JP5204054B2 - Network management system and communication management server - Google Patents

Description

  The present invention relates to a network management system and apparatus for preventing unauthorized access to a network.

  In a LAN (Local Area Network) used in a company, it is necessary to prohibit data transmission / reception with an unauthorized terminal in order to prevent information leakage. In Patent Document 1, when a device is connected to an input / output port of a packet switching device such as a switching hub or a router, the device authenticates the device and prevents unauthorized use of the network by an unauthorized computer. An exchange device is disclosed.

JP 2001-186186 A

  In the technique described in Patent Document 1, computer authentication is performed for each switching device. In such a configuration, if the network scale increases and the number of switching devices increases, the setting for authentication must be performed for each switching device, which increases the amount of work and also manages the switching devices. It becomes difficult.

  The present invention has been made in view of such circumstances, and an object of the present invention is to provide a network management technique provided with a communication management server that centrally manages unauthorized use of a network.

  One embodiment of the present invention is a network management system. This system is a packet switching apparatus having a terminal for transmitting and receiving packets and a plurality of input / output ports, and a packet received via one of the input / output ports is transmitted to a terminal or other terminal via another input / output port. A packet management device configured to transmit to the packet switching device, and a communication management server for preventing communication by an unauthorized terminal that is not permitted to connect to the network in a network composed of the terminal and the packet switching device; including. The terminal includes a communication agent that is assigned unique identification information and adds identification information to the packet when the packet is transmitted. The packet switching apparatus receives the packet from the terminal, acquires the identification information of the communication agent from the packet, and manages the confirmation message for inquiring whether the terminal is a regular terminal permitted to connect to the network based on the identification information. A confirmation unit for transmitting to the server is provided. The communication management server includes a communication agent information holding unit that records identification information of communication agents included in all regular terminals, and whether or not the identification information is recorded in the communication agent information holding unit in response to the confirmation message. A communication control unit that returns an answer message notifying whether the terminal is a regular terminal or an unauthorized terminal to the packet switching apparatus. In response to the reply message, the packet switching device releases the input / output port to which the terminal is connected when the terminal is a regular terminal, and the input / output port to which the terminal is connected when the terminal is an unauthorized terminal. And a port lock section for locking.

Here, the packet refers to a data unit to which control information such as a destination address such as an IP packet or a MAC frame is added. The packet switching device includes a router, a layer 3 switch, a switching hub, and the like.
According to this aspect, the identification information of the communication agent of the authorized terminal permitted to connect to the network is centrally managed by the communication management server, and whether the terminal connected to the packet switching apparatus is an authorized terminal or an unauthorized terminal. Make a decision. Therefore, packets can be transmitted and received only between authorized terminals, and even when the network configuration is changed, it is not necessary to change the settings of individual packet switching devices, making it easy to manage unauthorized access over the entire network. Become.

  The communication management server includes an permission list management unit that holds an access permission list that records identification information of a destination terminal that is permitted to transmit and receive packets for each terminal, and a permission list distribution unit that distributes the access permission list to the terminal. Further, it may be provided. The communication agent of the terminal determines whether or not the access permission list includes the identification information of the destination terminal of the packet when the packet is transmitted, and the permission list holding unit that holds the access permission list received from the communication management server And a packet transceiver configured to transmit a packet when included. According to this, transmission / reception of packets between terminals can be restricted, and since the access permission list is centrally managed by the communication management server, access control of the entire network can be performed compared to the case where the list is managed for each terminal. Management becomes easy.

  When a plurality of packet switching devices are connected in a hierarchy in the network, the packet switching device in at least one layer is assigned a unique identification information, and a communication agent that adds the identification information to the packet at the time of packet transmission is assigned. Further, it may be provided. The communication agent information holding unit records identification information of a communication agent included in a packet switching device permitted to connect to the network, and the upper layer packet switching device receives packets from at least one layer packet switching device. The communication agent identification information is acquired from the packet, and a confirmation message is sent to the communication management server inquiring whether or not connection to the network is permitted for at least one packet switching apparatus based on the identification information. May be. According to this, the upper layer packet switching apparatus inquires of the communication management server whether the lower layer packet switching apparatus is genuine. Therefore, it is possible to prevent an unauthorized access act using a packet switching apparatus that does not have a function of requesting the communication management server to check whether the terminal is a legitimate terminal.

  The permission list management unit holds a plurality of access permission lists with different destination terminals that are permitted to transmit and receive packets, and the permission list distribution unit distributes the access permission list selected according to the distribution time to the terminals. May be. According to this, it is possible to realize different access control for each time zone.

  Another aspect of the present invention is a communication management server. This communication management server is assigned with unique identification information, has a terminal equipped with a communication agent that adds identification information to a packet at the time of packet transmission, and one or more input / output ports. The packet switching device is configured to send the received packet to the terminal or another packet switching device via another input / output port, and receives the packet from the terminal and acquires the identification information of the communication agent from the packet. And a packet switching apparatus that issues a confirmation message for inquiring whether or not the terminal is a legitimate terminal permitted to connect to the network based on the identification information, the connection to the network is permitted. It is a server that prevents communication by unauthorized terminals. The server responds to the confirmation message from the communication agent information holding unit that records the identification information of the communication agent included in all authorized terminals and the packet switching device, and whether or not the identification information is recorded in the communication agent information holding unit. Based on the above, it is determined whether the terminal is a legitimate terminal or an unauthorized terminal. When the terminal is a legitimate terminal, the input / output port to which the terminal is connected is opened, and when the terminal is an unauthorized terminal, the terminal is connected A communication control unit that returns an answer message for locking the input / output port to the packet switching apparatus.

  It should be noted that any combination of the above-described constituent elements and a representation of the present invention converted between an apparatus, a method, a system, a program, a recording medium storing the program, and the like are also effective as an aspect of the present invention.

  According to the present invention, setting for preventing unauthorized use is facilitated by providing a communication management server that centrally manages unauthorized use of a network.

1 is an overall configuration diagram of a general network. It is a figure which shows the network which added the communication management server by one Embodiment of this invention. It is a figure explaining the detailed structure of a communication management server. It is a figure which shows the structure of an edge switch. It is a figure which shows the structure of the communication agent introduced into a terminal. It is a flowchart explaining the detection of the unauthorized terminal by this embodiment. It is a flowchart explaining operation | movement when a regular terminal and an unauthorized terminal are replaced.

  One embodiment of the present invention is a network management system that prevents information leakage caused by a terminal that is not permitted to be connected in a network such as a corporate LAN.

  FIG. 1 is an overall configuration diagram of a general corporate network system. The network system 100 basically has a three-layer structure including three types of switches: a core switch, a relay switch, and an edge switch. Of these, the core switch 14 is the highest-level switch constituting the backbone network. The core switch 14 relays the packet transmitted from the edge switches 84 to 88 to the other core switch 14 and transfers it to the destination edge switch. The edge switches 84 to 88 are switches that exist at the end of the network and to which the terminals 26 and 28 are connected using a LAN cable or the like. The relay switch 16 is a switch having a role of connecting the core switch 14 and the edge switches 84 to 88. Although only one relay switch 16 is illustrated in FIG. 1, the relay switch may be configured in two layers or three layers according to the scale of the network. If the network scale is small, the relay switch 16 may be configured. May be omitted.

The core switch 14, the relay switch 16, and the edge switches 84 to 88 are typically Ethernet (registered trademark) switching hubs having a plurality of input / output ports, but may be routers or layer 3 switches.
In the above description, the core switch, the relay switch, and the edge switch are described as being separate from each other. However, depending on the scale of the network and the network requirements, some of them may be the same device.

  The terminals 26 and 28 are connected to one of the input / output ports of the edge switches 84 and 86 via a network interface card (NIC). In this specification, “terminal” includes a desktop or notebook personal computer, a rack mount server, a blade server, and the like.

Hereinafter, a case where a packet is transmitted from terminal A to another terminal B in the network of FIG. 1 will be described.
When the edge switch A84 connected to the terminal A26 receives a packet such as a MAC (Media Access Control) frame or an IP (Internet Protocol) packet from the terminal A via the input / output port, the edge switch A84 acquires a destination address included in the header. . Subsequently, referring to a routing table in which correspondence between a destination address prepared in advance and an input / output port is described, a communication device (various switches or terminals) having the destination address is connected, or the destination address Select an I / O port that can be reached. Then, the edge switch A sends the packet to the selected output port, and the packet is transmitted to the relay switch or terminal connected to the input / output port. When a packet is transmitted to the relay switch, the relay switch selects an input / output port for transferring the packet in the same manner as described above. By this processing, the packet reaches the edge switch B 86 on the terminal B 28 side, and the packet received by the edge switch B is output to the terminal B. Since such packet transfer between switches is a well-known technique, further detailed description is omitted in this specification.

  Conventionally, in the network as shown in FIG. 1, in order to prevent the network connection of terminals that are not permitted to be connected, empty ports are formed in software or hardware in each of the core switch, relay switch, and edge switch. Measures such as blocking were necessary. Further, in order to limit the access destination from each terminal, it is necessary to set identification information of a destination terminal that is permitted to be accessed in each switch.

  However, if a mechanism for setting port blocks and access destination restrictions for each switch as described above is used, the work of setting each switch becomes very complicated when the network becomes large and the number of switches increases. There's a problem. In addition, since the switch hierarchical structure is complicated and it is difficult to grasp the entire network, an access restriction setting error is likely to occur, and the expected behavior may not be obtained. Furthermore, as the number of switches increases, the amount of processing required for access restriction increases, and the original routing function may be degraded.

  Therefore, in this embodiment, a communication agent is introduced into each terminal connected to the network, and information regarding these communication agents is collectively managed by the communication management server. Further, the communication management server determines whether to open the input / output port to which the terminal is connected.

  FIG. 2 shows a network system 100 'having a communication management server according to an embodiment of the present invention. The communication management server 10 is connected to any one of the core switches 14 in the network, and detects unauthorized terminals in the network and performs access control between terminals. The communication management server 10 includes a processor that executes various processes according to a program, a memory that temporarily stores data and programs, a hard disk drive, a DVD drive, and the like whose recorded contents are not lost even when the server is restarted. At least a storage device, a network interface connected to a network and executing various input / output processes, and a bus interconnecting them are provided. Since the communication management server 10 is preferably connected to a portion having a wide bandwidth, it is optimal to connect to the core switch. However, if communication with the edge switch is possible, the communication management server 10 can be connected to any location in the network. It may be.

  In this embodiment, a communication agent 90 is installed in the terminal 28, the file server 22, and the mail server 24 that are permitted to connect to the network. This communication agent 90 is preferably a function provided by software, and is always activated on the terminal. The communication agent functions so that all packets transmitted and received by the terminal are transmitted and received through the communication agent. An agent ID as unique identification information is assigned to the communication agent 90 of each terminal. The agent ID of the terminal permitted to connect to the network is recorded in the communication management server 10. Hereinafter, a terminal in which a communication agent has been installed and an agent ID is recorded in the communication management server is referred to as a “regular terminal”, and other terminals are referred to as “illegal terminals”. In the following description, the terminal A26 is described as an “illegal terminal”, and the terminal B28, the file server 22, and the mail server 24 are described as “regular terminals”.

  By providing the communication agent function in software, the communication agent software can be transmitted to any terminal that needs to be connected to the network through any recording medium such as a CD or DVD in which the communication agent software is recorded, or by network distribution. Can be installed. Alternatively, a terminal in which hardware having a communication agent function is previously incorporated may be used, or the communication agent function may be provided by a combination of hardware and software.

  The edge switches 44 to 48 of the present embodiment include a port control unit that opens or locks an input / output port. When the terminal 28 is connected to any of its own input / output ports, the port controllers of the edge switches 44 to 48 acquire terminal information such as the IP address, MAC address, or agent ID of the terminal. Then, the communication management server 10 is confirmed whether or not this terminal is a regular terminal permitted to connect to the network.

  The communication management server 10 manages access control between terminals and prevents a terminal in which a communication agent is not installed (hereinafter referred to as “illegal terminal”) from transmitting and receiving data via a network. The communication management server 10 confirms whether or not the terminal is genuine in response to an inquiry from the edge switch, and returns the result to the edge switch. If the terminal is not a legitimate terminal, the edge switches 44 to 46 lock the input / output port to which the terminal is connected to prevent data transmission / reception with the network.

  FIG. 3 is a diagram illustrating a detailed configuration of the communication management server 10. These configurations can be realized in hardware by any computer's CPU, memory, and other LSIs, and in software, they are realized by programs loaded into the memory. Draw functional blocks. Accordingly, those skilled in the art will understand that these functional blocks can be realized in various forms by hardware only, software only, or a combination thereof.

The communication management server includes a transmission / reception unit 40, a communication control unit 42, a list transfer unit 38, and a communication management master unit 50.
The transmission / reception unit 40 receives a confirmation message from the edge switches 44 to 46 as to whether or not the connected terminal is a legitimate terminal, and returns the confirmation result to the edge switches 44 to 46 as an answer message. The communication control unit 42 refers to the information in the communication management master unit 50 and confirms whether or not the terminal is a regular terminal.

The communication management master unit 50 includes a communication agent information holding unit 52, a permission list management unit 54, and a terminal information holding unit 56.
The communication agent information holding unit 52 holds an agent ID of a communication agent that operates on a regular terminal that is permitted to connect in the network. When a network manager newly installs a communication agent in a terminal, the network administrator registers the agent ID of the communication agent in the information holding unit 52.
The permission list management unit 54 holds an access permission list in which identification information of destination terminals permitted to transmit and receive data is recorded for each authorized terminal. The identification information recorded in the access permission list is at least one of an IP address, a MAC address, or an agent ID assigned to the NIC of the destination terminal. As identification information, a TCP / IP address and VLAN information including port information may be used. This access permission list is transmitted to the communication agent of each terminal and used to determine whether or not access is possible. With this access permission list, for example, for terminal B 28, access control can be realized such that data transmission / reception with the mail server 24 is permitted but data transmission / reception with the file server 22 is denied.
The terminal information holding unit 56 records identification information of the terminal and each switch to be managed by the communication management server 10, for example, an IP address or a MAC address.

  The list transfer unit 38 transmits the latest access permission list to the terminal 28 at a predetermined timing, at the time of a request from the regular terminal 28, or at the time of updating the access permission list.

  FIG. 4 is a diagram illustrating the configuration of the edge switches 44 to 48. Also in FIG. 4, these configurations can be realized in hardware by a CPU, memory, or other LSI of an arbitrary computer, and are realized in software by a program loaded in the memory. Describes functional blocks realized by collaboration.

The edge switch includes a communication unit 60, a port control unit 70, and a packet processing unit 82.
The communication unit 60 includes one or more input / output ports 62 connected to a communication cable in order to transmit and receive packets to and from a communication device such as a terminal or another switch.
The port control unit 70 includes a confirmation unit 72 and a port lock unit 74. The confirmation unit 72 is configured to be able to recognize which port the communication device is connected to when the edge switch is connected to the other communication device via the input / output port and is energized. Then, a confirmation message as to whether or not the connected terminal is a regular terminal is transmitted to the communication management server 10. The port lock unit 74 receives the reply message from the communication management server 10, and opens or locks the input / output port connected to the terminal depending on whether the terminal is a legitimate terminal or an unauthorized terminal.

  The packet processing unit 82 has a routing table in which the correspondence between input / output ports and destination addresses is described. According to a well-known routing technique, the packet processing unit 82 sets input / output ports for sending packets received through the input / output ports. Decide and exchange packets with other communication devices.

FIG. 5 is a diagram showing a configuration of the communication agent 90 introduced into the regular terminal, that is, the terminal 28 and the servers 22 and 24. As described above, in this embodiment, a communication agent is installed in a terminal connected to the network, and communication with other terminals is possible only via the communication agent.
The communication agent 90 includes a packet transmitting / receiving unit 92, a permission list receiving unit 94, and a permission list holding unit 96. The permission list receiving unit 94 receives the access permission list for the terminal itself from the communication management server 10 and stores it in the permission list holding unit 96. The permission list receiving unit 94 may receive the latest access permission list transmitted by the communication management server 10 at a predetermined timing, or the permission list receiving unit 94 may request the latest list at a predetermined timing. Good. The entire access permission list may be updated, or only the difference from the previous time may be updated. Alternatively, the permission list receiving unit 94 may inquire of the communication management server 10 whether or not the access permission list is updated every time communication is performed with another terminal.

  As described above, in the present embodiment, the access permission list is centrally managed by the communication management server. Therefore, compared to the case where the access permission list is managed for each terminal, the work of changing the destination terminal accompanying the network configuration change or the like can be performed. It becomes easy.

  The packet transmitting / receiving unit 92 controls packet transmission / reception with other terminals. The packet transmitting / receiving unit 92 refers to the identification information of the destination terminal described in the header of the packet when transmitting the packet. If the identification information of the destination terminal is included in the access permission list, the packet is transmitted. Otherwise, the packet is not transmitted. Further, the packet transmitting / receiving unit 92 adds the agent ID to the header of the packet when transmitting the packet. Alternatively, the agent ID may be added to the packet body.

  FIG. 6 is a flowchart illustrating detection of an unauthorized terminal connected to the network according to the present embodiment.

  First, the network administrator records the agent ID in the communication agent information holding unit 52 in the communication management server 10 when the communication agent is introduced into the terminal that permits connection. Further, the terminal identification information is recorded in the terminal information holding unit 56.

  Assume that a certain terminal is connected to one of the input / output ports of the edge switches 40 to 48 and attempts to transmit a packet from an unauthorized terminal. When an unauthorized terminal is connected to an input / output port (S10), the edge switch transmits a confirmation message for confirming whether or not the connected terminal is a regular terminal to the communication management server 10 (S12). This confirmation message includes the agent ID of the terminal.

  When receiving the confirmation message, the communication management server 10 refers to the communication agent information holding unit 52 and determines whether the terminal is a regular terminal or an unauthorized terminal based on whether the agent ID is recorded. (S14). And it transmits to the edge switch as an answer message which described whether it is a regular terminal or an unauthorized terminal (S16). If the edge switch is confirmed as a legitimate terminal, the edge switch opens the input / output port to which the terminal is connected (S18). As a result, the terminal can transmit and receive packets. When it is confirmed that the terminal is an unauthorized terminal, the edge switch locks the input / output port to which the terminal is connected (S18). This makes it impossible to send and receive packets with unauthorized terminals that are not allowed.

In this way, the edge switch monitors its own input / output port, and when the communication management server confirms that the terminal is an unauthorized terminal, it locks the input / output port to which the terminal is connected. Therefore, information leakage to the unauthorized terminal is prevented, or occupation of traffic due to packet transmission from the unauthorized terminal is avoided.
In the present embodiment, in the core switch, intermediate switch, and edge switch, it is left to the communication management server without determining whether the terminal is a regular terminal or an unauthorized terminal. Therefore, it is not necessary to make a setting for making the above determination for each switch, and network management becomes easy.

  In the embodiment described above, the edge switch transmits a confirmation message to the communication management server every time a packet is received from the terminal. However, if this is done, the amount of packet transmission / reception between the edge switch and the communication management server increases, traffic is congested and the processing speed of the switch also decreases. Therefore, when the edge switch receives a packet from a terminal once confirmed to be a legitimate terminal, it is preferable to transfer the packet without issuing a confirmation message. You may make it transfer the packet from the terminal only for the predetermined period after confirming that it is a regular terminal.

  An unauthorized act of connecting a terminal to the edge switch and replacing the terminal with an unauthorized terminal after the communication management server confirms the terminal as an authorized terminal is considered. As a countermeasure, the edge switch may have a function of confirming whether or not packet transmission from the terminal is performed via the communication agent whenever a cable is connected to or disconnected from the input / output port. If not via the communication agent, the edge switch locks the connected port of the terminal. This makes it impossible to communicate from an unauthorized terminal. For example, if the communication agent of the terminal writes information indicating that it has passed through the communication agent in the header when transmitting the packet, the edge switch determines whether or not the packet transmission is via the communication agent. be able to. When one of the input / output ports is locked, the edge switch may notify the communication management server of the identification information of the terminal connected to the port.

  In addition, for example, an illegal act of attempting to connect a terminal installed with a communication agent obtained by illegal copying (referred to as “illegal copy terminal”) with a regular terminal may be considered. As a countermeasure, the edge switch may be configured to check whether a terminal connected to the port is a legitimate terminal when a cable is connected to or disconnected from the input / output port.

FIG. 7 is a flowchart for explaining the operation when the authorized terminal and the illegal copy terminal are exchanged.
The user replaces a terminal that has been previously confirmed as a legitimate terminal with an illegal copy terminal in which an illegally obtained communication agent is installed (S30), and connects the input / output port of the edge switch with a cable (S32). The edge switch recognizes that the connection to the input / output port has been made, and transmits a confirmation message for confirming whether or not the connected terminal is a regular terminal to the communication management server 10 (S34).

  When receiving the confirmation message, the communication management server 10 refers to the communication agent information holding unit 52 and determines whether the terminal is a regular terminal or an unauthorized terminal based on whether the agent ID is recorded. (S36). In this case, since the communication agent of the terminal is obtained illegally, it is not recorded in the communication agent information holding unit 52. Therefore, the communication management server 10 transmits an answer message describing that the terminal is an unauthorized terminal to the edge switch (S38). In response to the reply message, the edge switch locks the input / output port to which the illegal copy terminal is connected (S40). This makes it impossible to send and receive packets from illegal copy terminals.

In addition, it is also possible to connect a terminal that has been confirmed as a legitimate terminal to the edge switch as it is, connect an unauthorized terminal to another port of the authorized terminal, and attempt to access the network via the communication agent of the authorized terminal. Conceivable. As a countermeasure, when a communication agent operating on a terminal receives a packet transmission that does not pass through an edge switch, whether or not the packet is transmitted via a communication agent of a legitimate terminal is recorded in the packet header. You may judge from the information. If not via the communication agent, the transfer of the packet may be rejected, or the fact may be reported to the edge switch. The edge switch may lock the input / output port to which the reported terminal is connected.
In this way, by allowing the communication agent on the terminal to determine whether or not the packet has been transmitted from the legitimate terminal, it is possible to prevent unauthorized access in the middle of the legitimate terminal.

  In addition, it is possible to replace the existing edge switch with an illegal act using an edge switch (hereinafter referred to as “illegal edge switch”) that does not have the function of requesting the communication management server to check whether it is a legitimate terminal. It is done. In this case, even if an unauthorized terminal is connected to the unauthorized edge switch, it becomes possible to transmit and receive data by the unauthorized terminal without confirming whether or not it is a legitimate terminal.

  Therefore, in another embodiment, a communication agent may be introduced into the edge switch so that all packets transferred by the edge switch are made via the communication agent. In this case, the ID of the communication agent of the edge switch is recorded in the communication agent information holding unit 52. In this case, when receiving a packet from the lower edge switch, the relay switch or core switch higher than the edge switch confirms with the communication management server whether the edge switch is genuine, the edge When it is confirmed that the switch is unauthorized, a port lock unit is provided for locking the input / output port to which the unauthorized edge switch is connected. As a result, data transmission / reception from an unauthorized terminal via an unauthorized edge switch becomes impossible.

As described above, according to the present embodiment, the agent ID is centrally managed by the communication management server for all terminals that are permitted to connect and have introduced the communication agent. The edge switch makes an inquiry to the communication management server as to whether or not it is a regular terminal regardless of whether or not a communication agent is installed in the terminal. As a result, communication is possible only between terminals in which agents are installed and registered in the communication management server.
Even when the network configuration is changed, such as a connection change between switches, it is not necessary to change the setting of individual switches, and only the agent ID in the communication management server needs to be changed. Therefore, it becomes easy to manage unauthorized access of the entire network.

  In general, the amount of information related to access control that can be written to a switch is limited, so if the network becomes large and the number of communication devices connected to each switch increases, detailed access control details may not be written to the switch. is there. In addition, as the content of access control becomes more complicated, the processing amount at the switch increases and the original routing performance may be degraded. In this embodiment, since the access permission list for each terminal is centrally managed by the communication management server, it is possible to suppress a decrease in the routing performance of the switch. Also, the access control setting method may differ depending on the switch vendor. However, if the access management list is collectively managed by the communication management server, there is no need to consider such a difference for each switch. Furthermore, since the access permission list is collectively managed, fine-grained access control settings between terminals can be easily performed even in a large-scale network.

  In the above-described embodiment, a single communication management server is provided for the network. However, the communication management server may have a hierarchical configuration according to the network or the size of traffic. In this case, a communication management server may be provided for each core switch or relay switch, and each communication management server may reply to a confirmation message from an edge switch in the subnet. As a result, the load on the communication management server can be reduced.

  In the above-described embodiment, it has been described that the edge switch confirms with the communication management server whether or not the connected terminal is a regular terminal. However, the edge switch itself may confirm whether it is a legitimate terminal. In this case, the communication agent information holding unit of the communication management server transmits a list of registered agent IDs to the edge switch at a predetermined timing or at a request from the confirmation unit of the edge switch. The confirmation unit of the edge switch determines whether or not the terminal is a regular terminal based on this list.

  In the above-described embodiment, it has been described that when the terminal is connected to the input / output port of the edge switch, the communication management server is confirmed whether or not the terminal is a legitimate terminal. However, the edge switch may periodically check whether all the terminals connected to the input / output ports are legitimate terminals, or may be executed at any time by a network administrator. .

The permission list management unit of the management server is configured to hold a plurality of access permission lists with different access control settings, select the access permission list according to the time or time zone, and transmit it to the communication agent of the terminal May be. For example, an access permission list that is different during business hours and outside business hours is prepared in the permission list management unit, and the management server selects a list according to the time zone and transmits it to the terminal. Good. In this way, for example, all terminals can be connected to various communication devices necessary for business during business hours, but only some terminals can be allowed to connect outside business hours. Alternatively, a plurality of access permission lists having different access control settings may be transmitted in advance from the management server to the communication agent of each terminal, and the communication agent may select an access permission list according to time. Good.
Further, an expiration date may be set in the access permission list. Each terminal may be configured to request a new list from the communication management server when the access permission list in the permission list holding unit expires.

  10 communication management server, 14 core switch, 16 relay switch, 28 terminal, 38 list transfer unit, 42 communication control unit, 44-48 edge switch, 50 communication management master unit, 52 communication agent information holding unit, 54 permission list management unit 56 terminal information holding unit, 60 communication unit, 62 input / output port, 70 port control unit, 72 confirmation unit, 74 port lock unit, 82 packet processing unit, 90 communication agent, 92 packet transmission / reception unit, 94 permission list reception unit, 96 Allow list holding part.

Claims (4)

A terminal that transmits and receives packets;
A packet switching device having a plurality of input / output ports, configured to send a packet received via any one of the input / output ports to the terminal or another packet switching device via another input / output port. Packet switching equipment,
A network management system including a communication management server for preventing communication by an unauthorized terminal that is not permitted to connect to the network in a network constituted by the terminal and the packet switching device;
The terminal includes a communication agent for adding the terminal agent ID to the packet when packet transmission is assigned terminal agent ID as unique identification information,
The packet switching device acquires the terminal agent ID packets from the received packet from the terminal, the confirmation message inquiring whether the terminal based on the terminal agent ID is authorized terminal the connection is permitted to the network Including a confirmation unit for transmitting to the communication management server,
The communication management server
A communication agent information holding unit for recording terminal agent IDs of communication agents included in all regular terminals;
Based on whether or not the terminal agent ID included in the confirmation message is recorded in the communication agent information holding unit, a reply message for notifying whether the terminal is a regular terminal or an unauthorized terminal is sent to the packet switching apparatus. A communication control unit that replies to
A permission list management unit that holds an access permission list that records identification information of destination terminals that are permitted to transmit and receive packets for each terminal;
A permission list distribution unit that distributes the access permission list to the terminal,
In response to the reply message, the packet switching device opens an input / output port to which the terminal is connected when the terminal is a regular terminal, and the terminal is connected when the terminal is an unauthorized terminal. further comprising a port lock portion to lock the input and output ports,
The communication agent of the terminal is
A permission list holding unit that holds the access permission list received from the communication management server;
A packet transmitting / receiving unit configured to determine whether or not the identification information of the destination terminal in the packet is included in the access permission list when transmitting the packet, and to transmit the packet when included in the access permission list; network management system characterized in that it further comprises a. When a plurality of packet switching devices are connected hierarchically in the network,
At least one packet switching device in the hierarchy is further provided with a communication agent for adding said switching device agent ID to the packet when packet transmission is allocated to the exchange device agent ID as unique identification information,
The communication agent information holding unit records the switching device agent ID of the communication agent included in the packet switching device permitted to connect to the network,
Upon receiving a packet from the at least one layer packet switching apparatus, the upper layer packet switching apparatus obtains the switching apparatus agent ID from the packet, and based on the switching apparatus agent ID , the at least one layer packet switching apparatus 2. The network management system according to claim 1 , wherein a confirmation message for inquiring whether or not the device is permitted to connect to the network is transmitted to the communication management server. The permission list management unit holds a plurality of access permission lists with different destination terminals permitted to transmit and receive packets, and the permission list distribution unit selects an access permission list selected according to a distribution time. The network management system according to claim 2, wherein the network management system is distributed to the network. A terminal comprising a communication agent for adding the agent ID in the packet when the packet transmission is assigned agent ID as unique identification information,
Packet switching having one or more input / output ports and configured to send a packet received via one of the input / output ports to the terminal or another packet switching device via another input / output port A device that receives a packet from the terminal, obtains the agent ID from the packet, and issues a confirmation message inquiring whether the terminal is a regular terminal permitted to connect to the network based on the agent ID An exchange device;
A communication management server that prevents communication by an unauthorized terminal that is not permitted to connect to the network,
A communication agent information holding unit for recording agent IDs of communication agents included in all regular terminals;
Determining whether the terminal is a legitimate terminal or an unauthorized terminal based on whether the agent ID included in the confirmation message from the packet switching apparatus is recorded in the communication agent information holding unit; Communication control for returning to the packet switching apparatus a reply message that opens the input / output port to which the terminal is connected when the terminal is an authorized terminal and locks the input / output port to which the terminal is connected when the terminal is an unauthorized terminal And
A permission list management unit that holds an access permission list that records identification information of destination terminals that are permitted to transmit and receive packets for each terminal;
An access list that distributes the access permission list to the communication agent of the terminal, and transmits the packet when the destination terminal identification information in the packet is included in the access permission list when the packet is transmitted from the terminal. A distribution department;
A communication management server comprising:

Images