JP2000224170A - Network security ensuring method and apparatus - Google Patents

Abstract

(57) [Summary] [Problem] To provide a network security ensuring method and apparatus in which confidentiality of the network is not hindered. When a terminal having a user name requesting a connection from outside the managed network exists inside the managed network, the connection is not permitted to the terminal requesting the connection from the outside. The apparatus includes a log storage unit for storing information transmitted by a terminal requesting an external connection, a user name and a password transmitted by a terminal requesting an external connection, and a user registered in advance by a network administrator. Password authentication means for confirming the match between the name and the password, and managing the user name and the terminal owned by the user in association with each other,
There is provided a connection permission confirming means for confirming whether or not a terminal having the same user name as a terminal requesting a connection from outside exists within the network.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a method and an apparatus for securing security in a managed network to which a terminal can be connected from the outside.

[0002]

2. Description of the Related Art Conventionally, in order to ensure security inside a network to be managed from the outside to the inside of a managed network, a device that responds to a connection request from the outside in the managed network is requested to connect. A user name and password are transmitted from the terminal to be connected, and after confirming that the password is the same as the password corresponding to the user name registered in advance by the network administrator, a method of permitting connection of the terminal is known. Have been.

In this method, a device that responds to an external connection request in a network to be managed, and a user name and a password transmitted from a terminal outside the network requesting the connection are registered in advance by a network administrator. If it was confirmed that they matched the user name and password, the connection was unconditionally permitted.

[0004] In such an authentication method for connection from the outside of the managed network, in a device responding to a connection request from the outside, the transmitted user name and password are registered in advance by a network administrator. If the password matches the password, the connection is permitted even if the password is accidentally or illegally accessed, so that the confidentiality of the network is hindered.

[0005]

SUMMARY OF THE INVENTION It is an object of the present invention to provide a method and an apparatus for securing network security, in which the confidentiality of the network is hardly hindered in view of the above problems.

[0006]

According to the present invention, there is provided a network security method for achieving the above object.
When a terminal having a user name requesting a connection from the outside of the managed network exists inside the network, the connection is not permitted to the terminal requesting the connection from the outside.

Further, the network security ensuring device of the present invention provides a log storage unit for storing information transmitted by a terminal requesting a connection from outside the managed network, and requests a connection from outside the managed network. Password authentication means for confirming that the user name and password transmitted by the terminal match the user name and password registered in advance by the network administrator, and associating the user name with the terminal owned by the user It is characterized by comprising a connection permission confirming means for confirming the presence or absence of a terminal having the same user name as a terminal which manages and requests a connection from outside the network to be managed, inside the network.

According to the present invention, when there is a terminal using a user name connected to the inside of the managed network, connection from outside the managed network is not permitted, thereby preventing illegal access. can do.

[0009]

Next, an embodiment of the present invention will be described with reference to the drawings. FIG. 1 is a diagram showing a configuration example of a network for implementing the present invention. A managed network 10 includes a transmission medium 40, terminals 31, 32, and 33 connected to the transmission medium 40, and a security device 20. The security ensuring device 20 includes an access server 11, an authentication server 12, and a DHCP server.
Including server 13. The connection from outside the management target network 10 is performed by the connection request terminal 51 via the telephone network 41. The access server 11, which is a device that responds to a connection request from outside the management target network 10, includes a log storage unit 21, and the authentication server 12 includes a password authentication unit 22 and a connection permission confirmation unit 23.

As shown in the log storage table of FIG. 2, the log storage means 21 stores the user name and password transmitted from the connection request terminal 51, the connection start date and time, the connection end date and time, and the source telephone number as information. . As shown in the password table of FIG.
The connection request terminal 51 includes a table of passwords registered in advance by a network administrator corresponding to the user name.
It verifies whether the user name and password sent from the server match this table. Connection permission confirmation means 23
As shown in the MAC address table of FIG. 4, a table in which a user name and a MAC address of a terminal owned by the user are registered in advance by a network administrator is provided.
It authenticates whether 51 exists inside the network 10 to be managed. The DHCP server 13 is a network to be managed.
IP address for the MAC address of the terminal used inside 10
Addresses are assigned and IP address information is held as shown in the IP address table of FIG.

Next, the operation of the embodiment of the present invention configured as described above will be described. FIG. 6 is a flowchart illustrating an example of a procedure of a connection permission process from the connection request terminal 51 to the management target network 10.

The access server 11 is a network to be managed.
While waiting until a connection from outside is detected (step 101), when a connection is detected, the log storage unit 21
The user name and password, the connection start date and time, and the source telephone number transmitted from the connection request terminal 51 are written as information in the log storage table of FIG. 2 (step 102). The authentication server 12 uses the password authentication means 22 to
It is verified whether or not the user name and password transmitted from 51 match the information registered in advance by the administrator shown in FIG. 3 (step 103). According to 23, it is verified whether or not a terminal having a user name requesting connection exists inside the managed network 10 (step 104). If it is confirmed that the terminal having the user name requesting the connection does not exist inside the managed network 10, the line is connected (step 105), and the communication is terminated (step 10).
6). When the communication is completed, the line is disconnected (step 107), and the log storage means 21 writes the connection end date and time in the log storage table of FIG. 2 (step 108).

In the verification in step 103, it is confirmed that the user name and the password transmitted from the connection request terminal 51 do not match the information registered in advance by the administrator shown in FIG. 3, and in the verification in step 104 If it is confirmed that the terminal having the user name requesting the connection exists inside the managed network 10, the access is regarded as an illegal access, and the connection end date and time is written by the log storage means 21 (step 109). The network administrator is notified that the access is illegal (step 110).

FIG. 7 shows that the authentication server 12 uses the connection permission confirming means 23 to verify whether a terminal having a user name requesting a connection from outside the managed network 10 exists inside the managed network. Processing (step 104)
6 is a flowchart showing an example of the procedure of FIG.

[0015] The connection permission confirming means 23 stores the M of the terminal corresponding to the user name registered in advance by the network administrator.
A MAC address corresponding to the user name transmitted from the terminal 51 requesting a connection from outside the management target network 10 is obtained from the MAC address table of FIG. 4 indicating the AC address (step 201). It is verified whether or not the MAC address corresponding to the user name registered in advance exists (step 202). If it is confirmed that the MAC address does not exist,
Since the MAC address corresponding to the user name has not been registered, the network administrator is notified of the illegal access (step 208).

If it is confirmed by the verification in step 202 that a MAC address corresponding to the user name registered in advance exists, the DHCP server 13 then uses the IP address table shown in FIG. IP
It is verified whether an address exists (step 203).
If there is no IP address corresponding to the MAC address, no terminal having the user name requesting the connection exists inside the managed network 10 (step 204). If there is an IP address corresponding to the MAC address, a ping command is sent to the IP address (step 205). It is verified whether or not there is a response to the ping command (step 206). If there is no response, there is no terminal having the user name requesting the connection inside the managed network 10 (step 204). ). If there is a response in step 206, there is a terminal having a user name requesting a connection inside the managed network 10 (step 207).
The network administrator is notified that the access is illegal (step 208).

In the above-described embodiment, the access server 11 including the log storage unit 21 and the password authentication unit
An example has been described in which the functions are distributed to three servers, the authentication server 12 including the connection permission confirmation means 22 and the DHCP server 13 for allocating the IP address to the terminal. These functions may be provided. In the above-described embodiment, an example in which the network connected to the management target network is a telephone network has been described. However, the same applies to a public network represented by an ISDN network, and, of course, the present invention is not limited thereto. . Further, in the above-described embodiment, the DHCP server is used to set the MA of the terminal used inside the managed network.
Although the method of dynamically allocating an IP address to the C address has been described, it is needless to say that the method may be used in a network in which an IP address is statically allocated.

[0018]

As described above in detail, according to the present invention, even if there is a terminal using a user name connected inside the managed network, a connection from outside the managed network can be established. Without permission, illegal access can be prevented.

[Brief description of the drawings]

FIG. 1 is a diagram illustrating a configuration example of a network that implements the present invention.

FIG. 2 is a diagram illustrating an example of a log storage table.

FIG. 3 is a diagram illustrating an example of a password table.

FIG. 4 is a diagram illustrating an example of a MAC address table.

FIG. 5 is a diagram showing an example of an IP address table.

FIG. 6 is a flowchart illustrating an example of a procedure of a connection permission process in response to a connection request from a terminal outside the management target network.

FIG. 7 is a flowchart illustrating an example of a procedure of a process of verifying whether a terminal having a user name requesting a connection from outside the managed network exists inside the managed network;

[Explanation of symbols]

 DESCRIPTION OF SYMBOLS 10 Management target network 11 Access server 12 Authentication server 13 DHCP server 20 Security device 21 Log storage means 22 Password authentication means 23 Connection permission confirmation means 31, 32, 33 Terminal 40 Transmission medium 41 Telephone network 51 Connection request terminal

Claims (2)

[Claims] 1. A method for ensuring security of a managed network to which a terminal can be connected from the outside,
When a terminal having a user name requesting a connection from outside the managed network exists inside the network, the connection is not permitted to a terminal requesting a connection from the outside. How to ensure security. 2. A security device for a managed network to which a terminal can be connected from the outside, wherein a log storage means for storing information transmitted by a terminal requesting a connection from outside the managed network, Password authentication means for confirming that a user name and a password transmitted from a terminal requesting a connection from outside the management target network match a user name and a password registered in advance by a network administrator, and a user name and a password. A connection permission confirming means for managing a terminal owned by a user in association with the terminal and confirming whether or not a terminal having the same user name as a terminal requesting a connection from outside the managed network exists in the network; Security of network characterized by having Location.