Patent Application
20080310319
This application is based upon and claims the benefit of priority from Japanese patent applications No. 2007-155809, filed on Jun. 13, 2007, the disclosure of which is incorporated herein its entirety by reference.
1. Field of the Invention
The present invention relates to a server, a network system and a network connection method used for the same, and more specifically to a network connection method for a terminal without a function of automatically allocating Internet Protocol (IP) address.
2. Description of the Prior Art
As a related quarantine system, a system for rejecting communications from a terminal immediately when a terminal that failed in user authentication or a terminal with insufficient anti-virus software program is connected with a network has been known.
Such a quarantine system takes a method of dynamically changing an IP address to be allocated to a terminal according to the user authentication result or the state of its anti-virus measures.
As another quarantine system, a system for applying another IP address to a computer with a fixed IP address has been known. Patent Document 1 (Japanese Patent Laid-Open No. 2006-262141) describes the quarantine system.
In the quarantine system, a receiving server receives an Address Resolution Protocol (ARP) request packet. The packet is sent from a terminal with a peer-to-peer connection to the same Virtual LAN (Local Area Network) (VLAN) to a default gateway or the like. And then, the receiving server sets its own Media Access Control (MAC) address as the original MAC address and returns an ARP response packet to the terminal. Simultaneously the receiving server registers the IP address of the destined default gateway in a interface.
When the terminal makes IP communications to the receiving server, the receiving server transfers the packet from the terminal to the registered default gateway in place of the terminal. When the IP packet is sent from the destined IP address to the receiving server, the receiving server changes the destination to the fixed IP address of the terminal and transfers the IP packet thereto.
The related quarantine system using a method of dynamically changing an IP address to be allocated to a terminal cannot apply the method to a terminal without a function of automatically allocating an IP address. Thus, the system has a problem in that it cannot use the quarantine system to that kind of terminal. The technique described in the Patent Document also has the problem.
As a method for solving the problem, a system for enabling a function of automatically allocating an IP address of a terminal from a device other than the terminal has been known. The system, however, requires IP communications between the device that provides the system for enabling the function of automatically allocating the IP address of the terminal and the terminal without a function of automatically allocating an IP address.
It has been desired to provide the related quarantine system with a system for enabling IP communications between a terminal that does not use a function of automatically allocating an IP address and a device that provides a system for enabling a function of automatically allocating the IP address of a terminal without changing the setting of the terminal when the terminal is connected with an unknown network under the abovementioned condition.
An exemplary object of the invention is to provide a server, a network system and a network connection method used for the same that enables communications between a terminal with a fixed IP address without using a function of automatically allocating an IP address and a receiving server without changing the IP address of the terminal when the terminal is connected with an unknown network, by solving the abovementioned problem.
A server according to the present invention includes a packet monitoring unit for monitoring a packet that is sent from a terminal without a function of automatically allocating an Internet Protocol (IP) address to a destination via an unknown network so as to detect the destined IP address of the packet, and a setting changing unit for setting the destined IP address detected by the packet monitoring unit to a self device.
A network system according to the present invention includes the abovementioned server.
A network connection method according to the present invention is such that a server monitors a packet that is sent from a terminal without a function of automatically allocating an IP address to a destination via an unknown network, detects the destined Internet Protocol (IP) address of the packet, and sets the detected destined IP address to a self device.
A recording medium according to the present invention is such that a program for causing a control unit in the server to execute the processes of: monitoring a packet that is sent from a terminal without a function of automatically allocating an Internet Protocol (IP) address to a destination via an unknown network and detecting the destined IP address of the packet, and setting the detected destined IP address to a self device.
In advance of describing of the exemplary embodiments of the present invention, a theory of an operation of a receiving server of the present invention is described briefly as follows.
Referring to
Therefore, IP communications between the terminal 2 and the receiving server 1 can be realized without changing the IP address setting of the terminal 2 by causing the receiving server 1 to monitor a packet sent from the terminal 2 and add the destined IP address of the packet to the receiving server 1 itself.
Now, exemplary embodiments of the present invention will be described with reference to the drawings.
In the receiving server 1, the interface 10 is allocated with an Internet Protocol (IP) address so that it can be accessed (sent/received and monitored its state) by a Kernel module unit.
The packet monitoring unit 11 detects a destined IP address of the packet to be sent from the terminal 2, and reports the destined IP address to the setting changing unit 12. The setting changing unit 12 adds the destined IP address reported from the packet monitoring unit 11 to the interface 10 of the receiving server 1.
In this manner, the embodiment enables IP communications between the terminal 2 and the receiving server 1 without changing the IP address setting of the terminal 2 even if the terminal 2 has a fixed IP address without using a function of automatically allocating an IP address.
That is, the related art cannot enable a terminal, which has a fixed IP address without using a function of automatically allocating an IP address, to make IP communications unless the IP address setting of the terminal is changed, when the terminal is connected with an unknown network.
The embodiment enables IP communications between the terminal 2 and the receiving server 1, which has the abovementioned system, without changing the IP address setting of the terminal 2 by causing the receiving server 1 to monitor a packet sent from the terminal 2 and add the destined IP address of the packet to the interface 10 of the receiving server 1.
The embodiment provides the receiving server 1 with a function of providing a system for enabling a function of automatically allocating the IP address of the terminal 2. That enables IP communications between the terminal 2 and the receiving server 1 and makes the function of automatically allocating the IP address of the terminal 2 available. Accordingly, the embodiment can be applied to the abovementioned quarantine system related with the present invention.
An exemplary advantage according to the invention is enabling communications between a terminal, which has a fixed IP address without using a function of automatically allocating an IP address, and a receiving server without changing the IP address of the terminal if the terminal is connected with an unknown network to which the receiving server is connected, with the abovementioned configuration and operation.
The receiving server 1a includes the packet monitoring unit 11, the setting changing unit 12, a camouflage response unit 13, and a VLAN interface 14. The receiving server 1a can connect with the terminal 2 via the VLAN interface 14.
The VLAN switch 3 divides a network by using the VLAN for each of the terminals 2 and 4 to be connected so as to prevent the terminal 2 and the terminal 4 from communicating with each other. The VLAN switch 3 includes the receiving server 1a in the same VLAN as that of the terminal 2 so as to enable peer-to-peer communications between the terminal 2 and the receiving server 1a.
The VLAN including the terminal 2 and the receiving server 1a has no terminal other than the terminal 2 when the destined IP address of a packet sent from the terminal 2 is added to the VLAN interface 14 of the receiving server 1a. Therefore, the receiving server 1a can add an IP address to the VLAN interface 14 without causing any redundancy of IP addresses.
The packet monitoring unit 11 monitors the packet sent from the terminal 2, detects a destined IP address in the packet, and reports the destined IP address to the setting changing unit 12. The setting changing unit 12 adds the destined IP address reported from the packet monitoring unit 11 to the VLAN interface 14 of the receiving server 1a.
In response to the Address Resolution Protocol (ARP) request packet or a Neighbor Solicitation (NS) message from the terminal 2 that is received by the packet monitoring unit 11, the camouflage response unit 13 adds Media Access Control address (MAC address) or a link layer address of the receiving server 1a to a response packet and returns a response to the terminal 2.
When the terminal 2 has IP addresses of a default gateway, a Domain Name Server (DNS) server, and a proxy server set and is connected with the network 700, the terminal 2 sends an ARP packet [an ARP other than the ARP (Gratuitous ARP) destined to itself] to the network 700 (a1 of
The packet monitoring unit 11 monitors a packet, and when it receives the ARP request packet 200 sent from the terminal 2, it detects the destined IP address 201 from the ARP request packet 200 (a2 of
The setting changing unit 12 adds the reported destined IP address 201 to the VLAN interface 14 of the receiving server 1a that received the ARP request packet 200 (a4 of
In response to the ARP request packet 200 that is received by the packet monitoring unit 11, the camouflage response unit 13 sets the MAC address of the receiving server 1a to the original MAC address of an ARP response packet 202 and returns the ARP response packet 202 to the terminal 2 (a6 of
The terminal 2 recognizes the MAC address and the IP address of the receiving server 1a according to the original MAC address and the original IP address of the ARP response packet 202 received from the receiving server 1A. As the ARP response is sent to solve the issue of the MAC address to the IP address to which the ARP request sending side is to communicate, the IP address added by the receiving server 1a to the VLAN interface 14 is the IP address with which the terminal 2 is to communicate. Therefore, IP communications from the terminal 2 to the receiving server 1a become available (a7 of
As such, the embodiment has the receiving server 1a having a function of monitoring a packet sent by the terminal 2 and adding the destined IP address of the packet to the VLAN interface 14 of the receiving server 1a. Therefore, the embodiment enables IP communications between the terminal 2 and the receiving server 1a without changing the IP address of the terminal 2 when the terminal 2 has a fixed IP address without using a function of automatically allocating an IP address and connects to the unknown network 700 to which the receiving server 1a is connected.
As the embodiment needs not to change the IP address of the terminal 2, information on the unknown network 700 needs not to be obtained and setting of the terminal 2 needs not to be manually changed.
An exemplary advantage according to the invention is that the embodiment provides the receiving server 1a with a function of providing a system for enabling a function of automatically allocating the IP address of the terminal 2. That enables IP communications between the terminal 2 and the receiving server 1a and makes the function of automatically allocating the IP address of the terminal 2 available. Accordingly, the embodiment can be applied to the abovementioned quarantine system related with the present invention.
When the terminal 2 has IP addresses of a default gateway, a DNS server, and a proxy server set and is connected with the network 700, the terminal 2 sends an ARP request packet 300 to the network 700 (b1 of
The packet monitoring unit 11 monitors a packet, and when it receives the ARP request packet 300 sent from the terminal 2, it detects the destined IP address 301 from the ARP request packet 300 (b2 of
The setting changing unit 12 adds the reported destined IP address 301 to the VLAN interface 14 of the receiving server 1a that received the ARP request packet 300 (b4 of
The receiving server 1a can obtain the MAC address and the IP address of the terminal 2 according to the original MAC address and the original IP address of the ARP request packet 300. As the IP address with which the terminal 2 is to communicate is added to the VLAN interface 14 of the receiving server 1a, IP communications from the receiving server 1a to the terminal 2 become available (b5 of
As such, the embodiment has the receiving server 1a having a function of monitoring a packet sent by the terminal 2 and adding the destined IP address of the packet to the VLAN interface 14 of the receiving server 1a. Therefore, the embodiment enables IP communications between the terminal 2 and the receiving server 1a without changing the IP address of the terminal 2 when the terminal 2 has a fixed IP address without using a function of automatically allocating an IP address and connects to the unknown network 700 to which the receiving server 1a is connected.
As the embodiment needs not to change the IP address of the terminal 2, information on the unknown network 700 needs not to be obtained and setting of the terminal 2 needs not to be manually changed.
An exemplary advantage according to the invention is that the embodiment provides the receiving server 1a with a function of providing a system for enabling a function of automatically allocating the IP address of the terminal 2. That enables IP communications between the terminal 2 and the receiving server 1a and makes the function of automatically allocating the IP address of the terminal 2 available. Accordingly, the embodiment can be applied to the abovementioned quarantine system related with the present invention.
When only the IP address is known and a link layer address is to be obtained in the IPv6, the NS message is sent to the destined IP address, and a node which is to respond to the NS message sends the link layer address of the self node on the Neighbor Advertisement (NA) message to solve the issue of the link layer address.
If the terminal 2 has IP addresses of a default gateway, a DNS server, and a proxy server set when the terminal 2 is to be connected with the network 800, the terminal 2 sends an NS message 400 to the network 800 (c1 of
The packet monitoring unit 11 monitors a packet, and when it receives the NS message 400 sent from the terminal 2, it detects the destined IP address 401 from the NS message 400 (c2 of
The setting changing unit 12 adds the reported destined IP address 401 to the VLAN interface 14 of the receiving server 1a that received the NS message 400 (c4 of
In response to the NS message 400 from the terminal 2 that is received by the packet monitoring unit 11, the camouflage response unit 13 sends an NA message 402 including the link layer address of the receiving server 1a to the terminal 2 (c6 of
The terminal 2 recognizes the link layer address and the IP address of the receiving server 1a according to the NA message received from the receiving server 1a. As the IP address of the receiving server 1a is the IP address with which the terminal 2 is to communicate, IP communications from the terminal 2 to the receiving server 1a become available (c7 of
As such, the embodiment has the receiving server 1a having a function of monitoring a packet sent by the terminal 2 and adding the destined IP address of the packet to the VLAN interface 14 of the receiving server 1a. Therefore, the embodiment enables IP communications between the terminal 2 and the receiving server 1a without changing the IP address of the terminal 2 when the terminal 2 has a fixed IP address without using a function of automatically allocating an IP address and connects to the unknown network 800 to which the receiving server 1a is connected.
As the embodiment needs not to change the IP address of the terminal 2, information on the unknown network 800 needs not to be obtained and setting of the terminal 2 needs not to be manually changed.
An exemplary advantage according to the invention is that the embodiment provides the receiving server 1a with a function of providing a system for enabling a function of automatically allocating the IP address of the terminal 2. That enables IP communications between the terminal 2 and the receiving server 1a and enables the function of automatically allocating the IP address of the terminal 2. Accordingly, the embodiment can be applied to the abovementioned quarantine system related with the present invention.
When the terminal 2 has IP addresses of a default gateway, a DNS server, and a proxy server set and is connected with the network 800, the terminal 2 sends an NS message 500 to the network 800 (d1 of
The packet monitoring unit 11 monitors a packet, and when it receives the NS message 500 sent from the terminal 2, it detects the destined IP address 501 from the NS message 500 (d2 of
The setting changing unit 12 adds the reported destined IP address 501 to the VLAN interface 14 of the receiving server 1a that received the NS message 500 (d4 of
The setting changing unit 12 can obtain the link layer address and the IP address of the terminal 2 according to the link layer address and the original IP address of the NS message 500. As the IP address with which the terminal 2 is to communicate is added to the VLAN interface 14 of the receiving server 1a, IP communications from the receiving server 1a to the terminal 2 become available (d5 of
As such, the embodiment has the receiving server 1a having a function of monitoring a packet sent by the terminal 2 and adding the destined IP address of the packet to the VLAN interface 14 of the receiving server 1a. Therefore, the embodiment enables IP communications between the terminal 2 and the receiving server 1a without changing the IP address of the terminal 2 when the terminal 2 has a fixed IP address without using a function of automatically allocating an IP address and connects to the unknown network 800 to which the receiving server 1a is connected.
As the embodiment needs not to change the IP address of the terminal 2, information on the unknown network 800 needs not to be obtained and setting of the terminal 2 needs not to be manually changed.
An exemplary advantage according to the invention is that the embodiment provides the receiving server 1a with a function of providing a system for enabling a function of automatically allocating the IP address of the terminal 2. That enables IP communications between the terminal 2 and the receiving server 1a and enables the function of automatically allocating the IP address of the terminal 2. Accordingly, the embodiment can be applied to the abovementioned quarantine system related with the present invention.
In
When the terminal 2 has an IP address of a network different from those of a DNS server and a proxy server set and is connected with the network 700 or the network 800, the terminal 2 sends a packet 600 to the default gateway (receiving server 1a) (e1 of
The packet monitoring unit 11 monitors a packet, and when it receives the packet 600 sent from the terminal 2, it detects the destined IP address 601 from the packet 600 (e2 of
As the IP address of the default gateway of the terminal 2 and the destined IP address of the packet 600 are given to the VLAN interface 14 of the receiving server 1a, IP communications are enabled between the terminal 2 and the server at the destined IP address 601 (receiving server 1a) (e5 of
As such, the embodiment has the receiving server 1a having a function of monitoring a packet sent by the terminal 2 and adding the destined IP address of the packet to the VLAN interface 14 of the receiving server 1a. Therefore, the embodiment enables IP communications between the terminal 2 and the receiving server 1a without changing the IP address of the terminal 2 when the terminal 2 has a fixed IP address without using a function of automatically allocating an IP address and connects to the unknown network 700 or the network 800 to which the receiving server 1a is connected.
As the embodiment needs not to change the IP address of the terminal 2, information on the unknown network 700 or the network 800 needs not to be obtained and setting of the terminal 2 needs not to be manually changed.
An exemplary advantage according to the invention is that the embodiment provides the receiving server 1a with a function of providing a system for enabling a function of automatically allocating the IP address of the terminal 2. That enables IP communications between the terminal 2 and the receiving server 1a and enables the function of automatically allocating the IP address of the terminal 2. Accordingly, the embodiment can be applied to the abovementioned quarantine system related with the present invention.
Referring to
The recording medium 7 records a program for causing a computer to execute the network connection method shown in the sequence charts in
An exemplary advantage according to the invention is that the embodiment provides a program for providing the receiving server 1a with a system for enabling a function of automatically allocating the IP address of the terminal 2.
While the invention has been particularly shown and described with reference to exemplary embodiments thereof, the invention is not limited to these embodiments. It will be understood by those of ordinary skill in the art that various changes in form and details may be made therein without departing from the spirit and scope of the present invention as defined by the claims.
| Number | Date | Country | Kind |
|---|---|---|---|
| 155809/2007 | Jun 2007 | JP | national |
