Authentication system, network line concentrator, authentication method and authentication program

• US 20060015714A1
• Filed: 07/13/2005
• Published: 01/19/2006
• Est. Priority Date: 07/14/2004
• Status: Active Grant

• Current Assignee: NEC Corporation
• Original Assignee: NEC Corporation
• Inventors: Hirano, Takashi, Hirata, Hiroaki, Shibayama, Kiyoshi, Nunome, Atsushi
• Granted Patent: US 8,209,529 B2
• Time in Patent Office: Days
• US Class Current: 713/151
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32

Abstract

A DHCP server 8 dispenses an IP address in response to a request from a terminal equipment 1. An authentication server 3 receives an authentication frame transmitted from the terminal equipment 1 using the dispensed IP address as a sender address and authenticates the terminal equipment 1. Upon completion of authentication, the authentication server 3 informs a registration information database 22 of an authentication hub 2 of communication permission for the terminal equipment 1. In the authentication hub 2, a frame receiving circuit 21 receives a transmission frame transmitted from the terminal equipment 1. The authentication hub 2 refers to the registration information database 22 on the basis of sender information of the transmission frame, determines transmission, rewriting-and-transmission, or discarding for the frame, and sends the transmission frame to a transmission buffer 23 if transmission or rewriting-and-transmission is permitted for the frame.

Claims

1. An authentication system including a network line concentrator and an authentication server for authenticating a terminal equipment accommodated in said network line concentrator, wherein said network line concentrator comprises a unit for restricting transfer of a frame transmitted from any other node except an authenticated terminal equipment authenticated by said authentication server to the inside and the outside of a network including said authentication server.

2. The authentication system as claimed in claim 1, wherein said unit for restricting transfer of a frame at least enables the terminal equipment to access to the authentication server before authentication.

3. The authentication system as claimed in claim 2, wherein said unit for restricting transfer of a frame restricts transmission of a unicast frame transmitted from the terminal equipment and rewrites a broadcast frame essential for an authenticating operation for the terminal equipment into a unicast frame addressed to a preliminarily permitted destination.

4. The authentication system as claimed in claim 3, wherein the network line concentrator is of a variable broadcast range type capable of rewriting the broadcast frame into the unicast frame.

5. The authentication system as claimed in claim 3, wherein the authenticating operation at least includes IP (Internet Protocol) address acquisition and ARP (Address Resolution Protocol) solution.

6. The authentication system as claimed in claim 1, wherein said unit for restricting transfer of a frame at least inhibits access to any other node except said authenticated terminal equipment through a switching hub inside the network and a router outside the network before authentication.

7. The authentication system as claimed in claim 1, wherein said network line concentrator is an integrated circuit formed by integrating at least said unit for restricting transfer of a frame.

8. A network line concentrator for accommodating a terminal equipment which is authenticated by an authentication server, said network line concentrator comprising a unit for restricting transfer of a frame transmitted from any other node except an authenticated terminal equipment authenticated by the authentication server to the inside and the outside of a network including said authentication server.

9. The network line concentrator as claimed in claim 8, wherein said unit for restricting transfer of a frame at least enables the terminal equipment to access to the authentication server before authentication.

10. The network line concentrator as claimed in claim 9, wherein said unit for restricting transfer of a frame restricts transmission of a unicast frame transmitted from the terminal equipment and rewrites a broadcast frame essential for an authenticating operation for the terminal equipment into a unicast frame addressed to a preliminarily permitted destination.

11. The network line concentrator as claimed in claim 10, wherein the network line concentrator is of a variable broadcast range type capable of rewriting the broadcast frame into the unicast frame.

12. The network line concentrator as claimed in claim 10, wherein the authenticating operation at least includes IP (Internet Protocol) address acquisition and ARP (Address Resolution Protocol) solution.

13. The network line concentrator as claimed in claim 8, wherein said unit for restricting transfer of a frame at least inhibits access to any other node except said authenticated terminal equipment through a switching hub inside the network and a router outside the network before authentication.

14. The network line concentrator as claimed in claim 8, wherein said network line concentrator is an integrated circuit formed by integrating at least said unit for restricting transfer of a frame.

15. An authentication method for use in an authentication system including a network line concentrator and an authentication server for authenticating a terminal equipment accommodated in said network line concentrator, said method comprising a step of restricting transfer of a frame transmitted from any other node except an authenticated terminal equipment authenticated by said authentication server to the inside and the outside of a network including said authentication server, said step being performed in said network line concentrator.

16. The authentication method as claimed in claim 15, wherein said step of restricting transfer of a frame at least enables the terminal equipment to access to the authentication server before authentication.

17. The authentication method as claimed in claim 16, wherein said step of restricting transfer of a frame restricts transmission of a unicast frame transmitted from the terminal equipment and rewrites a broadcast frame essential for an authenticating operation for the terminal equipment into a unicast frame addressed to a preliminarily permitted destination.

18. The authentication method as claimed in claim 17, wherein the network line concentrator is of a variable broadcast range type capable of rewriting the broadcast frame into the unicast frame.

19. The authentication method as claimed in claim 17, wherein the authenticating operation at least includes IP (Internet Protocol) address acquisition and ARP (Address Resolution Protocol) solution.

20. The authentication method as claimed in claim 15, wherein said step of restricting transfer of a frame at least inhibits access to any other node except said authenticated terminal equipment through a switching hub inside the network and a router outside the network before authentication.

21. The authentication method as claimed in claim 15, wherein said network line concentrator is an integrated circuit formed by at least integrating a unit for restricting transfer of a frame.

22. A program of an authentication method for use in an authentication system including a network line concentrator and an authentication server for authenticating a terminal equipment accommodated in said network line concentrator, said program being for making a computer execute processing of restricting transfer of a frame transmitted from any other node except an authenticated terminal equipment authenticated by said authentication server to the inside and the outside of a network including said authentication server.