JP2004266516A - Network management server, communication terminal, edge switch device, program for communication, and network system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To secure security in a radio section between a communication terminal and an access point without adding any special functions, such as an authentication function, to the access point. <P>SOLUTION: An area network management server 25 shares a pre-shared key using the MAC address of each communication terminal as a key with the communication terminals 10A, 10B for connecting group networks 30A, 30B to which its own terminal belongs via an area network 20. When the communication terminal starts communication with the group networks via the area network 20, the connection with the area network management server where the security is secured by the pre-shared key is relayed for communicating between the communication terminal and authentication servers 70A, 70B. When the authentication is successful, the area network server sets a new main communication key to the communication terminal and a house-side edge switch. After that, communication where security is secured by a main signal key is made between the communication terminal and the group networks. <P>COPYRIGHT: (C)2004,JPO&NCIPI

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to a public network system that requires encryption in an access network and user authentication, and more particularly to a network management server, a communication terminal, an edge switch device, a communication program, and a network system in a mobile network system.
[0002]
[Prior art]
2. Description of the Related Art Conventionally, as a method of authentication to a public Internet connection network or a corporate VPN (Virtual Private Network) connection, a method using a PPP (Point-to-Point Protocol) protocol is generally used. PPP has functions such as a user authentication function and a function of assigning a subscriber IP address by an ISP (Internet Service Provider). To realize these functions on Ethernet (R) (Ethernet (R)), the access network carries PPP packets by a protocol called PPP over Ethernet (R). The station terminates PPPoE.
[0003]
In addition, as another example of a mobile authentication system of a conventional wireless Internet service, there is a technology described in Non-Patent Document 1 below. FIG. 15 is a diagram showing an example of a configuration of a network system according to the related art, and FIG. 16 is a sequence diagram of an example of a configuration of a network system according to the related art. The sequence shown in FIG. 16 is basically the same as the content of Non-Patent Document 1.
[0004]
In the conventional network shown in FIG. 15, the access point (base router) has an authentication function, and the communication terminal 110 is authenticated only by one round trip message, thereby enabling quick authentication. First, the access point 115 broadcasts time information to the communication terminal 110. The communication terminal 110 that has received the time information generates a hash value using the time as a seed by using the secret key exchanged with the authentication server 170, and sends the time information and the hash value to the access point as an authentication request. Submit the value. The authentication server 170 calculates a hash value from the received time information using a secret key. Then, it is checked whether or not the calculation result is the same as the received hash value. If the hash value is the same, the authentication response is transmitted to the access point 115 as an authentication response, and the access point 115 transfers the authentication response to the communication terminal 110 .
[0005]
[Non-patent document 1]
"High-speed Authentication System Providing Security Required for Wireless Internet Services", IPSJ Research Report 2001-DPS-107, March 2002
[0006]
[Problems to be solved by the invention]
However, in access by PPPoE, a PPPoE session is established between a communication terminal and a network-side terminating device called a BAS (Broadband Access Server). Therefore, when the wireless link is broken when the communication terminal moves, it is necessary to reestablish the PPPoE session, and it is necessary to perform authentication by PPP again. Therefore, it is difficult to quickly perform wireless switching movement.
[0007]
The technique described in Non-Patent Document 1 has the following problems. First, because base stations and communication terminals are built with proprietary specifications, it is not possible to use general-purpose access points, which are currently very inexpensive, and the advantage of the Internet of using inexpensive networks is impaired. There is a problem that there is a possibility that it will be. In addition, since the authentication server and the communication terminal need to have their own specifications, there is a problem that the cost increases.
[0008]
In view of the above problems, the present invention provides a network system that ensures security without adding a special function such as an authentication function to an access point, and particularly provides a network system between a communication terminal and an access point. An object is to provide a network management server, a communication terminal, an edge switch device, a communication program, and a network system in a mobile network system capable of ensuring security in a wireless section.
[0009]
[Means for Solving the Problems]
In order to achieve the above object, the present invention is arranged in an inter-network that connects a plurality of communication terminals and a network to which each of the plurality of communication terminals belongs, and to which the plurality of communication terminals and each of the plurality of communication terminals belong. A network management server for managing a connection with a network, wherein a shared key unique to each of a plurality of communication terminals is held in advance, and encryption / decryption using a shared key is performed between each of the plurality of communication terminals. It is configured to perform communication.
With this configuration, it is possible to provide a secure network system without adding a special function such as an authentication function to the access point, and in particular, it is possible to provide security in a wireless section between the communication terminal and the access point. Can be secured.
[0010]
Further, the present invention is arranged in an inter-network connecting a plurality of communication terminals and a network to which each of the plurality of communication terminals belongs, and establishes a connection between the plurality of communication terminals and a network to which each of the plurality of communication terminals belongs. A network management server that manages, holds in advance a shared key unique to each of the plurality of communication terminals, receives information necessary for authentication in an encrypted network from each of the plurality of communication terminals, The received information is decrypted with the shared key, and information necessary for authentication in the network related to the communication terminal is transmitted to an authentication server in the network to which the communication terminal belongs.
With this configuration, it is possible to provide a secure network system without adding a special function such as an authentication function to the access point, and in particular, the communication terminal transmits when connecting to a desired network. With respect to information necessary for authentication to be performed, security in a wireless section between a desired communication terminal and an access point can be ensured.
[0011]
Further, in addition to the above configuration, the present invention is configured such that an authentication result in an authentication server in a network to which the communication terminal belongs is received from the authentication server, the authentication result is encrypted with a shared key, and transmitted to the communication terminal.
With this configuration, it is possible to provide a secure network system without adding a special function such as an authentication function to the access point. In particular, the authentication result relaying from the authentication server to the communication terminal With regard to the above, security in a wireless section between a desired communication terminal and an access point can be ensured.
[0012]
Furthermore, in addition to the above-described configuration, the present invention provides a method for communicating in an inter-network when receiving position information of a communication terminal from an edge switch device that forms an edge of the inter-network and connects to a plurality of communication terminals. An edge switch device that sets a path between a terminal and a network, forms an edge of an inter-network, and connects to a plurality of communication terminals, and an edge switch that forms an edge of an inter-network, and connects to the network side The apparatus is configured to transmit, to the apparatus, path information enabling communication by path.
With this configuration, it is possible to manage a route in the network between the home-side edge switch device and the network-side edge switch device, which are relay networks when the communication terminal connects to a desired network.
[0013]
Furthermore, the present invention, in addition to the above configuration, when the authentication result in the authentication server in the network to which the communication terminal belongs is successful, generates a main signal key for encryption corresponding to the identification information of the communication terminal, A main signal key is transmitted to a communication terminal and an edge switch device that forms an edge of an inter-network and connects to a plurality of communication terminals.
With this configuration, it is possible to newly set a common main signal key for main signal communication in the communication terminal and the home-side edge switch device.
[0014]
Further, in addition to the above configuration, the present invention is configured so that the main signal key is encrypted with the shared key and transmitted to the communication terminal.
With this configuration, it is possible to encrypt the main signal key sent to the communication terminal and prevent the main signal key from being stolen from outside.
[0015]
Further, in addition to the above configuration, the present invention is configured such that a MAC address unique to the communication terminal is used as identification information of the communication terminal.
With this configuration, the main signal key and the communication terminal can be related one-to-one.
[0016]
Furthermore, the present invention, in addition to the above configuration, when receiving, from each of the plurality of communication terminals, movement notification information that notifies that the connection of the edge switch device encrypted by the shared key has been switched, the received information Is decrypted with the shared key, and the communication terminal transmits the main signal key to the edge switch device connected after the movement, and the communication terminal transmits the main signal key to the edge switch device connected before the movement to the moved communication terminal. The main signal key is requested to be deleted.
With this configuration, when the communication terminal changes the connection of the home-side edge switch device, it becomes possible to move the main signal key of the edge switch device according to this connection change, and without performing authentication processing again, It is possible to support movement.
[0017]
Further, in addition to the above configuration, the present invention is configured to request the communication terminal to transmit a shared key at regular time intervals, and to confirm the legitimacy of the communication terminal.
With this configuration, it is possible to confirm the validity of the communication terminal at regular intervals.
[0018]
Further, in addition to the above-described configuration, the present invention provides an edge switch device that configures an edge of an inter-network and connects to a plurality of communication terminals when the validity of the communication terminal cannot be confirmed. An edge switch device that configures an edge of the inter-network and connects to the network side is configured to request deletion of path information related to the communication terminal.
With this configuration, it is possible to prevent communication with a fake user or communication terminal.
[0019]
According to the present invention, there is provided a communication program executable by the network management server in order to realize the above-described network management server.
This makes it possible to realize a network management server using a general computer.
[0020]
The present invention also provides a communication terminal for connecting to a network to which the terminal belongs via an inter-network, and a network management server in the inter-network that previously holds a shared key unique to the communication terminal. , Communication is performed by encryption / decryption using a shared key.
With this configuration, it is possible to provide a secure network system without adding a special function such as an authentication function to the access point, and in particular, it is possible to provide security in a wireless section between the communication terminal and the access point. Can be secured.
[0021]
The present invention also relates to a communication terminal for connecting to a network to which the terminal belongs via an inter-network, and a network management server in the inter-network that holds a shared key unique to the communication terminal in advance. On the other hand, information necessary for authentication on the network to which the terminal belongs is encrypted with a shared key and transmitted.
With this configuration, it is possible to provide a secure network system without adding a special function such as an authentication function to the access point, and in particular, the communication terminal transmits when connecting to a desired network. With respect to information necessary for authentication to be performed, security in a wireless section between a desired communication terminal and an access point can be ensured.
[0022]
Further, in addition to the above configuration, the present invention receives from the network management server information obtained by encrypting the authentication result in the authentication server in the network to which the communication terminal belongs with the shared key, and decrypts the received information with the shared key. It is configured to do.
With this configuration, it is possible to provide a secure network system without adding a special function such as an authentication function to the access point. In particular, it is possible to provide a communication terminal with a desired authentication result received from the authentication server. Security in a wireless section between the communication terminal and the access point.
[0023]
Further, in addition to the above configuration, the present invention is configured to receive, from the network management server, a main signal key for encryption corresponding to the identification information of the communication terminal.
With this configuration, it is possible to newly obtain a main signal key for main signal communication.
[0024]
Further, in addition to the above configuration, the present invention configures an edge of an inter-network and performs communication by encryption / decryption using a main signal key with an edge switch device that connects to a communication terminal. Constitute.
With this configuration, communication with the home edge switch device can be encrypted with the main signal key.
[0025]
Further, the present invention provides a communication terminal for connecting to a network to which the terminal belongs via an inter-network, the edge switch device forming an edge of the inter-network and connecting to the communication terminal side. When the connection is switched, the movement notification information for notifying that the connection of the edge switch device has been switched is encrypted with the shared key to the network management server in the inter-network that holds the shared key unique to the communication terminal in advance. And send it.
With this configuration, when the communication terminal moves and switches the connection of the home-side edge switch device, the movement can be notified to the network management server.
[0026]
Further, in addition to the above configuration, the present invention is configured to transmit the shared key to the network management server when transmission of the shared key is requested from the network management server.
With this configuration, it is possible to notify the network management server of the validity of the terminal at regular intervals.
[0027]
According to the present invention, there is provided a communication program executable by the communication terminal to realize the above communication terminal.
This makes it possible to realize a network management server using a general computer.
[0028]
Further, the present invention is an edge switch device that configures an edge of an inter-network connecting a plurality of communication terminals and a network to which each of the plurality of communication terminals belongs, and performs connection with a plurality of communication terminals. When relaying a request for authentication in a network from each of the plurality of communication terminals to a network management server that manages a connection between the plurality of communication terminals and a network to which each of the plurality of communication terminals belongs, the network management server It is configured to notify the location information of the communication terminal.
With this configuration, it is possible to allow the network management server to set the route at the same time as the authentication of the communication terminal.
[0029]
Further, in addition to the above configuration, the present invention is configured to receive, from the network management server, route information enabling communication via a route set between the communication terminal and the network in the inter-network.
According to this configuration, information from the communication terminal or information to the communication terminal can be relayed according to the route set by the network management server.
[0030]
Further, in addition to the above configuration, the present invention is configured to receive, from the network management server, a main signal key for encryption corresponding to the identification information of the communication terminal.
With this configuration, it is possible to newly obtain a main signal key for main signal communication.
[0031]
Further, in addition to the above configuration, the present invention is configured to perform communication with a communication terminal by encryption / decryption using a main signal key.
With this configuration, communication with the communication terminal can be encrypted with the main signal key.
[0032]
Further, in addition to the above-described configuration, the present invention is configured to delete the main signal key when requested to delete the main signal key related to the communication terminal from the network management server.
According to this configuration, when the communication terminal moves, the connection with the edge switch device is cut off, and communication with the edge switch device with the communication terminal is stopped, the main signal is sent according to a request from the network management server. The key can be deleted.
[0033]
Further, the present invention provides a communication terminal for connecting to a network to which the terminal belongs via a network between homes, and a home edge switch device which forms an edge of the network between networks and connects to a plurality of communication terminals. And a network-side edge switch device that configures an edge of the inter-network and connects to the network side, and a network management server that is arranged in the network-side network and manages the connection between the communication terminal and the network. In a network system, a network management server is connected to a network-side edge switch device, and a first connection between a communication terminal and a network management server is provided between a home-side edge switch device and a network-side edge switch device. The communication tunnel and the second communication tunnel between the communication terminal and the network are set separately. It is formed.
With this configuration, different logical paths can be set between the home-side edge switch device and the network-side edge switch device, so that desired communication devices can reliably communicate with each other.
[0034]
Further, in addition to the above configuration, the present invention is configured to apply IEEE 802.1x to communication between the communication terminal and the network management server.
With this configuration, the existing IEEE 802.1x and its extension can be used for communication between the communication terminal and the network management server.
[0035]
Further, in addition to the above-described configuration, the present invention is configured to apply an existing Simple Network Management Protocol (SNMP) to communication between the network management server and the home-side edge switch device or the network-side edge switch device. With this configuration, SNMP or its extension can be used for communication between the network management server and the home-side edge switch device or the network-side edge switch device.
[0036]
Further, in addition to the above configuration, the present invention is configured to apply label switching to communication between the network side edge switch device and the home side edge switch device.
With this configuration, it is possible to use an existing MPLS (Multi Protocol Label Switching) protocol or the like for communication between networks between the network side edge switch device and the home side edge switch device.
[0037]
Further, in addition to the above configuration, the present invention is configured to apply VLAN switching to communication between the network side edge switch device and the home side edge switch device.
With this configuration, it is possible to use an existing VLAN (Virtual Local Area Network) protocol or the like for communication between networks between the network-side edge switch device and the home-side edge switch device.
[0038]
BEST MODE FOR CARRYING OUT THE INVENTION
Hereinafter, embodiments of a network management server, a communication terminal, an edge switch device, a communication program, and a network system of the present invention will be described with reference to the drawings.
[0039]
<First Embodiment: Initial Authentication>
First, a first embodiment of the present invention will be described with reference to FIG. In the first embodiment, an operation at the time of initial authentication will be mainly described. FIG. 1 is a diagram showing an example of a basic configuration of a network system according to the present invention.
[0040]
The communication terminal 10A belongs to the group A, and the terminal 10B belongs to the group B. Each of the communication terminals 10A and 10B communicates with the group networks 30A and 30B to which they belong via a regional network (regional network) 20. The group A network is called a group network 30A, and the group B network is called a group network 30B.
[0041]
The local network 20 includes a home edge switch (home edge switch device, sometimes simply referred to as an edge switch device) 40 on the home edge side, and a network edge switch (network edge switch device) on the network edge side. 50 are arranged. In the regional network 20, a regional network management server (network management server) 25 that manages communication between the communication terminals 10A and 10B and the group networks 30A and 30B is arranged. The home side refers to a side that connects to the communication terminals 10A and 10B, and the network side refers to a side that connects to the group networks 30A and 30B. The edge is an end of a network and refers to a communication device that can connect to a communication device that does not belong to the network.
[0042]
The home side port of the local network 20 and the communication terminals 10A and 10B can be connected through an access network, and the communication terminals 10A and 10B can be connected to the access network by wireless communication with the access point 15 or the like. is there. The network side of the regional network 20 can be connected to the group networks 30A and 30B through the edge routers 60A and 60B of each group.
[0043]
In addition, authentication servers 70A and 70B that authenticate each group are installed in each of the group networks 30A and 30B. The authentication servers 70A and 70B of each group can use a RADIUS (Remote Authentication Dial In User Service) server that holds authentication information (user authentication information) of each of the communication terminals 10A and 10B. When the communication terminals 10A and 10B communicate with the group networks 30A and 30B to which they belong, authentication of the communication terminals 10A and 10B by the authentication servers 70A and 70B is performed.
[0044]
Each of the above components needs to hold the following information in advance. The communication terminals 10A and 10B hold a user ID and a password, and a pre-shared key (for example, a MAC address unique to each of the communication terminals 10A and 10B). Further, the regional network management server 25 holds information (user / group management information) in which a relationship between a user ID and a group identifier is described, and a pre-shared key of each of the communication terminals 10A and 10B. In addition, the home-side edge switch 40 holds path information between the regional network management server 25 and the communication terminals 10A and 10B. The authentication servers 70A and 70B hold information (user authentication information) describing the relationship between the user ID and the password.
[0045]
The user ID and the password are managed in the group networks 30A and 30B, and using this user information, it is authenticated that each of the communication terminals 10A and 10B belongs to each group. For example, the user ID and the password are managed in a network in an organization such as a company or a school. The pre-shared key is a key that is shared and held between the communication terminals 10A and 10B and the local network management server 25. The key is used to prevent the communication terminals 10A and 10B from being known to others. And the local network management server 25.
[0046]
Next, an initial authentication sequence in the network system shown in FIG. 1 will be described. FIG. 2 is an initial authentication sequence diagram showing the first half of the initial authentication according to the first embodiment of the present invention. When performing the initial authentication sequence, encrypted communication using a pre-shared key is performed for all information between the communication terminals 10A and 10B and the local network management server 25, and security for the user ID and the password is ensured. . Note that IEEE 802.1x is used for communication between the communication terminals 10A and 10B and the regional network management server 25. For the initial authentication, the flow of IEEE 802.1x + EAP (Extensible Authentication Protocol) is used as it is. However, it is possible to set whether or not to transfer a packet for each MAC address of a communication terminal instead of the port authentication which is a feature of IEEE 802.1x (hereinafter sometimes simply referred to as 802.1x).
[0047]
First, the communication terminals 10A and 10B encrypt with the pre-shared key, transmit the EAP-Start to the regional network management server 25, and start communication (step S201). The EAP-Start is MAC bridge-transferred by the home-side edge switch 40. The regional network management server 25 receives this information and decrypts (also referred to as decryption) using the pre-shared key of the communication terminals 10A and 10B of the transmission source (step S202).
[0048]
The regional management network server 25 encrypts the data with the pre-shared key, transmits EAP-Request / Identity to the communication terminals 10A and 10B, and requests a user ID (step S203). The communication terminals 10A and 10B receive this information and decrypt it using the pre-shared key (step S204). Then, the communication terminals 10A and 10B encrypt the data with the pre-shared key and transmit the EAP-Response / Identity including the user ID to the regional network management server 25 (step S205). The regional network management server 25 receives this information and decrypts it using the pre-shared key of the communication terminals 10A and 10B of the transmission source (step S206). Further, the regional network management server 25 transmits a Radius-Access-Request including the user ID to the authentication servers 70A and 70B in the group belonging to each of the communication terminals 10A and 10B. The RADIUS protocol is used for communication between the regional network management server 25 and the authentication servers 70A and 70B.
[0049]
The authentication servers 70A and 70B receive this information, return a Radius-Access-Challenge to the regional network management server 25, and the regional management network server 25 encrypts the EAP-Request with the pre-shared key and EAP-Request the communication terminals 10A and 10B (Step S207). The communication terminals 10A and 10B receive this information and decrypt it using the pre-shared key (step S208). Then, the communication terminals 10A and 10B encrypt the data with the pre-shared key and transmit an EAP-Response including the password to the regional network management server 25 (step S209). The local network management server 25 receives this information, decrypts the information using the pre-shared key of the communication terminals 10A and 10B of the transmission source (step S210), and, like the user ID, Radius-Access-Request including the password. To the authentication servers 70A and 70B.
[0050]
The authentication servers 70A and 70B compare the user authentication information stored in advance with the user ID and the password sent from the communication terminals 10A and 10B, and when the authentication is successful, Radius-Access-Success. Is returned to the regional network management server 25. Receiving this information, the regional management network server 25 encrypts the information with the pre-shared key, transmits EAP-Success to the communication terminals 10A and 10B, and notifies the authentication success (step S211). The communication terminals 10A and 10B receive this information and decrypt using the pre-shared key (step S212).
[0051]
FIG. 3 is an initial authentication sequence diagram showing the latter half of the initial authentication according to the first embodiment of the present invention. When the regional network management server 25 notifies EAP-Success to the communication terminals 10A and 10B in step S211, the regional network management server 25 stores the MAC addresses of the communication terminals 10A and 10B and corresponds to the MAC addresses. A main signal key is set (step S301). The regional network management server 25 transmits the MAC address and the main signal key corresponding to the MAC address to the residential side edge switch 40 as the transferability information of the packet having the MAC address. In addition, while performing the sequence shown in FIG. 2, it is also possible for the home edge switch 40 to store the MAC addresses of the communication terminals 10A and 10B. In this case, the main signal key and the main signal key What is necessary is just to transmit the set information for identifying the communication terminals 10A and 10B.
[0052]
The home side edge switch 40 receives the main signal key and registers the correspondence between the MAC address and the main signal key (step S302). Note that the main signal key is different from the pre-shared key, and the pre-shared key is a key previously shared between the communication terminals 10A and 10B and the regional network management server 25, and the main signal key is This is a key for encrypting the main signal when the authentication is successful and the actual communication is performed.
[0053]
Specifically, for example, when the communication terminals 10A and 10B having the MAC address “00-80-45-23-21-fe” successfully authenticate to the respective group networks 30A and 30B, “00-80 -45-23-21-fe "and the main signal key are set. The home-side edge switch 40 cannot transfer a packet having a MAC address that is not registered as a key of the main signal key.
[0054]
When the main signal keys of the communication terminals 10A and 10B are set from the regional network management server 25 to the home-side edge switch 40, a network operation protocol such as SNMP can be used.
[0055]
Further, the regional management network server 25 encrypts with the pre-shared key and transmits the main signal key to the communication terminals 10A and 10B (step S303). The communication terminals 10A and 10B receive this information and decrypt it using the pre-shared key (step S304). Then, the communication terminals 10A and 10B store the main signal key obtained from the regional network management server 25. In the subsequent main signal communication, data encryption / decryption (also referred to as encryption / decryption) is performed using the main signal key, and the communication terminals 10A and 10B and the home edge switch 40 communicate with each other. Is performed (steps S305 and S306). As a result, the wireless section between the communication terminals 10A and 10B and the home-side edge switch 40 becomes an encrypted section that is encrypted with the main signal key.
[0056]
When the access point 15 is installed between the communication terminals 10A and 10B and the home-side edge switch 40, it is necessary to manage the position information of the communication terminals 10A and 10B as path information. In this case, at the time of the authentication request of the communication terminal, the regional network management server 25 transmits to the home side edge switch 40 which access point of which home side edge switch 40 the communication terminals 10A and 10B are connected to. As a result, the regional network management server 25 can manage the route information.
[0057]
FIG. 4 is an initial authentication and route setting sequence diagram in the first embodiment of the present invention. Note that the sequence of FIG. 4 is also a sequence following FIG. 1, similarly to the sequence of FIG. 2. The home-side edge switch 40 notifies the location information of the communication terminals 10A and 10B to the regional network management server 25 upon the transfer of the EAP-Success (step S401). At this time, it is also possible to add position information of the communication terminals 10A and 10B to an arbitrary packet sent from the communication terminals 10A and 10B to the regional network management server 25 and transmit the packet. The regional network management server 25 requests the home-side edge switch 40 and the network-side edge switch 50 to set the path information on the corresponding communication terminals 10A and 10B based on the notified position information (step S402). .
[0058]
The subsequent steps S403 to S407 are the same as steps S302 to S306 shown in FIG. Also, even when the main signal communication is being performed, the regional network management server 25 can make a route setting request based on the position information of the communication terminals 10A and 10B (step S408). In the case where the route setting of the communication terminals 10A and 10B is performed from the regional network management server 25 to the home edge switch 40, a network operation protocol such as SNMP can be used.
[0059]
<Second Embodiment: Mobile Authentication>
Next, a second embodiment of the present invention will be described. In the second embodiment, mainly the operation at the time of mobile authentication will be described, and in particular, the operation when the communication terminal switches the home edge switch will be described. FIG. 5 is a diagram for explaining an outline of the mobile authentication according to the second embodiment of the present invention. Note that FIG. 5 illustrates a change in the communication flow when the communication terminal 10B belonging to the group B switches the connection of the home-side edge switch 40, and illustrates the change of the home-side edge switch ( The home side edge switch 40X before the movement is the home side edge switch 40X, and the newly connected home side edge switch (the home side edge switch after the movement) is the home side edge switch 40Y.
[0060]
When the communication terminal 10B switches the connection of the home-side edge switch 40, the movement is notified from the communication terminal 10B to the regional network management server 25 through the moved home-side edge switch 40Y ((1) movement notification in FIG. 5). ), The main signal key is distributed from the regional network management server 25 to the home side edge switch 40Y after the movement ((2) main signal key distribution in FIG. 5), and the main signal key of the home side edge switch 40X before the movement is deleted. ((3) main signal key deletion in FIG. 5).
[0061]
FIG. 6 is a mobile authentication sequence diagram according to the second embodiment of the present invention. The communication terminal 10B moves while performing main signal communication with the host (communication partner) through the access point 15 connected to the home-side edge switch 40X before moving, and accesses to connect to another home-side edge switch 40. Switch connection to point 15. At this time, the communication terminal 10B detects movement on the wireless link (step S601), and then establishes a link with the new access point 15 (step S602).
[0062]
Then, the communication terminal 10B encrypts the area network management server 25 with the pre-shared key and notifies the movement to the local network management server 25 in order to secure security with the home side edge switch 40Y after the movement (step S603). . Here, for example, the communication terminal 10B encrypts the payload portion of the Ethernet packet with the pre-shared key, and transmits information related to the movement notification to the regional network management server 25. The regional network management server 25 receives this information and decrypts it using the pre-shared key of the communication terminal 10B of the transmission source (step S604).
[0063]
In response to the movement notification, the regional network management server 25 reads the main signal key set corresponding to the communication terminal 10B from the MAC address of the communication terminal 10B (step S605). Then, the MAC address of the communication terminal 10B and the main signal key corresponding to the MAC address are transmitted to the moved home-side edge switch 40Y, and the main signal key of the communication terminal 10B is set in the moved home-side edge switch 40Y. To be done. Further, a request for deleting the main signal key of the communication terminal 10B is issued to the home side edge switch 40X before the movement, and the main signal key of the communication terminal 10B stored in the home side edge switch 40X before the movement is deleted.
[0064]
In addition, it is necessary to rewrite the route information of the home-side edge switch 40Y and the network-side edge switch 50 so that the communication terminal 10B can communicate even after moving. The moved home-side edge switch 40Y notifies the regional network management server 25 of the location information of the communication terminal 10B, triggered by the movement notification from the communication terminal 10B. The regional network management server 25 starts setting the path information on the corresponding communication terminals 10A and 10B in the home edge switch 40Y and the network edge switch 50 based on the notified position information (step S606). Request routing information.
[0065]
As a result, even if the communication terminal moves, it is possible to support the movement of the communication terminal without performing authentication by the authentication server, and the wireless section between the communication terminal 10B and the moved home-side edge switch 40Y is moved. Thus, encrypted communication using the main signal key can be performed. In addition, by deleting information related to the communication terminal 10B existing in the home-side edge switch 40X before moving, unnecessary information can be deleted and security of the communication system can be increased. The side edge switch 40 only needs to hold the main signal key of only the subordinate communication terminal 10B at all times, and from the point of scalability, it is not necessary to hold that of all the terminals, and it is efficient. When the route setting of the communication terminal 10B is performed from the regional network management server 25 to the home edge switches 40X and 40Y, a network operation protocol such as SNMP can be used.
[0066]
In addition, for the movement notification from the communication terminal 10B, it is possible to use an EAPOL (EAP over LAN) -Key packet defined in IEEE 802.1x. The EAPOL-Key packet is a packet frame for exchanging an encryption key. The communication terminal 10B can send the main signal key actually managed by the communication terminal 10B to the regional network management server 25, or the key portion can be emptied and sent. The reception of the EAPOL-Key packet by the regional network management server 25 triggers the regional network management server 25 to start setting the main signal key for the moved home-side edge switch 40Y. Note that when the main signal key of the communication terminal 10B is set from the regional network management server 25 to the home-side edge switch 40, a network operation protocol such as SNMP can be used.
[0067]
<Third Embodiment: Periodic Authentication>
Next, a third embodiment of the present invention will be described. In the third embodiment, an operation at the time of periodic authentication in which the regional network management server authenticates a communication terminal at regular intervals will be mainly described. FIG. 7 is a diagram for explaining an outline of the periodic authentication according to the third embodiment of the present invention. FIG. 7 illustrates a state in which the regional network management server 25 performs periodic authentication on the communication terminal 10B belonging to the group B. FIG. 7 shows only one communication terminal 10B belonging to the group B, and the description will be made based on this.
[0068]
For example, it is necessary to prevent a user from illegally logging in and performing communication by stealing a packet at the time of initial authentication of a predetermined user as it is. According to the present invention, unless a pre-shared key is obtained, a fake user cannot communicate by impersonating a legitimate user. However, in order to prevent multiple logins, it is usual that only one communication terminal 10B communicates with one user ID, and when a fake user logs in first. It is not possible for a legitimate user to log in after that.
[0069]
Therefore, the regional network management server 25 periodically transmits a terminal authentication request to confirm whether the communication terminal 10B holds the pre-shared key. Since the authorized communication terminal 10B must hold the pre-shared key, it is possible to transmit the pre-shared key. At this time, the pre-shared key is made invisible from outside by encryption. (This process is called periodic authentication). That is, the authentication request is made from the regional network management server 25 to the communication terminal 10B at regular intervals ((1) authentication request in FIG. 7), and the communication terminal 10B makes a response to the regional network management server 25. (2) authentication response in FIG.
[0070]
FIG. 8 is a periodic authentication sequence diagram according to the third embodiment of the present invention. The regional management network server 25 transmits the terminal authentication request (EAP-Request +) to the communication terminal 10B after encrypting it with the pre-shared key (step S801). This is a step for requesting the communication terminal 10B for a pre-shared key and confirming whether the communication terminal 10B has the pre-shared key. The communication terminal 10B receives this information and decrypts it using the pre-shared key (step S802). At this time, the IEEE 802.1x EAP-Request frame can be used as it is, and here, a pre-shared key is required instead of a password.
[0071]
If the communication terminal 10B is a legitimate communication terminal, the communication terminal 10B encrypts it with the pre-shared key and transmits a terminal authentication response (EAP-Response +) to the regional network management server 25 (step S803). At this time, the communication terminal 10B can put the pre-shared key on the EAP-Response and transmit the EAP-Response to the regional network management server 25. The regional network management server 25 receives this information and decrypts it using the pre-shared key (step S804). Then, the regional network management server 25 compares the pre-shared key received from the communication terminal 10B with the pre-shared key held by itself, confirms that they are the same, confirms that the communication terminal 10B is a legitimate communication terminal, The main signal communication of the communication terminal 10B is continued as it is. Note that the local network management server 25 can determine whether or not the communication terminal 10B is the legitimate communication terminal by requesting the MAC address, and request both the pre-shared key and the MAC address to obtain more reliable information. Alternatively, the validity of the communication terminal 10B can be determined.
[0072]
On the other hand, when the terminal authentication response is not returned, or when the pre-shared key received from the communication terminal 10B does not match the pre-shared key held by the terminal itself (when the terminal authentication response is invalid) (step S805). Is determined to be a fake communication terminal. Then, the regional network management server 25 transmits a disconnection request for the communication terminal 10B to the authentication server 70B, and disconnects communication between the communication terminal 10B and the group network 30B. Further, the regional network management server 25 transmits a route information deletion request to the home side edge switch 40 and the network side edge switch 50, and deletes the transfer information. As a result, the communication terminal determined to be false loses the communication and packet transfer paths with the group network 30B and cannot perform communication. In this way, by performing the periodic authentication, even if a fake user logs in, the fake user cannot log in for at least a certain time (time interval of the periodic authentication).
[0073]
<Fourth Embodiment: Protocol>
Next, a fourth embodiment of the present invention will be described. In the fourth embodiment, a protocol mainly used in the local network 20 will be described. In particular, a case where an MPLS protocol or a VLAN protocol that can establish a logical path in the local network 20 is used. explain.
[0074]
FIG. 9 is an example of a configuration of a network system according to the present invention, and is a diagram illustrating a configuration in which a regional network management server is connected to a network side edge switch. In the above description, the local network management server 25 is directly connected to the home edge switch 40. However, as shown in FIG. 9, the local network management server 25 is connected to the network edge switch 50. It is also possible. In this case, a link used for communication between the communication terminals 10A and 10B and the group networks 30A and 30B to which the communication terminals 10A and 10B belong, and a link used between the communication terminals 10A and 10B and the regional network management server 25. Are the same links in the regional network 20.
[0075]
FIG. 10 is a diagram showing an outline of a logical path in a configuration in which the regional network management server in the network system according to the present invention connects to the network side edge switch. In the configuration shown in FIG. 9, the links are physically the same in the regional network 20, but in this case, communication is performed through logically different paths as shown in FIG. That is, a main signal path (a path for main signal communication between the communication terminal 10A and the group networks 30A and 30B) and a local area are connected to the mesh network between the home-side edge switch 40 and the network-side edge switch 50. A network management path (a path for communication between the communication terminal 10A and the local network management server 25) is set separately in advance.
[0076]
The residential side edge switch 40 distributes a packet to the regional network management server 25 to a regional network management path and a packet to the group networks 30A and 30B to a main signal path. At this time, whether or not the packet is to be sent to the local network management server 25 is determined by referring to the header of the Ethernet packet. For example, if the Ethernet type is 0x880e indicating IEEE 802.1x, or the destination MAC address is the local network management server 25, the home edge switch 40 distributes the packet to a local network management path. Since the area management server 25 sets and registers the main signal key using the MAC addresses of the communication terminals 10A and 10B as keys at the time of authentication, the MAC addresses of the communication terminals 10A and 10B need to reach the area management server 25 as they are. In order to realize this, it is possible to apply, for example, the MPLS protocol or the VLAN protocol.
[0077]
FIG. 11 is a main signal protocol stack diagram when the MPLS protocol according to the fourth embodiment of the present invention is used, and FIG. 12 is a diagram when the MPLS protocol according to the fourth embodiment of the present invention is used. FIG. 4 is an authentication and route setting protocol stack diagram. For example, as a protocol for establishing a logical path in the regional network 20, MPLS for performing label switching is applicable. Since the MPLS label is assigned 20 bits (bits), about 1 million paths can be assigned.
[0078]
The home-side edge switch 40 and the network-side edge switch 50 are configured to be able to add and delete MPLS labels. Further, a switch router (not shown) arranged in the intra-area network 20 is configured to transfer the packet to a predetermined route with reference to the MPLS label added to the packet. It should be noted that the switch router can also add, delete, and exchange labels. In addition, since the regional network management server 25 needs to exchange an Ethernet header (Ether in the drawing) when communicating with the communication terminals 10A and 10B, the EoMPLS (EoMPLS (capable of encapsulating an Ethernet packet and carrying it by a label). Ethernet (R) over MPLS).
[0079]
FIG. 13 is a main signal protocol stack diagram when the VLAN protocol according to the fourth embodiment of the present invention is used, and FIG. 14 is a diagram when the VLAN protocol according to the fourth embodiment of the present invention is used. FIG. 4 is an authentication and route setting protocol stack diagram. For example, as a protocol for establishing a logical path in the regional network 20, besides MPLS, a VLAN protocol is also applicable.
[0080]
In the VLAN protocol, a VLAN tag is added to an Ethernet header, and transfer is performed using the VLAN tag. In addition, a VLAN tag is assigned to a port of a switch router (not shown) in the regional network to configure a logical path. As a result, similarly to the MPLS protocol, in the VLAN protocol, a VLAN tag can be added to a packet in a regional network to transfer the packet. Note that a maximum of 4000 tags can be assigned to one VLAN in one stack.
[0081]
In addition, among the devices described in each of the above-described embodiments, particularly, regarding the communication terminals 10A and 10B and the local network management server 25, an existing computer or the like executes a communication program for performing the operation of the present invention. It can be realized by:
[0082]
【The invention's effect】
As described above, according to the present invention, according to the present invention, the regional network management server previously holds a shared key unique to each of the plurality of communication terminals, and performs an initial authentication between the regional network management server and the communication terminal. The shared key is used for communication to ensure security. On the other hand, when the communication terminal performs communication with a desired network, the main signal key set by the regional management network server is used to communicate with the local network. Since the security of communication between the management server and the communication terminal is ensured, a network system with security is provided without adding a special function such as an authentication function to the access point. It is possible to secure security in a wireless section between the access point and the access point.
[Brief description of the drawings]
FIG. 1 is a diagram showing an example of a basic configuration of a network system according to the present invention.
FIG. 2 is an initial authentication sequence diagram showing a first half of the initial authentication according to the first embodiment of the present invention;
FIG. 3 is an initial authentication sequence diagram showing the latter half of the initial authentication according to the first embodiment of the present invention.
FIG. 4 is an initial authentication and route setting sequence diagram according to the first embodiment of the present invention.
FIG. 5 is a diagram for explaining an outline of mobile authentication according to the second embodiment of the present invention;
FIG. 6 is a mobile authentication sequence diagram according to the second embodiment of the present invention.
FIG. 7 is a diagram for explaining an outline of periodic authentication according to the third embodiment of the present invention;
FIG. 8 is a diagram illustrating a periodic authentication sequence according to the third embodiment of the present invention.
FIG. 9 is an example of a configuration of a network system according to the present invention, showing a configuration in which a regional network management server is connected to a network side edge switch.
FIG. 10 is a diagram showing an outline of a logical path in a configuration in which a regional network management server is connected to a network side edge switch in the network system according to the present invention;
FIG. 11 is a main signal protocol stack diagram when the MPLS protocol is used according to the fourth embodiment of the present invention.
FIG. 12 is an authentication and route setting protocol stack diagram when the MPLS protocol is used according to the fourth embodiment of the present invention.
FIG. 13 is a main signal protocol stack diagram when the VLAN protocol is used according to the fourth embodiment of the present invention.
FIG. 14 is an authentication and route setting protocol stack diagram when a VLAN protocol is used according to the fourth embodiment of the present invention.
FIG. 15 is a diagram showing a configuration example of a network system according to a conventional technique.
FIG. 16 is a sequence diagram in a configuration example of a network system according to a conventional technique.
[Explanation of symbols]
10A, 10B, 110 Communication terminal
15, 115 access point
20 Regional networks (regional networks, networks between networks)
25 Regional Network Management Server (Network Management Server)
30A, 30B Group network
40, 40X, 40Y Home side edge switch (Home side edge switch device)
50 Network-side edge switch (network-side edge switch device)
60A, 60B edge router
70A, 70B, 170 authentication server

Claims (29)

Network management arranged in an inter-network connecting a plurality of communication terminals and a network to which each of the plurality of communication terminals belongs, and managing connection between the plurality of communication terminals and a network to which each of the plurality of communication terminals belongs A server,
A network management server that holds a shared key unique to each of the plurality of communication terminals in advance and performs communication by encryption / decryption with the shared key with each of the plurality of communication terminals. Network management arranged in an inter-network connecting a plurality of communication terminals and a network to which each of the plurality of communication terminals belongs, and managing connection between the plurality of communication terminals and a network to which each of the plurality of communication terminals belongs A server,
Holding a shared key unique to each of the plurality of communication terminals in advance, receiving encrypted information required for authentication in the network from each of the plurality of communication terminals, and sharing the received information with the shared terminal. A network management server that decrypts with a key and transmits information required for authentication of the communication terminal in the network to an authentication server in the network to which the communication terminal belongs. The network management server according to claim 2, wherein an authentication result from an authentication server in a network to which the communication terminal belongs is received from the authentication server, the authentication result is encrypted with the shared key, and transmitted to the communication terminal. When the position information of the communication terminal is received from an edge switch device that configures an edge of the inter-network and connects to the plurality of communication terminals, a path between the communication terminal and the network in the inter-network. And an edge switch device that configures an edge of the inter-network and connects to the plurality of communication terminals, and an edge switch device that configures an edge of the inter-network and connects to the network 4. The network management server according to claim 3, wherein path information that enables communication by the path is transmitted to the network management server. When the authentication result in the authentication server in the network to which the communication terminal belongs is authentication success, a main signal key for encryption is generated corresponding to the identification information of the communication terminal, and the communication terminal and the inter-network 5. The network management server according to claim 3, wherein the main signal key is transmitted to the edge switch device that forms an edge and connects to the plurality of communication terminals. The network management server according to claim 5, wherein the main signal key is encrypted with the shared key and transmitted to the communication terminal. The network management server according to claim 5, wherein a MAC address unique to the communication terminal is used as the identification information of the communication terminal. When receiving, from each of the plurality of communication terminals, movement notification information that notifies that the connection of the edge switch device encrypted by the shared key has been switched, the received information is decrypted by the shared key, The communication terminal transmits the main signal key to an edge switch device connected after the movement, and the main signal related to the moved communication terminal to an edge switch device connected before the communication terminal moves. The network management server according to any one of claims 5 to 7, which requests deletion of a key. The network management server according to any one of claims 5 to 8, wherein the network management server requests the communication terminal to transmit the shared key at regular time intervals and checks the legitimacy of the communication terminal. If the legitimacy of the communication terminal cannot be confirmed, the edge switch device that configures an edge of the inter-network and connects to the plurality of communication terminals and configures an edge of the inter-network. 10. The network management server according to claim 9, wherein the network management server requests the edge switch device that connects to the network side to delete the path information related to the communication terminal. A communication program executable by the network management server to realize the network management server according to any one of claims 1 to 10. A communication terminal for connecting to a network to which the terminal belongs via an inter-network,
A communication terminal that performs communication by encryption / decryption using the shared key with a network management server in the inter-network that previously holds a shared key unique to the communication terminal. A communication terminal for connecting to a network to which the terminal belongs via an inter-network,
Communication in which information necessary for authentication in the network to which the terminal belongs is encrypted with the shared key and transmitted to a network management server in the inter-network that holds a shared key unique to the communication terminal in advance. Terminal. 14. The communication terminal according to claim 13, wherein information obtained by encrypting an authentication result in an authentication server in a network to which the communication terminal belongs with a shared key is received from the network management server, and the received information is decrypted with the shared key. . 15. The communication terminal according to claim 13, wherein a main signal key for encryption corresponding to identification information of the communication terminal is received from the network management server. 16. The communication terminal according to claim 15, wherein communication is performed by encryption / decryption using the main signal key with an edge switch device that forms an edge of the inter-network and connects to the communication terminal. A communication terminal for connecting to a network to which the terminal belongs via an inter-network,
The network management in the inter-network, which constitutes an edge of the inter-network and switches a connection of an edge switch device for connection with the communication terminal side in advance and holds a shared key unique to the communication terminal. A communication terminal that encrypts, using the shared key, movement notification information that notifies a server that the connection of the edge switch device has been switched, and transmits the information. 18. The communication terminal according to claim 17, wherein when the network management server requests transmission of the shared key, the communication terminal transmits the shared key to the network management server. A communication program executable by the communication terminal to implement the communication terminal according to any one of claims 12 to 18. An edge switch device that configures an edge of an inter-network connecting a plurality of communication terminals and a network to which each of the plurality of communication terminals belongs, and performs connection with the plurality of communication terminals.
When relaying a request for authentication in the network from each of the plurality of communication terminals to a network management server that manages a connection between the plurality of communication terminals and a network to which each of the plurality of communication terminals belongs, An edge switch device for notifying the network management server of position information of the communication terminal. 21. The edge switch device according to claim 20, wherein the edge switch device receives, from the network management server, route information enabling communication via the route set between the communication terminal and the network in the inter-network. 22. The edge switch device according to claim 20, wherein a main signal key for encryption corresponding to identification information of the communication terminal is received from the network management server. 23. The edge switch device according to claim 22, wherein communication with the communication terminal is performed by encryption / decryption using the main signal key. The edge switch device according to claim 22 or 23, wherein when the network management server requests deletion of the main signal key related to the communication terminal, the main signal key is deleted. A communication terminal that connects to a network to which the terminal belongs via an inter-network, a home-side edge switch device that forms an edge of the inter-network, and that connects to the plurality of communication terminals; A network-side edge switch device that forms an edge of the inter-network and connects to the network side, and a network management server that is arranged in the network-side network and manages a connection between the communication terminal and the network. A network system,
The network management server is connected to the network-side edge switch device,
A first communication tunnel between the communication terminal and the network management server, and a second communication tunnel between the communication terminal and the network, between the home-side edge switch device and the network-side edge switch device. A network system that is set up separately for communication tunnels. The network system according to claim 25, wherein IEEE 802.1x is applied to communication between the communication terminal and the network management server. 27. The network system according to claim 25, wherein SNMP is applied to communication between the network management server and the home-side edge switch device or the network-side edge switch device. The network system according to any one of claims 25 to 27, wherein label switching is applied to communication between the network-side edge switch device and the home-side edge switch device. The network system according to any one of claims 25 to 27, wherein VLAN switching is applied to communication between the network-side edge switch device and the home-side edge switch device.

Images