JP4510593B2 - Device authentication apparatus and computer program - Google Patents

Description

  The present invention relates to a device authentication apparatus and a computer program that are provided in a network device such as a router and stop the device function when movement of the installation location of the network device is detected.

As a technique for managing devices connected to a network, for example, in Patent Document 1, a MAC (Media Access Control) address and an IP (Internet Protocol) address of each device connected to the network are registered in a server in association with resources. In addition, the server automatically acquires the MAC address and IP address of each device on the network and compares it with the MAC address and IP address of each registered device to automatically move or replace the device. An apparatus for automatically determining is disclosed.
JP 2002-108734 A

  By the way, it is possible to use a network device installation location as a security environment, for example, enabling network connection when installed in a data center, and disabling network connection when installed in other locations. In order to embody such a form, the technique disclosed in Patent Document 1 that automatically determines the movement or replacement of a device connected to the network is suitable, but if there is no server to manage, what is the moved device? There is a problem that it can be used freely without restrictions and cannot be used after illegal movement.

  The present invention has been made in view of such circumstances, and an object of the present invention is to provide a device authentication apparatus and a computer program that prevent use of a device connected to a network after unauthorized movement.

In order to achieve the above object, the present invention provides a device authentication apparatus mounted on a device connected to a network, and at the time of initial registration for connecting the device to the network, identification information unique to another device adjacent to the device, network The first environment information generating means for generating the first environment information composed of the route information and routing information of the device above, and the identification unique to other devices adjacent to the device after the initial registration in which the device is connected to the network Second environmental information generating means for generating second environmental information consisting of information, route information of the device on the network and routing information at every elapse of a predetermined period , and storage means for storing the first environmental information; registration means for registering the first environmental information which the generated in the storage means, the second environmental information generating means and the second environmental information In each generation, the rate of matching with other device-specific identification information included in the second first environment information stored in the other device-specific identification information and the storage means included in the environment information is equal to or higher than a predetermined value Each time the second environmental information generating means generates the second environmental information, the first detecting means for detecting the presence or absence of the movement of the device depending on whether the second environmental information is generated or not. Second detection means for detecting whether or not the device has moved based on whether or not a matching rate between the route information to be stored and the path information included in the first environment information stored in the storage means is equal to or greater than a predetermined value; Each time the second environment information generating means generates the second environment information, the routing information included in the second environment information and the routing information included in the first environment information stored in the storage means Whether or not the matching rate is equal to or higher than a predetermined value And a third detecting means for detecting presence or absence of movement, and an instruction means for instructing the apparatus to stop functioning when any of the first to third detecting means detects movement of the apparatus. This is a device authentication apparatus.

According to the present invention, in the invention described above, when the first to third detection units do not detect movement of the device , the registration unit uses the second environment information currently generated as the first environment. It characterized that you update registered in said storage means as the information.

The present invention provides a device authentication apparatus computer mounted on a device connected to a network at the time of initial registration for connecting the device to the network, identification information unique to another device adjacent to the device, and route information of the device on the network First environmental information generating means for generating first environmental information comprising routing information, identification information unique to another device adjacent to the device after initial registration of the device connected to the network, and information on the device on the network Second environment information generating means for generating second environment information composed of route information and routing information every elapse of a predetermined period , registration means for registering the generated first environment information in a storage means, Each time the environmental information generating means generates the second environmental information, the identification information unique to the other device included in the second environmental information First detecting means for the first match rate with other device-specific identification information included in the environment information stored in the serial storage means for detecting the presence or absence of the movement of the equipment whether more than a predetermined value, Each time the second environment information generating means generates the second environment information, the path information included in the second environment information and the path information included in the first environment information stored in the storage means The second detection means for detecting the presence or absence of movement of the device depending on whether or not the coincidence rate is equal to or greater than a predetermined value, and the second environmental information generation means each time the second environmental information is generated, The presence or absence of movement of the device is detected based on whether or not the matching rate between the routing information included in the environmental information 2 and the routing information included in the first environmental information stored in the storage means is greater than or equal to a predetermined value. Third detection means, any of the first to third detection means If either detects the movement of the device, a computer program to function as instruction means for instructing the stalls the device.

  According to the present invention, the device authentication apparatus generates first environment information indicating the installation environment on the network at the time of initial registration for connecting the device to the network, and thereafter, the installation environment on the network of the device every certain period of time. Device is connected to the network because the device is instructed to stop functioning when the movement of the device is detected from the comparison between the generated second environment information and the first environment information. Can be prevented from being used after illegal movement. In addition, it is possible to automatically grasp position information with high credibility of the device, and to enable safe communication / connection control based on device attributes such as installation environment.

  According to the present invention, the device authentication apparatus generates and stores the first environment information representing the installation environment on the network at the time of initial registration for connecting the device to the network, and thereafter, the device authentication device stores the device information every time a certain period of time elapses. Second environment information representing the installation environment on the network is generated, and the presence or absence of movement of the device is detected from a comparison between the generated second environment information and the stored first environment information. If the movement is not detected, the second environment information that is currently generated is updated and registered as the first environment information. On the other hand, if the movement is detected, the device is instructed to stop functioning. While adapting, it is possible to prevent the use of devices connected to the network after unauthorized movement.

  According to the present invention, at the time of initial registration for connecting a device to the network, the device authentication apparatus includes first environment information including identification information unique to another device adjacent to the device, route information of the device on the network, and routing information. After that, the same second environment information is generated every certain period of time. Each time the second environment information is generated, the matching rate between the identification information in the second environment information and the identification information in the first environment information, the path information in the second environment information, and the first information It is determined whether or not the match rate with the route information in the environment information and the match rate between the routing information in the second environment information and the routing information in the first environment information are each equal to or greater than a predetermined value. If any of the determinations does not satisfy the determination condition, it is instructed to stop the function of the device because it has been moved, so that it is possible to prevent use of the device connected to the network after unauthorized movement.

  According to the present invention, at the time of initial registration for connecting a device to the network, the device authentication apparatus includes first environment information including identification information unique to another device adjacent to the device, route information of the device on the network, and routing information. Is generated and stored, and thereafter, similar second environment information is generated every time a certain period of time elapses. Each time the second environment information is generated, the matching rate between the identification information in the second environment information and the identification information in the first environment information, the path information in the second environment information, and the first information The movement rate of the device depends on whether the matching rate with the route information in the environmental information and the matching rate between the routing information in the second environmental information and the routing information in the first environmental information are equal to or greater than a predetermined value, respectively. If the presence / absence is detected and the movement is not detected, the second environment information that is currently generated is updated and registered as the first environment information. It is possible to prevent the use of devices connected to the network after unauthorized movement while adapting to the changing network environment.

Embodiments of the present invention will be described below with reference to the drawings.
(1) Configuration FIG. 1 is a network diagram including routers provided with a device authentication apparatus according to the present embodiment.
In the figure, a router 2a is connected to adjacent routers 2b to 2d. In addition, the management server 1 is connected via the routers 2b to 2d. The routers 2a to 2d (hereinafter referred to as the router 2 when the entire router is shown) are respectively connected to the device authentication apparatuses 10a to 10d (hereinafter referred to as the device authentication apparatus 10 when the entire device authentication apparatus is shown). To be described).

  The management server 1 is originally a device that controls the routers 2a to 2d by SNMP (Simple Network Management Protocol), but in this embodiment, the arrival when the routers 2a to 2d collect network route information with the trace route command. Used as a destination.

FIG. 2 is a block diagram showing an internal configuration of the device authentication apparatus 10, which includes an initial registration unit 11, a memory 12, a movement detection unit 13, and an instruction unit 14.
The initial registration unit 11 generates initial environment information (corresponding to determination data described later) that represents an installation environment on the network of the router 2 by performing initial registration processing described later during initial registration for connecting the router 2 to the network. And stored in the memory 12. The movement detection unit 13 generates second environment information (corresponding to position data described later) representing the installation environment of the router 2 on the network every time a predetermined period has elapsed after the initial registration in which the router 2 is connected to the network. The presence or absence of movement of the router 2 is detected according to the comparison between the second environment information and the first environment information stored in the memory 12. If the movement detection unit 13 does not detect the movement of the router 2, the second environmental information that is currently generated is updated and registered in the memory 12 as the first environmental information. On the other hand, when the movement of the router 2 is detected, The router 2 is instructed to stop functioning via the instruction unit 14.

  Note that the first environmental information generating unit described above corresponds to the initial registration unit 11. In addition, the second environment generation unit, the detection unit, the first detection unit, the second detection unit, the third detection unit, and the registration unit correspond to the movement detection unit 13. Further, the storage means corresponds to the memory 12, and the instruction means corresponds to the instruction unit 14.

(2) Operation Next, each operation of the initial registration process and the movement detection process executed by the device authentication apparatus 10a installed in the router 2a will be described with reference to FIGS.

<Operation of initial registration process>
When the apparatus power supply is powered on at the time of initial registration for connecting the router 2a to the network, the initial registration unit 11 executes an initial registration process illustrated in FIG. First, the process proceeds to step SA1, and the MAC addresses of adjacent network devices (each router 2b to 2d) are collected. For collecting MAC addresses, for example, APR (Address Resolution Protocol) is used. In the example shown in FIG. 1, the MAC addresses of the routers 2b to 2d connected to the router 2a are collected.

  Next, in steps SA2 to SA4, mutual authentication is performed on all network devices (each router 2b to 2d) connected to the router 2a. The mutual authentication referred to here is, for example, a processing operation in which a tamper-resistant chip for storing an authentication ID is provided in each of the router 2a and each of the routers 2b to 2d, and authentication is performed using the authentication ID read from the chip. Point to.

  If an unauthorized network device is found in the process of mutual authentication, the determination result in step SA3 is “YES”, and the process proceeds to step SA5, where the instruction unit 14 displays an error for a certain period of time on the router 2a side, that is, an unauthorized After notifying that the network device has been found, the router 2a is instructed to power off. Therefore, if the network device connected to the router 2a is illegal, such as chip tampering, the connection can be blocked.

  On the other hand, if all the network devices connected to the router 2a are authentic, the determination result in step SA4 is “YES”, the process proceeds to step SA6, and the initial registration unit 11 includes the adjacent information collected in step SA1. The MAC address of the network device is recorded in the memory 12. Subsequently, in step SA7, a trace route command for detecting the information of the network route provided in the router 2a is executed to detect the network route (packet transfer route) information from the router 2a to the management server 1 and store it in the memory 12. Record. Next, in step SA8, a routing protocol (for example, RIP (Routing Information Protocol), OSPF (Open Shortest Path First), or BGP (Border Gateway Protocol)) is used to detect the routing information indicating the destination IP and the destination IP. After recording in 12, this processing is completed.

The “MAC address of adjacent network device”, “network route information”, and “routing information” recorded in the memory 12 in steps SA6 to SA8 are determination data representing the environment in which the router 2a is first installed. It is treated as (first environmental information).
Further, the network route information detected in step SA7 is received from the management server 1 as “route from the management server 1 to the router 2a” detected on the management server 1 side instead of the route from the router 2a to the management server 1. It is possible to record in the memory 12 or record both the “route from the router 2a to the management server 1” and the “route from the management server 1 to the router 2a” in the memory 12. Absent.

<Operation of movement detection processing>
After execution of the initial registration process described above, the movement detection unit 13 of the device authentication apparatus mounted on the router 2a executes the movement detection process illustrated in FIG. 4 every time a certain period elapses. When the movement detection process is executed by the movement detection unit 13, the process first proceeds to step SB1, and the MAC addresses of adjacent network devices are collected. The MAC address is collected using APR as in step SA1. Subsequently, in step SB2, a trace route command is executed to detect network route information from the router 2a to the management server 1 and record it in the memory 12. Next, in step SB3, routing information representing the destination IP and the transfer destination IP is detected and recorded in the memory 12 using a routing protocol (for example, RIP, OSPF, BGP).

Next, in Steps SB4 to SB6, the position data (second environment information) indicating the current installation location of the router 2a detected in Steps SB1 to SB3 and the determination obtained in the above-described initial registration process. The data (first environmental information) is compared to determine whether the installation location of the router 2a has moved.
That is, in step SB4, it is determined whether or not the coincidence rate between the MAC address collected as the position data and the MAC address collected as the determination data is greater than or equal to a preset threshold TH1, and the coincidence rate is greater than or equal to the threshold TH1. If there is, the determination result is “YES” because it has not moved, and the process proceeds to step SB5.

In step SB5, it is determined whether or not the matching rate between the network route information detected as the position data and the network route information detected as the determination data is equal to or higher than a preset threshold TH2, and the matching rate is equal to or higher than the threshold TH2. If there is, the determination result is “YES” as it is not moved, and the process proceeds to Step SB6.
In step SB6, it is determined whether or not the matching rate between the routing information detected as the position data and the routing information detected as the determination data is equal to or higher than a preset threshold TH3, and if the matching rate is equal to or higher than the threshold TH3. The determination result is “YES” because it has not moved, and the process proceeds to step SB8. In Step SB8, the position data detected in Steps SB1 to SB3 is updated and registered as determination data, and this process is finished.

  On the other hand, if any of the “MAC address match rate”, “network route information match rate”, and “routing information match rate” is smaller than the threshold value, it is considered that the router 2a has moved, and any of the above steps SB4 to SB6 is performed. The determination result is “NO”, the process proceeds to step SB7, and the instruction unit 14 instructs the router 2a to stop the communication function, while displaying an error indicating that the movement is illegal.

  Next, an example of specific movement detection of the device authentication apparatus 10 will be described with reference to FIG. In the embodiment described above, the simple network illustrated in FIG. 1 is taken as an example for the sake of simplification of description. However, for example, as illustrated in FIG. According to the initial registration processing to be executed, the MAC address “a, b, c, d”, the network route information “hijjk”, and the routing information “o: p, q: r, s: t, u: It is assumed that determination data (first environment information) consisting of “v” is registered in the memory 12.

  When the threshold TH1 of the MAC address matching rate is set to 60% or more, the threshold TH2 of the network route information matching rate is set to 30% or more, and the threshold TH3 of the routing information matching rate is set to 80% or more. For example, the MAC address “a, b, f, g”, the network route information “hm-n-o-1”, and the routing information “o: p, q: When the position data (second environment information) consisting of “r, s: t, u: x” is obtained, the MAC address match rate falls below the threshold value TH1 from the comparison with the determination data. 2 is instructed to stop the communication function, while displaying an error indicating that the movement is illegal.

  On the other hand, for example, the MAC address “a, b, c, d, f, g” and the network route information “hijjk-” are obtained by the movement detection process executed after a certain period of time has elapsed since the initial registration. l ”and the routing data“ o: p, q: r, s: t, u: v ”, when the position data (second environment information) is obtained, the MAC address matches from the comparison with the determination data Since all of the rate, the network route information match rate, and the routing information match rate satisfy the threshold value, it is determined that the vehicle is not moving and the obtained position data is used as the next determination data in FIG. As shown in FIG.

  As described above, if the router 2 equipped with the device authentication apparatus 10 according to the present invention performs the above-described initial registration process and then moves to another place where the installation environment is different, the communication function stops and the other place. As a result, the use of devices connected to the network can be prevented from being used after unauthorized movement.

  In the present embodiment, the threshold values TH1 to TH3 for detecting movement are fixed, but instead of this, a mode of dynamically changing each time the movement detection process is executed may be used. Specifically, the thresholds TH1 to TH3 are variably set according to the contents of the determination data updated each time the movement detection process is executed. In this way, it is possible to adapt to a dynamically changing network environment, and to improve the reliability of movement detection.

  The device authentication apparatus 10 described above has a computer system inside. The initial registration process and movement detection process described above are stored in a computer-readable recording medium in the form of a program, and the above process is performed by the computer reading and executing this program. Here, the computer-readable recording medium means a magnetic disk, a magneto-optical disk, a CD-ROM, a DVD-ROM, a semiconductor memory, or the like. Alternatively, the computer program may be distributed to the computer via a communication line, and the computer that has received the distribution may execute the program.

It is a network diagram comprised from the router provided with the apparatus authentication apparatus which is one Embodiment of this invention. It is a block diagram which shows the function structure of an apparatus authentication apparatus. It is a flowchart which shows operation | movement of the initial registration process which an apparatus authentication apparatus performs. It is a flowchart which shows the operation | movement of the movement detection process which an apparatus authentication apparatus performs. It is a figure for demonstrating an example of the specific movement detection of an apparatus authentication apparatus.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 Management server 2a-2d Router 10a-10d Device authentication apparatus

Claims (3)

A device authentication device mounted on a device connected to a network,
First environment information generating means for generating first environment information including identification information unique to another device adjacent to the device, route information of the device on the network, and routing information at the time of initial registration for connecting the device to the network When,
After the initial registration with the device connected to the network, second environment information including identification information unique to another device adjacent to the device, route information of the device on the network, and routing information is generated every certain period of time. 2 environmental information generating means;
Storage means for storing the first environmental information;
Registration means for registering the generated first environment information in the storage means;
Each time the second environment information generating means generates the second environment information, it is included in the identification information unique to the other device included in the second environment information and the first environment information stored in the storage means. First detection means for detecting the presence or absence of movement of the device based on whether the matching rate with the identification information unique to the other device is greater than or equal to a predetermined value;
Each time the second environment information generating means generates the second environment information, the path information included in the second environment information and the path information included in the first environment information stored in the storage means Second detection means for detecting the presence or absence of movement of the device based on whether or not the coincidence rate is equal to or greater than a predetermined value;
Each time the second environment information generating means generates the second environment information, the routing information included in the second environment information and the routing information included in the first environment information stored in the storage means A third detecting means for detecting whether or not the device has moved depending on whether or not the matching rate is equal to or greater than a predetermined value;
If any of the first to third detection means detects the movement of the device, the instruction means for instructing the device to stop functioning;
A device authentication apparatus comprising: The registration means includes
When the first to third detection means do not detect the movement of the device, the second environmental information that is currently generated is updated and registered in the storage means as the first environment information.
The device authentication apparatus according to claim 1, wherein the this. The computer of the device authentication device installed in the device connected to the network
First environment information generating means for generating first environment information including identification information unique to another device adjacent to the device, route information of the device on the network, and routing information at the time of initial registration for connecting the device to the network ,
After the initial registration with the device connected to the network, second environment information including identification information unique to another device adjacent to the device, route information of the device on the network, and routing information is generated every certain period of time. 2 environmental information generating means,
Registration means for registering the generated first environment information in a storage means;
Each time the second environment information generating means generates the second environment information, it is included in the identification information unique to the other device included in the second environment information and the first environment information stored in the storage means. First detection means for detecting whether or not the device has moved depending on whether the matching rate with the identification information unique to the other device is greater than or equal to a predetermined value;
Each time the second environment information generating means generates the second environment information, the path information included in the second environment information and the path information included in the first environment information stored in the storage means Second detecting means for detecting whether or not the device has moved depending on whether or not the matching rate is equal to or greater than a predetermined value;
Each time the second environment information generating means generates the second environment information, the routing information included in the second environment information and the routing information included in the first environment information stored in the storage means A third detecting means for detecting whether or not the device has moved depending on whether or not the coincidence rate is equal to or greater than a predetermined value;
Instructing means for instructing the device to stop functioning when any of the first to third detecting means detects movement of the device;
Computer program to function as.

Images