Relay device, path control method, and path control program

• US 20080008192A1
• Filed: 11/21/2006
• Published: 01/10/2008
• Est. Priority Date: 07/07/2006
• Status: Active Grant

• Current Assignee: Fujitsu Limited
• Original Assignee: Fujitsu Limited
• Inventors: Matoba, Kazumine
• Granted Patent: US 7,756,140 B2
• Time in Patent Office: Days
• US Class Current: 370/397
• CPC Class Codes: H04L 2101/622 Layer-2 addresses, e.g. medium access control [MAC] addresses
• CPC Class Codes: H04L 61/103 across network layers, e.g. resolution of network layer into physical layer addresses or address resolution protocol [ARP]
• CPC Class Codes: H04L 61/2596 Translation of addresses of the same type other than IP, e.g. translation from MAC to MAC addresses
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic

Abstract

The relay device, comprising an address correspondence holding section which holds, for each of the terminals, the IP address and real MAC address of the terminal and a virtual MAC address being a MAC address that is virtual; a proxy reply section which, when a first ARP request frame that seeks the acquisition of the virtual MAC address from the terminal is received, reads the virtual MAC address of the corresponding terminal from the address correspondence holding section and sends back the virtual MAC address to the terminal; a MAC address conversion section which receives a first frame addressed to the virtual MAC address when the first frame is sent and received between the terminals, performs conversion of the virtual MAC address and real MAC address for the MAC address of the first frame, and sends back a converted second frame; and a security check section.

Claims

1. A relay device in which a single or a plurality of layer-2 switches are connected in subordination to the same physical port and a single or a plurality of terminals are connected in subordination to the layer-2 switches, comprising:

an address correspondence holding unit which holds, for each of the terminals, an IP address and real MAC address of the terminal and a virtual MAC address being a MAC address that is virtual;

a proxy reply unit which reads the virtual MAC address of the corresponding terminal from the address correspondence holding unit upon receiving a first ARP request frame that seeks acquisition of the virtual MAC address from the terminal, and sends back the virtual MAC address to the terminal; and

a MAC address conversion unit that receives the first frame addressed to the virtual MAC address, when the first frame is sent and received between the terminals, performs conversion of the virtual MAC address and real MAC address for the MAC address of the first frame, and sends back a converted second frame.

2. The relay device according to claim 1, further comprising:

an address collection unit which transmits a second ARP request frame at regular intervals to all of the terminals connected via the layer-2 switch and collects correspondence between the IP address and MAC address of the terminal by a reply frame with respect to the second ARP request frame; and

a virtual MAC address generation unit that allocates the virtual MAC address to the IP address and the MAC address thus collected,

wherein the virtual MAC address generation unit registers the allocated virtual MAC address, the IP address and the MAC address in the address correspondence holding unit.

3. The relay device according to claim 1, further comprising:

an address collection unit which receives a third frame that is transmitted from the terminal and collects the correspondence between the IP address and MAC address of the terminal from the third frame; and

a virtual MAC address generation unit which allocates the virtual MAC address to the corrected IP address and MAC address,

wherein the virtual MAC address generation unit registers the allocated virtual MAC address, the IP address, and the MAC address in the address correspondence holding unit.

4. The relay device according to claim 1, further comprising:

a terminal connection port holding unit which holds connection-destination physical port information,

wherein the proxy reply unit sends back the virtual MAC address when judging that communication is in subordination to the same physical port on the basis of the physical port information when the first ARP request frame has been received and sends back the real MAC address when judging that communication is in subordination to another physical port.

5. The relay device according to claim 1, further comprising:

a noncorresponding terminal detection unit which transmits a third ARP request frame by a source address that differs from the address of the relay device,

wherein the noncorresponding terminal detection unit specifies whether the terminal that has transmitted the third ARP request frame is a corresponding terminal that sends back only the first ARP request frame for which the relay device is the source address on the basis of a reply frame with respect to the third ARP request frame.

6. The relay device according to claim 1, further comprising:

a reply judgment unit which judges duplication of the IP address upon receiving a fourth ARP request frame, for which the IP addresses of the transmission source and destination are the same, which is transmitted from the terminal,

wherein the proxy reply unit replies or does not reply to the fourth ARP frame in accordance with the judgment result of the reply judgment section.

7. The relay device according to claim 1, further comprising:

a log collection unit which collects logs of the first frame sent and received between the terminals.

8. The relay device according to claim 1, wherein the layer-2 switch holds a learning table in which the virtual MAC address and connection port information contained in a reply frame with respect to the first ARP request frame are stored when the reply frame is transmitted from the relay device to the terminal;

and

the first frame is transmitted to the relay device by referencing the learning table when the first frame is transmitted from the terminal.

9. The relay device according to claim 1, further comprising:

a security check unit which discards the first frame when a problem with security of the first frame exists and outputs the first frame to the MAC address conversion unit when no such problem exists,

wherein the MAC address conversion unit performs conversion of the MAC address for the normal first frame.

10. The relay device according to claim 2, wherein the virtual MAC address generation unit searches the address correspondence holding unit from the collected IP address and MAC address and allocates the virtual MAC address when the virtual MAC address corresponding with the IP address and the MAC address has not been registered in the address correspondence holding unit.

11. The relay device according to claim 4, wherein the proxy reply unit compares the physical port information with a port number of the relay device received the first ARP request frame, judges that communication is in subordination to the same physical port when a match exits between the physical port information and the port number, and judges that communication is in subordination to another physical port when no such match exists.

12. The relay device according to claim 5, wherein the noncorresponding terminal detection unit specifies the terminal as the corresponding terminal when the reply frame with respect to the third ARP frame is not received from the terminal and specifies the terminal as a terminal that is not the corresponding terminal when the reply frame is received.

13. The relay device according to claim 6, wherein the reply judgment unit searches the address correspondence holding unit by taking the source IP address of the fourth ARP request frame as a search key upon receiving the fourth ARP request frame from the terminal, and judges that the source IP address is a duplicate if the real MAC address corresponding with the source IP address has not been registered, and

the proxy reply unit replies to the terminal upon obtaining the judgment result that the duplicate exists.

14. A network system in which a single or a plurality of layer-2 switches are connected in subordination to the same physical port of the relay device and a single or a plurality of terminals are connected in subordination to the layer-2 switches,

wherein the relay device comprises:

an address correspondence holding unit which holds, for each of the terminals, an IP address and real MAC address of the terminal and a virtual MAC address being a MAC address that is virtual;

a proxy reply unit which, when a first ARP request frame that seeks acquisition of the virtual MAC address from the terminal is received, reads the virtual MAC address of the corresponding terminal from the address correspondence holding unit and sends back the virtual MAC address to the terminal; and

a MAC address conversion unit which receives a first frame addressed to the virtual MAC address when the first frame is sent and received between the terminals, performs conversion of the virtual MAC address and real MAC address for the MAC address of the first frame, and sends back a converted second frame, and

the terminal comprises a reply control unit that replies only to a reply frame from the relay device.

15. A path control method for a relay device in which a single or a plurality of layer-2 switches are connected in subordination to the same physical port and in which a single or a plurality of terminals are connected in subordination to the layer-2 switches, comprising the steps of:

receiving a first ARP reply frame from the terminal,

reading a virtual MAC address of the corresponding terminal on the basis of the received first ARP reply frame from an address correspondence holding unit that holds, for each of the terminals, an IP address and real MAC address of the terminal and the virtual MAC address being a MAC address that is virtual, and sending back the virtual MAC address to the terminal, and

receiving a first frame addressed to the virtual MAC address when the first frame is sent and received between the terminals, performing conversion of the virtual MAC address and real MAC address with respect to the MAC address of the first frame, and sending back a converted second frame.

16. A path control program for a relay device in which a single or a plurality of layer-2 switches are connected in subordination to the same physical port and a single or a plurality of terminals are connected in subordination to the layer-2 switches, the path control program causing a computer to execute:

processing to receive a first ARP reply frame from the terminal;

processing to read a virtual MAC address of the corresponding terminal from an address correspondence holding unit that holds, for each of the terminals, an IP address and real MAC address of the terminal and the virtual MAC address being a MAC address that is virtual, and sending back the virtual MAC address to the terminal; and

processing to receive a first frame addressed to the virtual MAC address when the first frame is sent and received between the terminals, perform conversion of the virtual MAC address and real MAC address with respect to the MAC address of the first frame, and send back a converted second frame.