indicating that the authentication is successful. With reference to the class ID, the MAC address or IP address of the terminal device 10, 12, 14, 16 is associated with the class ID and registered in the class ID table 36.

  FIG. 4 is a table showing a filtering table 42 included in the filtering unit 40. The filtering unit 40 filters the user frame based on the policy corresponding to the class ID in the process in which the user frame to which the class ID is added is relayed to the transfer destination port 4 by the transfer processing unit 34. The contents of the policy include, for example, “access list”, “routing”, “priority control”, and “count / mirror”. The contents of the policy are the same as the known policies, and detailed description thereof is omitted here.

  In FIG. 4, in the “class ID” column arranged in the leftmost column, numbers “20” and “30” indicating the class ID are shown. The columns “Access List”, “Routing”, “Priority Control” and “Count / Mirror”, which are the specific contents of the policy, are arranged from the second column to the fifth column from the left. Each content of the policy is shown as either valid or invalid.

  For example, in the class ID “20” shown in the class ID column, the “access list” and “priority control” columns are shown as “valid”, and the “routing” and “count / mirror” columns are shown. Shown as "invalid". Therefore, when receiving the user frame to which the class ID “20” is added, the filtering unit 40 filters the user frame based on the access list and priority control.

  It should be noted that any one of the above “access list”, “routing”, “priority control”, and “count / mirror” may be used. Other contents may be added to the policy, and a user or an operator who manages the content can specify a necessary policy in the class ID according to the usage.

  In this way, it is possible to define any combination of the class ID and various policies that are valid or invalid. For this reason, for example, an operator who manages the network relay devices 1 and 2 and the terminal devices 10, 12, 14, and 16 can define necessary policies for each user or each device.

  FIG. 5 is a table showing authentication information and class IDs registered in the authentication DB 46. In FIG. 5, the “user ID” column arranged in the leftmost column shows account information for recognizing the user who uses each terminal device 10, 12, 14, 16. Here, for example, it is assumed that “user1” is shown in the “user ID” column as account information for recognizing a user who uses the terminal device 10.

  In the “password” column arranged in the second column from the left, a password corresponding to the account information shown in the “user ID” column is shown. For example, the password corresponding to “user1” shown in the “user ID” column is shown as “pass1” in the “password” column.

  VLAN information is shown in the “VLAN ID” column arranged in the third column from the left. For example, when the user who uses the terminal device 10 belongs to the VLAN number 10, “10” representing the VLAN number is shown in the “VLAN ID” column. Note that “−” shown in the first to third lines from the bottom of the “VLAN ID” column indicates that no VLAN is set in the terminal device.

  In the “class ID” column arranged in the rightmost column, the class IDs described above are indicated by numbers. The number shown in the “class ID” column corresponds to the account information registered in the “user ID” column. For example, “user1” is “20” shown in the class ID column. It corresponds.

  FIG. 6 is a sequence diagram showing a flow of user frame transfer processing. The flow of user frame transfer processing will be described below based on the sequence diagram.

Step S10: The terminal device 10 transmits authentication information to the authentication server 20 based on a predetermined network authentication method.
Step S12: The network relay device 1 transfers the authentication information transmitted from the terminal device 10 to the authentication server 20.
Step S14: Upon receiving the authentication information, the authentication server 20 refers to the authentication DB 46 and determines whether the authentication is successful or unsuccessful. Next, the authentication server 20 notifies the response data indicating the authentication result to the terminal device 10 (step S16).

  Step S18: The network relay device 1 transfers the response data transmitted from the authentication server 20 to the terminal device 10. When the authentication is successful, the network relay device 1 refers to the received response data and registers the MAC address or IP address of the terminal device 10 and the class ID in association with each other in the class ID table.

  Here, when the response data transferred from the network relay device 1 indicates successful authentication, the terminal device 10 can communicate via the network relay device 1. On the other hand, when authentication fails, for example, the user who uses the terminal device 10 may input authentication information again and execute step S10. In any case, unless the authentication is successful, communication is interrupted in the network relay device 1, and thus the terminal device 10 cannot transmit and receive data via the network relay device 1.

  In the following steps S20 to S28, for example, a user frame transfer process when the terminal device 10 accesses the business server 22 will be described.

  Step S20: The terminal device 10 transmits a user frame to the business server 22.

  Step S22: Upon receiving the user frame transmitted from the terminal device 10, the network relay device 1 refers to the class ID table 36 by the transmission source MAC address of the user frame and is associated with the transmission source MAC address of the user frame. The stored class ID “20” is added to the user frame.

  Step S24: Next, the network relay device 1 refers to the FDB 38 based on the destination MAC address of the user frame, specifies the port number stored in association with the destination MAC address of the user frame, and sets this port number. Add to user frame and transfer user frame to transceiver 30

  Step S26: The filtering unit 40 of the network relay device 1 performs user frame filtering based on the policy corresponding to the class ID in the process of transferring the user frame to the transmission / reception unit 30. For example, when the class ID “20” is added to the user frame, the filtering unit 40 is based on the “access list” and “priority control” indicating “valid” in FIG. 4 among the policies corresponding thereto. Filter user frames. In this embodiment, it is assumed that access to the business server 20 is permitted for the class ID “20” by the access list.

  Step S28: The network relay device 1 transfers the user frame from the port 4 to the business server 20 based on the above filtering. At this time, the network relay device 1 deletes the class ID added to the user frame and transfers it.

  In the following steps S30 to S38, for example, a user frame transfer process when the terminal device 10 accesses the public network 26 will be described.

Step S30: The terminal device 10 transmits a user frame toward the public network 26.
Step S32: When the network relay device 1 receives the user frame transmitted from the terminal device 10, the network relay device 1 executes the same procedure as the above-described steps S22 to S24. That is, the network relay device 1 adds the class ID “20” to the user frame (step S32), and then specifies the transfer destination port 4 with reference to the FDB 38 (step S34). Further, the filtering unit 40 performs filtering of user frames based on the policy (access list and priority control) defined for the class ID “20” (step S36). In this embodiment, it is assumed that access to the public network 26 is prohibited for the class ID “20” by the access list.

  Step S38: As a result of filtering the user frame in step S36, the network relay device 1 discards the user frame without transmitting it from the transfer destination port 4.

  In the following steps S40 to S44, authentication information transfer processing when the terminal device 12 is authenticated by the authentication server 20 will be described.

  Step S <b> 40: The terminal device 12 transmits authentication information such as a user ID and a password input by a user who uses the terminal device 12 to the authentication server 20.

  Step S42: The network relay device 1 transfers the authentication information transmitted from the terminal device 12 to the authentication server 20.

  Step S44: Upon receiving the authentication information, the authentication server 20 refers to the authentication DB 46 based on the received authentication information, and determines the success or failure of the authentication, as in step S14. Next, similarly to step S16, the authentication server 20 notifies the terminal device 12 of response data indicating the authentication result (step S46). At this time, the network relay device 1 refers to the content of the received response data and associates the MAC address or IP address of the terminal device 12 with the class ID and registers them in the class ID table 36.

  In the following steps S50 to S58, the user frame transfer process when the terminal device 12 accesses the public network 26 after the authentication is successful in step S46 will be described.

Step S50: The terminal device 12 transmits a user frame toward the public network 26.
Step S52: Upon receiving the user frame transmitted from the terminal device 12, the network relay device 1 refers to the class ID table 36 by the transmission source MAC address of the user frame and is associated with the transmission source MAC address of the user frame. The stored class ID “30” is added to the user frame.

  Step S54: Next, the network relay device 1 refers to the FDB 38 with the destination MAC address of the user frame, specifies the port number stored in association with the destination MAC address of the user frame, and uses this port number as the user frame. And the user frame is transferred to the transmission / reception unit 30.

  Step S56: In the process of transferring the user frame to the transfer destination port 4, the network relay device 1 performs filtering based on a policy corresponding to the class ID added to the user frame by the filtering unit 40. For example, when the class ID “30” is added to the user frame, transfer control of the user frame is performed based on “routing” and “priority control” indicated as “valid” in FIG.

  Step S <b> 58: The network relay device 1 performs filtering of user frames based on the above “routing” and “priority control” in the filtering unit 40, and transmits the user frames to the public network 26 from the port 4.

  As described above, the network relay devices 1 and 2 store the terminal device identification information and the class ID of the terminal devices 10, 12, 14, and 16 in association with each other, thereby transmitting the terminal devices 10, 12, 14, and 16. Filtering based on the policy corresponding to the class ID can be executed for each user frame.

  Further, by storing the authentication information for authenticating the terminal device or the user who uses the terminal device in association with the class ID in the authentication DB 46, the policy corresponding to the class ID is applied on a terminal device or user basis. be able to.

  Further, by storing the class ID and the contents of the policy corresponding to the class ID in the filtering table 42, various policies can be easily set. Then, by assigning a class ID to a terminal device or a user, the set policy can be applied on a terminal device or user basis. Therefore, the network relay devices 1 and 2 are not limited to applying various policies in units of VLANs, and even if they belong to the same VLAN, by assigning a class ID to the terminal device or user, the terminal device or user Various policies can be applied in units.

[Second Embodiment]
Next, the network relay devices 1 and 2 according to the second embodiment will be described. The second embodiment is different from the first embodiment in that network authentication is performed in the network relay devices 1 and 2 instead of the authentication server 20. Other configurations are the same as those of the first embodiment, and in the second embodiment, the same reference numerals are given to the configurations common to the first embodiment, and redundant description will be omitted.

  FIG. 7 is a diagram schematically illustrating a configuration example of a transfer processing system according to the second embodiment. The business server 20, the public network 26, and the like are connected to the port 4 of the network relay apparatuses 1 and 2 via the corporate network 18.

  An access point 6 and a HUB 8 are connected to the port 4 of the network relay devices 1 and 2. The terminal devices 10, 12, 14, and 16 connected to the access point 6 and the HUB 8 can access the business server 20 and the public network 26 via the network relay devices 1 and 2. Further, the network relay devices 1 and 2 execute authentication of the terminal devices 10, 12, 14, and 16 and authentication of users who use them using a predetermined network authentication method. The network relay devices 1 and 2 perform filtering based on various policies when the terminal devices 10, 12, 14, and 16 access the business server 20 and the public network 26.

  FIG. 8 is a block diagram schematically illustrating a functional configuration of the network relay devices 1 and 2 according to the second embodiment. The network relay devices 1 and 2 according to the second embodiment include a CPU 28 as an authentication unit (authentication unit) and an authentication DB 48 as an authentication management unit (authentication management unit).

  In the first embodiment, the operator registers the user ID, password, VLAN ID, class ID, etc. in the authentication DB 46 of the authentication server 20 in advance, so that the terminal devices connected via the plurality of network relay devices 1 and 2 Authentication information of users and the like who use 10, 12, 14, and 16 is centrally managed by the authentication server 20. However, authentication information is stored in the authentication DB 48 of each network relay device 1 and 2 for the terminal devices connected to the respective network relay devices 1 and 2 like the network relay devices 1 and 2 of the second embodiment. It can also be left.

  In this case, when the CPU 28 of the network relay device 1 or 2 receives the authentication information transmitted from the terminal device 10, 12, 14, or 16, the authentication DB 48 is referred to by the received authentication information, and the authentication information is registered in the authentication DB 48. If the authentication information is not registered in the authentication DB 48, the authentication is determined to be unsuccessful. If the authentication is successful, each terminal device 10, 12, 14, 16 can access the business server 20 and the public network 26 via the network relay devices 1, 2. Further, the control unit 32 uses the filtering unit 40 to restrict access to the business server 20 and the public network 26 based on a policy corresponding to the class ID, and to determine a transfer route.

  FIG. 9 is a sequence diagram illustrating a flow of user frame transfer processing according to the second embodiment.

  Step S60: The terminal device 10 transmits the authentication information input by the user who uses the terminal device 10, such as a user ID and a password, to the network relay device 1.

  Step S62: The network relay device 1 refers to the authentication DB 48 based on the received authentication information, and determines whether authentication is successful or unsuccessful. Next, the network relay device 1 notifies the authentication result to the terminal device 10 (step S64).

  When the terminal device 10 performs communication via the network relay device 1, filtering based on a policy corresponding to the class ID assigned to the terminal device 10 is performed as in the first embodiment. Specifically, the terminal device 10 can access the business server 22 but cannot access the public network 26.

  Step S70: Similarly to the terminal device 10, the terminal device 12 also transmits authentication information to the network relay device 1. Upon receiving the authentication information transmitted from the terminal device 12, the network relay device 1 refers to the authentication DB 48 based on the received authentication information and determines whether the authentication is successful or unsuccessful, as in steps S62 and S64 described above. (Step S72). Then, the network relay device 1 notifies the authentication result to the terminal device 12 (step S74).

  Thus, each network relay apparatus 1 and 2 can perform authentication of each terminal device 10, 12, 14, 16 and user authentication using various network authentication methods. Further, the network relay devices 1 and 2 can add individual class IDs to the user frames transmitted from the authenticated terminal devices 10, 12, 14, and 16. Thereby, the communication executed from each terminal device 10, 12, 14, 16 through the network relay devices 1, 2 and the authentication assigned to each terminal device 10, 12, 14, 16 and the user who uses them. Information can be efficiently managed in each of the network relay devices 1 and 2.

  According to the network relay device and transfer control system of the present invention, various policies can be applied for each class ID assigned to a terminal device or a user assigned to a user who uses the terminal device. Thereby, a filtering policy can be applied per terminal device or user.

1, 2, Network relay device 10, 12, 14, 16 Terminal device 20 Authentication server 34 Transfer processing unit 36 Class ID table 38 FDB
40 Filtering unit 46, 48 Authentication DB

Claims (10)

A network relay device that relays a user frame transmitted from a terminal device,
A filtering identification information storage unit that stores the terminal device identification information for identifying the terminal device and the filtering identification information in association with each other;
The filtering identification information storage unit is referred to by the terminal device identification information of the terminal device that has transmitted the user frame stored in the user frame, and the filtering identification information corresponding to the terminal device identification information is specified. A transfer processing unit;
The filtering identification information and the filtering policy are stored in association with each other, and filtering is performed on the user frame based on the policy corresponding to the filtering identification information specified by the transfer processing unit. A network relay device comprising a filtering unit to be executed. The terminal device performs authentication by a predetermined network authentication method via the network relay device or with the network relay device,
The transfer processing unit
The network relay device according to claim 1, wherein the terminal device identification information and the filtering identification information are associated with each other and stored in the filtering identification information storage unit for the terminal device that has been successfully authenticated. An authentication management unit for storing authentication information for authenticating the terminal device or a user who uses the terminal device, and the filtering identification information in association with each other;
When the authentication information is transmitted from the terminal device, further comprising an authentication unit that performs authentication with reference to the authentication management unit by the received authentication information,
The transfer processing unit
When authentication by the authentication unit is successful, the terminal device identification information of the terminal device that has been successfully authenticated, and the filtering identification information stored in the authentication management unit corresponding to the authentication information that has been successfully authenticated The network relay device according to claim 2, which is stored in the filtering identification information storage unit in association with each other. The transfer processing unit
4. The filtering identification information storage unit is referred to according to transmission source information of the user frame as the terminal device identification information of the terminal device that has transmitted the user frame stored in the user frame. 5. Network relay device. The network relay device according to claim 1, wherein the terminal device information is a MAC address or an IP address assigned to the terminal device. A transfer control system comprising a terminal device and a network relay device that relays a user frame transmitted from the terminal device, wherein the network relay device filters the user frame when relaying the user frame,
The network relay device is:
A filtering identification information storage unit that stores the terminal device identification information for identifying the terminal device and the filtering identification information in association with each other;
The filtering identification information storage unit is referred to by the terminal device identification information of the terminal device that has transmitted the user frame stored in the user frame, and the filtering identification information corresponding to the terminal device identification information is specified. Transfer processing means;
The filtering identification information and the filtering policy are stored in association with each other, and filtering is performed on the user frame based on the policy corresponding to the filtering identification information specified by the transfer processing unit. A transfer control system comprising filtering means for execution. The terminal device performs authentication by a predetermined network authentication method via the network relay device or with the network relay device,
The transfer processing means includes
The transfer control system according to claim 6, wherein the terminal device that has been successfully authenticated is stored in the filtering identification information storage unit that associates the terminal device identification information with the filtering identification information. The network relay device is:
Authentication management means for storing authentication information for authenticating the terminal device or a user who uses the terminal device and the identification information for filtering in association with each other;
When the authentication information is transmitted from the terminal device, authentication means for executing authentication with reference to the authentication information stored by the authentication management means and the filtering information corresponding to the authentication information received by the received authentication information; In addition,
The transfer processing means includes
If the authentication by the authentication unit is successful, the terminal device identification information of the terminal device that has been successfully authenticated, and the filtering identification information stored by the authentication management unit corresponding to the authentication information that has been successfully authenticated, Are associated with each other and stored in the filtering identification information storage unit. The transfer processing means includes
9. The filtering identification information storage unit is referred to by the transmission source information of the user frame as the terminal device identification information of the terminal device that has transmitted the user frame stored in the user frame. Transfer control system. The transfer control system according to claim 6, wherein the terminal device identification information is a MAC address or an IP address assigned to the terminal device.

Images