Communications control method and information relaying device for communications network system

• US 7,360,086 B1
• Filed: 12/06/1999
• Issued: 04/15/2008
• Est. Priority Date: 12/07/1998
• Status: Expired due to Fees

• Current Assignee: Alaxala Networks Corporation (Fortinet Inc.)
• Original Assignee: Hitachi, Ltd.
• Inventors: Nozaki, Shinji, Tsuchiya, Kazuaki
• Primary Examiner(s): Moise; Emmanuel L.
• Assistant Examiner(s): PYZOCHA, MICHAEL J
• Application Number:
  US09/455,363
• Time in Patent Office: 3,053 Days
• Field of Search: 713/201, 713/152, 713/170, 713/168, 709/225, 709/209, 370/389, 726/22
• US Class Current: 713/168
• CPC Class Codes: H04L 12/44 Star or tree networks
• CPC Class Codes: H04L 12/4625 Single bridge functionality, e.g. connection of two networks over a single bridge
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226

Abstract

A LAN switch is one component of a communications network system composed of a virtual LAN having network terminals such as personal computers connected with ports respectively. The LAN switch provides a host table for holding correspondence between each port and address information of the network terminal connected to each port and an authentication table for holding information for authenticating a user of each network terminal. If a request takes place of changing the correspondence about the source network terminal held in the host table when relaying the packets, the LAN switch prompts a user name and a password for the source network terminal, does user authentication on the basis of the information held in an authentication table, and enables rewrite of the host table and relay of the packets if the user is correct. These processes are executed for easily preventing false use of an address or tapping or false access by a malignant user as well as analyzing or recovering the erroneously set address.

Claims

1. A network relaying method for a communication network system in which a plurality of network devices are coupled via a communication path, each network device including a network relaying device which is coupled via a plurality of I/O ports to a corresponding plurality of terminals, the method comprising the steps of:

receiving a packet at a first I/O port from a source terminal coupled to the first I/O port, the packet including a header containing a packet transmission source address;

determining whether a first combination of information contained in the received packet coincides with a second combination of information that has been registered in advance, wherein said first combination of information includes the first I/O port and the packet transmission source address of the received packet and said second combination of information includes an I/O port and a transmission source address that have been registered in advance with a correspondence therebetween, and, in response to the determining step resulting in a determination that the first combination of information coincides with the second combination of information, transferring the packet received at the first I/O port via a second I/O port, wherein it is determined that said first combination of information coincides with said second combination of information that has been registered in advance when only said first I/O port and said packet transmission source address coincide with said I/O port and transmission source address that have been registered in advance with a correspondence therebetween;

in response to the determining step resulting in a determination that the first combination of information does not coincide with the second combination of information;

limiting transfer of the received packet and transmitting a request for user authentication of a user to the source terminal of said received packet;

receiving user authentication information sent from the source terminal in response to the request for user authentication;

executing user authentication of the user based on the user authentication information thus received and based on the packet transmission source address;

when the user is authenticated by the user authentication executed in the executing step, registering the first I/O port with a correspondence to the packet transmission source address;

transferring the packet received at the first I/O port via the second I/O port; and

when the user is not authenticated by the user authentication executed in the executing step, not transferring the packet received at the first I/O port.

2. A network relaying method according to claim 1, wherein the user authentication information includes a user name and a password.

3. A network relaying method according to claim 1, wherein the transmission source address includes an IP address and a MAC address.

4. The network relaying method according to claim 1, further comprising the step of performing user authentication periodically for each of said plurality of terminals having an address registered in advance with a correspondence to an I/O port.

5. The network relaying method according to claim 1, wherein the received packet includes a destination address, and the method further comprises the steps of:

determining whether the destination address is registered in advance as a source address in combination with an I/O port;

if the determining step determines that the destination address of the received packet is not registered in advance as a source address in combination with an I/O port, user authentication is made as to a destination terminal having the destination address, by transmitting a request for user authentication to the destination terminal of the received packet;

receiving user authentication information sent from the destination terminal in response to the request for user authentication based on the user authentication information thus received from the destination terminal;

when the user is authenticated by the user authentication based on the user authentication information received from the destination terminal, registering the first I/O port with a correspondence to the destination address; and

when the user is not authenticated by the user authentication based on the user authentication information received from the destination terminal, not registering the first I/O port with a correspondence to the destination address.

6. A network relaying apparatus, comprising:

a plurality of I/O ports adapted to be coupled to a plurality of terminals, respectively;

a communication portion for transmitting and receiving data via the plurality of I/O ports;

a relay portion which determines a transmitting I/O port of the plurality of I/O ports, from which a packet received via the communication portion from a receiving I/O port of the plurality of I/O ports is output via the communication portion; and

which determines whether a first combination of information contained in the received packet coincides with a second combination of information that has been registered in advance, wherein said first combination of information includes the receiving I/O port and a packet transmission source address of the received packet and said second combination of information includes an I/O port and a transmission source address that have been registered in advance with a correspondence therebetween, wherein said relay portion transfers the received packet from the transmitting I/O port in response to the relay portion determining that the first combination of information coincides with the second combination of information, wherein it is determined by said relay portion that said first combination of information coincides with said second combination of information that has been registered in advance when only said receiving I/O port and said packet transmission source address coincide with said I/O port and transmission source address that have been registered in advance with a correspondence therebetween, and wherein said relay portion requests user authentication of a user from a source terminal of said received packet in response to the relay portion determining that the first combination of information does not coincide with the second combination of information;

an authentication portion which registers the receiving I/O port with a correspondence to the packet transmission source address when completing user authentication based on user authentication information sent from the source terminal in response to the request for user authentication and based on the packet transmission source address,

wherein when the authentication portion does not authenticate the user, the relay portion does not transfer the received packet.

7. A network relaying apparatus according to claim 6, wherein the user authentication information includes a user name and a password.

8. A network relaying apparatus according to claim 6, wherein the transmission source address includes an IP address and a MAC address.

9. The network relaying apparatus according to claim 6, wherein user authentication is performed periodically for each terminal having an address registered in advance with a correspondence to an I/O port.

10. The network relaying method according to claim 6,

wherein the received packet includes a destination address,

wherein the relay portion determines whether the destination address is registered in advance as a source address in combination with an I/O port,

wherein if the relay portion determines that the destination address of the received packet is not registered in advance as a source address in combination with an I/O port, the relay portion initiates user authentication as to a destination terminal having the destination address by transmitting a request for user authentication to the destination terminal of the received packet and receiving user authentication information sent from the destination terminal in response to the request for user authentication based on the user authentication information thus received from the destination terminal,

wherein when the user is authenticated by the user authentication based on the user authentication information received from the destination terminal, the authentication portion registers the receiving I/O port with a correspondence to the destination address, and

wherein when the user is not authenticated by the user authentication based on the user authentication information received from the destination terminal, the authentication portion does not register the receiving I/O port with a correspondence to the destination address.

11. A network relaying method for a communication network system in which a plurality of network devices are coupled via a communication path, each network device including a network relaying device which is coupled via a plurality of I/O ports to a corresponding plurality of terminals, the method comprising the steps of:

receiving a packet at a first I/O port from a source terminal coupled to the first I/O port, the packet including a header containing a packet transmission source address;

determining whether a combination of only the first I/O port and the packet transmission source address coincides with a combination of an I/O port and a transmission source address that have been registered in advance with a correspondence therebetween;

when the determining step results in a determination that the combination of only the first I/O port and the packet transmission source address coincides with a combination of an I/O port and transmission source address that have been registered in advance with a correspondence therebetween, transferring the packet received at the first I/O port via a second I/O port;

when the determining step results in a determination that the combination of only the first I/O port and the packet transmission source address do not have a coincidence with a combination of an I/O port and transmission source address that have been registered in advance with a correspondence therebetween;

limiting transfer of the received packet and transmitting a request for user authentication of a user to the source terminal of said received packet;

receiving user authentication information sent from the source terminal in response to the request for user authentication;

executing user authentication of the user based on the user authentication information thus received and based on the packet transmission source address;

when the user is authenticated by the user authentication executed in the executing step, registering the first I/O port with a correspondence to the packet transmission source address;

transferring the packet received at the first I/O port via the second I/O port; and

when the user is not authenticated by the user authentication executed in the executing step, not transferring the packet received at the first I/O port;

wherein the source terminal coupled to the first I/O port belongs to a VLAN; and

wherein when a user is not authenticated by the user authentication executed in the executing step, a warning message is sent to all terminals belonging to the same VLAN as the source terminal of the packet received at the first I/O port.

12. A network relaying apparatus, comprising:

a plurality of I/O ports adapted to be coupled to a plurality of terminals, respectively;

a communication portion for transmitting and receiving data via the plurality of I/O ports;

a relay portion which determines a transmitting I/O port of the plurality of I/O ports, from which a packet received via the communication portion from a receiving I/O port of the plurality of I/O ports is output via the communication portion; and

which determines whether a combination of only the receiving I/O port and a packet transmission source address contained in the packet coincides with a combination of an I/O port and a transmission source address that have been registered in advance with a correspondence therebetween, wherein said relay portion transfers the received packet from the transmitting I/O port when the relay portion determines that the combination of only the receiving I/O port and the packet transmission source address coincides with a combination of an I/O port and transmission source address that have been registered in advance with a correspondence therebetween, and wherein said relay portion requests user authentication of a user from a source terminal of said received packet when the relay portion determines that the combination of only the receiving I/O port and the packet transmission source address do not have a coincidence with a combination of an I/O port and a transmission source address that have been registered in advance with a correspondence therebetween;

an authentication portion which registers the receiving I/O port with a correspondence to the packet transmission source address when completing user authentication based on user authentication information sent from the source terminal in response to the request for user authentication,

wherein when the authentication portion does not authenticate the user, the relay portion does not transfer the received packet,

wherein the source terminal of the received packet belongs to a VLAN; and

wherein when a user is not authenticated by the user authentication, a warning message is sent to all terminals belonging to the same VLAN as the source terminal of the received packet.