JP3106000B2 - Security method - Google Patents

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a system security system using a node device for connecting a trunk local area network (hereinafter referred to as LAN) to a plurality of branch LANs.

[0002]

2. Description of the Related Art FIG. 7 is a block diagram showing a configuration of a conventional node device described in Japanese Patent Application No. 2-113669. 8 is a flowchart showing the operation of the node device of FIG. 7, and FIG. 9 is a network using the node device of FIG.
FIG. In FIG. 9, reference numeral 40 denotes a trunk LAN, 41 to 44 denote branch LANs, T denotes a terminal,
TA1 to TA5 indicate terminal addresses, and N10 to N
Reference numeral 40 denotes a node device. G1 and G2 are group numbers, TB1 to TB4 are filtering tables in the node device, and TTB1 to TTB4 are privileged terminal tables in the node device. 70 to 73
Is an arrow indicating communication between terminal devices. In FIG. 7, reference numeral 30 denotes a node device, reference numeral 31 denotes a trunk line control unit in the node device, reference numeral 32 denotes a branch line control unit, and reference numeral 33 denotes a central control unit for controlling the entire node device. In addition, 34 memories are connected to 35 buses along with other components, 36 comparison units,
37 filtering tables, 38 privileged terminal tables, and 39 data buffers are also components.

Next, the operation of this conventional example will be described. The node device Ni (N10 to N40 in FIG. 9) monitors the contents of all communication frames transmitted on the branch LAN, and performs filtering table TBi (TB1 to TB in FIG. 9).
4) is automatically generated. That is, each node device N1
By examining the source address SA of the received frame format, 0 to N40 can know what terminal address is connected in the own branch LAN. In addition, the destination address DA is checked and another LAN is checked.
Can find out what address the terminal has. Such information is automatically registered in the filtering table TBi, and the terminal addresses are arranged for each of the own branch LAN and other LAN systems. The node device Ni is free
When receiving the address, the destination address DA is searched (step 51), and if it is addressed to the own LAN, it is discarded (step 52).
If it is addressed to another LAN, it is relayed (step 53). Thus, the filtering operation is performed, and the traffic is suppressed.

A frame sent from another LAN compares group numbers for inter-group communication,
(Step 62), the packet is accepted and relayed (step 63) and sent to the terminal. In this example, in addition to inter-group communication, the concept of a privileged terminal is also taken in, so that communication is performed between specific terminals even if the group is different. That is, even if the group numbers do not match (step 61), if they are addressed to a terminal registered as a privileged terminal (step 65), they are relayed and transferred (step 67). If it is not addressed to its own LAN and is not registered in a privileged terminal, it is discarded. By providing the above filtering means, communication 71 in the same group (for example, G1) over different LANs as shown in FIG. 9 becomes possible, and communication between different groups (for example, G1 and G2) becomes possible. Communication 72
Is blocked. Even if communication is performed between different groups, communication 73 can be performed if the communication is registered.

[0005]

The conventional node device is configured as described above, and the security system operates as described above. Therefore, the network system of one trunk LAN and a plurality of branch LANs can be used. Has security and can communicate with a high degree of freedom. However, no consideration is given to a larger network connecting a plurality of trunk LANs, reducing traffic between LANs, enabling a plurality of inter-group communications, and furthermore, only a predetermined inter-group communication. There is a problem that security cannot be guaranteed.

[0006] The present invention has been made to solve the above problem, assign a port number to each node, for the network across multiple trunk LAN, high security, yet among the same group from distant LAN through the LAN between the free communication Huh different groups of each
An object of the present invention is to obtain a security method for dividing a communication track .

[0007]

A security system according to the present invention comprises a plurality of trunk local area networks.
(Hereinafter referred to as LAN) and a plurality of branch LANs
Or for filtering operation between trunk LANs.
Multiple nodes connected using a filtering table
In the device, the filtering table stores the terminal number.
Number and the port number that each terminal connects to the node device.
To register, store, and as a communication frame for relay
Is a method of assigning group numbers, and
The router operation checks the destination port number and receives
Assign a frame group number and relay to the port
And do not relay to other ports, and own LAN
When the group number is different for the communication frame addressed to
To be relayed when the group number is the same.
I made it.

[0008]

According to the security system of the present invention, a terminal number and a port number are stored in a pair, and a frame is transferred to the stored port. Alternatively, only frames having the same group number are transferred.

[0009]

【Example】

Embodiment 1 FIG. FIG. 1 is a block diagram showing a configuration of a node device to which a security system according to an embodiment of the present invention is applied. In the figure, reference numeral 11 denotes a filtering table, which will be described later in detail. 12 is a central control unit for controlling the entire node device, 31 is a main line control unit in the same node device as the conventional one, 4
Reference numerals 3 and 44 denote a wide-area control unit that controls communication transmitted / received to another trunk LAN or the like via a wide-area network or the like. FIG. 2 is a diagram showing the registration and storage contents of the filtering table 11 of FIG. 1. A terminal number and a port number are stored in pairs. FIG. 3 is a diagram showing the specific state, and the corresponding nodes in the network configuration diagram shown in FIG.
FIG. 4 is a state diagram of a filtering table of the storage device. In FIG. 4, 1, 2 and 3 are trunk LANs, respectively, N10 and N
11, the Ni such as N20 Roh - in de device, TB _10, T
TBi such B _11, TB ₂₀ each Roh - filtering Te in de device - a table. T is a terminal, and TA1 to TA4 are their terminal numbers. _{Also, P 1, P 2, P} 3 , etc. As Roh - a port number - Bruno de device is connected - port for each de device. G1, G2, and G3 are security group numbers for limiting communication only between groups as necessary,
1, C2 and C3 represent communication between terminals.

Next, the operation of this embodiment will be described.
Figure 5 is a flow chart for explaining a state in which node device shown in FIG. 1 is operated with respect to communications between the LAN. The central control unit 1 of this operation mainly FIG. 1, a communication frame (hereinafter
Against the abbreviated descending frame) relay (forwarding) or disposal decision. Branch line L connected to trunk line LAN1
From the terminal (address TA1) in the AN to the trunk LAN2
To terminal (address TA2) on branch LAN connected to
Transmits a frame, it considers the communication C 1. Here already learning terminal number to the node device N10, N20 value of 3 to the filtering table TB _10, TB ₂₀ is assumed to be stored. Node device N11, N2
A similar value is stored in the filtering table within 1. The node device N11 starts from the terminal address TA1.
Upon receiving a frame from the port P2, it searches the destination table TB ₁₁ based on the destination address TA2, obtained
Via the port P1 to the trunk LAN1 . Upon receiving this frame from the port P1 (step S1 in FIG. 5), the node device N10 inputs the SA of the terminal that has received the frame.
The port correspondence is registered in the table TBi (see FIG. 5).
S2). For example, when a frame is received from TA1,
For example, the port P1 to which the frame was input is
Register to Bull TB ₁₀ and receive a frame from TA2
For example, the port P2 to which the frame was input is
Register for Bull TB ₁₀ . Then, the node device N10 is the destination table TB ₁₀ in FIG. 3 search <br/> to search by examining the destination address TA2 (Fig. 5 step S3), and also, the contents of the TB ₁₀ is TA
If the same P1 as the input port has been registered for No. 2, the frame is discarded without relaying this input port P1 (step S5 in FIG. 5 ). If the destination is not registered and unknown, the same content frame is relayed to all ports except the input port P1 (step S5 in FIG. 5 ) .
8).

Next, the node device N20 is
10 from the port P2 ( FIG. 5)
Step S1), and look at the destination address TA2 searches the destination table TB ₂₀ in FIG. 3 (Fig. 5 step S3), and relayed to all ports other than the input port <br/> over preparative P2 (FIG. 5 step S6) . The node device N21 transmits this frame to the port P
1 and receives the destination based on the destination address TA2.
Searches the table TB _21, it relays the obtained port P2 to the branch LAN, the frame to the terminal of the terminal address TA2
Send

Embodiment 2 FIG. In the above embodiment, an example in which a group number is not added has been described. However, as an example of assuring security for a system extending over a plurality of trunk LANs, a case in which a group number is given will be described. In FIG. 4, groups G1, G2, and G3 indicated by dotted lines are set between networks, and communication is permitted only between terminals in the group. In this case, C1, C
No. 3 communication is allowed, and C2 communication is not allowed. In this case, steps S7 and S9 are added in FIG. The node equipment to be connected to a branch of the receiving side, a diagram of a conventional example 8 (b)
The following processing operation is performed. In FIG. 5, the communication C1 from the terminal number TA1 to the terminal number TA2 will be described. The node device N11 outputs the frame from the terminal TA1 as a port.
When the frame is received from P2 , the frame with the group number G1 added to all ports other than the port P2 is relayed. Similarly, the node device N10 receives a frame from the port P1,
After searching for the destination address, relay and transmission are performed without removing the group number G1 from all ports other than the port P1. Thereafter, through the node device described in the first embodiment, the same as the conventional example
The frame to which the group number G1 has been added arrives at the node device N21, where the group number is removed, and the frame is sent to the terminal TA2 of the branch LAN.

Security between terminals in different groups is guaranteed as described below. That is, group G
In the communication C2 between the terminal TA1 and the terminal TA3 is a communication between a 1 and G2, each node equipment in the middle of the drop frames
Does not, in the same manner as in Example 1, this frame arrives at Bruno <br/> over de device N21. However, as in the case of the conventional example possessed by the node device N21, if the group numbers are different by the group collation means for the terminal connected to the own branch LAN (step 61 in FIG. 8), the privileged terminal table
(Step 65 in FIG. 8), and SA is not a privileged terminal
As long as (step 67 in FIG. 8), the frame is discarded (see FIG. 8) .
8 Step 66) Because of the frame does not <br/> adhesive arrives to the terminal.

Embodiment 3 FIG. Example 1, was that the processing operation of FIG. 5 as an operation of the node device Ni in Example 2, Step S6 in FIG. 5 as the operation of the central control unit 12, to the port that is a "destination address pair If you change the process to just forwarding, you can send frames to one destination port.
To send frames to all ports except the receiving port
In this case, the relay operation of each node device Ni is shortened and communication traffic can be reduced. For example, if the node device N10 changes the terminal number TA1 to the terminal number T
When a frame to A2 is received, it is relayed only to port P2 (step S6 in FIG. 5). Similarly, the node device N20
Relays this frame only to port P1.

Embodiment 4 FIG. FIG. 6 shows groups G1, G2, G
FIG. 3 is a system configuration diagram showing an example in which Company A, Company B, and Company C respectively exclusively use No. 3; By assigning a group number to each company in this way, while sharing the transmission line interconnecting the trunk LANs and the device connecting the trunk LANs, the company's terminals can be spread over distant locations such as Tokyo and Osaka. Thus, security operation is possible in which communication is free and each company does not allow communication other than between companies.

Embodiment 5 FIG. Further, the central control unit 12 of FIG. 1 has a timer for each terminal number stored in the filtering table of FIG. 2, and must re-register (update the timer value) the terminal number within a certain period of time. if, by adding a function to reduce the terminal number from the filtering table, against the change in the relocation and network configuration of the terminal, automatically flexible response.

[0017]

As described above, according to the present invention, the trunk line L
For communication over the AN, the node device is provided with a filtering table in which the terminal number of the terminal and the port number to which the terminal is connected to the node device are paired. Since the communication frame is further relayed by adding a group number to the communication frame, communication between a plurality of trunk LANs can be performed with high security and free communication between the same groups even from a remote LAN. Can be between different groups
Network traffic by dividing
An effect of reducing the communication traffic.

[Brief description of the drawings]

FIG. 1 is a configuration block diagram of a node device to which an embodiment of the present invention is applied.

FIG. 2 is a diagram showing a filtering table of the node device of FIG. 1;

FIG. 3 is a diagram showing specific values in FIG. 2;

FIG. 4 is a network configuration diagram for explaining the present invention.

FIG. 5 is a flowchart illustrating a filtering operation of the node device.

FIG. 6 is a configuration diagram of a wide area system showing another embodiment of the present invention.

FIG. 7 is a configuration block diagram of a conventional node device.

FIG. 8 is a flowchart showing the operation of a conventional node device.

9 is a configuration diagram of a network system using the node device of FIG. 7;

[Explanation of symbols]

11 Filtering Te - table 12 the central control unit N1, N2 port - port number N10, N20, N30, Ni Bruno - de device P1, P2, P3 port - DOO TA1, TA2, TA3, TA4 terminal address TB _10, TB ₂₀ , TB ₃₀ filtering table example

Continuation of front page (56) References JP-A-64-23646 (JP, A) JP-A-2-134943 (JP, A) JP-A-3-141754 (JP, A) JP-A-3-205933 (JP) JP-A-3-280639 (JP, A) JP-A-3-289839 (JP, A) JP-A-4-107029 (JP, A) JP-A-4-360336 (JP, A) 5-199226 (JP, A) JP-A-5-2007037 (JP, A) Mitsubishi Electric Technical Report Vol. 66 No. 8, 1992, Koji Tatara et al. “Mitsubishi high-speed optical LAN“ MELNET R100 ”system technology”, pages. 56-59 Fig. 9 etc. Hitachi Review, Vol. 75 No. 3, 1993, Hiroshi Tomizawa, et al. “Application system of trunk network integrating information and control”, pages 23-26 Fig. 1 (58) Fields investigated (Int. Cl. ⁷ , DB name) H04L 12/46 H04L 12/28 JICST file (JOIS)

Claims (1)

(57) [Claims] 1. A method for connecting a plurality of trunk local area networks (hereinafter referred to as LANs) to a plurality of branch LANs, or for filtering between trunk LANs .
A plurality of node devices connecting with filtering table, the filtering table is registered in pairs the port number to which the terminal ID and the terminal connected to the node device,
Stores and assigns a group number to the communication frame for relay
And method of filtering operation of the node device, the destination port
Look at the number and assign the group number of the received frame.
Relay to that port, and relay to other ports.
Group for communication frames addressed to the own LAN
If the group numbers are different, discard the group numbers.
A security method characterized by relay transmission in such cases.